Merge remote-tracking branch 'origin/main' into mbg/improve-checkout-path

src/actions-util.ts

@@ -14,6 +14,7 @@ import {
   getCodeQLDatabasePath,
   ConfigurationError,
   getEnv,
+  getErrorMessage,
 } from "./util";
 
 /**
@@ -412,14 +413,23 @@ export const persistInputs = function (env: Env = getEnv()) {
 /**
  * Restores all inputs to the action from the persisted state.
  */
-export const restoreInputs = function () {
-  const persistedInputs = core.getState(persistedInputsKey);
-  if (persistedInputs) {
-    for (const [name, value] of JSON.parse(persistedInputs)) {
-      process.env[name] = value;
+export function restoreInputs(logger: Logger) {
+  try {
+    const persistedInputsValue = core.getState(persistedInputsKey);
+    if (persistedInputsValue) {
+      const persistedInputs = JSON.parse(persistedInputsValue);
+
+      for (const [name, value] of persistedInputs) {
+        process.env[name] = value;
+      }
     }
+  } catch (err) {
+    logger.error(`Unable to restore inputs: ${getErrorMessage(err)}`);
+    throw new Error(
+      "Failed to restore inputs from the state set by this action's main execution.",
+    );
   }
-};
+}
 
 export interface PullRequestBranches {
   base: string;

src/analyze-action-post.ts

@@ -25,8 +25,8 @@ export async function runWrapper() {
   // possible, and only use safe functions outside.
 
   try {
-    actionsUtil.restoreInputs();
     const logger = getActionsLogger();
+    actionsUtil.restoreInputs(logger);
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);
 

src/api-client.ts

@@ -249,9 +249,10 @@ export async function getGitHubVersionFromApi(
  */
 export async function getGitHubVersion(): Promise<GitHubVersion> {
   if (cachedGitHubVersion === undefined) {
+    const apiDetails = getApiDetails();
     cachedGitHubVersion = await getGitHubVersionFromApi(
-      getApiClient(),
-      getApiDetails(),
+      createApiClientWithDetails(apiDetails),
+      apiDetails,
     );
   }
   return cachedGitHubVersion;

src/codeql-bundle.test.ts

@@ -1,7 +1,26 @@
 import test from "ava";
 
-import { getCodeQLBundleFromUrl } from "./codeql-bundle";
+import { getCodeQLBundleFromUrl, getCodeQLBundleName } from "./codeql-bundle";
 import { BuiltInLanguage } from "./languages";
+import { BundlePlatform } from "./platform";
+
+test("getCodeQLBundleName returns a per-language bundle name only when a language is specified", (t) => {
+  t.is(
+    getCodeQLBundleName("zstd", BundlePlatform.Linux64, BuiltInLanguage.java),
+    "codeql-bundle-java-linux64.tar.zst",
+  );
+  t.is(
+    getCodeQLBundleName("zstd", BundlePlatform.Linux64),
+    "codeql-bundle-linux64.tar.zst",
+  );
+});
+
+test("getCodeQLBundleName names the Swift bundle for macOS", (t) => {
+  t.is(
+    getCodeQLBundleName("zstd", BundlePlatform.Osx64, BuiltInLanguage.swift),
+    "codeql-bundle-swift-osx64.tar.zst",
+  );
+});
 
 for (const [assetName, language] of [
   ["codeql-bundle-java-linux64.tar.zst", BuiltInLanguage.java],

src/codeql-bundle.ts

@@ -1,4 +1,6 @@
 import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
+import { BundlePlatform } from "./platform";
+import type { CompressionMethod } from "./tar";
 
 /** Describes the contents and location of a downloadable CodeQL bundle. */
 export type CodeQLBundle =
@@ -11,6 +13,42 @@ export type CodeQLBundle =
       combinedBundleURL?: string;
     };
 
+/** A resolved download, including its bundle identity and version. */
+export interface CodeQLDownloadSource {
+  /** Distinguishes downloads from local archives and cached installations. */
+  sourceType: "download";
+  /** The bundle to download. */
+  bundle: CodeQLBundle;
+  /** The compression format of the bundle archive. */
+  compressionMethod: CompressionMethod;
+  /** Bundle version of the tools, if known. */
+  bundleVersion?: string;
+  /** Requested CLI version, if known. */
+  cliVersion?: string;
+  /** Resolved version for telemetry, independent of whether the bundle can be cached. */
+  toolsVersion: string;
+}
+
+/** Returns the exact bundle asset name for a platform and optional language. */
+export function getCodeQLBundleName(
+  compressionMethod: CompressionMethod,
+  platform: BundlePlatform | undefined,
+  language?: BuiltInLanguage,
+): string {
+  const extensions: Record<CompressionMethod, string> = {
+    gzip: ".tar.gz",
+    zstd: ".tar.zst",
+  };
+  const extension = extensions[compressionMethod];
+  if (platform === undefined) {
+    return `codeql-bundle${extension}`;
+  }
+  if (language !== undefined) {
+    return `codeql-bundle-${language}-${platform}${extension}`;
+  }
+  return `codeql-bundle-${platform}${extension}`;
+}
+
 const PER_LANGUAGE_BUNDLE_NAME =
   /^codeql-bundle-(.+)-(?:linux64|osx64|win64)\.tar\.(?:gz|zst)$/;
 

src/codeql.ts

@@ -937,6 +937,7 @@ async function getCodeQLForCmd(
           "--format=json",
           `--language=${language}`,
           "--extractor-include-aliases",
+          "-J-XX:-UsePerfData",
           ...getExtraOptionsFromEnv(["resolve", "extractor"]),
         ],
         {
@@ -951,7 +952,13 @@ async function getCodeQLForCmd(
           },
         },
       ).exec();
-      return JSON.parse(extractorPath) as string;
+      try {
+        return JSON.parse(extractorPath) as string;
+      } catch (err) {
+        throw new Error(
+          `Failed to parse extractor path for '${language}' from CLI: ${getErrorMessage(err)}\nOutput was: ${extractorPath}`,
+        );
+      }
     },
     async resolveQueriesStartingPacks(queries: string[]): Promise<string[]> {
       const codeqlArgs = [

src/config-utils.ts

@@ -1440,7 +1440,12 @@ export async function getConfig(
   }
   if (config.version !== getActionVersion()) {
     throw new ConfigurationError(
-      `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'`,
+      [
+        `Loaded a configuration file for version '${config.version}', but running version '${getActionVersion()}'.`,
+        "All steps in a workflow that use `github/codeql-action` must use the same version to work correctly.",
+        "If you are using Dependabot to manage dependency updates, you can configure a dependency group to update all `github/codeql-action` steps at the same time.",
+        "For more information, see https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#groups--",
+      ].join(" "),
     );
   }
 

src/defaults.json

@@ -1,6 +1,6 @@
 {
-  "bundleVersion": "codeql-bundle-v2.27.0",
-  "cliVersion": "2.27.0",
-  "priorBundleVersion": "codeql-bundle-v2.26.4",
-  "priorCliVersion": "2.26.4"
+  "bundleVersion": "codeql-bundle-v2.27.1",
+  "cliVersion": "2.27.1",
+  "priorBundleVersion": "codeql-bundle-v2.27.0",
+  "priorCliVersion": "2.27.0"
 }

src/git-utils.test.ts

@@ -34,10 +34,13 @@ test.serial(
       });
 
       const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback.withArgs(sinon.match.any, "HEAD").resolves(currentSha);
+      callback.withArgs(sinon.match.string, "HEAD").resolves(currentSha);
 
       const actualRef = await gitUtils.getRef(env, tmpDir);
       t.deepEqual(actualRef, expectedRef);
+
+      t.is(callback.callCount, 1);
+      t.true(callback.calledOnceWith(tmpDir, "HEAD"));
     });
   },
 );
@@ -57,12 +60,16 @@ test.serial(
 
       const callback = sinon.stub(gitUtils, "getCommitOid");
       callback
-        .withArgs(sinon.match.any, "refs/remotes/pull/1/merge")
+        .withArgs(sinon.match.string, "refs/remotes/pull/1/merge")
         .resolves(sha);
       callback.withArgs(sinon.match.any, "HEAD").resolves(sha);
 
       const actualRef = await gitUtils.getRef(env, tmpDir);
       t.deepEqual(actualRef, expectedRef);
+
+      t.is(callback.callCount, 2);
+      t.true(callback.calledWith(tmpDir, "HEAD"));
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
     });
   },
 );
@@ -80,14 +87,17 @@ test.serial(
 
       const callback = sinon.stub(gitUtils, "getCommitOid");
       callback
-        .withArgs(sinon.match.any, tmpDir, "refs/pull/1/merge")
+        .withArgs(tmpDir, "refs/remotes/pull/1/merge")
         .resolves("a".repeat(40));
-      callback
-        .withArgs(sinon.match.any, tmpDir, "HEAD")
-        .resolves("b".repeat(40));
+      callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40));
+      callback.throws(new Error("Unexpected getCommitOid call in test."));
 
       const actualRef = await gitUtils.getRef(env, tmpDir);
       t.deepEqual(actualRef, "refs/pull/1/head");
+
+      t.is(callback.callCount, 2);
+      t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
+      t.true(callback.calledWith(tmpDir, "HEAD"));
     });
   },
 );
@@ -112,13 +122,14 @@ test.serial(
       });
 
       const callback = sinon.stub(gitUtils, "getCommitOid");
-      callback
-        .withArgs(sinon.match.any, "refs/pull/1/merge")
-        .resolves("b".repeat(40));
+      callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("b".repeat(40));
       callback.withArgs(sinon.match.any, "HEAD").resolves("b".repeat(40));
 
       const actualRef = await gitUtils.getRef(env, tmpDir);
       t.deepEqual(actualRef, "refs/pull/2/merge");
+
+      // getCommitOid shouldn't be called, because the ref should be taken from the input
+      t.is(callback.callCount, 0);
     });
   },
 );

src/init-action-post.ts

@@ -63,7 +63,7 @@ async function run(startedAt: Date) {
     const jobStatus = getOptionalInput("job-status");
 
     // Restore inputs from `init` Action.
-    restoreInputs();
+    restoreInputs(logger);
 
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);

src/init-action.ts

@@ -716,7 +716,7 @@ async function run(
       );
     }
 
-    const tracerConfig = await getCombinedTracerConfig(codeql, config);
+    const tracerConfig = await getCombinedTracerConfig(logger, codeql, config);
     if (tracerConfig !== undefined) {
       for (const [key, value] of Object.entries(tracerConfig.env)) {
         core.exportVariable(key, value);

src/per-language-bundles.test.ts

@@ -38,7 +38,6 @@ async function checkEligibility(
         [ActionsEnvVars.RUNNER_ENVIRONMENT]: "github-hosted",
       }),
       features: createFeatures([Feature.PerLanguageBundles]),
-      logger: getRecordingLogger([], { logToConsole: false }),
       ...stateOverrides,
     }),
     { ...ELIGIBLE_OPTIONS, ...overrides },
@@ -134,7 +133,6 @@ test("getPerLanguageBundleLanguage explains a disabled feature before checking e
   const messages: LoggedMessage[] = [];
   const language = await getPerLanguageBundleLanguage(
     initAllState({
-      env: getTestEnv(),
       features: createFeatures([]),
       logger: getRecordingLogger(messages, { logToConsole: false }),
     }),

src/per-language-bundles.ts

@@ -102,8 +102,11 @@ export async function getPerLanguageBundleLanguage(
     return explain("the job is not running on a GitHub-hosted runner");
   }
 
-  // Check whether per-language bundles are published for the requested CLI version.
-  // Latest-nightly selection skips this release-version check, but not the other eligibility checks.
+  // Nightly releases are identified by dates rather than versions. If
+  // `isLatestNightly` is `true`, the latest nightly is requested with
+  // `tools: nightly` and we don't yet have the corresponding tag at this point.
+  // Therefore, we skip the version check and don't have an equivalent.
+  // We can safely assume that the latest nightly will have per-language bundles.
   if (!isLatestNightly) {
     if (cliVersion === undefined) {
       return explain("the requested CLI version is unknown");
@@ -128,3 +131,16 @@ export async function getPerLanguageBundleLanguage(
 
   return language;
 }
+
+/** Explains why an eligible per-language bundle is being replaced by a combined bundle. */
+export function logPerLanguageBundleFallback(
+  { logger }: ActionState<["Logger"]>,
+  language: BuiltInLanguage,
+  location: string,
+): void {
+  logger.warning(
+    `No per-language CodeQL bundle for '${language}' was found at ${location}, so ` +
+      "falling back to the bundle that contains all languages. This analysis will still " +
+      "produce correct results, but will take longer to set up.",
+  );
+}

src/sarif/index.ts

@@ -1,6 +1,7 @@
 import * as fs from "fs";
 
 import { Logger } from "../logging";
+import { getErrorMessage } from "../util";
 
 import * as sarif from "sarif";
 
@@ -48,7 +49,13 @@ export function getToolNames(sarifFile: Partial<sarif.Log>): string[] {
  * @returns The resulting JSON value, cast to a SARIF `Log`.
  */
 export function readSarifFile(sarifFilePath: string): Partial<sarif.Log> {
-  return JSON.parse(fs.readFileSync(sarifFilePath, "utf8")) as sarif.Log;
+  try {
+    return JSON.parse(fs.readFileSync(sarifFilePath, "utf8")) as sarif.Log;
+  } catch (err) {
+    throw new Error(
+      `Parsing SARIF file at '${sarifFilePath}' failed: ${getErrorMessage(err)}`,
+    );
+  }
 }
 
 // Takes a list of paths to sarif files and combines them together,

src/setup-codeql.test.ts

@@ -69,25 +69,29 @@ function stubHostedNightly(tagName: string) {
     available: true,
     foundZstdBinary: true,
   });
-  const fetchRelease = sinon
-    .stub<Parameters<typeof fetch>, ReturnType<typeof fetch>>()
-    .rejects(new Error("Unexpected API request in nightly bundle test"));
-  fetchRelease
-    .withArgs(
-      "https://api.github.com/repos/dsp-testing/codeql-cli-nightlies/releases?per_page=1&page=1&prerelease=true",
-      sinon.match({ method: "GET" }),
-    )
-    .callsFake(
-      async () =>
-        new Response(JSON.stringify([{ tag_name: tagName }]), {
-          headers: { "content-type": "application/json" },
-        }),
-    );
   const client = github.getOctokit("123", {
-    request: { fetch: fetchRelease },
+    request: {
+      fetch: async () => {
+        throw new Error("Unexpected API request in nightly bundle test");
+      },
+    },
   });
+  const listReleases = sinon
+    .stub(client.rest.repos, "listReleases")
+    .rejects(new Error("Unexpected release request in nightly bundle test"));
+  listReleases
+    .withArgs({
+      owner: "dsp-testing",
+      repo: "codeql-cli-nightlies",
+      per_page: 1,
+      page: 1,
+      prerelease: true,
+    })
+    .resolves({
+      data: [{ tag_name: tagName }],
+    } as Awaited<ReturnType<typeof client.rest.repos.listReleases>>);
   sinon.stub(api, "getApiClient").value(() => client);
-  return fetchRelease;
+  return listReleases;
 }
 
 test.serial("parse codeql bundle url version", (t) => {
@@ -431,7 +435,7 @@ test.serial(
 
       // Check that the `CodeQLToolsSource` object matches our expectations.
       const expectedVersion = `0.0.0-${expectedDate}`;
-      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/${setupCodeql.getCodeQLBundleName("zstd")}`;
+      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/codeql-bundle-linux64.tar.zst`;
       t.deepEqual(source, {
         bundle: { kind: "combined", url: expectedURL },
         bundleVersion: expectedDate,
@@ -501,7 +505,7 @@ test.serial(
 
       // Check that the `CodeQLToolsSource` object matches our expectations.
       const expectedVersion = `0.0.0-${expectedDate}`;
-      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/${setupCodeql.getCodeQLBundleName("zstd")}`;
+      const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/codeql-bundle-linux64.tar.zst`;
       t.deepEqual(source, {
         bundle: { kind: "combined", url: expectedURL },
         bundleVersion: expectedDate,
@@ -1139,30 +1143,6 @@ const PER_LANGUAGE_CLI_VERSION = {
   ],
 };
 
-test.serial(
-  "getCodeQLBundleName returns a per-language bundle name only when a language is specified",
-  (t) => {
-    sinon.stub(process, "platform").value("linux");
-    sinon.stub(process, "arch").value("x64");
-    t.is(
-      setupCodeql.getCodeQLBundleName("zstd", BuiltInLanguage.java),
-      "codeql-bundle-java-linux64.tar.zst",
-    );
-    t.is(
-      setupCodeql.getCodeQLBundleName("zstd"),
-      "codeql-bundle-linux64.tar.zst",
-    );
-  },
-);
-
-test.serial("getCodeQLBundleName names the Swift bundle for macOS", (t) => {
-  sinon.stub(process, "platform").value("darwin");
-  t.is(
-    setupCodeql.getCodeQLBundleName("zstd", BuiltInLanguage.swift),
-    "codeql-bundle-swift-osx64.tar.zst",
-  );
-});
-
 test.serial(
   "getCodeQLSource downloads the per-language bundle for a single explicit language",
   async (t) => {

src/setup-codeql.ts

@@ -17,7 +17,12 @@ import {
   isRunningLocalAction,
 } from "./actions-util";
 import * as api from "./api-client";
-import { CodeQLBundle, getCodeQLBundleFromUrl } from "./codeql-bundle";
+import {
+  CodeQLBundle,
+  CodeQLDownloadSource,
+  getCodeQLBundleFromUrl,
+  getCodeQLBundleName,
+} from "./codeql-bundle";
 import * as defaults from "./defaults.json";
 import {
   addNoLanguageDiagnostic,
@@ -35,7 +40,10 @@ import {
 import { BuiltInLanguage } from "./languages";
 import { Logger } from "./logging";
 import { getCodeQlVersionsForOverlayBaseDatabases } from "./overlay/caching";
-import { getPerLanguageBundleLanguage } from "./per-language-bundles";
+import {
+  getPerLanguageBundleLanguage,
+  logPerLanguageBundleFallback,
+} from "./per-language-bundles";
 import { getBundlePlatform } from "./platform";
 import * as tar from "./tar";
 import {
@@ -49,6 +57,8 @@ import {
 import * as util from "./util";
 import { isGoodVersion } from "./util";
 
+export type { CodeQLDownloadSource } from "./codeql-bundle";
+
 export enum ToolsSource {
   Unknown = "UNKNOWN",
   Local = "LOCAL",
@@ -64,41 +74,6 @@ const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"];
 const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
 const CODEQL_TOOLCACHE_INPUT = "toolcache";
 
-function getCodeQLBundleExtension(
-  compressionMethod: tar.CompressionMethod,
-): string {
-  switch (compressionMethod) {
-    case "gzip":
-      return ".tar.gz";
-    case "zstd":
-      return ".tar.zst";
-    default:
-      util.assertNever(compressionMethod);
-  }
-}
-
-/**
- * Returns the name of the CodeQL bundle asset to download.
- *
- * @param compressionMethod The compression method of the bundle.
- * @param language Optional language for a per-language bundle. If omitted, returns a combined bundle name.
- */
-export function getCodeQLBundleName(
-  compressionMethod: tar.CompressionMethod,
-  language?: BuiltInLanguage,
-): string {
-  const extension = getCodeQLBundleExtension(compressionMethod);
-  const platform = getBundlePlatform();
-
-  if (platform === undefined) {
-    return `codeql-bundle${extension}`;
-  }
-  if (language !== undefined) {
-    return `codeql-bundle-${language}-${platform}${extension}`;
-  }
-  return `codeql-bundle-${platform}${extension}`;
-}
-
 export function getCodeQLActionRepository(logger: Logger): string {
   if (isRunningLocalAction()) {
     // This handles the case where the Action does not come from an Action repository,
@@ -223,22 +198,6 @@ export function convertToSemVer(version: string, logger: Logger): string {
   return s;
 }
 
-/** A resolved download, including its bundle identity and version. */
-export interface CodeQLDownloadSource {
-  /** Distinguishes downloads from local archives and cached installations. */
-  sourceType: "download";
-  /** The bundle to download. */
-  bundle: CodeQLBundle;
-  /** The compression format of the bundle archive. */
-  compressionMethod: tar.CompressionMethod;
-  /** Bundle version of the tools, if known. */
-  bundleVersion?: string;
-  /** Requested CLI version, if known. */
-  cliVersion?: string;
-  /** Resolved version for telemetry, independent of whether the bundle can be cached. */
-  toolsVersion: string;
-}
-
 export type CodeQLToolsSource =
   | {
       codeqlTarPath: string;
@@ -757,13 +716,14 @@ export async function getCodeQLSource(
         ? "zstd"
         : "gzip";
 
+    const platform = getBundlePlatform();
     const perLanguageBundleLanguage = await getPerLanguageBundleLanguage(
       { env: getEnv(), features, logger },
       {
         rawLanguages,
         cliVersion,
         compressionMethod,
-        platform: getBundlePlatform(),
+        platform,
         variant,
       },
     );
@@ -773,7 +733,7 @@ export async function getCodeQLSource(
       getCodeQLBundleDownloadURL(
         bundleTagName,
         apiDetails,
-        getCodeQLBundleName(compressionMethod, language),
+        getCodeQLBundleName(compressionMethod, platform, language),
         logger,
       );
 
@@ -1153,11 +1113,7 @@ export async function downloadCodeQLBundle(
     ) {
       throw e;
     }
-    logger.warning(
-      `No per-language CodeQL bundle for '${bundle.language}' was found at ${bundle.url}, so ` +
-        "falling back to the bundle that contains all languages. This analysis will still " +
-        "produce correct results, but will take longer to set up.",
-    );
+    logPerLanguageBundleFallback(action, bundle.language, bundle.url);
 
     const result = await downloadCodeQL(
       {
@@ -1215,11 +1171,12 @@ async function getLatestNightlyBundle(
     ? "zstd"
     : "gzip";
 
+  const platform = getBundlePlatform();
   const language = await getPerLanguageBundleLanguage(action, {
     rawLanguages,
     cliVersion: undefined,
     compressionMethod,
-    platform: getBundlePlatform(),
+    platform,
     variant,
     isLatestNightly: true,
   });
@@ -1241,14 +1198,18 @@ async function getLatestNightlyBundle(
     }
     const assetUrl = (name: string) =>
       `https://github.com/${CODEQL_NIGHTLIES_REPOSITORY_OWNER}/${CODEQL_NIGHTLIES_REPOSITORY_NAME}/releases/download/${latestRelease.tag_name}/${name}`;
-    const url = assetUrl(getCodeQLBundleName(compressionMethod, language));
+    const url = assetUrl(
+      getCodeQLBundleName(compressionMethod, platform, language),
+    );
     return language === undefined
       ? { kind: "combined", url }
       : {
           kind: "per-language",
           url,
           language,
-          combinedBundleURL: assetUrl(getCodeQLBundleName(compressionMethod)),
+          combinedBundleURL: assetUrl(
+            getCodeQLBundleName(compressionMethod, platform),
+          ),
         };
   } catch (e) {
     throw new Error(

src/start-proxy-action-post.ts

@@ -20,7 +20,7 @@ export async function runWrapper() {
 
   try {
     // Restore inputs from `start-proxy` Action.
-    actionsUtil.restoreInputs();
+    actionsUtil.restoreInputs(logger);
 
     // Kill the running proxy
     const pid = core.getState("proxy-process-pid");
@@ -38,12 +38,6 @@ export async function runWrapper() {
       logger.info(
         "Debug mode is on. Uploading proxy log as Actions debugging artifact...",
       );
-      if (config?.gitHubVersion.type === undefined) {
-        logger.warning(
-          `Did not upload debug artifacts because cannot determine the GitHub variant running.`,
-        );
-        return;
-      }
       const gitHubVersion = await getGitHubVersion();
       checkGitHubVersionInRange(gitHubVersion, logger);
 

src/tracer-config.test.ts

@@ -7,7 +7,12 @@ import * as sinon from "sinon";
 import { CodeQL, getCodeQLForTesting } from "./codeql";
 import * as configUtils from "./config-utils";
 import { BuiltInLanguage } from "./languages";
-import { createTestConfig, makeVersionInfo, setupTests } from "./testing-utils";
+import {
+  createTestConfig,
+  makeVersionInfo,
+  RecordingLogger,
+  setupTests,
+} from "./testing-utils";
 import { ToolsFeature } from "./tools-features";
 import { getCombinedTracerConfig } from "./tracer-config";
 import * as util from "./util";
@@ -42,18 +47,20 @@ async function stubCodeql(
 }
 
 test("getCombinedTracerConfig - return undefined when no languages are traced languages", async (t) => {
+  const logger = new RecordingLogger();
   await util.withTmpDir(async (tmpDir) => {
     const config = getTestConfig(tmpDir);
     // No traced languages
     config.languages = [BuiltInLanguage.javascript, BuiltInLanguage.python];
     t.deepEqual(
-      await getCombinedTracerConfig(await stubCodeql(), config),
+      await getCombinedTracerConfig(logger, await stubCodeql(), config),
       undefined,
     );
   });
 });
 
 test("getCombinedTracerConfig", async (t) => {
+  const logger = new RecordingLogger();
   await util.withTmpDir(async (tmpDir) => {
     const config = getTestConfig(tmpDir);
 
@@ -82,7 +89,11 @@ test("getCombinedTracerConfig", async (t) => {
     );
     fs.writeFileSync(startTracingJson, JSON.stringify(startTracingEnv));
 
-    const result = await getCombinedTracerConfig(await stubCodeql(), config);
+    const result = await getCombinedTracerConfig(
+      logger,
+      await stubCodeql(),
+      config,
+    );
     t.notDeepEqual(result, undefined);
 
     t.false(Object.prototype.hasOwnProperty.call(result?.env, "CODEQL_RUNNER"));

src/tracer-config.ts

@@ -4,7 +4,7 @@ import * as path from "path";
 import { type CodeQL } from "./codeql";
 import { type Config } from "./config-utils";
 import { Logger } from "./logging";
-import { asyncSome, BuildMode } from "./util";
+import { asyncSome, BuildMode, getErrorMessage } from "./util";
 
 export type TracerConfig = {
   env: { [key: string]: string };
@@ -77,23 +77,28 @@ export async function endTracingForCluster(
 }
 
 async function getTracerConfigForCluster(
+  logger: Logger,
   config: Config,
 ): Promise<TracerConfig> {
-  const tracingEnvVariables = JSON.parse(
-    fs.readFileSync(
-      path.resolve(
-        config.dbLocation,
-        "temp/tracingEnvironment/start-tracing.json",
-      ),
-      "utf8",
-    ),
+  const filePath = path.resolve(
+    config.dbLocation,
+    "temp/tracingEnvironment/start-tracing.json",
   );
-  return {
-    env: tracingEnvVariables,
-  };
+  try {
+    const tracingEnvVariables = JSON.parse(fs.readFileSync(filePath, "utf8"));
+    return {
+      env: tracingEnvVariables,
+    };
+  } catch (err) {
+    logger.error(
+      `Failed to parse tracing environment from '${filePath}': ${getErrorMessage(err)}`,
+    );
+    throw new Error(`Failed to parse tracing environment from '${filePath}'.`);
+  }
 }
 
 export async function getCombinedTracerConfig(
+  logger: Logger,
   codeql: CodeQL,
   config: Config,
 ): Promise<TracerConfig | undefined> {
@@ -101,5 +106,5 @@ export async function getCombinedTracerConfig(
     return undefined;
   }
 
-  return await getTracerConfigForCluster(config);
+  return await getTracerConfigForCluster(logger, config);
 }

src/upload-sarif-action-post.ts

@@ -17,9 +17,10 @@ export async function runWrapper() {
   // possible, and only use safe functions outside.
 
   try {
-    // Restore inputs from `upload-sarif` Action.
-    actionsUtil.restoreInputs();
     const logger = getActionsLogger();
+
+    // Restore inputs from `upload-sarif` Action.
+    actionsUtil.restoreInputs(logger);
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);
 

src/util.ts

@@ -682,7 +682,7 @@ export async function bundleDb(
   return databaseBundlePath;
 }
 
-/** Returns the elapsed milliseconds, rounded, since a `performance.now()` timestamp. */
+/** Returns the elapsed milliseconds, rounded, since `startTime` was recorded with `performance.now()`. */
 export function durationMsSince(startTime: number): number {
   return Math.round(performance.now() - startTime);
 }
@@ -894,7 +894,13 @@ export function parseMatrixInput(
   if (matrixInput === undefined || matrixInput === "null") {
     return undefined;
   }
-  return JSON.parse(matrixInput) as { [key: string]: string };
+  try {
+    return JSON.parse(matrixInput) as { [key: string]: string };
+  } catch (err) {
+    throw new Error(
+      `Failed to parse matrix input '${matrixInput}': ${getErrorMessage(err)}`,
+    );
+  }
 }
 
 export function wrapError(error: unknown): Error {
@@ -1037,7 +1043,11 @@ export enum BuildMode {
 }
 
 export function cloneObject<T>(obj: T): T {
-  return JSON.parse(JSON.stringify(obj)) as T;
+  try {
+    return JSON.parse(JSON.stringify(obj)) as T;
+  } catch (err) {
+    throw new Error(`Cloning object failed: ${getErrorMessage(err)}`);
+  }
 }
 
 export async function cleanUpPath(file: string, name: string, logger: Logger) {