github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-21 02:01:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set removeComments to true

Browse Source
This commit is contained in:
Michael B. Gale
2026-10-19 18:50:03 +01:00
parent cd14330772
commit 895cd922d9
2 changed files with 27 additions and 296 deletions
Download Patch File Download Diff File Expand all files Collapse all files

322
lib/entry-points.js generated
View File

@@ -26641,41 +26641,24 @@ var require_environment = __commonJS({
constructor(vars) {
this.vars = vars;
}
/** Clones the object while detaching the underlying environment from the original. */
clone() {
return Object.create(this, { vars: { value: { ...this.vars } } });
}
/** Gets a copy of the underlying environment. */
get() {
return { ...this.vars };
}
/** Tries to get the value for `name` and throws if there isn't one. */
getRequired(name) {
return getRequiredEnvVar2(this.vars, name);
}
/** Gets the value for `name`, or `undefined` if it isn't set or empty. */
getOptional(name) {
return getOptionalEnvVarFrom2(this.vars, name);
}
/** Gets the entries of the underlying `ProcessEnv`. */
entries() {
return Object.entries(this.vars);
}
/**
* Gets a value indicating whether we should skip uploads of
* all kinds (SARIF results, status reports, DBs, ...).
*
* This is not guaranteed to be set in all test environments.
*/
isSkippingUploadsInTests() {
return this.getOptional(EnvVar2.TEST_MODE) === "true";
}
/**
* Gets a value indicative of whether we are in a testing environment
* by testing whether the value of the `NODE_ENV` variable is "test".
* This is expected to be the case if e.g. `ava` is running the tests
* or if this instance was constructed by `getTestEnv`.
*/
isTestingEnv() {
return false;
}
@@ -26683,32 +26666,21 @@ var require_environment = __commonJS({
exports2.ReadOnlyEnv = ReadOnlyEnv7;
var Env3 = class extends ReadOnlyEnv7 {
changed = false;
/** Sets an environment variable. */
set(name, value) {
this.vars[name] = value;
this.changed = true;
}
/** Sets all environment variables given by `vars`. */
setAll(vars) {
for (const [key, val] of Object.entries(vars)) {
this.set(key, val);
}
}
/**
* Wrapper around `core.exportVariable` which does not call `core.exportVariable`
* when running unit tests. This is important, because otherwise `core.exportVariable`
* sets environment variables for other steps in a workflow when we run unit tests in CI.
*
* @param name The name of the environment variable to set and export.
* @param val The value to set and export for the environment variable.
*/
export(name, val) {
this.set(name, val);
if (!this.isTestingEnv()) {
core13.exportVariable(name, val);
}
}
/** Gets a value indicating whether `set` was called at least once. */
hasChanged() {
return this.changed;
}
@@ -32846,12 +32818,7 @@ var require_util9 = __commonJS({
}
}
function looksLikeHostedRunner2() {
return (
// Name of the runner on hosted Windows runners
process.env["RUNNER_NAME"]?.includes("Hosted Agent") || // Name of the runner on hosted POSIX runners
process.env["RUNNER_NAME"]?.includes("GitHub Actions") || // Segment of the path to the tool cache on all hosted runners
process.env["RUNNER_TOOL_CACHE"]?.includes("hostedtoolcache")
);
return process.env["RUNNER_NAME"]?.includes("Hosted Agent") || process.env["RUNNER_NAME"]?.includes("GitHub Actions") || process.env["RUNNER_TOOL_CACHE"]?.includes("hostedtoolcache");
}
function parseMatrixInput2(matrixInput) {
if (matrixInput === void 0 || matrixInput === "null") {
@@ -32897,8 +32864,7 @@ var require_util9 = __commonJS({
}
}
function checkActionVersion(version2, githubVersion) {
if (!semver10.satisfies(version2, ">=4") && // do not log error if the customer is already running v4
!process.env[environment_1.EnvVar.LOG_VERSION_DEPRECATION]) {
if (!semver10.satisfies(version2, ">=4") && !process.env[environment_1.EnvVar.LOG_VERSION_DEPRECATION]) {
if (githubVersion.type === GitHubVariant2.DOTCOM || githubVersion.type === GitHubVariant2.GHEC_DR || githubVersion.type === GitHubVariant2.GHES && semver10.satisfies(semver10.coerce(githubVersion.version) ?? "0.0.0", ">=3.20")) {
core13.warning("CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/");
(0, environment_1.exportEnvVar)(environment_1.EnvVar.LOG_VERSION_DEPRECATION, "true");
@@ -33331,9 +33297,6 @@ var require_actions_util = __commonJS({
if (pullRequest) {
return {
base: pullRequest.base.ref,
// We use the head label instead of the head ref here, because the head
// ref lacks owner information and by itself does not uniquely identify
// the head branch (which may be in a forked repository).
head: pullRequest.head.label
};
}
@@ -33342,8 +33305,6 @@ var require_actions_util = __commonJS({
if (codeScanningRef && codeScanningBaseBranch) {
return {
base: codeScanningBaseBranch,
// PR analysis under Default Setup analyzes the PR head commit instead of
// the merge commit, so we can use the provided ref directly.
head: codeScanningRef
};
}
@@ -33438,13 +33399,9 @@ var require_logging = __commonJS({
}
function getRunnerLogger2(debugMode) {
return {
// eslint-disable-next-line no-console
debug: debugMode ? console.debug : () => void 0,
// eslint-disable-next-line no-console
info: console.info,
// eslint-disable-next-line no-console
warning: console.warn,
// eslint-disable-next-line no-console
error: console.error,
isDebug: () => debugMode,
startGroup: () => void 0,
@@ -35811,14 +35768,6 @@ var require_types = __commonJS({
exports2.versionInfoBaseSchema = {
version: json.string,
features: json.optional(json.object({})),
/**
* The overlay version helps deal with backward incompatible changes for
* overlay analysis. When a precompiled query pack reports the same overlay
* version as the CodeQL CLI, we can use the CodeQL CLI to perform overlay
* analysis with that pack. Otherwise, if the overlay versions are different,
* or if either the pack or the CLI does not report an overlay version,
* we need to revert to non-overlay analysis.
*/
overlayVersion: json.optional(json.number)
};
}
@@ -36366,14 +36315,12 @@ var require_types2 = __commonJS({
var json = __importStar2(require_json());
var util_1 = require_util9();
exports2.usernameSchema = {
/** The username needed to authenticate to the package registry, if any. */
username: json.optionalOrNull(json.string)
};
function hasUsername(config) {
return "username" in config;
}
exports2.usernamePasswordSchema = {
/** The password needed to authenticate to the package registry, if any. */
password: json.optionalOrNull(json.string),
...exports2.usernameSchema
};
@@ -36381,7 +36328,6 @@ var require_types2 = __commonJS({
return hasUsername(config) && "password" in config;
}
exports2.tokenSchema = {
/** The token needed to authenticate to the package registry, if any. */
token: json.optionalOrNull(json.string),
...exports2.usernameSchema
};
@@ -36484,9 +36430,7 @@ var require_types2 = __commonJS({
return result;
}
exports2.registryBaseSchema = {
/** The type of the package registry. */
type: json.string,
/** Whether the registry replaces the base registry for the ecosystem. */
"replaces-base": json.optional(json.boolean)
};
function getAddressString(address) {
@@ -36692,7 +36636,6 @@ var require_status_report = __commonJS({
const statusReport = {
action_name: actionName,
action_oid: "unknown",
// TODO decide if it's possible to fill this in
action_ref: actionRef,
action_started_at: actionStartedAt.toISOString(),
action_version: (0, actions_util_1.getActionVersion)(),
@@ -37311,9 +37254,6 @@ var require_feature_flags = __commonJS({
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
minimumVersion: overlay_1.CODEQL_OVERLAY_MINIMUM_VERSION
},
// Per-language overlay feature flags. Each has minimumVersion set to the
// minimum CLI version that supports overlay analysis for that language.
// Only languages that are GA or in staff-ship should have feature flags here.
[Feature2.OverlayAnalysisCodeScanningCpp]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
@@ -37384,7 +37324,6 @@ var require_feature_flags = __commonJS({
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
minimumVersion: overlay_1.CODEQL_OVERLAY_MINIMUM_VERSION_RUBY
},
// Other overlay-related feature flags
[Feature2.OverlayAnalysisDisableTrapCaching]: {
defaultValue: false,
envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_DISABLE_TRAP_CACHING",
@@ -37500,25 +37439,9 @@ var require_feature_flags = __commonJS({
enabledVersions: [LINKED_CODEQL_VERSION]
};
}
/**
* Gets the `FeatureConfig` for `feature`.
*/
getFeatureConfig(feature) {
return exports2.featureConfig[feature];
}
/**
* Determines whether `feature` is enabled without consulting the GitHub API.
*
* @param feature The feature to check.
* @param codeql An optional CodeQL object. If provided, and a `minimumVersion` is specified for the
* feature, the version of the CodeQL CLI will be checked against the minimum version.
* If the version is less than the minimum version, the feature will be considered
* disabled. If not provided, and a `minimumVersion` is specified for the feature, then
* this function will throw.
* @returns true if the feature is enabled, false otherwise.
*
* @throws if a `minimumVersion` is specified for the feature, and `codeql` is not provided.
*/
async getValue(feature, codeql) {
const offlineValue = await this.getOfflineValue(feature, codeql);
if (offlineValue !== void 0) {
@@ -37526,9 +37449,6 @@ var require_feature_flags = __commonJS({
}
return this.getDefaultValue(feature);
}
/**
* Determines whether `feature` is enabled using the CLI and environment variables.
*/
async getOfflineValue(feature, codeql) {
const config = this.getFeatureConfig(feature);
if (!codeql && config.minimumVersion) {
@@ -37566,7 +37486,6 @@ var require_feature_flags = __commonJS({
}
return void 0;
}
/** Gets the default value of `feature`. */
async getDefaultValue(feature) {
const config = this.getFeatureConfig(feature);
const defaultValue = config.defaultValue;
@@ -37586,18 +37505,6 @@ var require_feature_flags = __commonJS({
}
return super.getEnabledDefaultCliVersions(variant);
}
/**
*
* @param feature The feature to check.
* @param codeql An optional CodeQL object. If provided, and a `minimumVersion` is specified for the
* feature, the version of the CodeQL CLI will be checked against the minimum version.
* If the version is less than the minimum version, the feature will be considered
* disabled. If not provided, and a `minimumVersion` is specified for the feature, then
* this function will throw.
* @returns true if the feature is enabled, false otherwise.
*
* @throws if a `minimumVersion` is specified for the feature, and `codeql` is not provided.
*/
async getValue(feature, codeql) {
const offlineValue = await this.getOfflineValue(feature, codeql);
if (offlineValue !== void 0) {
@@ -37616,8 +37523,6 @@ var require_feature_flags = __commonJS({
featureFlagsFile;
logger;
cachedApiResponse;
// We cache whether the feature flags were accessed or not in order to accurately report whether flags were
// incorrectly configured vs. inaccessible in our telemetry.
hasAccessedRemoteFeatureFlags;
constructor(repositoryNwo, featureFlagsFile, logger2) {
this.repositoryNwo = repositoryNwo;
@@ -37636,11 +37541,6 @@ var require_feature_flags = __commonJS({
}
return version2;
}
/**
* Returns CLI versions enabled by `default_codeql_version_*_enabled` feature
* flags, sorted from highest to lowest. Falls back to the version pinned in
* `defaults.json` if no such flags are enabled.
*/
async getEnabledDefaultCliVersionsFromFlags() {
const response = await this.getAllFeatures();
const sortedCliVersions = Object.entries(response).map(([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : void 0).filter((f) => f !== void 0).sort(semver10.rcompare);
@@ -38025,7 +37925,6 @@ var require_cli_errors = __commonJS({
new RegExp("\\[autobuild\\] FAILURE: Build failed with an exception.")
]
},
// Version of CodeQL CLI is incompatible with this version of the CodeQL Action
[CliConfigErrorCategory.IncompatibleWithActionVersion]: {
cliErrorMessageCandidates: [
new RegExp("is not compatible with this CodeQL CLI")
@@ -38048,7 +37947,6 @@ var require_cli_errors = __commonJS({
new RegExp("Specifier for external repository is invalid")
]
},
// Expected source location for database creation does not exist
[CliConfigErrorCategory.InvalidSourceRoot]: {
cliErrorMessageCandidates: [new RegExp("Invalid source root")]
},
@@ -38067,8 +37965,6 @@ var require_cli_errors = __commonJS({
new RegExp("Could not detect a suitable build command for the source checkout")
]
},
// Usually when a manual build script has failed, or if an autodetected language
// was unintended to have CodeQL analysis run on it.
[CliConfigErrorCategory.NoSourceCodeSeen]: {
exitCode: 32,
cliErrorMessageCandidates: [
@@ -39619,13 +39515,7 @@ var require_diagnostics2 = __commonJS({
}
function addNoLanguageDiagnostic2(config, diagnostic) {
if (config !== void 0) {
addDiagnostic2(
config,
// Arbitrarily choose the first language. We could also choose all languages, but that
// increases the risk of misinterpreting the data.
config.languages[0],
diagnostic
);
addDiagnostic2(config, config.languages[0], diagnostic);
} else {
unwrittenDefaultLanguageDiagnostics2.push(diagnostic);
}
@@ -39824,7 +39714,6 @@ var require_properties = __commonJS({
parse: parseStringRepositoryProperty
};
var booleanProperty = {
// The value from the API should come as a string, which we then parse into a boolean.
validate: isString2,
parse: parseBooleanRepositoryProperty
};
@@ -40130,7 +40019,6 @@ var require_db_config = __commonJS({
"code-scanning"
]);
var ORG_SCHEMA2 = {
/** An array of model pack names. */
"model-packs": json.optional(json.array(json.string))
};
var DEFAULT_SETUP_SCHEMA2 = {
@@ -40229,11 +40117,7 @@ var require_db_config = __commonJS({
throw new util_1.ConfigurationError(errorMessages.getPacksStrInvalid(packStr));
}
}
if (packPath && (path14.isAbsolute(packPath) || // Permit using "/" instead of "\" on Windows
// Use `x.split(y).join(z)` as a polyfill for `x.replaceAll(y, z)` since
// if we used a regex we'd need to escape the path separator on Windows
// which seems more awkward.
path14.normalize(packPath).split(path14.sep).join("/") !== packPath.split(path14.sep).join("/"))) {
if (packPath && (path14.isAbsolute(packPath) || path14.normalize(packPath).split(path14.sep).join("/") !== packPath.split(path14.sep).join("/"))) {
throw new util_1.ConfigurationError(errorMessages.getPacksStrInvalid(packStr));
}
if (!packPath && pathStart) {
@@ -40349,10 +40233,7 @@ var require_db_config = __commonJS({
}
function parseUserConfig2(logger2, pathInput, contents, validateConfig) {
try {
const schema = (
// eslint-disable-next-line @typescript-eslint/no-require-imports
require_db_config_schema()
);
const schema = require_db_config_schema();
const doc = yaml.load(contents);
if (validateConfig) {
const result = new jsonschema3.Validator().validate(doc, schema);
@@ -116226,7 +116107,6 @@ var require_trap_caching = __commonJS({
logger2.info(`Looking in Actions cache for TRAP cache with key ${preferredKey}`);
const found = await (0, util_1.waitForResultWithTimeLimit)(MAX_CACHE_OPERATION_MS, actionsCache4.restoreCache([cacheDir], preferredKey, [
preferredKey,
// Fall back to any cache with the right key prefix
await cachePrefix(codeql, language)
]), () => {
logger2.info(`Timed out downloading cache for ${language}, will continue without it`);
@@ -116737,11 +116617,7 @@ var require_config_utils = __commonJS({
return validateOverlayDatabaseMode(overlayDatabaseMode, true, false, codeql, languages, repositoryRoot, sourceRoot, buildMode, gitVersion, logger2);
}
async function validateOverlayDatabaseMode(overlayDatabaseMode, useOverlayDatabaseCaching, overlayModeSetExplicitly, codeql, languages, repositoryRoot, sourceRoot, buildMode, gitVersion, logger2) {
if (buildMode !== util_1.BuildMode.None && (await Promise.all(languages.map(async (l) => l !== languages_1.BuiltInLanguage.go && // Workaround to allow overlay analysis for Go with any build
// mode, since it does not yet support BMN. The Go autobuilder and/or extractor will
// ensure that overlay-base databases are only created for supported Go build setups,
// and that we'll fall back to full databases in other cases.
await codeql.isTracedLanguage(l)))).some(Boolean)) {
if (buildMode !== util_1.BuildMode.None && (await Promise.all(languages.map(async (l) => l !== languages_1.BuiltInLanguage.go && await codeql.isTracedLanguage(l)))).some(Boolean)) {
logger2.warning(`Cannot build an ${overlayDatabaseMode} database because build-mode is set to "${buildMode}" instead of "none". Falling back to creating a normal full database instead.`);
return new util_1.Failure(diagnostics_2.OverlayDisabledReason.IncompatibleBuildMode);
}
@@ -117018,10 +116894,7 @@ var require_config_utils = __commonJS({
logger2.debug("Using CODEQL_REGISTRIES_AUTH environment variable to authenticate with registries.");
}
return {
registriesAuthTokens: (
// if the user has explicitly set the CODEQL_REGISTRIES_AUTH env var then use that
process.env.CODEQL_REGISTRIES_AUTH ?? registriesAuthTokens
),
registriesAuthTokens: process.env.CODEQL_REGISTRIES_AUTH ?? registriesAuthTokens,
qlconfigFile
};
}
@@ -117030,7 +116903,6 @@ var require_config_utils = __commonJS({
throw new util_1.ConfigurationError("Invalid 'registries' input. Must be an array of objects with 'url' and 'packages' properties.");
}
const safeRegistries = registries.map((registry) => ({
// ensure the url ends with a slash to avoid a bug in the CLI 2.10.4
url: !registry?.url.endsWith("/") ? `${registry.url}/` : registry.url,
packages: registry.packages,
kind: registry.kind
@@ -117078,10 +116950,6 @@ var require_config_utils = __commonJS({
return augmentedConfig;
}
augmentedConfig["query-filters"] = [
// Ordering matters. If the first filter is an inclusion, it implicitly
// excludes all queries that are not included. If it is an exclusion,
// it implicitly includes all queries that are not excluded. So user
// filters (if any) should always be first to preserve intent.
...augmentedConfig["query-filters"] || [],
...extraQueryExclusions
];
@@ -118136,38 +118004,11 @@ var require_caching = __commonJS({
let databaseDownloadDurationMs = 0;
try {
const databaseDownloadStart = performance.now();
const foundKey = await (0, util_1.waitForResultWithTimeLimit)(
// This ten-minute limit for the cache restore operation is mainly to
// guard against the possibility that the cache service is unresponsive
// and hangs outside the data download.
//
// Data download (which is normally the most time-consuming part of the
// restore operation) should not run long enough to hit this limit. Even
// for an extremely large 10GB database, at a download speed of 40MB/s
// (see below), the download should complete within five minutes. If we
// do hit this limit, there are likely more serious problems other than
// mere slow download speed.
//
// This is important because we don't want any ongoing file operations
// on the database directory when we do hit this limit. Hitting this
// time limit takes us to a fallback path where we re-initialize the
// database from scratch at dbLocation, and having the cache restore
// operation continue to write into dbLocation in the background would
// really mess things up. We want to hit this limit only in the case
// of a hung cache service, not just slow download speed.
MAX_CACHE_OPERATION_MS,
actionsCache4.restoreCache([dbLocation], cacheRestoreKeyPrefix, [cacheRestoreKeyPrefix], {
// Azure SDK download (which is the default) uses 128MB segments; see
// https://github.com/actions/toolkit/blob/main/packages/cache/README.md.
// Setting segmentTimeoutInMs to 3000 translates to segment download
// speed of about 40 MB/s, which should be achievable unless the
// download is unreliable (in which case we do want to abort).
segmentTimeoutInMs: 3e3
}),
() => {
logger2.info("Timed out downloading overlay-base database from cache");
}
);
const foundKey = await (0, util_1.waitForResultWithTimeLimit)(MAX_CACHE_OPERATION_MS, actionsCache4.restoreCache([dbLocation], cacheRestoreKeyPrefix, [cacheRestoreKeyPrefix], {
segmentTimeoutInMs: 3e3
}), () => {
logger2.info("Timed out downloading overlay-base database from cache");
});
databaseDownloadDurationMs = Math.round(performance.now() - databaseDownloadStart);
if (foundKey === void 0) {
logger2.info("No overlay-base database found in Actions cache");
@@ -118214,7 +118055,6 @@ var require_caching = __commonJS({
const languagesComponent = [...parsedLanguages].sort().join("_");
const cacheKeyComponents = {
automationID: await (0, api_client_1.getAutomationID)()
// Add more components here as needed in the future
};
const componentsHash = (0, caching_utils_1.createCacheKeyHash)(cacheKeyComponents);
return `${CACHE_PREFIX2}-${CACHE_VERSION2}-${componentsHash}-${languagesComponent}-`;
@@ -118501,11 +118341,8 @@ var require_repository2 = __commonJS({
async function getCodeQLAssetDownloadURL2(action, apiDetails, tagName, assetName, assetKind = "CodeQL bundle") {
const codeQLActionRepository = getCodeQLActionRepository2(action);
const potentialDownloadSources = [
// This GitHub instance, and this Action.
[apiDetails.url, codeQLActionRepository],
// This GitHub instance, and the canonical Action.
[apiDetails.url, exports2.CODEQL_DEFAULT_ACTION_REPOSITORY],
// GitHub.com, and the canonical Action.
exports2.DEFAULT_DOWNLOAD_SOURCE
];
const uniqueDownloadSources = potentialDownloadSources.filter((source, index2, self2) => {
@@ -118632,16 +118469,13 @@ var require_tar2 = __commonJS({
switch (type) {
case "gnu":
return {
available: foundZstdBinary && // GNU tar only uses major and minor version numbers
semver10.gte(semver10.coerce(version2), semver10.coerce(MIN_REQUIRED_GNU_TAR_VERSION2)),
available: foundZstdBinary && semver10.gte(semver10.coerce(version2), semver10.coerce(MIN_REQUIRED_GNU_TAR_VERSION2)),
foundZstdBinary,
version: tarVersion
};
case "bsd":
return {
available: foundZstdBinary && // Do a loose comparison since these version numbers don't contain
// a patch version number.
semver10.gte(version2, MIN_REQUIRED_BSD_TAR_VERSION2),
available: foundZstdBinary && semver10.gte(version2, MIN_REQUIRED_BSD_TAR_VERSION2),
foundZstdBinary,
version: tarVersion
};
@@ -119373,9 +119207,7 @@ var require_tools_download = __commonJS({
const response = await new Promise((resolve8, reject) => {
const request2 = follow_redirects_1.https.get(codeqlURL, {
headers,
// Increase the high water mark to improve performance.
highWaterMark: STREAMING_HIGH_WATERMARK_BYTES2,
// Use the agent to respect proxy settings.
agent
}, (r) => resolve8(r));
request2.on("error", reject);
@@ -119986,10 +119818,7 @@ var require_setup_codeql = __commonJS({
}
}
async function useZstdBundle2(cliVersion2, tarSupportsZstd) {
return (
// In testing, gzip performs better than zstd on Windows.
process.platform !== "win32" && tarSupportsZstd && semver10.gte(cliVersion2, feature_flags_1.CODEQL_VERSION_ZSTD_BUNDLE)
);
return process.platform !== "win32" && tarSupportsZstd && semver10.gte(cliVersion2, feature_flags_1.CODEQL_VERSION_ZSTD_BUNDLE);
}
function getTempExtractionDir2(tempDir) {
return path14.join(tempDir, (0, uuid_1.v4)());
@@ -120230,11 +120059,7 @@ var require_codeql = __commonJS({
if (!(e instanceof Error)) {
return false;
}
return (
// out of disk space
e.message.includes("ENOSPC") || // access denied
e.message.includes("EACCES")
);
return e.message.includes("ENOSPC") || e.message.includes("EACCES");
}
async function setupCodeQL2(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, otherLanguagePacksReason, useOverlayAwareDefaultCliVersion, features, logger2, checkVersion) {
try {
@@ -120384,12 +120209,6 @@ Details: ${e.stack}` : ""}`);
"--extractor-include-aliases",
...extraArgs,
...getExtraOptionsFromEnv2(["database", "init"], {
// Some user configs specify `--no-calculate-baseline` as an additional
// argument to `codeql database init`. Therefore ignore the baseline file
// options here to avoid specifying the same argument twice and erroring.
//
// Ignore `--overwrite` to avoid passing both `--force-overwrite` and `--overwrite` if
// the user has configured `--overwrite`.
ignoringOptions: [
"--force-overwrite",
"--overwrite",
@@ -120465,9 +120284,6 @@ Details: ${e.stack}` : ""}`);
"--format=betterjson",
"--extractor-options-verbosity=4",
"--extractor-include-aliases",
// TODO: Unconditionally include `--filter-to-languages-with-queries`
// once CODEQL_MINIMUM_VERSION is at least v2.23.0
// — the first version to support this flag.
...filterToLanguagesWithQueries ? ["--filter-to-languages-with-queries"] : [],
...getExtraOptionsFromEnv2(["resolve", "languages"])
]);
@@ -120492,7 +120308,6 @@ Details: ${e.stack}` : ""}`);
...flags,
databasePath,
"--min-disk-free=1024",
// Try to leave at least 1GB free
"-v",
...queries,
...getExtraOptionsFromEnv2(["database", "run-queries"], {
@@ -120579,11 +120394,9 @@ Details: ${e.stack}` : ""}`);
"export-diagnostics",
`${databasePath}`,
"--db-cluster",
// Database is always a cluster for CodeQL versions that support diagnostics.
"--format=sarif-latest",
`--output=${sarifFile}`,
"--sarif-include-diagnostics",
// ExportDiagnosticsEnabled is always true if this command is run.
"-vvv",
...getExtraOptionsFromEnv2(["diagnostics", "export"])
];
@@ -120931,11 +120744,8 @@ var require_dependency_caching = __commonJS({
}
async function getJavaDependencyDirs() {
return [
// Maven
(0, path_1.join)(os2.homedir(), ".m2", "repository"),
// Gradle
(0, path_1.join)(os2.homedir(), ".gradle", "caches"),
// CodeQL Java build-mode: none
getJavaTempDependencyDir()
];
}
@@ -120944,7 +120754,6 @@ var require_dependency_caching = __commonJS({
}
async function getCsharpDependencyDirs(codeql, features) {
const dirs = [
// Nuget
(0, path_1.join)(os2.homedir(), ".nuget", "packages")
];
if (await features.getValue(feature_flags_1.Feature.CsharpCacheBuildModeNone, codeql)) {
@@ -120960,9 +120769,7 @@ var require_dependency_caching = __commonJS({
return patterns;
}
exports2.CSHARP_BASE_PATTERNS = [
// NuGet
"**/packages.lock.json",
// Paket
"**/paket.lock"
];
exports2.CSHARP_EXTRA_PATTERNS = [
@@ -120984,9 +120791,7 @@ var require_dependency_caching = __commonJS({
java: {
getDependencyPaths: getJavaDependencyDirs,
getHashPatterns: async () => exports2.internal.makePatternCheck([
// Maven
"**/pom.xml",
// Gradle
"**/*.gradle*",
"**/gradle-wrapper.properties",
"buildSrc/**/Versions.kt",
@@ -121734,7 +121539,6 @@ var require_database_upload = __commonJS({
"Content-Type": "application/zip",
"Content-Length": bundledDbSize
},
// Disable `octokit/plugin-retry.js`, since the request body is a ReadStream which can only be consumed once.
request: {
retries: 0
}
@@ -126352,22 +126156,7 @@ var require_upload_lib = __commonJS({
...github4.getCurrentInstance(env)
};
const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type);
const initCodeQLResult = await (0, init_1.initCodeQL)(
void 0,
// There is no tools input on the upload action
apiDetails,
tempDir,
gitHubVersion.type,
codeQLDefaultVersionInfo,
void 0,
// rawLanguages: upload-lib does not run analysis
void 0,
// otherLanguagePacksReason: upload-lib does not run analysis
false,
// useOverlayAwareDefaultCliVersion: upload-lib does not run analysis
features,
logger2
);
const initCodeQLResult = await (0, init_1.initCodeQL)(void 0, apiDetails, tempDir, gitHubVersion.type, codeQLDefaultVersionInfo, void 0, void 0, false, features, logger2);
codeQL = initCodeQLResult.codeql;
}
const baseTempDir = path14.resolve(tempDir, "combined-sarif");
@@ -126525,8 +126314,7 @@ var require_upload_lib = __commonJS({
}
}
function validateSarifFileSchema2(sarifLog, sarifFilePath, logger2) {
if ((0, sarif_1.areAllRunsProducedByCodeQL)([sarifLog]) && // We want to validate CodeQL SARIF in testing environments.
!util4.getTestingEnvironment()) {
if ((0, sarif_1.areAllRunsProducedByCodeQL)([sarifLog]) && !util4.getTestingEnvironment()) {
logger2.debug(`Skipping SARIF schema validation for ${sarifFilePath} as all runs are produced by CodeQL.`);
return true;
}
@@ -126725,8 +126513,7 @@ ${response.data.errors}`;
return processingErrors.every((error3) => error3.startsWith("rejecting SARIF") || error3.startsWith("an invalid URI was provided as a SARIF location") || error3.startsWith("locationFromSarifResult: expected artifact location") || error3.startsWith("could not convert rules: invalid security severity value, is not a number") || /^SARIF URI scheme [^\s]* did not match the checkout URI scheme [^\s]*/.test(error3));
}
function handleProcessingResultForUnsuccessfulExecution2(response, status, logger2) {
if (status === "failed" && Array.isArray(response.data.errors) && response.data.errors.length === 1 && // eslint-disable-next-line @typescript-eslint/no-unsafe-call
response.data.errors[0].toString().startsWith("unsuccessful execution")) {
if (status === "failed" && Array.isArray(response.data.errors) && response.data.errors.length === 1 && response.data.errors[0].toString().startsWith("unsuccessful execution")) {
logger2.info('Successfully uploaded a SARIF file for the unsuccessful execution. Received expected "unsuccessful execution" processing error, and no other errors.');
} else if (status === "failed") {
logger2.warning(`Failed to upload a SARIF file for the unsuccessful execution. Code scanning status information for the repository may be out of date as a result. Processing errors: ${response.data.errors}`);
@@ -170030,7 +169817,6 @@ var require_debug_artifacts = __commonJS({
const artifactUploader = await getArtifactUploaderClient(logger2, ghVariant);
try {
await artifactUploader.uploadArtifact(sanitizeArtifactName(`${artifactName}${suffix}`), toUpload.map((file) => path14.normalize(file)), path14.normalize(rootDir), {
// ensure we don't keep the debug artifacts around for too long since they can be large.
retentionDays: 7
});
return "upload-successful";
@@ -170304,7 +170090,6 @@ var require_inputs = __commonJS({
if (allowRepositoryProperty && propertyValue?.startsWith("!")) {
action.logger.info(`Using ${name} input from repository property (enforced): ${propertyValue}`);
return {
// Drop the '!' from the value.
value: propertyValue.substring(1),
source: InputSource.RepositoryProperty
};
@@ -170610,13 +170395,7 @@ var require_workflow = __commonJS({
return getInputOrThrow(workflow, jobName, getAnalyzeActionName(), "upload", matrixVars);
}
function getRepositoryRootOrThrow(workflow, jobName, matrixVars, config, env = (0, environment_1.getEnv)()) {
return (
// If the CodeQL Action already has a persisted repository root, then we can just use that.
config.repositoryRoot ?? // Otherwise, try to retrieve it from a `checkout_path` input in the workflow specification.
getInputOrThrow(workflow, jobName, getAnalyzeActionName(), "checkout_path", matrixVars) ?? // Finally, if all of the above fail, just use the value of `GITHUB_WORKSPACE` since that
// is what is used by default.
env.getRequired(environment_1.ActionsEnvVars.GITHUB_WORKSPACE)
);
return config.repositoryRoot ?? getInputOrThrow(workflow, jobName, getAnalyzeActionName(), "checkout_path", matrixVars) ?? env.getRequired(environment_1.ActionsEnvVars.GITHUB_WORKSPACE);
}
async function checkWorkflow(logger2, codeql) {
if (!(0, actions_util_1.isDynamicWorkflow)() && process.env[environment_1.EnvVar.SKIP_WORKFLOW_VALIDATION] !== "true") {
@@ -170813,11 +170592,7 @@ var require_init_action = __commonJS({
toolsVersion = initCodeQLResult.toolsVersion;
toolsSource = initCodeQLResult.toolsSource;
await (0, workflow_1.checkWorkflow)(logger2, codeql);
if (
// Only enable the experimental features env variable for Rust analysis if the user has explicitly
// requested rust - don't enable it via language autodetection.
configUtils.getRawLanguagesNoAutodetect((0, actions_util_1.getOptionalInput)("languages")).includes(languages_1.BuiltInLanguage.rust)
) {
if (configUtils.getRawLanguagesNoAutodetect((0, actions_util_1.getOptionalInput)("languages")).includes(languages_1.BuiltInLanguage.rust)) {
const publicPreview = "2.22.1";
const actualVer = (await codeql.getVersion()).version;
if (semver10.lt(actualVer, publicPreview)) {
@@ -170839,10 +170614,6 @@ var require_init_action = __commonJS({
dbLocation: (0, actions_util_1.getOptionalInput)("db-location"),
configInput,
dependencyCachingEnabled: (0, caching_utils_1.getDependencyCachingEnabled)(),
// Debug mode is enabled if:
// - The `init` Action is passed `debug: true`.
// - Actions step debugging is enabled (e.g. by [enabling debug logging for a rerun](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs#re-running-all-the-jobs-in-a-workflow),
// or by setting the `ACTIONS_STEP_DEBUG` secret to `true`).
debugMode,
debugArtifactName: (0, actions_util_1.getOptionalInput)("debug-artifact-name") || util_1.DEFAULT_DEBUG_ARTIFACT_NAME,
debugDatabaseName: (0, actions_util_1.getOptionalInput)("debug-database-name") || util_1.DEFAULT_DEBUG_DATABASE_NAME,
@@ -171001,21 +170772,7 @@ exec ${goBinaryPath} "$@"`);
} catch (unwrappedError) {
const error3 = (0, util_1.wrapError)(unwrappedError);
core13.setFailed(error3.message);
await sendCompletedStatusReport(
startedAt,
config,
void 0,
// We only report config info on success.
toolsInput,
toolsDownloadStatusReport,
toolsFeatureFlagsValid,
toolsSource,
toolsVersion,
overlayBaseDatabaseStats,
dependencyCachingStatus,
logger2,
error3
);
await sendCompletedStatusReport(startedAt, config, void 0, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingStatus, logger2, error3);
return;
} finally {
(0, diagnostics_1.logUnwrittenDiagnostics)();
@@ -171713,22 +171470,7 @@ var require_setup_codeql_action = __commonJS({
toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
const rawLanguages = (0, config_utils_1.getRawLanguagesNoAutodetect)((0, actions_util_1.getOptionalInput)("languages"));
const analysisKinds = await (0, analyses_1.getAnalysisKinds)(logger2, features);
const initCodeQLResult = await (0, init_1.initCodeQL)(
toolsInput?.value,
apiDetails,
(0, actions_util_1.getTemporaryDirectory)(),
gitHubVersion.type,
codeQLDefaultVersionInfo,
rawLanguages,
// CodeQL resolves the dependencies of queries that aren't in compiled packs from the bundle,
// so the queries that the workflow runs with this CLI may need library packs for languages
// other than those in the `languages` input. That input therefore only informs the choice of
// CLI version.
"the 'setup-codeql' Action can't tell whether the queries that the workflow runs will need library packs for other languages",
analysisKinds.length === 1 && analysisKinds[0] === analyses_1.AnalysisKind.CodeScanning,
features,
logger2
);
const initCodeQLResult = await (0, init_1.initCodeQL)(toolsInput?.value, apiDetails, (0, actions_util_1.getTemporaryDirectory)(), gitHubVersion.type, codeQLDefaultVersionInfo, rawLanguages, "the 'setup-codeql' Action can't tell whether the queries that the workflow runs will need library packs for other languages", analysisKinds.length === 1 && analysisKinds[0] === analyses_1.AnalysisKind.CodeScanning, features, logger2);
codeql = initCodeQLResult.codeql;
toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport;
toolsVersion = initCodeQLResult.toolsVersion;
@@ -172148,9 +171890,6 @@ var require_start_proxy = __commonJS({
const proxyAssetUrl = await (0, repository_1.getCodeQLAssetDownloadURL)(action, apiDetails, versionInfo.tagName, proxyPackage, "private registry proxy");
return {
url: proxyAssetUrl,
// The `update-job-proxy` doesn't have a version as such. Since we now bundle it
// with CodeQL CLI bundle releases, we use the corresponding CLI version to
// differentiate between (potentially) different versions of `update-job-proxy`.
version: versionInfo.cliVersion
};
} catch (ex) {
@@ -172159,15 +171898,9 @@ var require_start_proxy = __commonJS({
}
async function downloadProxy(logger2, url2, authorization) {
try {
return await toolcache4.downloadTool(
url2,
/* dest: */
void 0,
authorization,
{
accept: "application/octet-stream"
}
);
return await toolcache4.downloadTool(url2, void 0, authorization, {
accept: "application/octet-stream"
});
} catch (error3) {
logger2.error(`Failed to download proxy archive from ${url2}: ${(0, util_1.getErrorMessage)(error3)}`);
throw new status_report_1.StartProxyError(status_report_1.StartProxyErrorType.DownloadFailed);
@@ -190226,9 +189959,7 @@ var require_environment2 = __commonJS({
}
function checkJdkSettings(logger2, jdkHome) {
const filesToCheck = [
// JDK 9+
path14.join("conf", "net.properties"),
// JDK 8 and below
path14.join("lib", "net.properties")
];
for (const fileToCheck of filesToCheck) {
@@ -190384,7 +190115,6 @@ var require_reachability = __commonJS({
method: "GET",
ca: this.proxy.cert,
timeout: 5 * 1e3
// 5 seconds
}, (res) => {
res.destroy();
if (res.statusCode !== void 0 && res.statusCode < 400) {

1
tsconfig.json
View File

@@ -9,6 +9,7 @@
"rootDir": "./src",
"sourceMap": true,
"types": ["node"],
"removeComments": true, /* Remove all comments. */
/* Strict Type-Checking Options */
"strict": true, /* Enable all strict type-checking options. */