Merge branch 'main' into rneatherway/content-type

src/analyze-action.ts

@@ -111,12 +111,6 @@ async function run() {
       repositoryNwo,
       logger
     );
-    // We currently perform an API request in both the `init` and `analyze` Actions to determine
-    // what feature flags are enabled. At the time of writing, this redundant API call is acceptable
-    // to us, but if we wanted to avoid it, we could do so by serializing the feature flags as part
-    // of the config file.
-    void featureFlags.preloadFeatureFlags();
-
     await runFinalize(outputDir, threads, memory, config, logger);
     if (actionsUtil.getRequiredInput("skip-queries") !== "true") {
       runStats = await runQueries(

src/analyze.ts

@@ -232,12 +232,7 @@ export async function runQueries(
 
     try {
       if (hasPackWithCustomQueries) {
-        logger.info("*************");
-        logger.info(
-          "Performing analysis with custom QL Packs. QL Packs are an experimental feature."
-        );
-        logger.info("And should not be used in production yet.");
-        logger.info("*************");
+        logger.info("Performing analysis with custom CodeQL Packs.");
         logger.startGroup(`Downloading custom packs for ${language}`);
 
         const codeql = await getCodeQL(config.codeQLCmd);

src/database-upload.test.ts

@@ -10,7 +10,7 @@ import * as apiClient from "./api-client";
 import { setCodeQL } from "./codeql";
 import { Config } from "./config-utils";
 import { uploadDatabases } from "./database-upload";
-import { createFeatureFlags, FeatureFlag, FeatureFlags } from "./feature-flags";
+import { createFeatureFlags, FeatureFlag } from "./feature-flags";
 import { Language } from "./languages";
 import { RepositoryNwo } from "./repository";
 import {
@@ -37,7 +37,6 @@ test.beforeEach(() => {
 
 const uploadToUploadsDomainFlags = createFeatureFlags([
   FeatureFlag.DatabaseUploadsEnabled,
-  FeatureFlag.UploadsDomainEnabled,
 ]);
 
 const testRepoName: RepositoryNwo = { owner: "github", repo: "example" };
@@ -65,18 +64,14 @@ function getTestConfig(tmpDir: string): Config {
   };
 }
 
-async function mockHttpRequests(
-  featureFlags: FeatureFlags,
-  databaseUploadStatusCode: number
-) {
+async function mockHttpRequests(databaseUploadStatusCode: number) {
   // Passing an auth token is required, so we just use a dummy value
   const client = github.getOctokit("123");
 
   const requestSpy = sinon.stub(client, "request");
 
-  const url = (await featureFlags.getValue(FeatureFlag.UploadsDomainEnabled))
-    ? "POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name"
-    : "PUT /repos/:owner/:repo/code-scanning/codeql/databases/:language";
+  const url =
+    "POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name";
   const databaseUploadSpy = requestSpy.withArgs(url);
   if (databaseUploadStatusCode < 300) {
     databaseUploadSpy.resolves(undefined);
@@ -222,7 +217,7 @@ test("Abort database upload if feature flag is disabled", async (t) => {
     await uploadDatabases(
       testRepoName,
       getTestConfig(tmpDir),
-      createFeatureFlags([FeatureFlag.UploadsDomainEnabled]),
+      createFeatureFlags([]),
       testApiDetails,
       getRecordingLogger(loggedMessages)
     );
@@ -250,7 +245,7 @@ test("Don't crash if uploading a database fails", async (t) => {
       FeatureFlag.DatabaseUploadsEnabled,
     ]);
 
-    await mockHttpRequests(featureFlags, 500);
+    await mockHttpRequests(500);
 
     setCodeQL({
       async databaseBundle(_: string, outputFilePath: string) {
@@ -287,7 +282,7 @@ test("Successfully uploading a database to api.github.com", async (t) => {
       .returns("true");
     sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
 
-    await mockHttpRequests(uploadToUploadsDomainFlags, 201);
+    await mockHttpRequests(201);
 
     setCodeQL({
       async databaseBundle(_: string, outputFilePath: string) {
@@ -322,7 +317,7 @@ test("Successfully uploading a database to uploads.github.com", async (t) => {
       .returns("true");
     sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
 
-    await mockHttpRequests(uploadToUploadsDomainFlags, 201);
+    await mockHttpRequests(201);
 
     setCodeQL({
       async databaseBundle(_: string, outputFilePath: string) {

src/feature-flags.test.ts

@@ -88,7 +88,6 @@ test("Feature flags are disabled if they're not returned in API response", async
     for (const featureFlag of [
       "database_uploads_enabled",
       "ml_powered_queries_enabled",
-      "uploads_domain_enabled",
     ]) {
       t.assert(
         loggedMessages.find(
@@ -115,17 +114,19 @@ test("Feature flags exception is propagated if the API request errors", async (t
 
     mockFeatureFlagApiEndpoint(500, {});
 
-    await t.throwsAsync(async () => featureFlags.preloadFeatureFlags(), {
-      message:
-        "Encountered an error while trying to load feature flags: Error: some error message",
-    });
+    await t.throwsAsync(
+      async () => featureFlags.getValue(FeatureFlag.DatabaseUploadsEnabled),
+      {
+        message:
+          "Encountered an error while trying to load feature flags: Error: some error message",
+      }
+    );
   });
 });
 
 const FEATURE_FLAGS = [
   "database_uploads_enabled",
   "ml_powered_queries_enabled",
-  "uploads_domain_enabled",
 ];
 
 for (const featureFlag of FEATURE_FLAGS) {
@@ -154,9 +155,6 @@ for (const featureFlag of FEATURE_FLAGS) {
         ml_powered_queries_enabled: await featureFlags.getValue(
           FeatureFlag.MlPoweredQueriesEnabled
         ),
-        uploads_domain_enabled: await featureFlags.getValue(
-          FeatureFlag.UploadsDomainEnabled
-        ),
       };
 
       t.deepEqual(actualFeatureFlags, expectedFeatureFlags);

src/feature-flags.ts

@@ -10,7 +10,6 @@ export interface FeatureFlags {
 export enum FeatureFlag {
   DatabaseUploadsEnabled = "database_uploads_enabled",
   MlPoweredQueriesEnabled = "ml_powered_queries_enabled",
-  UploadsDomainEnabled = "uploads_domain_enabled",
 }
 
 /**
@@ -42,10 +41,6 @@ export class GitHubFeatureFlags implements FeatureFlags {
     return response;
   }
 
-  async preloadFeatureFlags(): Promise<void> {
-    await this.getApiResponse();
-  }
-
   private async getApiResponse(): Promise<FeatureFlagsApiResponse> {
     const loadApiResponse = async () => {
       // Do nothing when not running against github.com
@@ -66,13 +61,22 @@ export class GitHubFeatureFlags implements FeatureFlags {
         );
         return response.data;
       } catch (e) {
-        // Some feature flags, such as `ml_powered_queries_enabled` affect the produced alerts.
-        // Considering these feature flags disabled in the event of a transient error could
-        // therefore lead to alert churn. As a result, we crash if we cannot determine the value of
-        // the feature flags.
-        throw new Error(
-          `Encountered an error while trying to load feature flags: ${e}`
-        );
+        if (util.isHTTPError(e) && e.status === 403) {
+          this.logger.warning(
+            "This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. " +
+              "As a result, it will not be opted into any experimental features. " +
+              "This could be because the Action is running on a pull request from a fork. If not, " +
+              `please ensure the Action has the 'security-events: write' permission. Details: ${e}`
+          );
+        } else {
+          // Some feature flags, such as `ml_powered_queries_enabled` affect the produced alerts.
+          // Considering these feature flags disabled in the event of a transient error could
+          // therefore lead to alert churn. As a result, we crash if we cannot determine the value of
+          // the feature flags.
+          throw new Error(
+            `Encountered an error while trying to load feature flags: ${e}`
+          );
+        }
       }
     };
 

src/init-action.ts

@@ -143,7 +143,6 @@ async function run() {
     repositoryNwo,
     logger
   );
-  void featureFlags.preloadFeatureFlags();
 
   try {
     const workflowErrors = await validateWorkflow();