From 99fe83948eb780db2b4bd9b5f63c498673f3b857 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 16 Sep 2026 12:44:04 +0100 Subject: [PATCH 01/58] Refactor: Add `determineCheckoutPath` function for `analyze` action --- lib/entry-points.js | 13 +++++++------ src/analyze-action.ts | 11 +++++------ src/analyze.ts | 12 ++++++++++++ 3 files changed, 24 insertions(+), 12 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 3fbacc32e..ef7547dda 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -153801,6 +153801,9 @@ var CodeQLAnalysisError = class extends Error { message; error; }; +function determineCheckoutPath(action) { + return action.actions.getRequiredInput("checkout_path"); +} async function setupPythonExtractor(logger) { const codeqlPython = process.env["CODEQL_PYTHON"]; if (codeqlPython === void 0 || codeqlPython.length === 0) { @@ -156544,11 +156547,9 @@ async function runAutobuildIfLegacyGoWorkflow(config, logger) { ); await runAutobuild(config, "go" /* go */, logger); } -async function run({ - startedAt, - logger, - actions -}) { +async function run(action) { + const startedAt = action.startedAt; + const logger = action.logger; let uploadResults = void 0; let runStats = void 0; let config = void 0; @@ -156614,7 +156615,7 @@ async function run({ getOptionalInput("ram") || process.env["CODEQL_RAM"], logger ); - const checkoutPath = actions.getRequiredInput("checkout_path"); + const checkoutPath = determineCheckoutPath(action); const diffRangePackDir = await setupDiffInformedQueryRun( logger, checkoutPath diff --git a/src/analyze-action.ts b/src/analyze-action.ts index 7963fa52b..67b025ead 100644 --- a/src/analyze-action.ts +++ b/src/analyze-action.ts @@ -10,6 +10,7 @@ import * as analyses from "./analyses"; import { CodeQLAnalysisError, dbIsFinalized, + determineCheckoutPath, QueriesStatusReport, runFinalize, runQueries, @@ -212,13 +213,11 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) { await runAutobuild(config, BuiltInLanguage.go, logger); } -async function run({ - startedAt, - logger, - actions, -}: ActionState<["Base", "Logger", "Actions"]>) { +async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. + const startedAt = action.startedAt; + const logger = action.logger; let uploadResults: | Partial> @@ -311,7 +310,7 @@ async function run({ logger, ); - const checkoutPath = actions.getRequiredInput("checkout_path"); + const checkoutPath = determineCheckoutPath(action); // Setup diff informed analysis if needed (based on whether init created the file) const diffRangePackDir = await setupDiffInformedQueryRun( diff --git a/src/analyze.ts b/src/analyze.ts index 8f9071168..3580f80aa 100644 --- a/src/analyze.ts +++ b/src/analyze.ts @@ -5,6 +5,7 @@ import { performance } from "perf_hooks"; import * as io from "@actions/io"; import * as yaml from "js-yaml"; +import type { ActionState } from "./action-common"; import { getTemporaryDirectory } from "./actions-util"; import * as analyses from "./analyses"; import { setupCppAutobuild } from "./autobuild"; @@ -85,6 +86,17 @@ export interface QueriesStatusReport event_reports?: EventReport[]; } +/** + * Determines the path at which the repository being analysed is checked out at. + * Returns the value of the required `checkout_path` input and validates that it + * refers to the root of a repository. + * + * @param action The action state. + */ +export function determineCheckoutPath(action: ActionState<["Actions"]>) { + return action.actions.getRequiredInput("checkout_path"); +} + async function setupPythonExtractor(logger: Logger) { const codeqlPython = process.env["CODEQL_PYTHON"]; if (codeqlPython === undefined || codeqlPython.length === 0) { From 5dab0ccf518dc8b6da0d5a182150ae1b5db7253a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 16 Sep 2026 12:49:02 +0100 Subject: [PATCH 02/58] Persist repository root from `init` action in CodeQL Action state --- lib/entry-points.js | 43 ++++++++++++++++++++++++++++--------- src/analyze-action.test.ts | 2 ++ src/analyze-action.ts | 2 +- src/analyze.ts | 30 ++++++++++++++++++++++++-- src/config-utils.test.ts | 12 ++++++----- src/config-utils.ts | 16 ++++++++++---- src/config/action-config.ts | 5 +++++ src/testing-utils.ts | 1 + 8 files changed, 89 insertions(+), 22 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index ef7547dda..7994d26d9 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -150444,7 +150444,7 @@ async function initActionState({ analysisKinds, logger, enableFileCoverageInformation -}, userConfig) { +}, userConfig, repositoryRoot) { const languages = await getLanguages( codeql, languagesInput, @@ -150480,6 +150480,7 @@ async function initActionState({ ); return { version: getActionVersion(), + repositoryRoot, analysisKinds, languages, buildMode, @@ -150630,7 +150631,7 @@ async function checkRunnerResources(codeql, features, diskUsage, ramInput, logge } return new Success(void 0); } -async function checkOverlayEnablement(codeql, features, languages, sourceRoot, buildMode, ramInput, codeScanningConfig, repositoryProperties, gitVersion, logger) { +async function checkOverlayEnablement(codeql, features, languages, repositoryRoot, sourceRoot, buildMode, ramInput, codeScanningConfig, repositoryProperties, gitVersion, logger) { const modeEnv = process.env.CODEQL_OVERLAY_DATABASE_MODE; if (modeEnv === "overlay" /* Overlay */ || modeEnv === "overlay-base" /* OverlayBase */ || modeEnv === "none" /* None */) { logger.info( @@ -150645,6 +150646,7 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b true, codeql, languages, + repositoryRoot, sourceRoot, buildMode, gitVersion, @@ -150717,13 +150719,14 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b false, codeql, languages, + repositoryRoot, sourceRoot, buildMode, gitVersion, logger ); } -async function validateOverlayDatabaseMode(overlayDatabaseMode, useOverlayDatabaseCaching, overlayModeSetExplicitly, codeql, languages, sourceRoot, buildMode, gitVersion, logger) { +async function validateOverlayDatabaseMode(overlayDatabaseMode, useOverlayDatabaseCaching, overlayModeSetExplicitly, codeql, languages, repositoryRoot, sourceRoot, buildMode, gitVersion, logger) { if (buildMode !== "none" /* None */ && (await Promise.all( languages.map( async (l) => l !== "go" /* go */ && // Workaround to allow overlay analysis for Go with any build @@ -150744,14 +150747,13 @@ async function validateOverlayDatabaseMode(overlayDatabaseMode, useOverlayDataba ); return new Failure("incompatible-codeql" /* IncompatibleCodeQl */); } - const gitRoot = await getGitRoot(sourceRoot); - if (gitRoot === void 0) { + if (repositoryRoot === void 0) { logger.warning( `Cannot build an ${overlayDatabaseMode} database because the source root "${sourceRoot}" is not inside a git repository. Falling back to creating a normal full database instead.` ); return new Failure("no-git-root" /* NoGitRoot */); } - if (hasSubmodules(gitRoot)) { + if (hasSubmodules(repositoryRoot)) { if (gitVersion === void 0) { logger.warning( `Cannot build an ${overlayDatabaseMode} database because the repository has submodules and the Git version could not be determined. Falling back to creating a normal full database instead.` @@ -150886,8 +150888,9 @@ async function determineUserConfig(action, tempDir, inputs) { async function initConfig(actionState, inputs) { const { logger, features } = actionState; const { tempDir } = inputs; + const repositoryRoot = await getGitRoot(inputs.sourceRoot); const userConfig = await determineUserConfig(actionState, tempDir, inputs); - const config = await initActionState(inputs, userConfig); + const config = await initActionState(inputs, userConfig, repositoryRoot); if (config.analysisKinds.length === 1 && isCodeQualityEnabled(config)) { if (hasQueryCustomisation(config.computedConfig)) { throw new ConfigurationError( @@ -150940,6 +150943,7 @@ async function initConfig(actionState, inputs) { inputs.codeql, inputs.features, config.languages, + repositoryRoot, inputs.sourceRoot, config.buildMode, inputs.ramInput, @@ -153801,8 +153805,27 @@ var CodeQLAnalysisError = class extends Error { message; error; }; -function determineCheckoutPath(action) { - return action.actions.getRequiredInput("checkout_path"); +async function determineCheckoutPath(action) { + const checkoutPathInput = action.actions.getRequiredInput("checkout_path"); + const repositoryRoot = await getGitRoot(checkoutPathInput); + if (repositoryRoot === void 0) { + action.logger.warning( + [ + `The directory at '${checkoutPathInput}' is not in the work tree of a git repository.`, + "If the repository being analyzed is checked out elsewhere,", + "you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to", + "the checkout path." + ].join(" ") + ); + } else if (repositoryRoot !== path16.resolve(checkoutPathInput)) { + action.logger.warning( + [ + `The directory at '${checkoutPathInput}' is not the root of the repository ('${repositoryRoot}').`, + "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout." + ].join(" ") + ); + } + return checkoutPathInput; } async function setupPythonExtractor(logger) { const codeqlPython = process.env["CODEQL_PYTHON"]; @@ -156615,7 +156638,7 @@ async function run(action) { getOptionalInput("ram") || process.env["CODEQL_RAM"], logger ); - const checkoutPath = determineCheckoutPath(action); + const checkoutPath = await determineCheckoutPath(action); const diffRangePackDir = await setupDiffInformedQueryRun( logger, checkoutPath diff --git a/src/analyze-action.test.ts b/src/analyze-action.test.ts index 923908a64..ffba5a03d 100644 --- a/src/analyze-action.test.ts +++ b/src/analyze-action.test.ts @@ -45,6 +45,7 @@ test.serial( requiredInputStub.withArgs("token").returns("fake-token"); requiredInputStub.withArgs("upload-database").returns("false"); requiredInputStub.withArgs("output").returns("out"); + requiredInputStub.withArgs("checkout_path").returns(""); const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput"); optionalInputStub.withArgs("expect-error").returns("false"); sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion); @@ -104,6 +105,7 @@ test.serial( requiredInputStub.withArgs("token").returns("fake-token"); requiredInputStub.withArgs("upload-database").returns("false"); requiredInputStub.withArgs("output").returns("out"); + requiredInputStub.withArgs("checkout_path").returns(""); const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput"); optionalInputStub.withArgs("expect-error").returns("false"); sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion); diff --git a/src/analyze-action.ts b/src/analyze-action.ts index 67b025ead..7c117f75a 100644 --- a/src/analyze-action.ts +++ b/src/analyze-action.ts @@ -310,7 +310,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { logger, ); - const checkoutPath = determineCheckoutPath(action); + const checkoutPath = await determineCheckoutPath(action); // Setup diff informed analysis if needed (based on whether init created the file) const diffRangePackDir = await setupDiffInformedQueryRun( diff --git a/src/analyze.ts b/src/analyze.ts index 3580f80aa..306ccd434 100644 --- a/src/analyze.ts +++ b/src/analyze.ts @@ -22,6 +22,7 @@ import { } from "./diff-informed-analysis-utils"; import { EnvVar } from "./environment"; import { FeatureEnablement, Feature } from "./feature-flags"; +import { getGitRoot } from "./git-utils"; import { BuiltInLanguage, Language } from "./languages"; import { Logger, withGroupAsync } from "./logging"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; @@ -93,8 +94,33 @@ export interface QueriesStatusReport * * @param action The action state. */ -export function determineCheckoutPath(action: ActionState<["Actions"]>) { - return action.actions.getRequiredInput("checkout_path"); +export async function determineCheckoutPath( + action: ActionState<["Logger", "Actions"]>, +) { + const checkoutPathInput = action.actions.getRequiredInput("checkout_path"); + + // Try to obtain the root path of the repository and validate that it matches the input. + const repositoryRoot = await getGitRoot(checkoutPathInput); + + if (repositoryRoot === undefined) { + action.logger.warning( + [ + `The directory at '${checkoutPathInput}' is not in the work tree of a git repository.`, + "If the repository being analyzed is checked out elsewhere,", + "you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to", + "the checkout path.", + ].join(" "), + ); + } else if (repositoryRoot !== path.resolve(checkoutPathInput)) { + action.logger.warning( + [ + `The directory at '${checkoutPathInput}' is not the root of the repository ('${repositoryRoot}').`, + "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout.", + ].join(" "), + ); + } + + return checkoutPathInput; } async function setupPythonExtractor(logger: Logger) { diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index 29d72f3af..ec18bec45 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -172,6 +172,7 @@ test.serial("load empty config", async (t) => { createTestInitConfigInputs({ languagesInput: languages, repository: { owner: "github", repo: "example" }, + sourceRoot: tempDir, tempDir, codeql, logger, @@ -186,6 +187,7 @@ test.serial("load empty config", async (t) => { logger, }), {}, + undefined, ); t.deepEqual(config, expectedConfig); @@ -216,6 +218,7 @@ test.serial("load code quality config", async (t) => { analysisKinds: [AnalysisKind.CodeQuality], languagesInput: languages, repository: { owner: "github", repo: "example" }, + sourceRoot: tempDir, tempDir, codeql, logger, @@ -296,6 +299,7 @@ test.serial( analysisKinds: [AnalysisKind.CodeQuality], languagesInput: languages, repository: { owner: "github", repo: "example" }, + sourceRoot: tempDir, tempDir, codeql, repositoryProperties, @@ -512,6 +516,7 @@ test.serial("load non-empty input", async (t) => { // And the config we expect it to parse to const expectedConfig = createTestConfig({ languages: [BuiltInLanguage.javascript], + repositoryRoot: undefined, buildMode: BuildMode.None, originalUserInput: userConfig, computedConfig: userConfig, @@ -532,6 +537,7 @@ test.serial("load non-empty input", async (t) => { state, createTestInitConfigInputs({ languagesInput, + sourceRoot: tempDir, buildModeInput: "none", configFile: configFilePath, debugArtifactName: "my-artifact", @@ -1092,11 +1098,6 @@ const checkOverlayEnablementMacro = makeMacro({ return lang === BuiltInLanguage.java; }); - // Mock git root detection - if (setup.gitRoot !== undefined) { - sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot); - } - // Mock submodule detection sinon.stub(gitUtils, "hasSubmodules").returns(setup.hasSubmodules); @@ -1109,6 +1110,7 @@ const checkOverlayEnablementMacro = makeMacro({ codeql, features, setup.languages, + setup.gitRoot, // repositoryRoot tempDir, // sourceRoot setup.buildMode, undefined, diff --git a/src/config-utils.ts b/src/config-utils.ts index 288b4f02f..37337b68d 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -385,6 +385,7 @@ export async function initActionState( enableFileCoverageInformation, }: InitConfigInputs, userConfig: UserConfig, + repositoryRoot: string | undefined, ): Promise { const languages = await getLanguages( codeql, @@ -436,6 +437,7 @@ export async function initActionState( return { version: getActionVersion(), + repositoryRoot, analysisKinds, languages, buildMode, @@ -718,6 +720,7 @@ export async function checkOverlayEnablement( codeql: CodeQL, features: FeatureEnablement, languages: Language[], + repositoryRoot: string | undefined, sourceRoot: string, buildMode: BuildMode | undefined, ramInput: string | undefined, @@ -747,6 +750,7 @@ export async function checkOverlayEnablement( true, codeql, languages, + repositoryRoot, sourceRoot, buildMode, gitVersion, @@ -836,6 +840,7 @@ export async function checkOverlayEnablement( false, codeql, languages, + repositoryRoot, sourceRoot, buildMode, gitVersion, @@ -855,6 +860,7 @@ async function validateOverlayDatabaseMode( overlayModeSetExplicitly: boolean, codeql: CodeQL, languages: Language[], + repositoryRoot: string | undefined, sourceRoot: string, buildMode: BuildMode | undefined, gitVersion: GitVersionInfo | undefined, @@ -890,8 +896,7 @@ async function validateOverlayDatabaseMode( ); return new Failure(OverlayDisabledReason.IncompatibleCodeQl); } - const gitRoot = await getGitRoot(sourceRoot); - if (gitRoot === undefined) { + if (repositoryRoot === undefined) { logger.warning( `Cannot build an ${overlayDatabaseMode} database because ` + `the source root "${sourceRoot}" is not inside a git repository. ` + @@ -899,7 +904,7 @@ async function validateOverlayDatabaseMode( ); return new Failure(OverlayDisabledReason.NoGitRoot); } - if (hasSubmodules(gitRoot)) { + if (hasSubmodules(repositoryRoot)) { if (gitVersion === undefined) { logger.warning( `Cannot build an ${overlayDatabaseMode} database because ` + @@ -1160,9 +1165,11 @@ export async function initConfig( const { logger, features } = actionState; const { tempDir } = inputs; + const repositoryRoot = await getGitRoot(inputs.sourceRoot); + const userConfig = await determineUserConfig(actionState, tempDir, inputs); - const config = await initActionState(inputs, userConfig); + const config = await initActionState(inputs, userConfig, repositoryRoot); // If Code Quality analysis is the only enabled analysis kind, then we will initialise // the database for Code Quality. That entails disabling the default queries and only @@ -1244,6 +1251,7 @@ export async function initConfig( inputs.codeql, inputs.features, config.languages, + repositoryRoot, inputs.sourceRoot, config.buildMode, inputs.ramInput, diff --git a/src/config/action-config.ts b/src/config/action-config.ts index de6882e77..2b69141d2 100644 --- a/src/config/action-config.ts +++ b/src/config/action-config.ts @@ -16,6 +16,11 @@ export interface Config { * The version of the CodeQL Action that the configuration is for. */ version: string; + /** + * The path at which the repository being analysed is checked out at, if available. + * Persisted in the CodeQL Action configuration state, so that we can consult it in later workflow steps. + */ + repositoryRoot: string | undefined; /** * Set of analysis kinds that are enabled. */ diff --git a/src/testing-utils.ts b/src/testing-utils.ts index f15cee2e7..b50d51c94 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -968,6 +968,7 @@ export function createTestConfig(overrides: Partial): Config { {}, { version: getActionVersion(), + repositoryRoot: undefined, analysisKinds: [AnalysisKind.CodeScanning], languages: [], buildMode: undefined, From ba615b5d9d7156e92e6950dd84dc3ee1d4d5f4ea Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 16 Sep 2026 15:27:29 +0100 Subject: [PATCH 03/58] Verify persisted repository root path in `analyze` action --- lib/entry-points.js | 13 +++++++++++-- src/analyze-action.ts | 2 +- src/analyze.ts | 15 +++++++++++++++ 3 files changed, 27 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 7994d26d9..ca6dd881b 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -153805,7 +153805,7 @@ var CodeQLAnalysisError = class extends Error { message; error; }; -async function determineCheckoutPath(action) { +async function determineCheckoutPath(action, config) { const checkoutPathInput = action.actions.getRequiredInput("checkout_path"); const repositoryRoot = await getGitRoot(checkoutPathInput); if (repositoryRoot === void 0) { @@ -153824,6 +153824,15 @@ async function determineCheckoutPath(action) { "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout." ].join(" ") ); + } else if (config.repositoryRoot !== void 0 && repositoryRoot !== config.repositoryRoot) { + action.logger.warning( + [ + `The repository path at '${repositoryRoot}' does not match that found by the 'codeql-action/init' step: '${config.repositoryRoot}'.`, + "Ensure that the 'checkout_path' input for the 'codeql-action/analyze' step is set to the path of the same repository that", + "the 'codeql-action/init' step determined. This is either the GitHub Actions workspace or the repository root corresponding to", + "the 'source-root' input if that was provided." + ].join(" ") + ); } return checkoutPathInput; } @@ -156638,7 +156647,7 @@ async function run(action) { getOptionalInput("ram") || process.env["CODEQL_RAM"], logger ); - const checkoutPath = await determineCheckoutPath(action); + const checkoutPath = await determineCheckoutPath(action, config); const diffRangePackDir = await setupDiffInformedQueryRun( logger, checkoutPath diff --git a/src/analyze-action.ts b/src/analyze-action.ts index 7c117f75a..8cc13c1ba 100644 --- a/src/analyze-action.ts +++ b/src/analyze-action.ts @@ -310,7 +310,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { logger, ); - const checkoutPath = await determineCheckoutPath(action); + const checkoutPath = await determineCheckoutPath(action, config); // Setup diff informed analysis if needed (based on whether init created the file) const diffRangePackDir = await setupDiffInformedQueryRun( diff --git a/src/analyze.ts b/src/analyze.ts index 306ccd434..f1a1841f3 100644 --- a/src/analyze.ts +++ b/src/analyze.ts @@ -93,9 +93,11 @@ export interface QueriesStatusReport * refers to the root of a repository. * * @param action The action state. + * @param config The CodeQL Action configuration state. */ export async function determineCheckoutPath( action: ActionState<["Logger", "Actions"]>, + config: configUtils.Config, ) { const checkoutPathInput = action.actions.getRequiredInput("checkout_path"); @@ -118,6 +120,19 @@ export async function determineCheckoutPath( "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout.", ].join(" "), ); + } else if ( + config.repositoryRoot !== undefined && + repositoryRoot !== config.repositoryRoot + ) { + // The repository root that was persisted by the `init` step doesn't match the one we have found here. + action.logger.warning( + [ + `The repository path at '${repositoryRoot}' does not match that found by the 'codeql-action/init' step: '${config.repositoryRoot}'.`, + "Ensure that the 'checkout_path' input for the 'codeql-action/analyze' step is set to the path of the same repository that", + "the 'codeql-action/init' step determined. This is either the GitHub Actions workspace or the repository root corresponding to", + "the 'source-root' input if that was provided.", + ].join(" "), + ); } return checkoutPathInput; From 54a43494ca0def0db032b3ec35007ddcffc822a1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 16 Sep 2026 12:21:40 +0100 Subject: [PATCH 04/58] Propagate `checkoutPath` to `getRef` --- lib/entry-points.js | 90 +++++++++++++--------- src/actions-util.ts | 4 +- src/analyze-action.ts | 2 +- src/codeql.ts | 2 +- src/config-utils.ts | 13 +++- src/database-upload.ts | 6 +- src/environment.ts | 7 ++ src/git-utils.test.ts | 159 ++++++++++++++++++++++++--------------- src/git-utils.ts | 45 ++++++----- src/init-action-post.ts | 5 +- src/overlay/caching.ts | 3 +- src/status-report.ts | 2 +- src/trap-caching.test.ts | 1 + src/trap-caching.ts | 18 ++++- src/upload-lib.ts | 9 ++- 15 files changed, 229 insertions(+), 137 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index ca6dd881b..dc209ae62 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -142187,6 +142187,12 @@ var Env = class extends ReadOnlyEnv { this.vars[name] = value; this.changed = true; } + /** Sets all environment variables given by `vars`. */ + setAll(vars) { + for (const [key, val] of Object.entries(vars)) { + this.set(key, val); + } + } /** Gets a value indicating whether `set` was called at least once. */ hasChanged() { return this.changed; @@ -147019,7 +147025,7 @@ var runGitCommand = async function(workingDirectory, args, customErrorMessage, o throw error3; } }; -var getCommitOid = async function(checkoutPath, ref = "HEAD") { +var getCommitOid = async function(env, checkoutPath, ref = "HEAD") { try { const stdout = await runGitCommand( checkoutPath, @@ -147028,7 +147034,7 @@ var getCommitOid = async function(checkoutPath, ref = "HEAD") { ); return stdout.trim(); } catch { - return getOptionalInput("sha") || getRequiredEnvParam("GITHUB_SHA"); + return getOptionalInput("sha") || env.getRequired("GITHUB_SHA" /* GITHUB_SHA */); } }; var determineBaseBranchHeadCommitOid = async function(checkoutPathOverride) { @@ -147138,12 +147144,12 @@ var getFileOidsUnderPath = async function(basePath) { } return fileOidMap; }; -function getRefFromEnv() { +function getRefFromEnv(env) { let refEnv; try { - refEnv = getRequiredEnvParam("GITHUB_REF"); + refEnv = env.getRequired("GITHUB_REF" /* GITHUB_REF */); } catch (e) { - const maybeRef = process.env["CODE_SCANNING_REF"]; + const maybeRef = env.getOptional("CODE_SCANNING_REF" /* CODE_SCANNING_REF */); if (maybeRef === void 0 || maybeRef.length === 0) { throw e; } @@ -147151,10 +147157,10 @@ function getRefFromEnv() { } return refEnv; } -async function getRef() { +async function getRef(env, checkoutPath) { const refInput = getOptionalInput("ref"); const shaInput = getOptionalInput("sha"); - const checkoutPath = getOptionalInput("checkout_path") || getOptionalInput("source-root") || getRequiredEnvParam("GITHUB_WORKSPACE"); + checkoutPath = checkoutPath ?? env.getRequired("GITHUB_WORKSPACE" /* GITHUB_WORKSPACE */); const hasRefInput = !!refInput; const hasShaInput = !!shaInput; if ((hasRefInput || hasShaInput) && !(hasRefInput && hasShaInput)) { @@ -147162,8 +147168,8 @@ async function getRef() { "Both 'ref' and 'sha' are required if one of them is provided." ); } - const ref = refInput || getRefFromEnv(); - const sha = shaInput || getRequiredEnvParam("GITHUB_SHA"); + const ref = refInput || getRefFromEnv(env); + const sha = shaInput || env.getRequired("GITHUB_SHA" /* GITHUB_SHA */); if (refInput) { return refInput; } @@ -147171,8 +147177,9 @@ async function getRef() { if (!pull_ref_regex.test(ref)) { return ref; } - const head = await getCommitOid(checkoutPath, "HEAD"); + const head = await getCommitOid(env, checkoutPath, "HEAD"); const hasChangedRef = sha !== head && await getCommitOid( + env, checkoutPath, ref.replace(/^refs\/pull\//, "refs/remotes/pull/") ) !== head; @@ -147189,16 +147196,16 @@ async function getRef() { function removeRefsHeadsPrefix(ref) { return ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref; } -async function isAnalyzingDefaultBranch() { - if (process.env.CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH === "true") { +async function isAnalyzingDefaultBranch(env, checkoutPath) { + if (env.getOptional("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH") === "true") { return true; } - let currentRef = await getRef(); + let currentRef = await getRef(env, checkoutPath); currentRef = removeRefsHeadsPrefix(currentRef); - const event = getWorkflowEvent(); + const event = getWorkflowEvent(env); let defaultBranch = event?.repository?.default_branch; - if (getWorkflowEventName() === "schedule") { - defaultBranch = removeRefsHeadsPrefix(getRefFromEnv()); + if (getWorkflowEventName(env) === "schedule") { + defaultBranch = removeRefsHeadsPrefix(getRefFromEnv(env)); } return currentRef === defaultBranch; } @@ -147470,7 +147477,7 @@ function getRegistryTypesFromEnv(logger, env = getEnv()) { async function createStatusReportBase(actionName, status, actionStartedAt, config, diskInfo, logger, cause, exception) { try { const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || ""; - const ref = await getRef(); + const ref = await getRef(getEnv(), config?.repositoryRoot); const jobRunUUID = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */] || ""; const workflowRunID = getWorkflowRunID(); const workflowRunAttempt = getWorkflowRunAttempt(); @@ -150101,7 +150108,7 @@ var CACHE_VERSION = 1; var CODEQL_TRAP_CACHE_PREFIX = "codeql-trap"; var MINIMUM_CACHE_MB_TO_UPLOAD = 10; var MAX_CACHE_OPERATION_MS2 = 12e4; -async function downloadTrapCaches(codeql, languages, logger) { +async function downloadTrapCaches(codeql, languages, logger, repositoryRoot) { const result = {}; const languagesSupportingCaching = await getLanguagesSupportingCaching( codeql, @@ -150121,7 +150128,7 @@ async function downloadTrapCaches(codeql, languages, logger) { fs9.mkdirSync(cacheDir2, { recursive: true }); result[language] = cacheDir2; } - if (await isAnalyzingDefaultBranch()) { + if (await isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) { logger.info( "Analyzing default branch. Skipping downloading of TRAP caches." ); @@ -150160,7 +150167,9 @@ async function downloadTrapCaches(codeql, languages, logger) { return result; } async function uploadTrapCaches(codeql, config, logger) { - if (!await isAnalyzingDefaultBranch()) return false; + if (!await isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot)) { + return false; + } for (const language of config.languages) { const cacheDir2 = config.trapCaches[language]; if (cacheDir2 === void 0) continue; @@ -150196,6 +150205,7 @@ async function uploadTrapCaches(codeql, config, logger) { return true; } async function cleanupTrapCaches(config, features, logger) { + const env = getEnv(); if (!await features.getValue("cleanup_trap_caches" /* CleanupTrapCaches */)) { return { trap_cache_cleanup_skipped_because: "feature disabled" @@ -150204,7 +150214,7 @@ async function cleanupTrapCaches(config, features, logger) { logger.warning( "TRAP cache cleanup is deprecated and will be removed in May 2026. We recommend instead disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action." ); - if (!await isAnalyzingDefaultBranch()) { + if (!await isAnalyzingDefaultBranch(env, config.repositoryRoot)) { return { trap_cache_cleanup_skipped_because: "not analyzing default branch" }; @@ -150213,7 +150223,7 @@ async function cleanupTrapCaches(config, features, logger) { let totalBytesCleanedUp = 0; const allCaches = await listActionsCaches( CODEQL_TRAP_CACHE_PREFIX, - await getRef() + await getRef(env, config.repositoryRoot) ); for (const language of config.languages) { if (config.trapCaches[language]) { @@ -150505,9 +150515,14 @@ async function initActionState({ enableFileCoverageInformation }; } -async function downloadCacheWithTime(codeQL, languages, logger) { +async function downloadCacheWithTime(codeQL, languages, logger, repositoryRoot) { const start = import_perf_hooks2.performance.now(); - const trapCaches = await downloadTrapCaches(codeQL, languages, logger); + const trapCaches = await downloadTrapCaches( + codeQL, + languages, + logger, + repositoryRoot + ); const trapCacheDownloadTime = import_perf_hooks2.performance.now() - start; return { trapCaches, trapCacheDownloadTime }; } @@ -150705,7 +150720,7 @@ async function checkOverlayEnablement(codeql, features, languages, repositoryRoo logger.info( `Setting overlay database mode to ${overlayDatabaseMode} with caching because we are analyzing a pull request.` ); - } else if (await isAnalyzingDefaultBranch()) { + } else if (await isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) { overlayDatabaseMode = "overlay-base" /* OverlayBase */; logger.info( `Setting overlay database mode to ${overlayDatabaseMode} with caching because we are analyzing the default branch.` @@ -150992,7 +151007,8 @@ async function initConfig(actionState, inputs) { const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime( inputs.codeql, config.languages, - logger + logger, + repositoryRoot ); config.trapCaches = trapCaches; config.trapCacheDownloadTime = trapCacheDownloadTime; @@ -151455,7 +151471,7 @@ async function getCacheSaveKey(config, codeQlVersion, checkoutPath, logger) { `Failed to get workflow run ID or attempt ID. Reason: ${getErrorMessage(e)}` ); } - const sha = await getCommitOid(checkoutPath); + const sha = await getCommitOid(getEnv(), checkoutPath); const restoreKeyPrefix = await getCacheRestoreKeyPrefix( config, codeQlVersion @@ -153408,7 +153424,7 @@ async function getTrapCachingExtractorConfigArgs(config) { async function getTrapCachingExtractorConfigArgsForLang(config, language) { const cacheDir2 = config.trapCaches[language]; if (cacheDir2 === void 0) return []; - const write = await isAnalyzingDefaultBranch(); + const write = await isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot); return [ `-O=${language}.trap.cache.dir=${cacheDir2}`, `-O=${language}.trap.cache.bound=${TRAP_CACHE_SIZE_MB}`, @@ -154227,7 +154243,7 @@ async function cleanupAndUploadDatabases(action, repositoryNwo, codeql, config, logger.debug("Not running against github.com or GHEC-DR. Skipping upload."); return []; } - if (!await isAnalyzingDefaultBranch()) { + if (!await isAnalyzingDefaultBranch(action.env, checkoutPath)) { logger.debug("Not analyzing default branch. Skipping upload."); return []; } @@ -154244,7 +154260,7 @@ async function cleanupAndUploadDatabases(action, repositoryNwo, codeql, config, includeDiagnostics: false }); bundledDbSize = fs18.statSync(bundledDb).size; - const commitOid = await getCommitOid(checkoutPath); + const commitOid = await getCommitOid(action.env, checkoutPath); const maxAttempts = 4; let uploadDurationMs; for (let attempt = 1; attempt <= maxAttempts; attempt++) { @@ -156242,12 +156258,13 @@ async function uploadPostProcessedFiles(logger, checkoutPath, uploadTarget, post logger.debug(`Compressing serialized SARIF`); const zippedSarif = import_zlib.default.gzipSync(sarifPayload).toString("base64"); const checkoutURI = url.pathToFileURL(checkoutPath).href; + const env = getEnv(); const payload = uploadTarget.transformPayload( buildPayload( - await getCommitOid(checkoutPath), - await getRef(), + await getCommitOid(env, checkoutPath), + await getRef(env, checkoutPath), postProcessingResults.analysisKey, - getRequiredEnvParam("GITHUB_WORKFLOW"), + env.getRequired("GITHUB_WORKFLOW" /* GITHUB_WORKFLOW */), zippedSarif, getWorkflowRunID(), getWorkflowRunAttempt(), @@ -156723,7 +156740,7 @@ async function run(action) { checkoutPath ); databaseUploadResults = await cleanupAndUploadDatabases( - { logger, features }, + { ...action, features }, repositoryNwo, codeql, config, @@ -163024,6 +163041,7 @@ async function removeUploadedSarif(uploadFailedSarifResult, logger) { // src/init-action-post.ts async function run4(startedAt) { const logger = getActionsLogger(); + const env = getEnv(); let config; let uploadFailedSarifResult; let dependencyCachingUsage; @@ -163054,10 +163072,10 @@ async function run4(startedAt) { repositoryNwo, features, jobStatus2, - getEnv(), + env, logger ); - if (await isAnalyzingDefaultBranch() && config.dependencyCachingEnabled !== "none" /* None */) { + if (await isAnalyzingDefaultBranch(env, config.repositoryRoot) && config.dependencyCachingEnabled !== "none" /* None */) { dependencyCachingUsage = await getDependencyCacheUsage(logger); } } diff --git a/src/actions-util.ts b/src/actions-util.ts index 677bb04b1..da9127bde 100644 --- a/src/actions-util.ts +++ b/src/actions-util.ts @@ -94,7 +94,7 @@ export function getActionVersion(): string { * * This will be "dynamic" for default setup workflow runs. */ -export function getWorkflowEventName(env: Env = getEnv()) { +export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) { return env.getRequired(ActionsEnvVars.GITHUB_EVENT_NAME); } @@ -121,7 +121,7 @@ function getRelativeScriptPath(env: Env): string { } /** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */ -export function getWorkflowEvent(env: Env = getEnv()): any { +export function getWorkflowEvent(env: ReadOnlyEnv = getEnv()): any { const eventJsonFile = env.getRequired(ActionsEnvVars.GITHUB_EVENT_PATH); try { return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8")); diff --git a/src/analyze-action.ts b/src/analyze-action.ts index 8cc13c1ba..25d62c293 100644 --- a/src/analyze-action.ts +++ b/src/analyze-action.ts @@ -406,7 +406,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { // Note: Take care with the ordering of this call since databases may be cleaned up // at the `overlay` or `clear` level. databaseUploadResults = await cleanupAndUploadDatabases( - { logger, features }, + { ...action, features }, repositoryNwo, codeql, config, diff --git a/src/codeql.ts b/src/codeql.ts index 65e73d945..66d387ba4 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -1212,7 +1212,7 @@ export async function getTrapCachingExtractorConfigArgsForLang( ): Promise { const cacheDir = config.trapCaches[language]; if (cacheDir === undefined) return []; - const write = await isAnalyzingDefaultBranch(); + const write = await isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot); return [ `-O=${language}.trap.cache.dir=${cacheDir}`, `-O=${language}.trap.cache.bound=${TRAP_CACHE_SIZE_MB}`, diff --git a/src/config-utils.ts b/src/config-utils.ts index 37337b68d..3c4970c72 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -46,7 +46,7 @@ import { makeTelemetryDiagnostic, } from "./diagnostics"; import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils"; -import { EnvVar } from "./environment"; +import { EnvVar, getEnv } from "./environment"; import * as errorMessages from "./error-messages"; import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags"; import { @@ -467,12 +467,18 @@ async function downloadCacheWithTime( codeQL: CodeQL, languages: Language[], logger: Logger, + repositoryRoot: string | undefined, ): Promise<{ trapCaches: { [language: string]: string }; trapCacheDownloadTime: number; }> { const start = performance.now(); - const trapCaches = await downloadTrapCaches(codeQL, languages, logger); + const trapCaches = await downloadTrapCaches( + codeQL, + languages, + logger, + repositoryRoot, + ); const trapCacheDownloadTime = performance.now() - start; return { trapCaches, trapCacheDownloadTime }; } @@ -824,7 +830,7 @@ export async function checkOverlayEnablement( `Setting overlay database mode to ${overlayDatabaseMode} ` + "with caching because we are analyzing a pull request.", ); - } else if (await isAnalyzingDefaultBranch()) { + } else if (await isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) { overlayDatabaseMode = OverlayDatabaseMode.OverlayBase; logger.info( `Setting overlay database mode to ${overlayDatabaseMode} ` + @@ -1305,6 +1311,7 @@ export async function initConfig( inputs.codeql, config.languages, logger, + repositoryRoot, ); config.trapCaches = trapCaches; config.trapCacheDownloadTime = trapCacheDownloadTime; diff --git a/src/database-upload.ts b/src/database-upload.ts index 9e4339fd4..35dfd9078 100644 --- a/src/database-upload.ts +++ b/src/database-upload.ts @@ -46,7 +46,7 @@ export interface DatabaseUploadResult { } export async function cleanupAndUploadDatabases( - action: ActionState<["Logger", "FeatureFlags"]>, + action: ActionState<["ReadOnlyEnv", "Logger", "FeatureFlags"]>, repositoryNwo: RepositoryNwo, codeql: CodeQL, config: Config, @@ -81,7 +81,7 @@ export async function cleanupAndUploadDatabases( return []; } - if (!(await gitUtils.isAnalyzingDefaultBranch())) { + if (!(await gitUtils.isAnalyzingDefaultBranch(action.env, checkoutPath))) { // We only want to upload a database if we are analyzing the default branch. logger.debug("Not analyzing default branch. Skipping upload."); return []; @@ -113,7 +113,7 @@ export async function cleanupAndUploadDatabases( includeDiagnostics: false, }); bundledDbSize = fs.statSync(bundledDb).size; - const commitOid = await gitUtils.getCommitOid(checkoutPath); + const commitOid = await gitUtils.getCommitOid(action.env, checkoutPath); // Upload with manual retry logic. We disable Octokit's built-in retries // because the request body is a ReadStream, which can only be consumed // once. diff --git a/src/environment.ts b/src/environment.ts index bf4bb4f71..90a9d4358 100644 --- a/src/environment.ts +++ b/src/environment.ts @@ -307,6 +307,13 @@ export class Env< this.changed = true; } + /** Sets all environment variables given by `vars`. */ + public setAll(vars: Record): void { + for (const [key, val] of Object.entries(vars)) { + this.set(key, val); + } + } + /** Gets a value indicating whether `set` was called at least once. */ public hasChanged(): boolean { return this.changed; diff --git a/src/git-utils.test.ts b/src/git-utils.test.ts index b77d40a7e..8679f49a7 100644 --- a/src/git-utils.test.ts +++ b/src/git-utils.test.ts @@ -7,31 +7,36 @@ import test from "ava"; import * as sinon from "sinon"; import * as actionsUtil from "./actions-util"; +import { ActionsEnvVars, EnvVar } from "./environment"; import * as gitUtils from "./git-utils"; -import { setupActionsVars, setupTests } from "./testing-utils"; +import { getTestEnv, setupActionsVars, setupTests } from "./testing-utils"; import { withTmpDir } from "./util"; setupTests(test); -test.serial("getRef() throws on the empty string", async (t) => { - process.env["GITHUB_REF"] = ""; - await t.throwsAsync(gitUtils.getRef); +test("getRef() throws on the empty string", async (t) => { + const env = getTestEnv({ [ActionsEnvVars.GITHUB_REF]: "" }); + await t.throwsAsync(() => gitUtils.getRef(env, "")); }); test.serial( "getRef() returns merge PR ref if GITHUB_SHA still checked out", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); const expectedRef = "refs/pull/1/merge"; const currentSha = "a".repeat(40); - process.env["GITHUB_REF"] = expectedRef; - process.env["GITHUB_SHA"] = currentSha; + + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + env.setAll({ + [ActionsEnvVars.GITHUB_REF]: expectedRef, + [ActionsEnvVars.GITHUB_SHA]: currentSha, + }); const callback = sinon.stub(gitUtils, "getCommitOid"); - callback.withArgs("HEAD").resolves(currentSha); + callback.withArgs(sinon.match.any, "HEAD").resolves(currentSha); - const actualRef = await gitUtils.getRef(); + const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, expectedRef); }); }, @@ -41,17 +46,22 @@ test.serial( "getRef() returns merge PR ref if GITHUB_REF still checked out but sha has changed (actions checkout@v1)", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); const expectedRef = "refs/pull/1/merge"; - process.env["GITHUB_REF"] = expectedRef; - process.env["GITHUB_SHA"] = "b".repeat(40); + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + env.setAll({ + [ActionsEnvVars.GITHUB_REF]: expectedRef, + [ActionsEnvVars.GITHUB_SHA]: "b".repeat(40), + }); const sha = "a".repeat(40); const callback = sinon.stub(gitUtils, "getCommitOid"); - callback.withArgs("refs/remotes/pull/1/merge").resolves(sha); - callback.withArgs("HEAD").resolves(sha); + callback + .withArgs(sinon.match.any, "refs/remotes/pull/1/merge") + .resolves(sha); + callback.withArgs(sinon.match.any, "HEAD").resolves(sha); - const actualRef = await gitUtils.getRef(); + const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, expectedRef); }); }, @@ -61,15 +71,22 @@ test.serial( "getRef() returns head PR ref if GITHUB_REF no longer checked out", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); - process.env["GITHUB_REF"] = "refs/pull/1/merge"; - process.env["GITHUB_SHA"] = "a".repeat(40); + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + env.setAll({ + [ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge", + [ActionsEnvVars.GITHUB_SHA]: "a".repeat(40), + }); const callback = sinon.stub(gitUtils, "getCommitOid"); - callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("a".repeat(40)); - callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40)); + callback + .withArgs(sinon.match.any, tmpDir, "refs/pull/1/merge") + .resolves("a".repeat(40)); + callback + .withArgs(sinon.match.any, tmpDir, "HEAD") + .resolves("b".repeat(40)); - const actualRef = await gitUtils.getRef(); + const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, "refs/pull/1/head"); }); }, @@ -79,7 +96,6 @@ test.serial( "getRef() returns ref provided as an input and ignores current HEAD", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); const getAdditionalInputStub = sinon.stub( actionsUtil, "getOptionalInput", @@ -88,14 +104,20 @@ test.serial( getAdditionalInputStub.withArgs("sha").resolves("b".repeat(40)); // These values are be ignored - process.env["GITHUB_REF"] = "refs/pull/1/merge"; - process.env["GITHUB_SHA"] = "a".repeat(40); + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + env.setAll({ + [ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge", + [ActionsEnvVars.GITHUB_SHA]: "a".repeat(40), + }); const callback = sinon.stub(gitUtils, "getCommitOid"); - callback.withArgs("refs/pull/1/merge").resolves("b".repeat(40)); - callback.withArgs("HEAD").resolves("b".repeat(40)); + callback + .withArgs(sinon.match.any, "refs/pull/1/merge") + .resolves("b".repeat(40)); + callback.withArgs(sinon.match.any, "HEAD").resolves("b".repeat(40)); - const actualRef = await gitUtils.getRef(); + const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, "refs/pull/2/merge"); }); }, @@ -105,14 +127,17 @@ test.serial( "getRef() returns CODE_SCANNING_REF as a fallback for GITHUB_REF", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); const expectedRef = "refs/pull/1/HEAD"; const currentSha = "a".repeat(40); - process.env["CODE_SCANNING_REF"] = expectedRef; - process.env["GITHUB_REF"] = ""; - process.env["GITHUB_SHA"] = currentSha; + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + env.setAll({ + [EnvVar.CODE_SCANNING_REF]: expectedRef, + [ActionsEnvVars.GITHUB_REF]: "", + [ActionsEnvVars.GITHUB_SHA]: currentSha, + }); - const actualRef = await gitUtils.getRef(); + const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, expectedRef); }); }, @@ -122,14 +147,17 @@ test.serial( "getRef() returns GITHUB_REF over CODE_SCANNING_REF if both are provided", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); const expectedRef = "refs/pull/1/merge"; const currentSha = "a".repeat(40); - process.env["CODE_SCANNING_REF"] = "refs/pull/1/HEAD"; - process.env["GITHUB_REF"] = expectedRef; - process.env["GITHUB_SHA"] = currentSha; + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + env.setAll({ + [EnvVar.CODE_SCANNING_REF]: "refs/pull/1/HEAD", + [ActionsEnvVars.GITHUB_REF]: expectedRef, + [ActionsEnvVars.GITHUB_SHA]: currentSha, + }); - const actualRef = await gitUtils.getRef(); + const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, expectedRef); }); }, @@ -139,7 +167,9 @@ test.serial( "getRef() throws an error if only `ref` is provided as an input", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + const getAdditionalInputStub = sinon.stub( actionsUtil, "getOptionalInput", @@ -148,7 +178,7 @@ test.serial( await t.throwsAsync( async () => { - await gitUtils.getRef(); + await gitUtils.getRef(env, tmpDir); }, { instanceOf: Error, @@ -164,8 +194,12 @@ test.serial( "getRef() throws an error if only `sha` is provided as an input", async (t) => { await withTmpDir(async (tmpDir: string) => { - setupActionsVars(tmpDir, tmpDir); - process.env["GITHUB_WORKSPACE"] = "/tmp"; + const env = getTestEnv(); + setupActionsVars(tmpDir, tmpDir, {}, env); + env.setAll({ + [ActionsEnvVars.GITHUB_WORKSPACE]: "/tmp", + }); + const getAdditionalInputStub = sinon.stub( actionsUtil, "getOptionalInput", @@ -174,7 +208,7 @@ test.serial( await t.throwsAsync( async () => { - await gitUtils.getRef(); + await gitUtils.getRef(env, tmpDir); }, { instanceOf: Error, @@ -187,13 +221,16 @@ test.serial( ); test.serial("isAnalyzingDefaultBranch()", async (t) => { - process.env["GITHUB_EVENT_NAME"] = "push"; - process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "true"; - t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true); - process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "false"; + const env = getTestEnv({ + [ActionsEnvVars.GITHUB_EVENT_NAME]: "push", + CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: "true", + }); + t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, ""), true); + + env.set("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH", "false"); await withTmpDir(async (tmpDir) => { - setupActionsVars(tmpDir, tmpDir); + setupActionsVars(tmpDir, tmpDir, {}, env); const envFile = path.join(tmpDir, "event.json"); fs.writeFileSync( envFile, @@ -203,17 +240,17 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => { }, }), ); - process.env["GITHUB_EVENT_PATH"] = envFile; + env.set(ActionsEnvVars.GITHUB_EVENT_PATH, envFile); - process.env["GITHUB_REF"] = "main"; - process.env["GITHUB_SHA"] = "1234"; - t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true); + env.set(ActionsEnvVars.GITHUB_REF, "main"); + env.set(ActionsEnvVars.GITHUB_SHA, "1234"); + t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true); - process.env["GITHUB_REF"] = "refs/heads/main"; - t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true); + env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main"); + t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true); - process.env["GITHUB_REF"] = "feature"; - t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false); + env.set(ActionsEnvVars.GITHUB_REF, "feature"); + t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false); fs.writeFileSync( envFile, @@ -221,9 +258,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => { schedule: "0 0 * * *", }), ); - process.env["GITHUB_EVENT_NAME"] = "schedule"; - process.env["GITHUB_REF"] = "refs/heads/main"; - t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true); + env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule"); + env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main"); + t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true); const getAdditionalInputStub = sinon.stub(actionsUtil, "getOptionalInput"); getAdditionalInputStub @@ -232,9 +269,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => { getAdditionalInputStub .withArgs("sha") .resolves("0000000000000000000000000000000000000000"); - process.env["GITHUB_EVENT_NAME"] = "schedule"; - process.env["GITHUB_REF"] = "refs/heads/main"; - t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false); + env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule"); + env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main"); + t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false); }); }); diff --git a/src/git-utils.ts b/src/git-utils.ts index 0f5bf52a4..2e042e361 100644 --- a/src/git-utils.ts +++ b/src/git-utils.ts @@ -13,6 +13,7 @@ import { getWorkflowEvent, getWorkflowEventName, } from "./actions-util"; +import { ActionsEnvVars, EnvVar, type ReadOnlyEnv } from "./environment"; import { ConfigurationError, getRequiredEnvParam } from "./util"; /** @@ -101,6 +102,7 @@ export const runGitCommand = async function ( * Gets the SHA of the commit that is currently checked out. */ export const getCommitOid = async function ( + env: ReadOnlyEnv, checkoutPath: string, ref = "HEAD", ): Promise { @@ -119,7 +121,9 @@ export const getCommitOid = async function ( ); return stdout.trim(); } catch { - return getOptionalInput("sha") || getRequiredEnvParam("GITHUB_SHA"); + return ( + getOptionalInput("sha") || env.getRequired(ActionsEnvVars.GITHUB_SHA) + ); } }; @@ -314,18 +318,18 @@ export const getFileOidsUnderPath = async function ( return fileOidMap; }; -function getRefFromEnv(): string { +function getRefFromEnv(env: ReadOnlyEnv): string { // To workaround a limitation of Actions dynamic workflows not setting // the GITHUB_REF in some cases, we accept also the ref within the // CODE_SCANNING_REF variable. When possible, however, we prefer to use // the GITHUB_REF as that is a protected variable and cannot be overwritten. let refEnv: string; try { - refEnv = getRequiredEnvParam("GITHUB_REF"); + refEnv = env.getRequired(ActionsEnvVars.GITHUB_REF); } catch (e) { // If the GITHUB_REF is not set, we try to rescue by getting the // CODE_SCANNING_REF. - const maybeRef = process.env["CODE_SCANNING_REF"]; + const maybeRef = env.getOptional(EnvVar.CODE_SCANNING_REF); if (maybeRef === undefined || maybeRef.length === 0) { throw e; } @@ -337,15 +341,16 @@ function getRefFromEnv(): string { /** * Get the ref currently being analyzed. */ -export async function getRef(): Promise { +export async function getRef( + env: ReadOnlyEnv, + checkoutPath: string | undefined, +): Promise { // Will be in the form "refs/heads/master" on a push event // or in the form "refs/pull/N/merge" on a pull_request event const refInput = getOptionalInput("ref"); const shaInput = getOptionalInput("sha"); - const checkoutPath = - getOptionalInput("checkout_path") || - getOptionalInput("source-root") || - getRequiredEnvParam("GITHUB_WORKSPACE"); + checkoutPath = + checkoutPath ?? env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE); const hasRefInput = !!refInput; const hasShaInput = !!shaInput; @@ -356,8 +361,8 @@ export async function getRef(): Promise { ); } - const ref = refInput || getRefFromEnv(); - const sha = shaInput || getRequiredEnvParam("GITHUB_SHA"); + const ref = refInput || getRefFromEnv(env); + const sha = shaInput || env.getRequired(ActionsEnvVars.GITHUB_SHA); // If the ref is a user-provided input, we have to skip logic // and assume that it is really where they want to upload the results. @@ -374,7 +379,7 @@ export async function getRef(): Promise { return ref; } - const head = await getCommitOid(checkoutPath, "HEAD"); + const head = await getCommitOid(env, checkoutPath, "HEAD"); // in actions/checkout@v2+ we can check if git rev-parse HEAD == GITHUB_SHA // in actions/checkout@v1 this may not be true as it checks out the repository @@ -384,6 +389,7 @@ export async function getRef(): Promise { const hasChangedRef = sha !== head && (await getCommitOid( + env, checkoutPath, ref.replace(/^refs\/pull\//, "refs/remotes/pull/"), )) !== head; @@ -410,20 +416,23 @@ function removeRefsHeadsPrefix(ref: string): string { * environment variable can be set in cases where repository information might not be available, for * example dynamic workflows. */ -export async function isAnalyzingDefaultBranch(): Promise { - if (process.env.CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH === "true") { +export async function isAnalyzingDefaultBranch( + env: ReadOnlyEnv, + checkoutPath: string | undefined, +): Promise { + if (env.getOptional("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH") === "true") { return true; } // Get the current ref and trim and refs/heads/ prefix - let currentRef = await getRef(); + let currentRef = await getRef(env, checkoutPath); currentRef = removeRefsHeadsPrefix(currentRef); - const event = getWorkflowEvent(); + const event = getWorkflowEvent(env); let defaultBranch = event?.repository?.default_branch; - if (getWorkflowEventName() === "schedule") { - defaultBranch = removeRefsHeadsPrefix(getRefFromEnv()); + if (getWorkflowEventName(env) === "schedule") { + defaultBranch = removeRefsHeadsPrefix(getRefFromEnv(env)); } return currentRef === defaultBranch; diff --git a/src/init-action-post.ts b/src/init-action-post.ts index 749020ac6..985538b8a 100644 --- a/src/init-action-post.ts +++ b/src/init-action-post.ts @@ -50,6 +50,7 @@ async function run(startedAt: Date) { // possible, and only use safe functions outside. const logger = getActionsLogger(); + const env = getEnv(); let config: Config | undefined; let uploadFailedSarifResult: | initActionPostHelper.UploadFailedSarifResult @@ -91,7 +92,7 @@ async function run(startedAt: Date) { repositoryNwo, features, jobStatus, - getEnv(), + env, logger, ); @@ -100,7 +101,7 @@ async function run(startedAt: Date) { // do this under these circumstances to avoid slowing down analyses for PRs // and where caching may not be enabled. if ( - (await gitUtils.isAnalyzingDefaultBranch()) && + (await gitUtils.isAnalyzingDefaultBranch(env, config.repositoryRoot)) && config.dependencyCachingEnabled !== CachingKind.None ) { dependencyCachingUsage = await getDependencyCacheUsage(logger); diff --git a/src/overlay/caching.ts b/src/overlay/caching.ts index d24662678..9b5906dde 100644 --- a/src/overlay/caching.ts +++ b/src/overlay/caching.ts @@ -15,6 +15,7 @@ import { CleanupLevel, getBaseDatabaseOidsFilePath, getCodeQLDatabasePath, + getEnv, getErrorMessage, isInTestMode, tryGetFolderBytes, @@ -377,7 +378,7 @@ export async function getCacheSaveKey( `Failed to get workflow run ID or attempt ID. Reason: ${getErrorMessage(e)}`, ); } - const sha = await getCommitOid(checkoutPath); + const sha = await getCommitOid(getEnv(), checkoutPath); const restoreKeyPrefix = await getCacheRestoreKeyPrefix( config, codeQlVersion, diff --git a/src/status-report.ts b/src/status-report.ts index c392b5192..fa26d049e 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -366,7 +366,7 @@ export async function createStatusReportBase( try { const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || ""; - const ref = await getRef(); + const ref = await getRef(getEnv(), config?.repositoryRoot); const jobRunUUID = process.env[EnvVar.JOB_RUN_UUID] || ""; const workflowRunID = getWorkflowRunID(); const workflowRunAttempt = getWorkflowRunAttempt(); diff --git a/src/trap-caching.test.ts b/src/trap-caching.test.ts index 478305e57..15ab49481 100644 --- a/src/trap-caching.test.ts +++ b/src/trap-caching.test.ts @@ -182,6 +182,7 @@ test.serial( stubCodeql, [BuiltInLanguage.javascript, BuiltInLanguage.cpp], logger, + undefined, ); t.assert( stubRestore.calledOnceWith( diff --git a/src/trap-caching.ts b/src/trap-caching.ts index a802aac89..fbcd9951b 100644 --- a/src/trap-caching.ts +++ b/src/trap-caching.ts @@ -14,6 +14,7 @@ import { Language } from "./languages"; import { Logger } from "./logging"; import { asHTTPError, + getEnv, getErrorMessage, tryGetFolderBytes, waitForResultWithTimeLimit, @@ -43,6 +44,7 @@ const MAX_CACHE_OPERATION_MS = 120_000; // Two minutes * @param codeql The CodeQL instance to use. * @param languages The languages being analyzed. * @param logger A logger to record some informational messages to. + * @param repositoryRoot The path at which the repository is checked out at. * @returns A partial map from languages to TRAP cache paths on disk, with * languages for which we shouldn't use TRAP caching omitted. */ @@ -50,6 +52,7 @@ export async function downloadTrapCaches( codeql: CodeQL, languages: Language[], logger: Logger, + repositoryRoot: string | undefined, ): Promise<{ [language: string]: string }> { const result: { [language: string]: string } = {}; const languagesSupportingCaching = await getLanguagesSupportingCaching( @@ -72,7 +75,7 @@ export async function downloadTrapCaches( result[language] = cacheDir; } - if (await gitUtils.isAnalyzingDefaultBranch()) { + if (await gitUtils.isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) { logger.info( "Analyzing default branch. Skipping downloading of TRAP caches.", ); @@ -132,7 +135,12 @@ export async function uploadTrapCaches( config: Config, logger: Logger, ): Promise { - if (!(await gitUtils.isAnalyzingDefaultBranch())) return false; // Only upload caches from the default branch + // Only upload caches from the default branch + if ( + !(await gitUtils.isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot)) + ) { + return false; + } for (const language of config.languages) { const cacheDir = config.trapCaches[language]; @@ -180,6 +188,8 @@ export async function cleanupTrapCaches( features: FeatureEnablement, logger: Logger, ): Promise { + const env = getEnv(); + if (!(await features.getValue(Feature.CleanupTrapCaches))) { return { trap_cache_cleanup_skipped_because: "feature disabled", @@ -189,7 +199,7 @@ export async function cleanupTrapCaches( "TRAP cache cleanup is deprecated and will be removed in May 2026. " + "We recommend instead disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action.", ); - if (!(await gitUtils.isAnalyzingDefaultBranch())) { + if (!(await gitUtils.isAnalyzingDefaultBranch(env, config.repositoryRoot))) { return { trap_cache_cleanup_skipped_because: "not analyzing default branch", }; @@ -200,7 +210,7 @@ export async function cleanupTrapCaches( const allCaches = await apiClient.listActionsCaches( CODEQL_TRAP_CACHE_PREFIX, - await gitUtils.getRef(), + await gitUtils.getRef(env, config.repositoryRoot), ); for (const language of config.languages) { diff --git a/src/upload-lib.ts b/src/upload-lib.ts index da5552cf2..e323ae73f 100644 --- a/src/upload-lib.ts +++ b/src/upload-lib.ts @@ -14,7 +14,7 @@ import { getGitHubVersion, wrapApiConfigurationError } from "./api-client"; import { CodeQL, getCodeQL } from "./codeql"; import { getConfig } from "./config-utils"; import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils"; -import { EnvVar } from "./environment"; +import { ActionsEnvVars, EnvVar } from "./environment"; import { FeatureEnablement } from "./feature-flags"; import * as fingerprints from "./fingerprints"; import * as gitUtils from "./git-utils"; @@ -761,12 +761,13 @@ export async function uploadPostProcessedFiles( const zippedSarif = zlib.gzipSync(sarifPayload).toString("base64"); const checkoutURI = url.pathToFileURL(checkoutPath).href; + const env = util.getEnv(); const payload = uploadTarget.transformPayload( buildPayload( - await gitUtils.getCommitOid(checkoutPath), - await gitUtils.getRef(), + await gitUtils.getCommitOid(env, checkoutPath), + await gitUtils.getRef(env, checkoutPath), postProcessingResults.analysisKey, - util.getRequiredEnvParam("GITHUB_WORKFLOW"), + env.getRequired(ActionsEnvVars.GITHUB_WORKFLOW), zippedSarif, actionsUtil.getWorkflowRunID(), actionsUtil.getWorkflowRunAttempt(), From f5716fadf424f3d54ef11acb4fcb594ec749a006 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 22 Sep 2026 12:09:16 +0100 Subject: [PATCH 05/58] Allow `getCheckoutPathInputOrThrow` to get root from config --- lib/entry-points.js | 29 +++++--- src/init-action-post-helper.ts | 12 +++- src/workflow.test.ts | 125 ++++++++++++++++++++++++++++++++- src/workflow.ts | 33 +++++++-- 4 files changed, 180 insertions(+), 19 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dc209ae62..21b19f520 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -162185,14 +162185,20 @@ function getUploadInputOrThrow(workflow, jobName, matrixVars) { matrixVars ); } -function getCheckoutPathInputOrThrow(workflow, jobName, matrixVars) { - return getInputOrThrow( - workflow, - jobName, - getAnalyzeActionName(), - "checkout_path", - matrixVars - ) || getRequiredEnvParam("GITHUB_WORKSPACE"); +function getRepositoryRootOrThrow(workflow, jobName, matrixVars, config, env = getEnv()) { + return ( + // If the CodeQL Action already has a persisted repository root, then we can just use that. + config.repositoryRoot ?? // Otherwise, try to retrieve it from a `checkout_path` input in the workflow specification. + getInputOrThrow( + workflow, + jobName, + getAnalyzeActionName(), + "checkout_path", + matrixVars + ) ?? // Finally, if all of the above fail, just use the value of `GITHUB_WORKSPACE` since that + // is what is used by default. + env.getRequired("GITHUB_WORKSPACE" /* GITHUB_WORKSPACE */) + ); } async function checkWorkflow(logger, codeql) { if (!isDynamicWorkflow() && process.env["CODEQL_ACTION_SKIP_WORKFLOW_VALIDATION" /* SKIP_WORKFLOW_VALIDATION */] !== "true") { @@ -162763,7 +162769,12 @@ async function prepareFailedSarif(logger, features, config) { }); } const category = getCategoryInputOrThrow(workflow, jobName, matrix); - const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); + const checkoutPath = getRepositoryRootOrThrow( + workflow, + jobName, + matrix, + config + ); const result = await generateFailedSarif( logger, features, diff --git a/src/init-action-post-helper.ts b/src/init-action-post-helper.ts index 0e6dae13a..f4333cf68 100644 --- a/src/init-action-post-helper.ts +++ b/src/init-action-post-helper.ts @@ -44,7 +44,7 @@ import { } from "./util"; import { getCategoryInputOrThrow, - getCheckoutPathInputOrThrow, + getRepositoryRootOrThrow, getUploadInputOrThrow, getWorkflow, } from "./workflow"; @@ -144,7 +144,15 @@ async function prepareFailedSarif( }); } const category = getCategoryInputOrThrow(workflow, jobName, matrix); - const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); + + // Try to determine the path at which the repository that we failed to analyse is checked out at. + // We need this to relativise the paths in the SARIF. + const checkoutPath = getRepositoryRootOrThrow( + workflow, + jobName, + matrix, + config, + ); const result = await generateFailedSarif( logger, diff --git a/src/workflow.test.ts b/src/workflow.test.ts index c7f168a9d..2373e8bd1 100644 --- a/src/workflow.test.ts +++ b/src/workflow.test.ts @@ -4,10 +4,12 @@ import * as sinon from "sinon"; import * as actionsUtil from "./actions-util"; import { createStubCodeQL, getCodeQLForTesting } from "./codeql"; -import { EnvVar } from "./environment"; +import { ActionsEnvVars, EnvVar } from "./environment"; import { checkExpectedLogMessages, + createTestConfig, getRecordingLogger, + getTestEnv, LoggedMessage, setupTests, } from "./testing-utils"; @@ -1002,3 +1004,124 @@ test.serial( t.is(messages.length, 0); }, ); + +test("getRepositoryRootOrThrow - gets root from config", async (t) => { + const expectedRoot = "/path/to/root"; + const repositoryRoot = workflow.getRepositoryRootOrThrow( + {}, + "testJob", + {}, + createTestConfig({ repositoryRoot: expectedRoot }), + getTestEnv(), + ); + + t.is(repositoryRoot, expectedRoot); +}); + +test("getRepositoryRootOrThrow - gets root from workflow", async (t) => { + const expectedRoot = "/path/to/root"; + const repositoryRoot = workflow.getRepositoryRootOrThrow( + { + jobs: { + testJob: { + steps: [ + { + uses: "github/codeql-action/analyze", + with: { checkout_path: expectedRoot }, + }, + ], + }, + }, + }, + "testJob", + {}, + createTestConfig({}), + getTestEnv(), + ); + + t.is(repositoryRoot, expectedRoot); +}); + +test("getRepositoryRootOrThrow - gets root from environment", async (t) => { + const expectedRoot = "/path/to/root"; + const repositoryRoot = workflow.getRepositoryRootOrThrow( + { + jobs: { testJob: { steps: [{ uses: "github/codeql-action/analyze" }] } }, + }, + "testJob", + {}, + createTestConfig({}), + getTestEnv({ [ActionsEnvVars.GITHUB_WORKSPACE]: expectedRoot }), + ); + + t.is(repositoryRoot, expectedRoot); +}); + +test("getRepositoryRootOrThrow - throws if there's no matching job", async (t) => { + t.throws( + () => + workflow.getRepositoryRootOrThrow( + { + jobs: { + otherJob: { + steps: [ + { + uses: "github/codeql-action/analyze", + with: { checkout_path: "/some/path" }, + }, + ], + }, + }, + }, + "testJob", + {}, + createTestConfig({}), + getTestEnv(), + ), + { message: /since the workflow has no job named testJob./ }, + ); +}); + +test("getRepositoryRootOrThrow - throws if there's no analyze step", async (t) => { + t.throws( + () => + workflow.getRepositoryRootOrThrow( + { + jobs: { + testJob: { steps: [] }, + }, + }, + "testJob", + {}, + createTestConfig({}), + getTestEnv(), + ), + { message: /since the testJob job does not call/ }, + ); +}); + +test("getRepositoryRootOrThrow - throws if the env var is not set", async (t) => { + t.throws( + () => + workflow.getRepositoryRootOrThrow( + { + jobs: { + testJob: { + steps: [ + { + uses: "github/codeql-action/analyze", + }, + ], + }, + }, + }, + "testJob", + {}, + createTestConfig({}), + getTestEnv(), + ), + { + message: `${ActionsEnvVars.GITHUB_WORKSPACE} environment variable must be set`, + }, + ); +}); diff --git a/src/workflow.ts b/src/workflow.ts index 151cfd5c5..dd810f3a0 100644 --- a/src/workflow.ts +++ b/src/workflow.ts @@ -8,7 +8,8 @@ import * as yaml from "js-yaml"; import { isDynamicWorkflow } from "./actions-util"; import * as api from "./api-client"; import { CodeQL } from "./codeql"; -import { EnvVar } from "./environment"; +import type { Config } from "./config-utils"; +import { ActionsEnvVars, EnvVar, getEnv, ReadOnlyEnv } from "./environment"; import { Logger } from "./logging"; import { getRequiredEnvParam, @@ -441,27 +442,45 @@ export function getUploadInputOrThrow( } /** - * Makes a best effort attempt to retrieve the checkout_path input for the - * particular job, given a set of matrix variables. + * Makes a best effort attempt to determine the root path of the repository that the analysis + * relates to. We need that to make paths in SARIF files relative. + * + * - If available, we take the `repositoryRoot` from the `config`. + * - If it isn't, we fall back to trying to extract a `checkout_path` input from the `workflow`. + * - Finally, we fall back to the value of `GITHUB_WORKSPACE`. * * Typically you'll want to wrap this function in a try/catch block and handle the error. * - * @returns the checkout_path input - * @throws an error if the checkout_path input could not be determined + * @param workflow The workflow specification of the currently running workflow. + * @param jobName The name of the job that is currently running. + * @param matrixVars The matrix variables, if any. + * @param config The CodeQL Action configuration state. + * @param env The environment variables. + * + * @returns The repository root path, or its best approximation. + * @throws `Error` if the repository root could not be determined. */ -export function getCheckoutPathInputOrThrow( +export function getRepositoryRootOrThrow( workflow: Workflow, jobName: string, matrixVars: { [key: string]: string } | undefined, + config: Config, + env: ReadOnlyEnv = getEnv(), ): string { return ( + // If the CodeQL Action already has a persisted repository root, then we can just use that. + config.repositoryRoot ?? + // Otherwise, try to retrieve it from a `checkout_path` input in the workflow specification. getInputOrThrow( workflow, jobName, getAnalyzeActionName(), "checkout_path", matrixVars, - ) || getRequiredEnvParam("GITHUB_WORKSPACE") // if unspecified, checkout_path defaults to ${{ github.workspace }} + ) ?? + // Finally, if all of the above fail, just use the value of `GITHUB_WORKSPACE` since that + // is what is used by default. + env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE) ); } From 6fb4a88ed6ee94bc0e8d2491d745a439eff1ce9d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 22 Sep 2026 12:32:16 +0100 Subject: [PATCH 06/58] Normalise the results of `getGitRoot` --- lib/entry-points.js | 2 +- src/git-utils.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 21b19f520..61524b070 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147111,7 +147111,7 @@ var getGitRoot = async function(sourceRoot) { ["rev-parse", "--show-toplevel"], `Cannot find Git repository root from the source root ${sourceRoot}.` ); - return stdout.trim(); + return path4.normalize(stdout.trim()); } catch { return void 0; } diff --git a/src/git-utils.ts b/src/git-utils.ts index 2e042e361..da1189035 100644 --- a/src/git-utils.ts +++ b/src/git-utils.ts @@ -245,7 +245,7 @@ export const getGitRoot = async function ( ["rev-parse", "--show-toplevel"], `Cannot find Git repository root from the source root ${sourceRoot}.`, ); - return stdout.trim(); + return path.normalize(stdout.trim()); } catch { // Errors are already logged by runGitCommand() return undefined; From a876e23075cbbc1aa1f5a0a1adc3e71e9e00edac Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 22 Sep 2026 13:17:05 +0100 Subject: [PATCH 07/58] Add tests for `determineCheckoutPath` --- src/analyze.test.ts | 88 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) diff --git a/src/analyze.test.ts b/src/analyze.test.ts index 7523d239b..88e592507 100644 --- a/src/analyze.test.ts +++ b/src/analyze.test.ts @@ -11,9 +11,11 @@ import { resolveQuerySuiteAlias, addSarifExtension, diffRangeExtensionPackContents, + determineCheckoutPath, } from "./analyze"; import { createStubCodeQL } from "./codeql"; import { Feature } from "./feature-flags"; +import * as gitUtils from "./git-utils"; import { BuiltInLanguage } from "./languages"; import { getRunnerLogger } from "./logging"; import { @@ -21,12 +23,98 @@ import { setupActionsVars, createFeatures, createTestConfig, + callee, } from "./testing-utils"; import * as uploadLib from "./upload-lib"; import * as util from "./util"; setupTests(test); +test.serial( + "determineCheckoutPath - logs when checkout_path is not in a work tree", + async (t) => { + const expectedPath = "/checkout/path"; + const target = callee(determineCheckoutPath) + .withActions((actions) => { + sinon + .stub(actions, "getRequiredInput") + .withArgs("checkout_path") + .returns("/checkout/path"); + }) + .withArgs(createTestConfig({})); + sinon.stub(gitUtils, "getGitRoot").resolves(undefined); + + await target + .logs(t, "is not in the work tree of a git repository") + .passes(t.is, expectedPath); + }, +); + +test.serial( + "determineCheckoutPath - logs when checkout_path is not a repo root", + async (t) => { + const expectedPath = "/checkout/path"; + const target = callee(determineCheckoutPath) + .withActions((actions) => { + sinon + .stub(actions, "getRequiredInput") + .withArgs("checkout_path") + .returns("/checkout/path"); + }) + .withArgs(createTestConfig({})); + sinon.stub(gitUtils, "getGitRoot").resolves("/checkout"); + + await target + .logs(t, "is not the root of the repository") + .passes(t.is, expectedPath); + }, +); + +test.serial( + "determineCheckoutPath - logs when checkout_path is not the same as repo root in config", + async (t) => { + const expectedPath = "/checkout/path"; + const target = callee(determineCheckoutPath) + .withActions((actions) => { + sinon + .stub(actions, "getRequiredInput") + .withArgs("checkout_path") + .returns("/checkout/path"); + }) + .withArgs(createTestConfig({ repositoryRoot: "/some/other/path" })); + sinon.stub(gitUtils, "getGitRoot").resolves("/checkout/path"); + + await target + .logs(t, "does not match that found by the 'codeql-action/init' step") + .passes(t.is, expectedPath); + }, +); + +test.serial( + "determineCheckoutPath - doesn't log any of the messages when all is as expected", + async (t) => { + const expectedPath = "/checkout/path"; + const target = callee(determineCheckoutPath) + .withActions((actions) => { + sinon + .stub(actions, "getRequiredInput") + .withArgs("checkout_path") + .returns("/checkout/path"); + }) + .withArgs(createTestConfig({ repositoryRoot: "/checkout/path" })); + sinon.stub(gitUtils, "getGitRoot").resolves("/checkout/path"); + + await target + .notLogs( + t, + "is not in the work tree of a git repository", + "is not the root of the repository", + "does not match that found by the 'codeql-action/init' step", + ) + .passes(t.is, expectedPath); + }, +); + /** * Checks the status report produced by the analyze Action. * From 72509a81baf838ee8e5ca4ada26a136ca380ce2b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 22 Sep 2026 16:25:29 +0100 Subject: [PATCH 08/58] Consistently use resolved path --- lib/entry-points.js | 1005 ++++++++++++++++++++++--------------------- src/analyze.test.ts | 22 +- src/analyze.ts | 11 +- src/git-utils.ts | 2 +- 4 files changed, 521 insertions(+), 519 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 61524b070..038cc085a 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -2384,9 +2384,9 @@ var require_dispatcher_base = __commonJS({ } close(callback) { if (callback === void 0) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { this.close((err, data) => { - return err ? reject(err) : resolve14(data); + return err ? reject(err) : resolve15(data); }); }); } @@ -2424,12 +2424,12 @@ var require_dispatcher_base = __commonJS({ err = null; } if (callback === void 0) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { this.destroy(err, (err2, data) => { return err2 ? ( /* istanbul ignore next: should never error */ reject(err2) - ) : resolve14(data); + ) : resolve15(data); }); }); } @@ -4696,8 +4696,8 @@ var require_util2 = __commonJS({ function createDeferredPromise() { let res; let rej; - const promise = new Promise((resolve14, reject) => { - res = resolve14; + const promise = new Promise((resolve15, reject) => { + res = resolve15; rej = reject; }); return { promise, resolve: res, reject: rej }; @@ -6943,12 +6943,12 @@ upgrade: ${upgrade}\r cb(); } } - const waitForDrain = () => new Promise((resolve14, reject) => { + const waitForDrain = () => new Promise((resolve15, reject) => { assert(callback === null); if (socket[kError]) { reject(socket[kError]); } else { - callback = resolve14; + callback = resolve15; } }); socket.on("close", onDrain).on("drain", onDrain); @@ -7585,12 +7585,12 @@ var require_client_h2 = __commonJS({ cb(); } } - const waitForDrain = () => new Promise((resolve14, reject) => { + const waitForDrain = () => new Promise((resolve15, reject) => { assert(callback === null); if (socket[kError]) { reject(socket[kError]); } else { - callback = resolve14; + callback = resolve15; } }); h2stream.on("close", onDrain).on("drain", onDrain); @@ -8068,16 +8068,16 @@ var require_client = __commonJS({ return this[kNeedDrain] < 2; } async [kClose]() { - return new Promise((resolve14) => { + return new Promise((resolve15) => { if (this[kSize]) { - this[kClosedResolve] = resolve14; + this[kClosedResolve] = resolve15; } else { - resolve14(null); + resolve15(null); } }); } async [kDestroy](err) { - return new Promise((resolve14) => { + return new Promise((resolve15) => { const requests = this[kQueue].splice(this[kPendingIdx]); for (let i = 0; i < requests.length; i++) { const request3 = requests[i]; @@ -8088,7 +8088,7 @@ var require_client = __commonJS({ this[kClosedResolve](); this[kClosedResolve] = null; } - resolve14(null); + resolve15(null); }; if (this[kHTTPContext]) { this[kHTTPContext].destroy(err, callback); @@ -8139,7 +8139,7 @@ var require_client = __commonJS({ }); } try { - const socket = await new Promise((resolve14, reject) => { + const socket = await new Promise((resolve15, reject) => { client[kConnector]({ host, hostname, @@ -8151,7 +8151,7 @@ var require_client = __commonJS({ if (err) { reject(err); } else { - resolve14(socket2); + resolve15(socket2); } }); }); @@ -8487,8 +8487,8 @@ var require_pool_base = __commonJS({ if (this[kQueue].isEmpty()) { await Promise.all(this[kClients].map((c) => c.close())); } else { - await new Promise((resolve14) => { - this[kClosedResolve] = resolve14; + await new Promise((resolve15) => { + this[kClosedResolve] = resolve15; }); } } @@ -9731,7 +9731,7 @@ var require_readable = __commonJS({ if (this._readableState.closeEmitted) { return null; } - return await new Promise((resolve14, reject) => { + return await new Promise((resolve15, reject) => { if (this[kContentLength] > limit) { this.destroy(new AbortError()); } @@ -9744,7 +9744,7 @@ var require_readable = __commonJS({ if (signal?.aborted) { reject(signal.reason ?? new AbortError()); } else { - resolve14(null); + resolve15(null); } }).on("error", noop3).on("data", function(chunk) { limit -= chunk.length; @@ -9763,7 +9763,7 @@ var require_readable = __commonJS({ } async function consume(stream2, type) { assert(!stream2[kConsume]); - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { if (isUnusable(stream2)) { const rState = stream2._readableState; if (rState.destroyed && rState.closeEmitted === false) { @@ -9780,7 +9780,7 @@ var require_readable = __commonJS({ stream2[kConsume] = { type, stream: stream2, - resolve: resolve14, + resolve: resolve15, reject, length: 0, body: [] @@ -9850,18 +9850,18 @@ var require_readable = __commonJS({ return buffer; } function consumeEnd(consume2) { - const { type, body, resolve: resolve14, stream: stream2, length } = consume2; + const { type, body, resolve: resolve15, stream: stream2, length } = consume2; try { if (type === "text") { - resolve14(chunksDecode(body, length)); + resolve15(chunksDecode(body, length)); } else if (type === "json") { - resolve14(JSON.parse(chunksDecode(body, length))); + resolve15(JSON.parse(chunksDecode(body, length))); } else if (type === "arrayBuffer") { - resolve14(chunksConcat(body, length).buffer); + resolve15(chunksConcat(body, length).buffer); } else if (type === "blob") { - resolve14(new Blob(body, { type: stream2[kContentType] })); + resolve15(new Blob(body, { type: stream2[kContentType] })); } else if (type === "bytes") { - resolve14(chunksConcat(body, length)); + resolve15(chunksConcat(body, length)); } consumeFinish(consume2); } catch (err) { @@ -10118,9 +10118,9 @@ var require_api_request = __commonJS({ }; function request3(opts, callback) { if (callback === void 0) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { request3.call(this, opts, (err, data) => { - return err ? reject(err) : resolve14(data); + return err ? reject(err) : resolve15(data); }); }); } @@ -10343,9 +10343,9 @@ var require_api_stream = __commonJS({ }; function stream2(opts, factory, callback) { if (callback === void 0) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { stream2.call(this, opts, factory, (err, data) => { - return err ? reject(err) : resolve14(data); + return err ? reject(err) : resolve15(data); }); }); } @@ -10630,9 +10630,9 @@ var require_api_upgrade = __commonJS({ }; function upgrade(opts, callback) { if (callback === void 0) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { upgrade.call(this, opts, (err, data) => { - return err ? reject(err) : resolve14(data); + return err ? reject(err) : resolve15(data); }); }); } @@ -10724,9 +10724,9 @@ var require_api_connect = __commonJS({ }; function connect(opts, callback) { if (callback === void 0) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { connect.call(this, opts, (err, data) => { - return err ? reject(err) : resolve14(data); + return err ? reject(err) : resolve15(data); }); }); } @@ -14588,7 +14588,7 @@ var require_fetch = __commonJS({ function dispatch({ body }) { const url2 = requestCurrentURL(request3); const agent = fetchParams.controller.dispatcher; - return new Promise((resolve14, reject) => agent.dispatch( + return new Promise((resolve15, reject) => agent.dispatch( { path: url2.pathname + url2.search, origin: url2.origin, @@ -14664,7 +14664,7 @@ var require_fetch = __commonJS({ } } const onError = this.onError.bind(this); - resolve14({ + resolve15({ status, statusText, headersList, @@ -14710,7 +14710,7 @@ var require_fetch = __commonJS({ for (let i = 0; i < rawHeaders.length; i += 2) { headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i]), rawHeaders[i + 1].toString("latin1"), true); } - resolve14({ + resolve15({ status, statusText: STATUS_CODES[status], headersList, @@ -18440,8 +18440,8 @@ var require_util8 = __commonJS({ return true; } function delay2(ms) { - return new Promise((resolve14) => { - setTimeout(resolve14, ms).unref(); + return new Promise((resolve15) => { + setTimeout(resolve15, ms).unref(); }); } module2.exports = { @@ -19164,11 +19164,11 @@ var require_lib = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -19184,7 +19184,7 @@ var require_lib = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -19271,26 +19271,26 @@ var require_lib = __commonJS({ } readBody() { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () { let output = Buffer.alloc(0); this.message.on("data", (chunk) => { output = Buffer.concat([output, chunk]); }); this.message.on("end", () => { - resolve14(output.toString()); + resolve15(output.toString()); }); })); }); } readBodyBuffer() { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () { const chunks = []; this.message.on("data", (chunk) => { chunks.push(chunk); }); this.message.on("end", () => { - resolve14(Buffer.concat(chunks)); + resolve15(Buffer.concat(chunks)); }); })); }); @@ -19498,14 +19498,14 @@ var require_lib = __commonJS({ */ requestRaw(info8, data) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { function callbackForResult(err, res) { if (err) { reject(err); } else if (!res) { reject(new Error("Unknown error")); } else { - resolve14(res); + resolve15(res); } } this.requestRawWithCallback(info8, data, callbackForResult); @@ -19749,12 +19749,12 @@ var require_lib = __commonJS({ return __awaiter2(this, void 0, void 0, function* () { retryNumber = Math.min(ExponentialBackoffCeiling, retryNumber); const ms = ExponentialBackoffTimeSlice * Math.pow(2, retryNumber); - return new Promise((resolve14) => setTimeout(() => resolve14(), ms)); + return new Promise((resolve15) => setTimeout(() => resolve15(), ms)); }); } _processResponse(res, options) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15, reject) => __awaiter2(this, void 0, void 0, function* () { const statusCode = res.message.statusCode || 0; const response = { statusCode, @@ -19762,7 +19762,7 @@ var require_lib = __commonJS({ headers: {} }; if (statusCode === HttpCodes.NotFound) { - resolve14(response); + resolve15(response); } function dateTimeDeserializer(key, value) { if (typeof value === "string") { @@ -19801,7 +19801,7 @@ var require_lib = __commonJS({ err.result = response.result; reject(err); } else { - resolve14(response); + resolve15(response); } })); }); @@ -19818,11 +19818,11 @@ var require_auth = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -19838,7 +19838,7 @@ var require_auth = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -19922,11 +19922,11 @@ var require_oidc_utils = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -19942,7 +19942,7 @@ var require_oidc_utils = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -20020,11 +20020,11 @@ var require_summary = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -20040,7 +20040,7 @@ var require_summary = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -20409,11 +20409,11 @@ var require_io_util = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -20429,7 +20429,7 @@ var require_io_util = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -20606,11 +20606,11 @@ var require_io = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -20626,7 +20626,7 @@ var require_io = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -20867,11 +20867,11 @@ var require_toolrunner = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -20887,7 +20887,7 @@ var require_toolrunner = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -21116,7 +21116,7 @@ var require_toolrunner = __commonJS({ this.toolPath = path30.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); } this.toolPath = yield io9.which(this.toolPath, true); - return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15, reject) => __awaiter2(this, void 0, void 0, function* () { this._debug(`exec tool: ${this.toolPath}`); this._debug("arguments:"); for (const arg of this.args) { @@ -21199,7 +21199,7 @@ var require_toolrunner = __commonJS({ if (error3) { reject(error3); } else { - resolve14(exitCode); + resolve15(exitCode); } }); if (this.options.input) { @@ -21365,11 +21365,11 @@ var require_exec = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -21385,7 +21385,7 @@ var require_exec = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -21485,11 +21485,11 @@ var require_platform = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -21505,7 +21505,7 @@ var require_platform = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -21614,11 +21614,11 @@ var require_core = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -21634,7 +21634,7 @@ var require_core = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -21912,11 +21912,11 @@ var require_utils3 = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -21932,7 +21932,7 @@ var require_utils3 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -28929,8 +28929,8 @@ var require_light = __commonJS({ return this.Promise.resolve(); } yieldLoop(t = 0) { - return new this.Promise(function(resolve14, reject) { - return setTimeout(resolve14, t); + return new this.Promise(function(resolve15, reject) { + return setTimeout(resolve15, t); }); } computePenalty() { @@ -29141,15 +29141,15 @@ var require_light = __commonJS({ return this._queue.length === 0; } async _tryToRun() { - var args, cb, error3, reject, resolve14, returned, task; + var args, cb, error3, reject, resolve15, returned, task; if (this._running < 1 && this._queue.length > 0) { this._running++; - ({ task, args, resolve: resolve14, reject } = this._queue.shift()); + ({ task, args, resolve: resolve15, reject } = this._queue.shift()); cb = await (async function() { try { returned = await task(...args); return function() { - return resolve14(returned); + return resolve15(returned); }; } catch (error1) { error3 = error1; @@ -29164,13 +29164,13 @@ var require_light = __commonJS({ } } schedule(task, ...args) { - var promise, reject, resolve14; - resolve14 = reject = null; + var promise, reject, resolve15; + resolve15 = reject = null; promise = new this.Promise(function(_resolve, _reject) { - resolve14 = _resolve; + resolve15 = _resolve; return reject = _reject; }); - this._queue.push({ task, args, resolve: resolve14, reject }); + this._queue.push({ task, args, resolve: resolve15, reject }); this._tryToRun(); return promise; } @@ -29571,14 +29571,14 @@ var require_light = __commonJS({ counts = this._states.counts; return counts[0] + counts[1] + counts[2] + counts[3] === at; }; - return new this.Promise((resolve14, reject) => { + return new this.Promise((resolve15, reject) => { if (finished()) { - return resolve14(); + return resolve15(); } else { return this.on("done", () => { if (finished()) { this.removeAllListeners("done"); - return resolve14(); + return resolve15(); } }); } @@ -29671,9 +29671,9 @@ var require_light = __commonJS({ options = parser$5.load(options, this.jobDefaults); } task = (...args2) => { - return new this.Promise(function(resolve14, reject) { + return new this.Promise(function(resolve15, reject) { return fn(...args2, function(...args3) { - return (args3[0] != null ? reject : resolve14)(args3); + return (args3[0] != null ? reject : resolve15)(args3); }); }); }; @@ -29913,7 +29913,7 @@ var require_helpers = __commonJS({ this.base = base; this.schemas = schemas; }; - SchemaContext.prototype.resolve = function resolve14(target) { + SchemaContext.prototype.resolve = function resolve15(target) { return (() => resolveUrl(this.base, target))(); }; SchemaContext.prototype.makeChild = function makeChild(schema, propertyName) { @@ -31018,7 +31018,7 @@ var require_validator = __commonJS({ } return schema; }; - Validator3.prototype.resolve = function resolve14(schema, switchSchema, ctx) { + Validator3.prototype.resolve = function resolve15(schema, switchSchema, ctx) { switchSchema = ctx.resolve(switchSchema); if (ctx.schemas[switchSchema]) { return { subschema: ctx.schemas[switchSchema], switchSchema }; @@ -32954,11 +32954,11 @@ var require_internal_globber = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -32974,7 +32974,7 @@ var require_internal_globber = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -32987,14 +32987,14 @@ var require_internal_globber = __commonJS({ }, i); function verb(n) { i[n] = o[n] && function(v) { - return new Promise(function(resolve14, reject) { - v = o[n](v), settle(resolve14, reject, v.done, v.value); + return new Promise(function(resolve15, reject) { + v = o[n](v), settle(resolve15, reject, v.done, v.value); }); }; } - function settle(resolve14, reject, d, v) { + function settle(resolve15, reject, d, v) { Promise.resolve(v).then(function(v2) { - resolve14({ value: v2, done: d }); + resolve15({ value: v2, done: d }); }, reject); } }; @@ -33244,11 +33244,11 @@ var require_internal_hash_files = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -33264,7 +33264,7 @@ var require_internal_hash_files = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -33277,14 +33277,14 @@ var require_internal_hash_files = __commonJS({ }, i); function verb(n) { i[n] = o[n] && function(v) { - return new Promise(function(resolve14, reject) { - v = o[n](v), settle(resolve14, reject, v.done, v.value); + return new Promise(function(resolve15, reject) { + v = o[n](v), settle(resolve15, reject, v.done, v.value); }); }; } - function settle(resolve14, reject, d, v) { + function settle(resolve15, reject, d, v) { Promise.resolve(v).then(function(v2) { - resolve14({ value: v2, done: d }); + resolve15({ value: v2, done: d }); }, reject); } }; @@ -33356,11 +33356,11 @@ var require_glob = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -33376,7 +33376,7 @@ var require_glob = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -34637,11 +34637,11 @@ var require_cacheUtils = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -34657,7 +34657,7 @@ var require_cacheUtils = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -34670,14 +34670,14 @@ var require_cacheUtils = __commonJS({ }, i); function verb(n) { i[n] = o[n] && function(v) { - return new Promise(function(resolve14, reject) { - v = o[n](v), settle(resolve14, reject, v.done, v.value); + return new Promise(function(resolve15, reject) { + v = o[n](v), settle(resolve15, reject, v.done, v.value); }); }; } - function settle(resolve14, reject, d, v) { + function settle(resolve15, reject, d, v) { Promise.resolve(v).then(function(v2) { - resolve14({ value: v2, done: d }); + resolve15({ value: v2, done: d }); }, reject); } }; @@ -34959,11 +34959,11 @@ function __metadata(metadataKey, metadataValue) { } function __awaiter(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -34979,7 +34979,7 @@ function __awaiter(thisArg, _arguments, P, generator) { } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -35170,14 +35170,14 @@ function __asyncValues(o) { }, i); function verb(n) { i[n] = o[n] && function(v) { - return new Promise(function(resolve14, reject) { - v = o[n](v), settle(resolve14, reject, v.done, v.value); + return new Promise(function(resolve15, reject) { + v = o[n](v), settle(resolve15, reject, v.done, v.value); }); }; } - function settle(resolve14, reject, d, v) { + function settle(resolve15, reject, d, v) { Promise.resolve(v).then(function(v2) { - resolve14({ value: v2, done: d }); + resolve15({ value: v2, done: d }); }, reject); } } @@ -36349,9 +36349,9 @@ var require_nodeHttpClient = __commonJS({ if (stream2.readable === false) { return Promise.resolve(); } - return new Promise((resolve14) => { + return new Promise((resolve15) => { const handler2 = () => { - resolve14(); + resolve15(); stream2.removeListener("close", handler2); stream2.removeListener("end", handler2); stream2.removeListener("error", handler2); @@ -36506,8 +36506,8 @@ var require_nodeHttpClient = __commonJS({ headers: request3.headers.toJSON({ preserveCase: true }), ...request3.requestOverrides }; - return new Promise((resolve14, reject) => { - const req = isInsecure ? node_http_1.default.request(options, resolve14) : node_https_1.default.request(options, resolve14); + return new Promise((resolve15, reject) => { + const req = isInsecure ? node_http_1.default.request(options, resolve15) : node_https_1.default.request(options, resolve15); req.once("error", (err) => { reject(new restError_js_1.RestError(err.message, { code: err.code ?? restError_js_1.RestError.REQUEST_SEND_ERROR, request: request3 })); }); @@ -36591,7 +36591,7 @@ var require_nodeHttpClient = __commonJS({ return stream2; } function streamToText(stream2) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const buffer = []; stream2.on("data", (chunk) => { if (Buffer.isBuffer(chunk)) { @@ -36601,7 +36601,7 @@ var require_nodeHttpClient = __commonJS({ } }); stream2.on("end", () => { - resolve14(Buffer.concat(buffer).toString("utf8")); + resolve15(Buffer.concat(buffer).toString("utf8")); }); stream2.on("error", (e) => { if (e && e?.name === "AbortError") { @@ -36879,7 +36879,7 @@ var require_helpers2 = __commonJS({ var AbortError_js_1 = require_AbortError(); var StandardAbortMessage = "The operation was aborted."; function delay2(delayInMs, value, options) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { let timer = void 0; let onAborted = void 0; const rejectOnAbort = () => { @@ -36902,7 +36902,7 @@ var require_helpers2 = __commonJS({ } timer = setTimeout(() => { removeListeners(); - resolve14(value); + resolve15(value); }, delayInMs); if (options?.abortSignal) { options.abortSignal.addEventListener("abort", onAborted); @@ -38065,8 +38065,8 @@ var require_helpers3 = __commonJS({ function req(url2, opts = {}) { const href = typeof url2 === "string" ? url2 : url2.href; const req2 = (href.startsWith("https:") ? https3 : http).request(url2, opts); - const promise = new Promise((resolve14, reject) => { - req2.once("response", resolve14).once("error", reject).end(); + const promise = new Promise((resolve15, reject) => { + req2.once("response", resolve15).once("error", reject).end(); }); req2.then = promise.then.bind(promise); return req2; @@ -38243,7 +38243,7 @@ var require_parse_proxy_response = __commonJS({ var debug_1 = __importDefault2(require_src()); var debug6 = (0, debug_1.default)("https-proxy-agent:parse-proxy-response"); function parseProxyResponse(socket) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { let buffersLength = 0; const buffers = []; function read() { @@ -38309,7 +38309,7 @@ var require_parse_proxy_response = __commonJS({ } debug6("got proxy server response: %o %o", firstLine, headers); cleanup(); - resolve14({ + resolve15({ connect: { statusCode, statusText, @@ -40395,7 +40395,7 @@ var require_createAbortablePromise = __commonJS({ var abort_controller_1 = require_commonjs3(); function createAbortablePromise(buildPromise, options) { const { cleanupBeforeAbort, abortSignal, abortErrorMsg } = options ?? {}; - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { function rejectOnAbort() { reject(new abort_controller_1.AbortError(abortErrorMsg ?? "The operation was aborted.")); } @@ -40413,7 +40413,7 @@ var require_createAbortablePromise = __commonJS({ try { buildPromise((x) => { removeListeners(); - resolve14(x); + resolve15(x); }, (x) => { removeListeners(); reject(x); @@ -40440,8 +40440,8 @@ var require_delay2 = __commonJS({ function delay2(timeInMs, options) { let token; const { abortSignal, abortErrorMsg } = options ?? {}; - return (0, createAbortablePromise_js_1.createAbortablePromise)((resolve14) => { - token = setTimeout(resolve14, timeInMs); + return (0, createAbortablePromise_js_1.createAbortablePromise)((resolve15) => { + token = setTimeout(resolve15, timeInMs); }, { cleanupBeforeAbort: () => clearTimeout(token), abortSignal, @@ -46738,7 +46738,7 @@ var require_utils_common = __commonJS({ return base64encode(res); } async function delay2(timeInMs, aborter, abortError) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { let timeout; const abortHandler = () => { if (timeout !== void 0) { @@ -46750,7 +46750,7 @@ var require_utils_common = __commonJS({ if (aborter !== void 0) { aborter.removeEventListener("abort", abortHandler); } - resolve14(); + resolve15(); }; timeout = setTimeout(resolveHandler, timeInMs); if (aborter !== void 0) { @@ -48291,7 +48291,7 @@ var require_BufferScheduler = __commonJS({ * */ async do() { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { this.readable.on("data", (data) => { data = typeof data === "string" ? Buffer.from(data, this.encoding) : data; this.appendUnresolvedData(data); @@ -48319,11 +48319,11 @@ var require_BufferScheduler = __commonJS({ if (this.isStreamEnd && this.executingOutgoingHandlers === 0) { if (this.unresolvedLength > 0 && this.unresolvedLength < this.bufferSize) { const buffer = this.shiftBufferFromUnresolvedDataArray(); - this.outgoingHandler(() => buffer.getReadableStream(), buffer.size, this.offset).then(resolve14).catch(reject); + this.outgoingHandler(() => buffer.getReadableStream(), buffer.size, this.offset).then(resolve15).catch(reject); } else if (this.unresolvedLength >= this.bufferSize) { return; } else { - resolve14(); + resolve15(); } } }); @@ -48796,7 +48796,7 @@ var require_utils_common2 = __commonJS({ return base64encode(res); } async function delay2(timeInMs, aborter, abortError) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { let timeout; const abortHandler = () => { if (timeout !== void 0) { @@ -48808,7 +48808,7 @@ var require_utils_common2 = __commonJS({ if (aborter !== void 0) { aborter.removeEventListener("abort", abortHandler); } - resolve14(); + resolve15(); }; timeout = setTimeout(resolveHandler, timeInMs); if (aborter !== void 0) { @@ -67006,7 +67006,7 @@ var require_AvroReadableFromStream = __commonJS({ this._position += chunk.length; return this.toUint8Array(chunk); } else { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const cleanUp = () => { this._readable.removeListener("readable", readableCallback); this._readable.removeListener("error", rejectCallback); @@ -67021,7 +67021,7 @@ var require_AvroReadableFromStream = __commonJS({ if (callbackChunk) { this._position += callbackChunk.length; cleanUp(); - resolve14(this.toUint8Array(callbackChunk)); + resolve15(this.toUint8Array(callbackChunk)); } }; const rejectCallback = () => { @@ -68501,8 +68501,8 @@ var require_poller3 = __commonJS({ this.stopped = true; this.pollProgressCallbacks = []; this.operation = operation; - this.promise = new Promise((resolve14, reject) => { - this.resolve = resolve14; + this.promise = new Promise((resolve15, reject) => { + this.resolve = resolve15; this.reject = reject; }); this.promise.catch(() => { @@ -68755,7 +68755,7 @@ var require_lroEngine = __commonJS({ * The method used by the poller to wait before attempting to update its operation. */ delay() { - return new Promise((resolve14) => setTimeout(() => resolve14(), this.config.intervalInMs)); + return new Promise((resolve15) => setTimeout(() => resolve15(), this.config.intervalInMs)); } }; exports2.LroEngine = LroEngine; @@ -69001,8 +69001,8 @@ var require_Batch = __commonJS({ return Promise.resolve(); } this.parallelExecute(); - return new Promise((resolve14, reject) => { - this.emitter.on("finish", resolve14); + return new Promise((resolve15, reject) => { + this.emitter.on("finish", resolve15); this.emitter.on("error", (error3) => { this.state = BatchStates.Error; reject(error3); @@ -69063,12 +69063,12 @@ var require_utils6 = __commonJS({ async function streamToBuffer(stream2, buffer, offset, end, encoding) { let pos = 0; const count = end - offset; - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const timeout = setTimeout(() => reject(new Error(`The operation cannot be completed in timeout.`)), constants_js_1.REQUEST_TIMEOUT); stream2.on("readable", () => { if (pos >= count) { clearTimeout(timeout); - resolve14(); + resolve15(); return; } let chunk = stream2.read(); @@ -69087,7 +69087,7 @@ var require_utils6 = __commonJS({ if (pos < count) { reject(new Error(`Stream drains before getting enough data needed. Data read: ${pos}, data need: ${count}`)); } - resolve14(); + resolve15(); }); stream2.on("error", (msg) => { clearTimeout(timeout); @@ -69098,7 +69098,7 @@ var require_utils6 = __commonJS({ async function streamToBuffer2(stream2, buffer, encoding) { let pos = 0; const bufferSize = buffer.length; - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { stream2.on("readable", () => { let chunk = stream2.read(); if (!chunk) { @@ -69115,25 +69115,25 @@ var require_utils6 = __commonJS({ pos += chunk.length; }); stream2.on("end", () => { - resolve14(pos); + resolve15(pos); }); stream2.on("error", reject); }); } async function streamToBuffer3(readableStream, encoding) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const chunks = []; readableStream.on("data", (data) => { chunks.push(typeof data === "string" ? Buffer.from(data, encoding) : data); }); readableStream.on("end", () => { - resolve14(Buffer.concat(chunks)); + resolve15(Buffer.concat(chunks)); }); readableStream.on("error", reject); }); } async function readStreamToLocalFile(rs, file) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const ws = node_fs_1.default.createWriteStream(file); rs.on("error", (err) => { reject(err); @@ -69141,7 +69141,7 @@ var require_utils6 = __commonJS({ ws.on("error", (err) => { reject(err); }); - ws.on("close", resolve14); + ws.on("close", resolve15); rs.pipe(ws); }); } @@ -70080,7 +70080,7 @@ var require_Clients = __commonJS({ * @returns The SAS URI consisting of the URI to the resource represented by this client, followed by the generated SAS token. */ generateSasUrl(options) { - return new Promise((resolve14) => { + return new Promise((resolve15) => { if (!(this.credential instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential)) { throw new RangeError("Can only generate the SAS when the client is initialized with a shared key credential"); } @@ -70091,7 +70091,7 @@ var require_Clients = __commonJS({ versionId: this._versionId, ...options }, this.credential).toString(); - resolve14((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); + resolve15((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); }); } /** @@ -70130,7 +70130,7 @@ var require_Clients = __commonJS({ * @returns The SAS URI consisting of the URI to the resource represented by this client, followed by the generated SAS token. */ generateUserDelegationSasUrl(options, userDelegationKey) { - return new Promise((resolve14) => { + return new Promise((resolve15) => { const sas = (0, BlobSASSignatureValues_js_1.generateBlobSASQueryParameters)({ containerName: this._containerName, blobName: this._name, @@ -70138,7 +70138,7 @@ var require_Clients = __commonJS({ versionId: this._versionId, ...options }, userDelegationKey, this.accountName).toString(); - resolve14((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); + resolve15((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); }); } /** @@ -71993,14 +71993,14 @@ var require_Mutex = __commonJS({ * @param key - lock key */ static async lock(key) { - return new Promise((resolve14) => { + return new Promise((resolve15) => { if (this.keys[key] === void 0 || this.keys[key] === MutexLockStatus.UNLOCKED) { this.keys[key] = MutexLockStatus.LOCKED; - resolve14(); + resolve15(); } else { this.onUnlockEvent(key, () => { this.keys[key] = MutexLockStatus.LOCKED; - resolve14(); + resolve15(); }); } }); @@ -72011,12 +72011,12 @@ var require_Mutex = __commonJS({ * @param key - */ static async unlock(key) { - return new Promise((resolve14) => { + return new Promise((resolve15) => { if (this.keys[key] === MutexLockStatus.LOCKED) { this.emitUnlockEvent(key); } delete this.keys[key]; - resolve14(); + resolve15(); }); } static keys = {}; @@ -73619,7 +73619,7 @@ var require_ContainerClient = __commonJS({ * @returns The SAS URI consisting of the URI to the resource represented by this client, followed by the generated SAS token. */ generateSasUrl(options) { - return new Promise((resolve14) => { + return new Promise((resolve15) => { if (!(this.credential instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential)) { throw new RangeError("Can only generate the SAS when the client is initialized with a shared key credential"); } @@ -73627,7 +73627,7 @@ var require_ContainerClient = __commonJS({ containerName: this._containerName, ...options }, this.credential).toString(); - resolve14((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); + resolve15((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); }); } /** @@ -73662,12 +73662,12 @@ var require_ContainerClient = __commonJS({ * @returns The SAS URI consisting of the URI to the resource represented by this client, followed by the generated SAS token. */ generateUserDelegationSasUrl(options, userDelegationKey) { - return new Promise((resolve14) => { + return new Promise((resolve15) => { const sas = (0, BlobSASSignatureValues_js_1.generateBlobSASQueryParameters)({ containerName: this._containerName, ...options }, userDelegationKey, this.accountName).toString(); - resolve14((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); + resolve15((0, utils_common_js_1.appendToURLQuery)(this.url, sas)); }); } /** @@ -75063,11 +75063,11 @@ var require_uploadUtils = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -75083,7 +75083,7 @@ var require_uploadUtils = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -75250,11 +75250,11 @@ var require_requestUtils = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -75270,7 +75270,7 @@ var require_requestUtils = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -75310,7 +75310,7 @@ var require_requestUtils = __commonJS({ } function sleep(milliseconds) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => setTimeout(resolve14, milliseconds)); + return new Promise((resolve15) => setTimeout(resolve15, milliseconds)); }); } function retry2(name_1, method_1, getStatusCode_1) { @@ -75571,11 +75571,11 @@ var require_downloadUtils = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -75591,7 +75591,7 @@ var require_downloadUtils = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -75887,8 +75887,8 @@ var require_downloadUtils = __commonJS({ } var promiseWithTimeout = (timeoutMs, promise) => __awaiter2(void 0, void 0, void 0, function* () { let timeoutHandle; - const timeoutPromise = new Promise((resolve14) => { - timeoutHandle = setTimeout(() => resolve14("timeout"), timeoutMs); + const timeoutPromise = new Promise((resolve15) => { + timeoutHandle = setTimeout(() => resolve15("timeout"), timeoutMs); }); return Promise.race([promise, timeoutPromise]).then((result) => { clearTimeout(timeoutHandle); @@ -76186,11 +76186,11 @@ var require_cacheHttpClient = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -76206,7 +76206,7 @@ var require_cacheHttpClient = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -79682,8 +79682,8 @@ var require_deferred = __commonJS({ */ constructor(preventUnhandledRejectionWarning = true) { this._state = DeferredState.PENDING; - this._promise = new Promise((resolve14, reject) => { - this._resolve = resolve14; + this._promise = new Promise((resolve15, reject) => { + this._resolve = resolve15; this._reject = reject; }); if (preventUnhandledRejectionWarning) { @@ -79898,11 +79898,11 @@ var require_unary_call = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -79918,7 +79918,7 @@ var require_unary_call = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -79967,11 +79967,11 @@ var require_server_streaming_call = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -79987,7 +79987,7 @@ var require_server_streaming_call = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -80037,11 +80037,11 @@ var require_client_streaming_call = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -80057,7 +80057,7 @@ var require_client_streaming_call = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -80106,11 +80106,11 @@ var require_duplex_streaming_call = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -80126,7 +80126,7 @@ var require_duplex_streaming_call = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -80174,11 +80174,11 @@ var require_test_transport = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -80194,7 +80194,7 @@ var require_test_transport = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -80391,11 +80391,11 @@ var require_test_transport = __commonJS({ responseTrailer: "test" }; function delay2(ms, abort) { - return (v) => new Promise((resolve14, reject) => { + return (v) => new Promise((resolve15, reject) => { if (abort === null || abort === void 0 ? void 0 : abort.aborted) { reject(new rpc_error_1.RpcError("user cancel", "CANCELLED")); } else { - const id = setTimeout(() => resolve14(v), ms); + const id = setTimeout(() => resolve15(v), ms); if (abort) { abort.addEventListener("abort", (ev) => { clearTimeout(id); @@ -81393,11 +81393,11 @@ var require_cacheTwirpClient = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -81413,7 +81413,7 @@ var require_cacheTwirpClient = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -81553,7 +81553,7 @@ var require_cacheTwirpClient = __commonJS({ } sleep(milliseconds) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => setTimeout(resolve14, milliseconds)); + return new Promise((resolve15) => setTimeout(resolve15, milliseconds)); }); } getExponentialRetryTimeMilliseconds(attempt) { @@ -81618,11 +81618,11 @@ var require_tar = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -81638,7 +81638,7 @@ var require_tar = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -81870,11 +81870,11 @@ var require_cache4 = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -81890,7 +81890,7 @@ var require_cache4 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -82372,11 +82372,11 @@ var require_manifest = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -82392,7 +82392,7 @@ var require_manifest = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -82520,11 +82520,11 @@ var require_retry_helper = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -82540,7 +82540,7 @@ var require_retry_helper = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -82585,7 +82585,7 @@ var require_retry_helper = __commonJS({ } sleep(seconds) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => setTimeout(resolve14, seconds * 1e3)); + return new Promise((resolve15) => setTimeout(resolve15, seconds * 1e3)); }); } }; @@ -82636,11 +82636,11 @@ var require_tool_cache = __commonJS({ })(); var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -82656,7 +82656,7 @@ var require_tool_cache = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -89136,11 +89136,11 @@ var require_artifact_twirp_client2 = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -89156,7 +89156,7 @@ var require_artifact_twirp_client2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -89283,7 +89283,7 @@ var require_artifact_twirp_client2 = __commonJS({ } sleep(milliseconds) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => setTimeout(resolve14, milliseconds)); + return new Promise((resolve15) => setTimeout(resolve15, milliseconds)); }); } getExponentialRetryTimeMilliseconds(attempt) { @@ -89424,11 +89424,11 @@ var require_blob_upload = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -89444,7 +89444,7 @@ var require_blob_upload = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -89463,7 +89463,7 @@ var require_blob_upload = __commonJS({ let lastProgressTime = Date.now(); const abortController = new AbortController(); const chunkTimer = (interval) => __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const timer = setInterval(() => { if (Date.now() - lastProgressTime > interval) { reject(new Error("Upload progress stalled.")); @@ -89471,7 +89471,7 @@ var require_blob_upload = __commonJS({ }, interval); abortController.signal.addEventListener("abort", () => { clearInterval(timer); - resolve14(); + resolve15(); }); }); }); @@ -90416,9 +90416,9 @@ var require_readdir_glob = __commonJS({ var fs32 = require("fs"); var { EventEmitter: EventEmitter2 } = require("events"); var { Minimatch: Minimatch2 } = require_minimatch2(); - var { resolve: resolve14 } = require("path"); + var { resolve: resolve15 } = require("path"); function readdir3(dir, strict) { - return new Promise((resolve15, reject) => { + return new Promise((resolve16, reject) => { fs32.readdir(dir, { withFileTypes: true }, (err, files) => { if (err) { switch (err.code) { @@ -90426,7 +90426,7 @@ var require_readdir_glob = __commonJS({ if (strict) { reject(err); } else { - resolve15([]); + resolve16([]); } break; case "ENOTSUP": @@ -90436,7 +90436,7 @@ var require_readdir_glob = __commonJS({ case "ENAMETOOLONG": // Filename too long case "UNKNOWN": - resolve15([]); + resolve16([]); break; case "ELOOP": // Too many levels of symbolic links @@ -90445,30 +90445,30 @@ var require_readdir_glob = __commonJS({ break; } } else { - resolve15(files); + resolve16(files); } }); }); } function stat2(file, followSymlinks) { - return new Promise((resolve15, reject) => { + return new Promise((resolve16, reject) => { const statFunc = followSymlinks ? fs32.stat : fs32.lstat; statFunc(file, (err, stats) => { if (err) { switch (err.code) { case "ENOENT": if (followSymlinks) { - resolve15(stat2(file, false)); + resolve16(stat2(file, false)); } else { - resolve15(null); + resolve16(null); } break; default: - resolve15(null); + resolve16(null); break; } } else { - resolve15(stats); + resolve16(stats); } }); }); @@ -90558,7 +90558,7 @@ var require_readdir_glob = __commonJS({ (skip) => new Minimatch2(skip, { dot: true }) ); } - this.iterator = explore2(resolve14(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this)); + this.iterator = explore2(resolve15(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this)); this.paused = false; this.inactive = false; this.aborted = false; @@ -90725,10 +90725,10 @@ var require_async = __commonJS({ if (typeof args[arity - 1] === "function") { return asyncFn.apply(this, args); } - return new Promise((resolve14, reject2) => { + return new Promise((resolve15, reject2) => { args[arity - 1] = (err, ...cbArgs) => { if (err) return reject2(err); - resolve14(cbArgs.length > 1 ? cbArgs : cbArgs[0]); + resolve15(cbArgs.length > 1 ? cbArgs : cbArgs[0]); }; asyncFn.apply(this, args); }); @@ -90974,13 +90974,13 @@ var require_async = __commonJS({ var applyEachSeries = applyEach$1(mapSeries$1); const PROMISE_SYMBOL = /* @__PURE__ */ Symbol("promiseCallback"); function promiseCallback() { - let resolve14, reject2; + let resolve15, reject2; function callback(err, ...args) { if (err) return reject2(err); - resolve14(args.length > 1 ? args : args[0]); + resolve15(args.length > 1 ? args : args[0]); } callback[PROMISE_SYMBOL] = new Promise((res, rej) => { - resolve14 = res, reject2 = rej; + resolve15 = res, reject2 = rej; }); return callback; } @@ -91327,8 +91327,8 @@ var require_async = __commonJS({ }); } if (rejectOnError || !callback) { - return new Promise((resolve14, reject2) => { - res = resolve14; + return new Promise((resolve15, reject2) => { + res = resolve15; rej = reject2; }); } @@ -91367,10 +91367,10 @@ var require_async = __commonJS({ } const eventMethod = (name) => (handler2) => { if (!handler2) { - return new Promise((resolve14, reject2) => { + return new Promise((resolve15, reject2) => { once2(name, (err, data) => { if (err) return reject2(err); - resolve14(data); + resolve15(data); }); }); } @@ -97269,25 +97269,25 @@ var require_util13 = __commonJS({ }; }, createDeferredPromise: function() { - let resolve14; + let resolve15; let reject; const promise = new Promise((res, rej) => { - resolve14 = res; + resolve15 = res; reject = rej; }); return { promise, - resolve: resolve14, + resolve: resolve15, reject }; }, promisify(fn) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { fn((err, ...args) => { if (err) { return reject(err); } - return resolve14(...args); + return resolve15(...args); }); }); }, @@ -98078,7 +98078,7 @@ var require_end_of_stream = __commonJS({ validateBoolean(opts.cleanup, "cleanup"); autoCleanup = opts.cleanup; } - return new Promise2((resolve14, reject) => { + return new Promise2((resolve15, reject) => { const cleanup = eos(stream2, opts, (err) => { if (autoCleanup) { cleanup(); @@ -98086,7 +98086,7 @@ var require_end_of_stream = __commonJS({ if (err) { reject(err); } else { - resolve14(); + resolve15(); } }); }); @@ -99252,7 +99252,7 @@ var require_readable3 = __commonJS({ error3 = this.readableEnded ? null : new AbortError(); this.destroy(error3); } - return new Promise2((resolve14, reject) => eos(this, (err) => err && err !== error3 ? reject(err) : resolve14(null))); + return new Promise2((resolve15, reject) => eos(this, (err) => err && err !== error3 ? reject(err) : resolve15(null))); }; Readable3.prototype.push = function(chunk, encoding) { return readableAddChunk(this, chunk, encoding, false); @@ -99796,12 +99796,12 @@ var require_readable3 = __commonJS({ } async function* createAsyncIterator(stream2, options) { let callback = nop; - function next(resolve14) { + function next(resolve15) { if (this === stream2) { callback(); callback = nop; } else { - callback = resolve14; + callback = resolve15; } } stream2.on("readable", next); @@ -100853,7 +100853,7 @@ var require_duplexify = __commonJS({ ); }; function fromAsyncGen(fn) { - let { promise, resolve: resolve14 } = createDeferredPromise(); + let { promise, resolve: resolve15 } = createDeferredPromise(); const ac = new AbortController2(); const signal = ac.signal; const value = fn( @@ -100868,7 +100868,7 @@ var require_duplexify = __commonJS({ throw new AbortError(void 0, { cause: signal.reason }); - ({ promise, resolve: resolve14 } = createDeferredPromise()); + ({ promise, resolve: resolve15 } = createDeferredPromise()); yield chunk; } })(), @@ -100879,8 +100879,8 @@ var require_duplexify = __commonJS({ return { value, write(chunk, encoding, cb) { - const _resolve = resolve14; - resolve14 = null; + const _resolve = resolve15; + resolve15 = null; _resolve({ chunk, done: false, @@ -100888,8 +100888,8 @@ var require_duplexify = __commonJS({ }); }, final(cb) { - const _resolve = resolve14; - resolve14 = null; + const _resolve = resolve15; + resolve15 = null; _resolve({ done: true, cb @@ -101340,7 +101340,7 @@ var require_pipeline4 = __commonJS({ callback(); } }; - const wait = () => new Promise2((resolve14, reject) => { + const wait = () => new Promise2((resolve15, reject) => { if (error3) { reject(error3); } else { @@ -101348,7 +101348,7 @@ var require_pipeline4 = __commonJS({ if (error3) { reject(error3); } else { - resolve14(); + resolve15(); } }; } @@ -101992,8 +101992,8 @@ var require_operators = __commonJS({ next = null; } if (!done && (queue2.length >= highWaterMark || cnt >= concurrency)) { - await new Promise2((resolve14) => { - resume = resolve14; + await new Promise2((resolve15) => { + resume = resolve15; }); } } @@ -102027,8 +102027,8 @@ var require_operators = __commonJS({ queue2.shift(); maybeResume(); } - await new Promise2((resolve14) => { - next = resolve14; + await new Promise2((resolve15) => { + next = resolve15; }); } } finally { @@ -102286,7 +102286,7 @@ var require_promises = __commonJS({ var { finished } = require_end_of_stream(); require_stream2(); function pipeline2(...streams) { - return new Promise2((resolve14, reject) => { + return new Promise2((resolve15, reject) => { let signal; let end; const lastArg = streams[streams.length - 1]; @@ -102301,7 +102301,7 @@ var require_promises = __commonJS({ if (err) { reject(err); } else { - resolve14(value); + resolve15(value); } }, { @@ -107088,11 +107088,11 @@ var require_core2 = __commonJS({ this._finalize(); } var self2 = this; - return new Promise(function(resolve14, reject) { + return new Promise(function(resolve15, reject) { var errored; self2._module.on("end", function() { if (!errored) { - resolve14(); + resolve15(); } }); self2._module.on("error", function(err) { @@ -109451,8 +109451,8 @@ var require_streamx = __commonJS({ return this; }, next() { - return new Promise(function(resolve14, reject) { - promiseResolve = resolve14; + return new Promise(function(resolve15, reject) { + promiseResolve = resolve15; promiseReject = reject; const data = stream2.read(); if (data !== null) ondata(data); @@ -109481,11 +109481,11 @@ var require_streamx = __commonJS({ } function destroy(err) { stream2.destroy(err); - return new Promise((resolve14, reject) => { - if (stream2._duplexState & DESTROYED) return resolve14({ value: void 0, done: true }); + return new Promise((resolve15, reject) => { + if (stream2._duplexState & DESTROYED) return resolve15({ value: void 0, done: true }); stream2.once("close", function() { if (err) reject(err); - else resolve14({ value: void 0, done: true }); + else resolve15({ value: void 0, done: true }); }); }); } @@ -109529,8 +109529,8 @@ var require_streamx = __commonJS({ const writes = pending + (ws._duplexState & WRITE_WRITING ? 1 : 0); if (writes === 0) return Promise.resolve(true); if (state.drains === null) state.drains = []; - return new Promise((resolve14) => { - state.drains.push({ writes, resolve: resolve14 }); + return new Promise((resolve15) => { + state.drains.push({ writes, resolve: resolve15 }); }); } write(data) { @@ -109635,10 +109635,10 @@ var require_streamx = __commonJS({ cb(null); } function pipelinePromise(...streams) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { return pipeline2(...streams, (err) => { if (err) return reject(err); - resolve14(); + resolve15(); }); }); } @@ -110281,16 +110281,16 @@ var require_extract = __commonJS({ entryCallback = null; cb(err); } - function onnext(resolve14, reject) { + function onnext(resolve15, reject) { if (error3) { return reject(error3); } if (entryStream) { - resolve14({ value: entryStream, done: false }); + resolve15({ value: entryStream, done: false }); entryStream = null; return; } - promiseResolve = resolve14; + promiseResolve = resolve15; promiseReject = reject; consumeCallback(null); if (extract2._finished && promiseResolve) { @@ -110318,11 +110318,11 @@ var require_extract = __commonJS({ function destroy(err) { extract2.destroy(err); consumeCallback(err); - return new Promise((resolve14, reject) => { - if (extract2.destroyed) return resolve14({ value: void 0, done: true }); + return new Promise((resolve15, reject) => { + if (extract2.destroyed) return resolve15({ value: void 0, done: true }); extract2.once("close", function() { if (err) reject(err); - else resolve14({ value: void 0, done: true }); + else resolve15({ value: void 0, done: true }); }); }); } @@ -111118,11 +111118,11 @@ var require_zip2 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -111138,7 +111138,7 @@ var require_zip2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -111253,11 +111253,11 @@ var require_upload_artifact = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -111273,7 +111273,7 @@ var require_upload_artifact = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -111519,11 +111519,11 @@ var require_lib4 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -111539,7 +111539,7 @@ var require_lib4 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -111625,26 +111625,26 @@ var require_lib4 = __commonJS({ } readBody() { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () { let output = Buffer.alloc(0); this.message.on("data", (chunk) => { output = Buffer.concat([output, chunk]); }); this.message.on("end", () => { - resolve14(output.toString()); + resolve15(output.toString()); }); })); }); } readBodyBuffer() { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () { const chunks = []; this.message.on("data", (chunk) => { chunks.push(chunk); }); this.message.on("end", () => { - resolve14(Buffer.concat(chunks)); + resolve15(Buffer.concat(chunks)); }); })); }); @@ -111853,14 +111853,14 @@ var require_lib4 = __commonJS({ */ requestRaw(info8, data) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { function callbackForResult(err, res) { if (err) { reject(err); } else if (!res) { reject(new Error("Unknown error")); } else { - resolve14(res); + resolve15(res); } } this.requestRawWithCallback(info8, data, callbackForResult); @@ -112042,12 +112042,12 @@ var require_lib4 = __commonJS({ return __awaiter2(this, void 0, void 0, function* () { retryNumber = Math.min(ExponentialBackoffCeiling, retryNumber); const ms = ExponentialBackoffTimeSlice * Math.pow(2, retryNumber); - return new Promise((resolve14) => setTimeout(() => resolve14(), ms)); + return new Promise((resolve15) => setTimeout(() => resolve15(), ms)); }); } _processResponse(res, options) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15, reject) => __awaiter2(this, void 0, void 0, function* () { const statusCode = res.message.statusCode || 0; const response = { statusCode, @@ -112055,7 +112055,7 @@ var require_lib4 = __commonJS({ headers: {} }; if (statusCode === HttpCodes.NotFound) { - resolve14(response); + resolve15(response); } function dateTimeDeserializer(key, value) { if (typeof value === "string") { @@ -112094,7 +112094,7 @@ var require_lib4 = __commonJS({ err.result = response.result; reject(err); } else { - resolve14(response); + resolve15(response); } })); }); @@ -112138,11 +112138,11 @@ var require_utils8 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -112158,7 +112158,7 @@ var require_utils8 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -118023,11 +118023,11 @@ var require_download_artifact = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -118043,7 +118043,7 @@ var require_download_artifact = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -118094,7 +118094,7 @@ var require_download_artifact = __commonJS({ } catch (error3) { retryCount++; core32.debug(`Failed to download artifact after ${retryCount} retries due to ${error3.message}. Retrying in 5 seconds...`); - yield new Promise((resolve14) => setTimeout(resolve14, 5e3)); + yield new Promise((resolve15) => setTimeout(resolve15, 5e3)); } } throw new Error(`Artifact download failed after ${retryCount} retries.`); @@ -118108,7 +118108,7 @@ var require_download_artifact = __commonJS({ throw new Error(`Unexpected HTTP response from blob storage: ${response.message.statusCode} ${response.message.statusMessage}`); } let sha256Digest = void 0; - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const timerFn = () => { const timeoutError = new Error(`Blob storage chunk did not respond in ${opts.timeout}ms`); response.message.destroy(timeoutError); @@ -118133,7 +118133,7 @@ var require_download_artifact = __commonJS({ sha256Digest = hashStream.read(); core32.info(`SHA256 digest of downloaded artifact is ${sha256Digest}`); } - resolve14({ sha256Digest: `sha256:${sha256Digest}` }); + resolve15({ sha256Digest: `sha256:${sha256Digest}` }); }).on("error", (error3) => { reject(error3); }); @@ -118416,11 +118416,11 @@ var require_get_artifact = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -118436,7 +118436,7 @@ var require_get_artifact = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -118539,11 +118539,11 @@ var require_delete_artifact = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -118559,7 +118559,7 @@ var require_delete_artifact = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -118645,11 +118645,11 @@ var require_list_artifacts = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -118665,7 +118665,7 @@ var require_list_artifacts = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -118802,11 +118802,11 @@ var require_client2 = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -118822,7 +118822,7 @@ var require_client2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -119291,11 +119291,11 @@ var require_lib5 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -119311,7 +119311,7 @@ var require_lib5 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -119397,26 +119397,26 @@ var require_lib5 = __commonJS({ } readBody() { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () { let output = Buffer.alloc(0); this.message.on("data", (chunk) => { output = Buffer.concat([output, chunk]); }); this.message.on("end", () => { - resolve14(output.toString()); + resolve15(output.toString()); }); })); }); } readBodyBuffer() { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () { const chunks = []; this.message.on("data", (chunk) => { chunks.push(chunk); }); this.message.on("end", () => { - resolve14(Buffer.concat(chunks)); + resolve15(Buffer.concat(chunks)); }); })); }); @@ -119625,14 +119625,14 @@ var require_lib5 = __commonJS({ */ requestRaw(info8, data) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { function callbackForResult(err, res) { if (err) { reject(err); } else if (!res) { reject(new Error("Unknown error")); } else { - resolve14(res); + resolve15(res); } } this.requestRawWithCallback(info8, data, callbackForResult); @@ -119814,12 +119814,12 @@ var require_lib5 = __commonJS({ return __awaiter2(this, void 0, void 0, function* () { retryNumber = Math.min(ExponentialBackoffCeiling, retryNumber); const ms = ExponentialBackoffTimeSlice * Math.pow(2, retryNumber); - return new Promise((resolve14) => setTimeout(() => resolve14(), ms)); + return new Promise((resolve15) => setTimeout(() => resolve15(), ms)); }); } _processResponse(res, options) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15, reject) => __awaiter2(this, void 0, void 0, function* () { const statusCode = res.message.statusCode || 0; const response = { statusCode, @@ -119827,7 +119827,7 @@ var require_lib5 = __commonJS({ headers: {} }; if (statusCode === HttpCodes.NotFound) { - resolve14(response); + resolve15(response); } function dateTimeDeserializer(key, value) { if (typeof value === "string") { @@ -119866,7 +119866,7 @@ var require_lib5 = __commonJS({ err.result = response.result; reject(err); } else { - resolve14(response); + resolve15(response); } })); }); @@ -119883,11 +119883,11 @@ var require_auth2 = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -119903,7 +119903,7 @@ var require_auth2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -119987,11 +119987,11 @@ var require_oidc_utils2 = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -120007,7 +120007,7 @@ var require_oidc_utils2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -120085,11 +120085,11 @@ var require_summary2 = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -120105,7 +120105,7 @@ var require_summary2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -120451,11 +120451,11 @@ var require_io_util2 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -120471,7 +120471,7 @@ var require_io_util2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -120624,11 +120624,11 @@ var require_io2 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -120644,7 +120644,7 @@ var require_io2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -120872,11 +120872,11 @@ var require_toolrunner2 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -120892,7 +120892,7 @@ var require_toolrunner2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -121120,7 +121120,7 @@ var require_toolrunner2 = __commonJS({ this.toolPath = path30.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); } this.toolPath = yield io9.which(this.toolPath, true); - return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15, reject) => __awaiter2(this, void 0, void 0, function* () { this._debug(`exec tool: ${this.toolPath}`); this._debug("arguments:"); for (const arg of this.args) { @@ -121203,7 +121203,7 @@ var require_toolrunner2 = __commonJS({ if (error3) { reject(error3); } else { - resolve14(exitCode); + resolve15(exitCode); } }); if (this.options.input) { @@ -121356,11 +121356,11 @@ var require_exec2 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -121376,7 +121376,7 @@ var require_exec2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -121467,11 +121467,11 @@ var require_platform2 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -121487,7 +121487,7 @@ var require_platform2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -121586,11 +121586,11 @@ var require_core3 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -121606,7 +121606,7 @@ var require_core3 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -122709,11 +122709,11 @@ var require_utils11 = __commonJS({ "use strict"; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -122729,7 +122729,7 @@ var require_utils11 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -122939,19 +122939,19 @@ Header Information: ${JSON.stringify(response.message.headers, void 0, 2)} exports2.getProperRetention = getProperRetention; function sleep(milliseconds) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => setTimeout(resolve14, milliseconds)); + return new Promise((resolve15) => setTimeout(resolve15, milliseconds)); }); } exports2.sleep = sleep; function digestForStream(stream2) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const crc64 = new crc64_1.default(); const md5 = crypto_1.default.createHash("md5"); stream2.on("data", (data) => { crc64.update(data); md5.update(data); - }).on("end", () => resolve14({ + }).on("end", () => resolve15({ crc64: crc64.digest("base64"), md5: md5.digest("base64") })).on("error", reject); @@ -123075,11 +123075,11 @@ var require_upload_gzip = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -123095,7 +123095,7 @@ var require_upload_gzip = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -123108,14 +123108,14 @@ var require_upload_gzip = __commonJS({ }, i); function verb(n) { i[n] = o[n] && function(v) { - return new Promise(function(resolve14, reject) { - v = o[n](v), settle(resolve14, reject, v.done, v.value); + return new Promise(function(resolve15, reject) { + v = o[n](v), settle(resolve15, reject, v.done, v.value); }); }; } - function settle(resolve14, reject, d, v) { + function settle(resolve15, reject, d, v) { Promise.resolve(v).then(function(v2) { - resolve14({ value: v2, done: d }); + resolve15({ value: v2, done: d }); }, reject); } }; @@ -123156,14 +123156,14 @@ var require_upload_gzip = __commonJS({ return Number.MAX_SAFE_INTEGER; } } - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const inputStream = fs32.createReadStream(originalFilePath); const gzip = zlib3.createGzip(); const outputStream = fs32.createWriteStream(tempFilePath); inputStream.pipe(gzip).pipe(outputStream); outputStream.on("finish", () => __awaiter2(this, void 0, void 0, function* () { const size = (yield stat2(tempFilePath)).size; - resolve14(size); + resolve15(size); })); outputStream.on("error", (error3) => { console.log(error3); @@ -123175,7 +123175,7 @@ var require_upload_gzip = __commonJS({ exports2.createGZipFileOnDisk = createGZipFileOnDisk; function createGZipFileInBuffer(originalFilePath) { return __awaiter2(this, void 0, void 0, function* () { - return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { + return new Promise((resolve15) => __awaiter2(this, void 0, void 0, function* () { var _a2, e_1, _b, _c; const inputStream = fs32.createReadStream(originalFilePath); const gzip = zlib3.createGzip(); @@ -123201,7 +123201,7 @@ var require_upload_gzip = __commonJS({ if (e_1) throw e_1.error; } } - resolve14(Buffer.concat(chunks)); + resolve15(Buffer.concat(chunks)); })); }); } @@ -123242,11 +123242,11 @@ var require_requestUtils2 = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -123262,7 +123262,7 @@ var require_requestUtils2 = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -123359,11 +123359,11 @@ var require_upload_http_client = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -123379,7 +123379,7 @@ var require_upload_http_client = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -123751,11 +123751,11 @@ var require_download_http_client = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -123771,7 +123771,7 @@ var require_download_http_client = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -123904,10 +123904,10 @@ var require_download_http_client = __commonJS({ }; const resetDestinationStream = (fileDownloadPath) => __awaiter2(this, void 0, void 0, function* () { destinationStream.close(); - yield new Promise((resolve14) => { - destinationStream.on("close", resolve14); + yield new Promise((resolve15) => { + destinationStream.on("close", resolve15); if (destinationStream.writableFinished) { - resolve14(); + resolve15(); } }); yield (0, utils_1.rmFile)(fileDownloadPath); @@ -123956,7 +123956,7 @@ var require_download_http_client = __commonJS({ */ pipeResponseToFile(response, destinationStream, isGzip) { return __awaiter2(this, void 0, void 0, function* () { - yield new Promise((resolve14, reject) => { + yield new Promise((resolve15, reject) => { if (isGzip) { const gunzip = zlib3.createGunzip(); response.message.on("error", (error3) => { @@ -123969,7 +123969,7 @@ var require_download_http_client = __commonJS({ destinationStream.close(); reject(error3); }).pipe(destinationStream).on("close", () => { - resolve14(); + resolve15(); }).on("error", (error3) => { core32.info(`An error occurred while writing a downloaded file to ${destinationStream.path}`); reject(error3); @@ -123980,7 +123980,7 @@ var require_download_http_client = __commonJS({ destinationStream.close(); reject(error3); }).pipe(destinationStream).on("close", () => { - resolve14(); + resolve15(); }).on("error", (error3) => { core32.info(`An error occurred while writing a downloaded file to ${destinationStream.path}`); reject(error3); @@ -124094,11 +124094,11 @@ var require_artifact_client = __commonJS({ }; var __awaiter2 = exports2 && exports2.__awaiter || function(thisArg, _arguments, P, generator) { function adopt(value) { - return value instanceof P ? value : new P(function(resolve14) { - resolve14(value); + return value instanceof P ? value : new P(function(resolve15) { + resolve15(value); }); } - return new (P || (P = Promise))(function(resolve14, reject) { + return new (P || (P = Promise))(function(resolve15, reject) { function fulfilled(value) { try { step(generator.next(value)); @@ -124114,7 +124114,7 @@ var require_artifact_client = __commonJS({ } } function step(result) { - result.done ? resolve14(result.value) : adopt(result.value).then(fulfilled, rejected); + result.done ? resolve15(result.value) : adopt(result.value).then(fulfilled, rejected); } step((generator = generator.apply(thisArg, _arguments || [])).next()); }); @@ -145904,8 +145904,8 @@ function durationMsSince(startTime) { } async function delay(milliseconds, opts) { const { allowProcessExit } = opts || {}; - return new Promise((resolve14) => { - const timer = setTimeout(resolve14, milliseconds); + return new Promise((resolve15) => { + const timer = setTimeout(resolve15, milliseconds); if (allowProcessExit) { timer.unref(); } @@ -147111,7 +147111,7 @@ var getGitRoot = async function(sourceRoot) { ["rev-parse", "--show-toplevel"], `Cannot find Git repository root from the source root ${sourceRoot}.` ); - return path4.normalize(stdout.trim()); + return path4.resolve(stdout.trim()); } catch { return void 0; } @@ -151730,7 +151730,7 @@ async function extractTarZst(tar, dest, tarVersion, logger) { args.push("-f", tar instanceof stream.Readable ? "-" : tar, "-C", dest); process.stdout.write(`[command]tar ${args.join(" ")} `); - await new Promise((resolve14, reject) => { + await new Promise((resolve15, reject) => { const tarProcess = (0, import_child_process.spawn)("tar", args, { stdio: "pipe" }); let stdout = ""; tarProcess.stdout?.on("data", (data) => { @@ -151766,7 +151766,7 @@ async function extractTarZst(tar, dest, tarVersion, logger) { ) ); } - resolve14(); + resolve15(); }); }); } catch (e) { @@ -151881,7 +151881,7 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio authorization ? { authorization } : {}, headers ); - const response = await new Promise((resolve14, reject) => { + const response = await new Promise((resolve15, reject) => { const request3 = import_follow_redirects.https.get( codeqlURL, { @@ -151891,7 +151891,7 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio // Use the agent to respect proxy settings. agent }, - (r) => resolve14(r) + (r) => resolve15(r) ); request3.on("error", reject); request3.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => { @@ -153823,20 +153823,21 @@ var CodeQLAnalysisError = class extends Error { }; async function determineCheckoutPath(action, config) { const checkoutPathInput = action.actions.getRequiredInput("checkout_path"); - const repositoryRoot = await getGitRoot(checkoutPathInput); + const absCheckoutPathInput = path16.resolve(checkoutPathInput); + const repositoryRoot = await getGitRoot(absCheckoutPathInput); if (repositoryRoot === void 0) { action.logger.warning( [ - `The directory at '${checkoutPathInput}' is not in the work tree of a git repository.`, + `The directory at '${absCheckoutPathInput}' is not in the work tree of a git repository.`, "If the repository being analyzed is checked out elsewhere,", "you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to", "the checkout path." ].join(" ") ); - } else if (repositoryRoot !== path16.resolve(checkoutPathInput)) { + } else if (repositoryRoot !== absCheckoutPathInput) { action.logger.warning( [ - `The directory at '${checkoutPathInput}' is not the root of the repository ('${repositoryRoot}').`, + `The directory at '${absCheckoutPathInput}' is not the root of the repository ('${repositoryRoot}').`, "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout." ].join(" ") ); @@ -153850,7 +153851,7 @@ async function determineCheckoutPath(action, config) { ].join(" ") ); } - return checkoutPathInput; + return absCheckoutPathInput; } async function setupPythonExtractor(logger) { const codeqlPython = process.env["CODEQL_PYTHON"]; @@ -154289,7 +154290,7 @@ async function cleanupAndUploadDatabases(action, repositoryNwo, codeql, config, logger.debug( `Database upload attempt ${attempt} of ${maxAttempts} failed for ${language}: ${getErrorMessage(e)}. Retrying in ${backoffMs / 1e3}s...` ); - await new Promise((resolve14) => setTimeout(resolve14, backoffMs)); + await new Promise((resolve15) => setTimeout(resolve15, backoffMs)); } } reports.push({ @@ -159645,11 +159646,11 @@ var Archiver = class extends import_readable_stream2.Transform { this._finalize(); } var self2 = this; - return new Promise(function(resolve14, reject) { + return new Promise(function(resolve15, reject) { var errored; self2._module.on("end", function() { if (!errored) { - resolve14(); + resolve15(); } }); self2._module.on("error", function(err) { @@ -164002,7 +164003,7 @@ var NetworkReachabilityBackend = class { proxy; agent; async checkConnection(url2) { - return new Promise((resolve14, reject) => { + return new Promise((resolve15, reject) => { const req = https2.request( url2, { @@ -164015,7 +164016,7 @@ var NetworkReachabilityBackend = class { (res) => { res.destroy(); if (res.statusCode !== void 0 && res.statusCode < 400) { - resolve14(res.statusCode); + resolve15(res.statusCode); } else { reject(new ReachabilityError(res.statusCode)); } diff --git a/src/analyze.test.ts b/src/analyze.test.ts index 88e592507..4ec428abb 100644 --- a/src/analyze.test.ts +++ b/src/analyze.test.ts @@ -33,13 +33,13 @@ setupTests(test); test.serial( "determineCheckoutPath - logs when checkout_path is not in a work tree", async (t) => { - const expectedPath = "/checkout/path"; + const expectedPath = path.resolve("/checkout/path"); const target = callee(determineCheckoutPath) .withActions((actions) => { sinon .stub(actions, "getRequiredInput") .withArgs("checkout_path") - .returns("/checkout/path"); + .returns(expectedPath); }) .withArgs(createTestConfig({})); sinon.stub(gitUtils, "getGitRoot").resolves(undefined); @@ -53,13 +53,13 @@ test.serial( test.serial( "determineCheckoutPath - logs when checkout_path is not a repo root", async (t) => { - const expectedPath = "/checkout/path"; + const expectedPath = path.resolve("/checkout/path"); const target = callee(determineCheckoutPath) .withActions((actions) => { sinon .stub(actions, "getRequiredInput") .withArgs("checkout_path") - .returns("/checkout/path"); + .returns(expectedPath); }) .withArgs(createTestConfig({})); sinon.stub(gitUtils, "getGitRoot").resolves("/checkout"); @@ -73,16 +73,16 @@ test.serial( test.serial( "determineCheckoutPath - logs when checkout_path is not the same as repo root in config", async (t) => { - const expectedPath = "/checkout/path"; + const expectedPath = path.resolve("/checkout/path"); const target = callee(determineCheckoutPath) .withActions((actions) => { sinon .stub(actions, "getRequiredInput") .withArgs("checkout_path") - .returns("/checkout/path"); + .returns(expectedPath); }) .withArgs(createTestConfig({ repositoryRoot: "/some/other/path" })); - sinon.stub(gitUtils, "getGitRoot").resolves("/checkout/path"); + sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath); await target .logs(t, "does not match that found by the 'codeql-action/init' step") @@ -93,16 +93,16 @@ test.serial( test.serial( "determineCheckoutPath - doesn't log any of the messages when all is as expected", async (t) => { - const expectedPath = "/checkout/path"; + const expectedPath = path.resolve("/checkout/path"); const target = callee(determineCheckoutPath) .withActions((actions) => { sinon .stub(actions, "getRequiredInput") .withArgs("checkout_path") - .returns("/checkout/path"); + .returns(expectedPath); }) - .withArgs(createTestConfig({ repositoryRoot: "/checkout/path" })); - sinon.stub(gitUtils, "getGitRoot").resolves("/checkout/path"); + .withArgs(createTestConfig({ repositoryRoot: expectedPath })); + sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath); await target .notLogs( diff --git a/src/analyze.ts b/src/analyze.ts index f1a1841f3..e482aa2ee 100644 --- a/src/analyze.ts +++ b/src/analyze.ts @@ -102,21 +102,22 @@ export async function determineCheckoutPath( const checkoutPathInput = action.actions.getRequiredInput("checkout_path"); // Try to obtain the root path of the repository and validate that it matches the input. - const repositoryRoot = await getGitRoot(checkoutPathInput); + const absCheckoutPathInput = path.resolve(checkoutPathInput); + const repositoryRoot = await getGitRoot(absCheckoutPathInput); if (repositoryRoot === undefined) { action.logger.warning( [ - `The directory at '${checkoutPathInput}' is not in the work tree of a git repository.`, + `The directory at '${absCheckoutPathInput}' is not in the work tree of a git repository.`, "If the repository being analyzed is checked out elsewhere,", "you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to", "the checkout path.", ].join(" "), ); - } else if (repositoryRoot !== path.resolve(checkoutPathInput)) { + } else if (repositoryRoot !== absCheckoutPathInput) { action.logger.warning( [ - `The directory at '${checkoutPathInput}' is not the root of the repository ('${repositoryRoot}').`, + `The directory at '${absCheckoutPathInput}' is not the root of the repository ('${repositoryRoot}').`, "Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout.", ].join(" "), ); @@ -135,7 +136,7 @@ export async function determineCheckoutPath( ); } - return checkoutPathInput; + return absCheckoutPathInput; } async function setupPythonExtractor(logger: Logger) { diff --git a/src/git-utils.ts b/src/git-utils.ts index da1189035..9045a7c3d 100644 --- a/src/git-utils.ts +++ b/src/git-utils.ts @@ -245,7 +245,7 @@ export const getGitRoot = async function ( ["rev-parse", "--show-toplevel"], `Cannot find Git repository root from the source root ${sourceRoot}.`, ); - return path.normalize(stdout.trim()); + return path.resolve(stdout.trim()); } catch { // Errors are already logged by runGitCommand() return undefined; From c2215db9ae4573ad44ad55d6030d072f42038ba0 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 28 Sep 2026 10:51:26 +0100 Subject: [PATCH 09/58] Update `git-utils` tests --- src/git-utils.test.ts | 38 ++++++++++++++++++++++++++------------ 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/src/git-utils.test.ts b/src/git-utils.test.ts index 6f5f37401..0240a0950 100644 --- a/src/git-utils.test.ts +++ b/src/git-utils.test.ts @@ -34,13 +34,15 @@ test.serial( }); const callback = sinon.stub(gitUtils, "getCommitOid"); - callback.withArgs(sinon.match.string, "HEAD").resolves(currentSha); + callback + .withArgs(sinon.match.any, sinon.match.string, "HEAD") + .resolves(currentSha); const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, expectedRef); t.is(callback.callCount, 1); - t.true(callback.calledOnceWith(tmpDir, "HEAD")); + t.true(callback.calledOnceWith(env, tmpDir, "HEAD")); }); }, ); @@ -60,16 +62,22 @@ test.serial( const callback = sinon.stub(gitUtils, "getCommitOid"); callback - .withArgs(sinon.match.string, "refs/remotes/pull/1/merge") + .withArgs( + sinon.match.any, + sinon.match.string, + "refs/remotes/pull/1/merge", + ) + .resolves(sha); + callback + .withArgs(sinon.match.any, sinon.match.string, "HEAD") .resolves(sha); - callback.withArgs(sinon.match.any, "HEAD").resolves(sha); const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, expectedRef); t.is(callback.callCount, 2); - t.true(callback.calledWith(tmpDir, "HEAD")); - t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge")); + t.true(callback.calledWith(env, tmpDir, "HEAD")); + t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge")); }); }, ); @@ -87,17 +95,19 @@ test.serial( const callback = sinon.stub(gitUtils, "getCommitOid"); callback - .withArgs(tmpDir, "refs/remotes/pull/1/merge") + .withArgs(sinon.match.any, tmpDir, "refs/remotes/pull/1/merge") .resolves("a".repeat(40)); - callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40)); + callback + .withArgs(sinon.match.any, tmpDir, "HEAD") + .resolves("b".repeat(40)); callback.throws(new Error("Unexpected getCommitOid call in test.")); const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, "refs/pull/1/head"); t.is(callback.callCount, 2); - t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge")); - t.true(callback.calledWith(tmpDir, "HEAD")); + t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge")); + t.true(callback.calledWith(env, tmpDir, "HEAD")); }); }, ); @@ -122,8 +132,12 @@ test.serial( }); const callback = sinon.stub(gitUtils, "getCommitOid"); - callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("b".repeat(40)); - callback.withArgs(sinon.match.any, "HEAD").resolves("b".repeat(40)); + callback + .withArgs(sinon.match.any, tmpDir, "refs/pull/1/merge") + .resolves("b".repeat(40)); + callback + .withArgs(sinon.match.any, sinon.match.string, "HEAD") + .resolves("b".repeat(40)); const actualRef = await gitUtils.getRef(env, tmpDir); t.deepEqual(actualRef, "refs/pull/2/merge"); From 909fda1468f8ef25624848914b92c3faeba7cfe7 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 13:36:35 +0100 Subject: [PATCH 10/58] Allow logging functions to accept `string[]` directly --- lib/entry-points.js | 20 ++++++++++++++++---- src/logging.test.ts | 17 +++++++++++++++++ src/logging.ts | 43 +++++++++++++++++++++++++++++++++++-------- src/testing-utils.ts | 14 +++++++------- 4 files changed, 75 insertions(+), 19 deletions(-) create mode 100644 src/logging.test.ts diff --git a/lib/entry-points.js b/lib/entry-points.js index ad7ac988a..1a75678e9 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -170435,12 +170435,24 @@ function fixCodeQualityCategory(logger2, category, env = getEnv()) { // src/logging.ts var core4 = __toESM(require_core()); +var joinMessageStrings = (message) => { + if (Array.isArray(message)) { + return message.join(" "); + } else { + return message; + } +}; +var autoJoinMessageStrings = (fn) => { + return (message) => { + return fn(joinMessageStrings(message)); + }; +}; function getActionsLogger() { return { - debug: core4.debug, - info: core4.info, - warning: core4.warning, - error: core4.error, + debug: autoJoinMessageStrings(core4.debug), + info: autoJoinMessageStrings(core4.info), + warning: autoJoinMessageStrings(core4.warning), + error: autoJoinMessageStrings(core4.error), isDebug: core4.isDebug, startGroup: core4.startGroup, endGroup: core4.endGroup diff --git a/src/logging.test.ts b/src/logging.test.ts new file mode 100644 index 000000000..33f6f8c16 --- /dev/null +++ b/src/logging.test.ts @@ -0,0 +1,17 @@ +import test from "ava"; + +import { joinMessageStrings } from "./logging"; +import { setupTests } from "./testing-utils"; + +setupTests(test); + +test("joinMessageStrings", async (t) => { + // For strings and errors, it is the identity function. + t.deepEqual(joinMessageStrings("Hello"), "Hello"); + + const error = new Error("Some error"); + t.deepEqual(joinMessageStrings(error), error); + + // For arrays of strings, we get a join-ed string. + t.deepEqual(joinMessageStrings(["foo", "bar"]), "foo bar"); +}); diff --git a/src/logging.ts b/src/logging.ts index 2c34cb54d..177aca6c7 100644 --- a/src/logging.ts +++ b/src/logging.ts @@ -1,10 +1,16 @@ import * as core from "@actions/core"; +/** Types that all of our logging functions accept. */ +export type Loggable = string | string[]; + +/** Some logging functions also accept errors directly. */ +export type LoggableError = Loggable | Error; + export interface Logger { - debug: (message: string) => void; - info: (message: string) => void; - warning: (message: string | Error) => void; - error: (message: string | Error) => void; + debug: (message: Loggable) => void; + info: (message: Loggable) => void; + warning: (message: LoggableError) => void; + error: (message: LoggableError) => void; isDebug: () => boolean; @@ -12,12 +18,33 @@ export interface Logger { endGroup: () => void; } +/** If `message` is an array of strings, the array is `join`-ed into one string separated by spaces. */ +export const joinMessageStrings = ( + message: string[] | string | T, +): string | T => { + if (Array.isArray(message)) { + return message.join(" "); + } else { + return message; + } +}; + +/** + * Wraps a logging function so that `joinMessageStrings` is applied to the input before + * calling the wrapped logging function. + */ +const autoJoinMessageStrings = (fn: (msg: string | T) => void) => { + return (message: string[] | string | T) => { + return fn(joinMessageStrings(message)); + }; +}; + export function getActionsLogger(): Logger { return { - debug: core.debug, - info: core.info, - warning: core.warning, - error: core.error, + debug: autoJoinMessageStrings(core.debug), + info: autoJoinMessageStrings(core.info), + warning: autoJoinMessageStrings(core.warning), + error: autoJoinMessageStrings(core.error), isDebug: core.isDebug, startGroup: core.startGroup, endGroup: core.endGroup, diff --git a/src/testing-utils.ts b/src/testing-utils.ts index a5ba50554..df81f51bb 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -30,7 +30,7 @@ import { featureConfig, FeatureEnablement, } from "./feature-flags"; -import { Logger } from "./logging"; +import { joinMessageStrings, Loggable, LoggableError, Logger } from "./logging"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import { getBundlePlatform } from "./platform"; import { ActionName } from "./status-report"; @@ -622,8 +622,8 @@ export class RecordingLogger implements Logger { constructor(private readonly logToConsole: boolean = true) {} - private addMessage(level: LogLevel, message: string | Error): void { - this.messages.push({ type: level, message }); + private addMessage(level: LogLevel, message: LoggableError): void { + this.messages.push({ type: level, message: joinMessageStrings(message) }); if (this.logToConsole) { // eslint-disable-next-line no-console @@ -648,19 +648,19 @@ export class RecordingLogger implements Logger { return true; } - debug(message: string) { + debug(message: Loggable) { this.addMessage("debug", message); } - info(message: string) { + info(message: Loggable) { this.addMessage("info", message); } - warning(message: string | Error) { + warning(message: LoggableError) { this.addMessage("warning", message); } - error(message: string | Error) { + error(message: LoggableError) { this.addMessage("error", message); } From cb7acf539626ded596e80ac0f4d7c38fc25a89d6 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 13:45:35 +0100 Subject: [PATCH 11/58] Refactor `getCodeQLActionRepository` out of `setup-codeql` --- lib/entry-points.js | 22 ++++++++++++---------- src/setup-codeql.test.ts | 18 ------------------ src/setup-codeql.ts | 20 ++++---------------- src/setup/repository.test.ts | 31 +++++++++++++++++++++++++++++++ src/setup/repository.ts | 19 +++++++++++++++++++ 5 files changed, 66 insertions(+), 44 deletions(-) create mode 100644 src/setup/repository.test.ts create mode 100644 src/setup/repository.ts diff --git a/lib/entry-points.js b/lib/entry-points.js index 1a75678e9..f0cc985d1 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -175634,6 +175634,18 @@ function logPerLanguageBundleFallback({ logger: logger2 }, language, location) { ); } +// src/setup/repository.ts +var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; +function getCodeQLActionRepository(logger2) { + if (isRunningLocalAction()) { + logger2.info( + "The CodeQL Action is checked out locally. Using the default CodeQL Action repository." + ); + return CODEQL_DEFAULT_ACTION_REPOSITORY; + } + return getRequiredEnvParam("GITHUB_ACTION_REPOSITORY"); +} + // src/tar.ts var import_child_process = require("child_process"); var fs12 = __toESM(require("fs")); @@ -176025,21 +176037,11 @@ function writeToolcacheMarkerFile(extractedPath, logger2) { } // src/setup-codeql.ts -var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; var CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing"; var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies"; var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"]; var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"]; var CODEQL_TOOLCACHE_INPUT = "toolcache"; -function getCodeQLActionRepository(logger2) { - if (isRunningLocalAction()) { - logger2.info( - "The CodeQL Action is checked out locally. Using the default CodeQL Action repository." - ); - return CODEQL_DEFAULT_ACTION_REPOSITORY; - } - return getRequiredEnvParam("GITHUB_ACTION_REPOSITORY"); -} async function getCodeQLBundleDownloadURL(tagName, apiDetails, codeQLBundleName, logger2) { const codeQLActionRepository = getCodeQLActionRepository(logger2); const potentialDownloadSources = [ diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index c33ac0700..e7a93455f 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -126,24 +126,6 @@ test.serial("convert to semver", (t) => { } }); -test.serial("getCodeQLActionRepository", (t) => { - const logger = getRunnerLogger(true); - - initializeEnvironment("1.2.3"); - - // isRunningLocalAction() === true - delete process.env["GITHUB_ACTION_REPOSITORY"]; - process.env["RUNNER_TEMP"] = path.dirname(__dirname); - const repoLocalRunner = setupCodeql.getCodeQLActionRepository(logger); - t.deepEqual(repoLocalRunner, "github/codeql-action"); - - // isRunningLocalAction() === false - sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); - process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy"; - const repoEnv = setupCodeql.getCodeQLActionRepository(logger); - t.deepEqual(repoEnv, "xxx/yyy"); -}); - test.serial( "getCodeQLSource sets CLI version for a semver tagged bundle", async (t) => { diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index d306d40d6..793191b8b 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -14,7 +14,6 @@ import { isAnalyzingPullRequest, isDynamicWorkflow, isGitHubHostedRunner, - isRunningLocalAction, } from "./actions-util"; import * as api from "./api-client"; import { @@ -45,6 +44,10 @@ import { logPerLanguageBundleFallback, } from "./per-language-bundles"; import { getBundlePlatform } from "./platform"; +import { + CODEQL_DEFAULT_ACTION_REPOSITORY, + getCodeQLActionRepository, +} from "./setup/repository"; import * as tar from "./tar"; import { deleteToolcacheBundles, @@ -66,7 +69,6 @@ export enum ToolsSource { Download = "DOWNLOAD", } -const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; const CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing"; const CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies"; @@ -74,20 +76,6 @@ const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"]; const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"]; const CODEQL_TOOLCACHE_INPUT = "toolcache"; -export function getCodeQLActionRepository(logger: Logger): string { - if (isRunningLocalAction()) { - // This handles the case where the Action does not come from an Action repository, - // e.g. our integration tests which use the Action code from the current checkout. - // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set. - logger.info( - "The CodeQL Action is checked out locally. Using the default CodeQL Action repository.", - ); - return CODEQL_DEFAULT_ACTION_REPOSITORY; - } - - return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY"); -} - async function getCodeQLBundleDownloadURL( tagName: string, apiDetails: api.GitHubApiDetails, diff --git a/src/setup/repository.test.ts b/src/setup/repository.test.ts new file mode 100644 index 000000000..c3dccbf9c --- /dev/null +++ b/src/setup/repository.test.ts @@ -0,0 +1,31 @@ +import * as path from "path"; + +import test from "ava"; +import * as sinon from "sinon"; + +import * as actionsUtil from "../actions-util"; +import { getRunnerLogger } from "../logging"; +import { setupTests } from "../testing-utils"; +import { initializeEnvironment } from "../util"; + +import { getCodeQLActionRepository } from "./repository"; + +setupTests(test); + +test.serial("getCodeQLActionRepository", (t) => { + const logger = getRunnerLogger(true); + + initializeEnvironment("1.2.3"); + + // isRunningLocalAction() === true + delete process.env["GITHUB_ACTION_REPOSITORY"]; + process.env["RUNNER_TEMP"] = path.dirname(__dirname); + const repoLocalRunner = getCodeQLActionRepository(logger); + t.deepEqual(repoLocalRunner, "github/codeql-action"); + + // isRunningLocalAction() === false + sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); + process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy"; + const repoEnv = getCodeQLActionRepository(logger); + t.deepEqual(repoEnv, "xxx/yyy"); +}); diff --git a/src/setup/repository.ts b/src/setup/repository.ts new file mode 100644 index 000000000..908cc39ee --- /dev/null +++ b/src/setup/repository.ts @@ -0,0 +1,19 @@ +import { isRunningLocalAction } from "../actions-util"; +import { Logger } from "../logging"; +import * as util from "../util"; + +export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; + +export function getCodeQLActionRepository(logger: Logger): string { + if (isRunningLocalAction()) { + // This handles the case where the Action does not come from an Action repository, + // e.g. our integration tests which use the Action code from the current checkout. + // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set. + logger.info( + "The CodeQL Action is checked out locally. Using the default CodeQL Action repository.", + ); + return CODEQL_DEFAULT_ACTION_REPOSITORY; + } + + return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY"); +} From 3f57a005543dac0b43f0fa212b72e5c09612cfa0 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 14:00:12 +0100 Subject: [PATCH 12/58] Use `ActionState` for `getCodeQLActionRepository` --- lib/entry-points.js | 13 ++++++++----- src/actions-util.ts | 4 ++-- src/setup-codeql.ts | 5 ++++- src/setup/repository.test.ts | 27 +++++++++++++++------------ src/setup/repository.ts | 23 +++++++++++++++++------ 5 files changed, 46 insertions(+), 26 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index f0cc985d1..3a4bdcb05 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -175636,14 +175636,14 @@ function logPerLanguageBundleFallback({ logger: logger2 }, language, location) { // src/setup/repository.ts var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; -function getCodeQLActionRepository(logger2) { - if (isRunningLocalAction()) { - logger2.info( +function getCodeQLActionRepository(action) { + if (isRunningLocalAction(action.env)) { + action.logger.info( "The CodeQL Action is checked out locally. Using the default CodeQL Action repository." ); return CODEQL_DEFAULT_ACTION_REPOSITORY; } - return getRequiredEnvParam("GITHUB_ACTION_REPOSITORY"); + return action.env.getRequired("GITHUB_ACTION_REPOSITORY" /* GITHUB_ACTION_REPOSITORY */); } // src/tar.ts @@ -176043,7 +176043,10 @@ var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"]; var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"]; var CODEQL_TOOLCACHE_INPUT = "toolcache"; async function getCodeQLBundleDownloadURL(tagName, apiDetails, codeQLBundleName, logger2) { - const codeQLActionRepository = getCodeQLActionRepository(logger2); + const codeQLActionRepository = getCodeQLActionRepository({ + logger: logger2, + env: getEnv() + }); const potentialDownloadSources = [ // This GitHub instance, and this Action. [apiDetails.url, codeQLActionRepository], diff --git a/src/actions-util.ts b/src/actions-util.ts index 6c7d6a78d..d51fdbe1d 100644 --- a/src/actions-util.ts +++ b/src/actions-util.ts @@ -103,7 +103,7 @@ export function getWorkflowEventName(env: Env = getEnv()) { * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running * a workflow on the codeql-action repo itself. */ -export function isRunningLocalAction(env: Env = getEnv()): boolean { +export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean { const relativeScriptPath = getRelativeScriptPath(env); return ( relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath) @@ -115,7 +115,7 @@ export function isRunningLocalAction(env: Env = getEnv()): boolean { * * This can be used to get the Action's name or tell if we're running a local Action. */ -function getRelativeScriptPath(env: Env): string { +function getRelativeScriptPath(env: ReadOnlyEnv): string { const runnerTemp = env.getRequired(ActionsEnvVars.RUNNER_TEMP); const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions"); return path.relative(actionsDirectory, __filename); diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 793191b8b..c97729471 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -82,7 +82,10 @@ async function getCodeQLBundleDownloadURL( codeQLBundleName: string, logger: Logger, ): Promise { - const codeQLActionRepository = getCodeQLActionRepository(logger); + const codeQLActionRepository = getCodeQLActionRepository({ + logger, + env: getEnv(), + }); const potentialDownloadSources = [ // This GitHub instance, and this Action. [apiDetails.url, codeQLActionRepository], diff --git a/src/setup/repository.test.ts b/src/setup/repository.test.ts index c3dccbf9c..56eb74786 100644 --- a/src/setup/repository.test.ts +++ b/src/setup/repository.test.ts @@ -4,28 +4,31 @@ import test from "ava"; import * as sinon from "sinon"; import * as actionsUtil from "../actions-util"; -import { getRunnerLogger } from "../logging"; -import { setupTests } from "../testing-utils"; +import { ActionsEnvVars } from "../environment"; +import { callee, setupTests } from "../testing-utils"; import { initializeEnvironment } from "../util"; import { getCodeQLActionRepository } from "./repository"; setupTests(test); -test.serial("getCodeQLActionRepository", (t) => { - const logger = getRunnerLogger(true); - +test.serial("getCodeQLActionRepository", async (t) => { initializeEnvironment("1.2.3"); + const target = callee(getCodeQLActionRepository) + .withArgs() + .withEnv((env) => { + env.set(ActionsEnvVars.RUNNER_TEMP, path.dirname(__dirname)); + }); + // isRunningLocalAction() === true - delete process.env["GITHUB_ACTION_REPOSITORY"]; - process.env["RUNNER_TEMP"] = path.dirname(__dirname); - const repoLocalRunner = getCodeQLActionRepository(logger); - t.deepEqual(repoLocalRunner, "github/codeql-action"); + await target.passes(t.deepEqual, "github/codeql-action"); // isRunningLocalAction() === false sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); - process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy"; - const repoEnv = getCodeQLActionRepository(logger); - t.deepEqual(repoEnv, "xxx/yyy"); + await target + .withEnv((env) => { + env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "xxx/yyy"); + }) + .passes(t.deepEqual, "xxx/yyy"); }); diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 908cc39ee..c58470630 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -1,19 +1,30 @@ +import { ActionState } from "../action-common"; import { isRunningLocalAction } from "../actions-util"; -import { Logger } from "../logging"; -import * as util from "../util"; +import { ActionsEnvVars } from "../environment"; +/** The NWO of the standard CodeQL Action repository. */ export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; -export function getCodeQLActionRepository(logger: Logger): string { - if (isRunningLocalAction()) { +/** + * Retrieves the NWO of the repository that the CodeQL Action is loaded from. + * Typically, this will be `github/codeql-action`, but it may be something else for + * forks of the Action or in environments other than GitHub.com. + * + * If this function detects that we are running the Action locally (e.g. in tests), + * then we default to `CODEQL_DEFAULT_ACTION_REPOSITORY`. + */ +export function getCodeQLActionRepository( + action: ActionState<["ReadOnlyEnv", "Logger"]>, +): string { + if (isRunningLocalAction(action.env)) { // This handles the case where the Action does not come from an Action repository, // e.g. our integration tests which use the Action code from the current checkout. // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set. - logger.info( + action.logger.info( "The CodeQL Action is checked out locally. Using the default CodeQL Action repository.", ); return CODEQL_DEFAULT_ACTION_REPOSITORY; } - return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY"); + return action.env.getRequired(ActionsEnvVars.GITHUB_ACTION_REPOSITORY); } From da07d40a0f387325a497ae40e0e02b45044b7f38 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 14:29:42 +0100 Subject: [PATCH 13/58] Refactor `getCodeQLBundleDownloadURL` out of `setup-codeql` --- lib/entry-points.js | 172 ++++++++++++++++------------------------ package-lock.json | 2 +- package.json | 1 - src/setup-codeql.ts | 73 ++--------------- src/setup/repository.ts | 99 +++++++++++++++++++++++ 5 files changed, 176 insertions(+), 171 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 3a4bdcb05..71b6915a9 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -42967,11 +42967,11 @@ var require_tracingPolicy = __commonJS({ var import_log = require_log3(); var import_core_util = require_commonjs4(); var import_restError = require_restError3(); - var import_util58 = require_internal3(); + var import_util59 = require_internal3(); var tracingPolicyName2 = "tracingPolicy"; function tracingPolicy2(options = {}) { const userAgentPromise = (0, import_userAgent.getUserAgentValue)(options.userAgentPrefix); - const sanitizer = new import_util58.Sanitizer({ + const sanitizer = new import_util59.Sanitizer({ additionalAllowedQueryParameters: options.additionalAllowedQueryParameters }); const tracingClient = tryCreateTracingClient(); @@ -46597,11 +46597,11 @@ var require_response2 = __commonJS({ }); module2.exports = __toCommonJS2(response_exports); var import_core_rest_pipeline = require_commonjs6(); - var import_util58 = require_util9(); + var import_util59 = require_util9(); var originalResponse = /* @__PURE__ */ Symbol("Original FullOperationResponse"); function toCompatResponse2(response, options) { - let request3 = (0, import_util58.toWebResourceLike)(response.request); - let headers = (0, import_util58.toHttpHeadersLike)(response.headers); + let request3 = (0, import_util59.toWebResourceLike)(response.request); + let headers = (0, import_util59.toHttpHeadersLike)(response.headers); if (options?.createProxy) { return new Proxy(response, { get(target, prop, receiver) { @@ -46642,7 +46642,7 @@ var require_response2 = __commonJS({ return { ...compatResponse, headers, - request: (0, import_util58.toPipelineRequest)(compatResponse.request) + request: (0, import_util59.toPipelineRequest)(compatResponse.request) }; } } @@ -46749,7 +46749,7 @@ var require_requestPolicyFactoryPolicy = __commonJS({ requestPolicyFactoryPolicyName: () => requestPolicyFactoryPolicyName2 }); module2.exports = __toCommonJS2(requestPolicyFactoryPolicy_exports); - var import_util58 = require_util9(); + var import_util59 = require_util9(); var import_response = require_response2(); var HttpPipelineLogLevel2 = /* @__PURE__ */ ((HttpPipelineLogLevel22) => { HttpPipelineLogLevel22[HttpPipelineLogLevel22["ERROR"] = 1] = "ERROR"; @@ -46773,14 +46773,14 @@ var require_requestPolicyFactoryPolicy = __commonJS({ async sendRequest(request3, next) { let httpPipeline = { async sendRequest(httpRequest) { - const response2 = await next((0, import_util58.toPipelineRequest)(httpRequest)); + const response2 = await next((0, import_util59.toPipelineRequest)(httpRequest)); return (0, import_response.toCompatResponse)(response2, { createProxy: true }); } }; for (const factory of orderedFactories) { httpPipeline = factory.create(httpPipeline, mockRequestPolicyOptions); } - const webResourceLike = (0, import_util58.toWebResourceLike)(request3, { createProxy: true }); + const webResourceLike = (0, import_util59.toWebResourceLike)(request3, { createProxy: true }); const response = await httpPipeline.sendRequest(webResourceLike); return (0, import_response.toPipelineResponse)(response); } @@ -46815,12 +46815,12 @@ var require_httpClientAdapter = __commonJS({ }); module2.exports = __toCommonJS2(httpClientAdapter_exports); var import_response = require_response2(); - var import_util58 = require_util9(); + var import_util59 = require_util9(); function convertHttpClient2(requestPolicyClient) { return { sendRequest: async (request3) => { const response = await requestPolicyClient.sendRequest( - (0, import_util58.toWebResourceLike)(request3, { createProxy: true }) + (0, import_util59.toWebResourceLike)(request3, { createProxy: true }) ); return (0, import_response.toPipelineResponse)(response); } @@ -46858,7 +46858,7 @@ var require_commonjs9 = __commonJS({ disableKeepAlivePolicyName: () => import_disableKeepAlivePolicy.disableKeepAlivePolicyName, requestPolicyFactoryPolicyName: () => import_requestPolicyFactoryPolicy.requestPolicyFactoryPolicyName, toCompatResponse: () => import_response.toCompatResponse, - toHttpHeadersLike: () => import_util58.toHttpHeadersLike + toHttpHeadersLike: () => import_util59.toHttpHeadersLike }); module2.exports = __toCommonJS2(src_exports); var import_extendedClient = require_extendedClient(); @@ -46866,7 +46866,7 @@ var require_commonjs9 = __commonJS({ var import_requestPolicyFactoryPolicy = require_requestPolicyFactoryPolicy(); var import_disableKeepAlivePolicy = require_disableKeepAlivePolicy(); var import_httpClientAdapter = require_httpClientAdapter(); - var import_util58 = require_util9(); + var import_util59 = require_util9(); } }); @@ -107096,41 +107096,6 @@ var require_tool_cache = __commonJS({ } }); -// node_modules/fast-deep-equal/index.js -var require_fast_deep_equal = __commonJS({ - "node_modules/fast-deep-equal/index.js"(exports2, module2) { - "use strict"; - module2.exports = function equal(a, b) { - if (a === b) return true; - if (a && b && typeof a == "object" && typeof b == "object") { - if (a.constructor !== b.constructor) return false; - var length, i, keys; - if (Array.isArray(a)) { - length = a.length; - if (length != b.length) return false; - for (i = length; i-- !== 0; ) - if (!equal(a[i], b[i])) return false; - return true; - } - if (a.constructor === RegExp) return a.source === b.source && a.flags === b.flags; - if (a.valueOf !== Object.prototype.valueOf) return a.valueOf() === b.valueOf(); - if (a.toString !== Object.prototype.toString) return a.toString() === b.toString(); - keys = Object.keys(a); - length = keys.length; - if (length !== Object.keys(b).length) return false; - for (i = length; i-- !== 0; ) - if (!Object.prototype.hasOwnProperty.call(b, keys[i])) return false; - for (i = length; i-- !== 0; ) { - var key = keys[i]; - if (!equal(a[key], b[key])) return false; - } - return true; - } - return a !== a && b !== b; - }; - } -}); - // node_modules/follow-redirects/debug.js var require_debug3 = __commonJS({ "node_modules/follow-redirects/debug.js"(exports2, module2) { @@ -175209,7 +175174,6 @@ var path13 = __toESM(require("path")); var import_perf_hooks4 = require("perf_hooks"); var core12 = __toESM(require_core()); var toolcache3 = __toESM(require_tool_cache()); -var import_fast_deep_equal = __toESM(require_fast_deep_equal()); var semver10 = __toESM(require_semver2()); // src/codeql-bundle.ts @@ -175645,6 +175609,55 @@ function getCodeQLActionRepository(action) { } return action.env.getRequired("GITHUB_ACTION_REPOSITORY" /* GITHUB_ACTION_REPOSITORY */); } +var DEFAULT_DOWNLOAD_SOURCE = [ + GITHUB_DOTCOM_URL, + CODEQL_DEFAULT_ACTION_REPOSITORY +]; +var isSameDownloadSource = ([srcUrl, srcRepo], [otherUrl, otherRepo]) => { + return srcUrl === otherUrl && srcRepo === otherRepo; +}; +async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, assetKind = "CodeQL bundle") { + const codeQLActionRepository = getCodeQLActionRepository(action); + const potentialDownloadSources = [ + // This GitHub instance, and this Action. + [apiDetails.url, codeQLActionRepository], + // This GitHub instance, and the canonical Action. + [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY], + // GitHub.com, and the canonical Action. + DEFAULT_DOWNLOAD_SOURCE + ]; + const uniqueDownloadSources = potentialDownloadSources.filter( + (source, index2, self2) => { + return !self2.slice(0, index2).some((other) => isSameDownloadSource(source, other)); + } + ); + for (const [apiURL, repository] of uniqueDownloadSources) { + if (isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [apiURL, repository])) { + break; + } + const [repositoryOwner, repositoryName] = repository.split("/"); + try { + const release2 = await getApiClient().rest.repos.getReleaseByTag({ + owner: repositoryOwner, + repo: repositoryName, + tag: tagName + }); + for (const asset of release2.data.assets) { + if (asset.name === assetName) { + action.logger.info( + `Found ${assetKind} ${assetName} in ${repository} on ${apiURL} with URL ${asset.url}.` + ); + return asset.url; + } + } + } catch (e) { + action.logger.info( + `Looked for ${assetKind} ${assetName} in ${repository} on ${apiURL} but got error ${e}.` + ); + } + } + return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; +} // src/tar.ts var import_child_process = require("child_process"); @@ -176042,52 +176055,6 @@ var CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies"; var CODEQL_BUNDLE_VERSION_ALIAS = ["linked", "latest"]; var CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"]; var CODEQL_TOOLCACHE_INPUT = "toolcache"; -async function getCodeQLBundleDownloadURL(tagName, apiDetails, codeQLBundleName, logger2) { - const codeQLActionRepository = getCodeQLActionRepository({ - logger: logger2, - env: getEnv() - }); - const potentialDownloadSources = [ - // This GitHub instance, and this Action. - [apiDetails.url, codeQLActionRepository], - // This GitHub instance, and the canonical Action. - [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY], - // GitHub.com, and the canonical Action. - [GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY] - ]; - const uniqueDownloadSources = potentialDownloadSources.filter( - (source, index2, self2) => { - return !self2.slice(0, index2).some((other) => (0, import_fast_deep_equal.default)(source, other)); - } - ); - for (const downloadSource of uniqueDownloadSources) { - const [apiURL, repository] = downloadSource; - if (apiURL === GITHUB_DOTCOM_URL && repository === CODEQL_DEFAULT_ACTION_REPOSITORY) { - break; - } - const [repositoryOwner, repositoryName] = repository.split("/"); - try { - const release2 = await getApiClient().rest.repos.getReleaseByTag({ - owner: repositoryOwner, - repo: repositoryName, - tag: tagName - }); - for (const asset of release2.data.assets) { - if (asset.name === codeQLBundleName) { - logger2.info( - `Found CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} with URL ${asset.url}.` - ); - return asset.url; - } - } - } catch (e) { - logger2.info( - `Looked for CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} but got error ${e}.` - ); - } - } - return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${codeQLBundleName}`; -} function tryGetBundleVersionFromTagName(tagName, logger2) { const match2 = tagName.match(/^codeql-bundle-(.+)$/); if (match2 === null || match2.length < 2) { @@ -176444,9 +176411,10 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO ); } compressionMethod = cliVersion2 !== void 0 && await useZstdBundle(cliVersion2, tarSupportsZstd) ? "zstd" : "gzip"; + const action = { env: getEnv(), logger: logger2 }; const platform2 = getBundlePlatform(); const perLanguageBundleLanguage = await getPerLanguageBundleLanguage( - { env: getEnv(), features, logger: logger2 }, + { ...action, features }, { rawLanguages, cliVersion: cliVersion2, @@ -176455,11 +176423,11 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO variant } ); - const resolveBundleURL = (language) => getCodeQLBundleDownloadURL( - bundleTagName, + const resolveBundleURL = (language) => getCodeQLAssetDownloadURL( + action, apiDetails, - getCodeQLBundleName(compressionMethod, platform2, language), - logger2 + bundleTagName, + getCodeQLBundleName(compressionMethod, platform2, language) ); const combinedBundleURL = await resolveBundleURL(); if (perLanguageBundleLanguage !== void 0) { @@ -182926,7 +182894,7 @@ var import_async = __toESM(require_async(), 1); var import_path7 = require("path"); // node_modules/archiver/lib/error.js -var import_util36 = __toESM(require("util"), 1); +var import_util37 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -182951,7 +182919,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util36.default.inherits(ArchiverError, Error); +import_util37.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); diff --git a/package-lock.json b/package-lock.json index 27bf393bf..8d3781fe5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -27,7 +27,6 @@ "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", - "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", @@ -5817,6 +5816,7 @@ }, "node_modules/fast-deep-equal": { "version": "3.1.3", + "dev": true, "license": "MIT" }, "node_modules/fast-diff": { diff --git a/package.json b/package.json index 5ebf14292..52c11027f 100644 --- a/package.json +++ b/package.json @@ -35,7 +35,6 @@ "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", - "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index c97729471..29a1809e4 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -5,7 +5,6 @@ import { performance } from "perf_hooks"; import * as core from "@actions/core"; import * as toolcache from "@actions/tool-cache"; -import { default as deepEqual } from "fast-deep-equal"; import * as semver from "semver"; import { v4 as uuidV4 } from "uuid"; @@ -44,10 +43,7 @@ import { logPerLanguageBundleFallback, } from "./per-language-bundles"; import { getBundlePlatform } from "./platform"; -import { - CODEQL_DEFAULT_ACTION_REPOSITORY, - getCodeQLActionRepository, -} from "./setup/repository"; +import { getCodeQLAssetDownloadURL } from "./setup/repository"; import * as tar from "./tar"; import { deleteToolcacheBundles, @@ -76,64 +72,6 @@ const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"]; const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"]; const CODEQL_TOOLCACHE_INPUT = "toolcache"; -async function getCodeQLBundleDownloadURL( - tagName: string, - apiDetails: api.GitHubApiDetails, - codeQLBundleName: string, - logger: Logger, -): Promise { - const codeQLActionRepository = getCodeQLActionRepository({ - logger, - env: getEnv(), - }); - const potentialDownloadSources = [ - // This GitHub instance, and this Action. - [apiDetails.url, codeQLActionRepository], - // This GitHub instance, and the canonical Action. - [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY], - // GitHub.com, and the canonical Action. - [util.GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY], - ]; - // We now filter out any duplicates. - // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork. - const uniqueDownloadSources = potentialDownloadSources.filter( - (source, index, self) => { - return !self.slice(0, index).some((other) => deepEqual(source, other)); - }, - ); - for (const downloadSource of uniqueDownloadSources) { - const [apiURL, repository] = downloadSource; - // If we've reached the final case, short-circuit the API check since we know the bundle exists and is public. - if ( - apiURL === util.GITHUB_DOTCOM_URL && - repository === CODEQL_DEFAULT_ACTION_REPOSITORY - ) { - break; - } - const [repositoryOwner, repositoryName] = repository.split("/"); - try { - const release = await api.getApiClient().rest.repos.getReleaseByTag({ - owner: repositoryOwner, - repo: repositoryName, - tag: tagName, - }); - for (const asset of release.data.assets) { - if (asset.name === codeQLBundleName) { - logger.info( - `Found CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} with URL ${asset.url}.`, - ); - return asset.url; - } - } - } catch (e) { - logger.info( - `Looked for CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} but got error ${e}.`, - ); - } - } - return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${codeQLBundleName}`; -} - function tryGetBundleVersionFromTagName( tagName: string, logger: Logger, @@ -707,9 +645,10 @@ export async function getCodeQLSource( ? "zstd" : "gzip"; + const action = { env: getEnv(), logger }; const platform = getBundlePlatform(); const perLanguageBundleLanguage = await getPerLanguageBundleLanguage( - { env: getEnv(), features, logger }, + { ...action, features }, { rawLanguages, cliVersion, @@ -721,11 +660,11 @@ export async function getCodeQLSource( // Resolves the combined or per-language bundle URL for the requested release. const resolveBundleURL = (language?: BuiltInLanguage) => - getCodeQLBundleDownloadURL( - bundleTagName, + getCodeQLAssetDownloadURL( + action, apiDetails, + bundleTagName, getCodeQLBundleName(compressionMethod, platform, language), - logger, ); const combinedBundleURL = await resolveBundleURL(); diff --git a/src/setup/repository.ts b/src/setup/repository.ts index c58470630..53ca44f3e 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -1,6 +1,8 @@ import { ActionState } from "../action-common"; import { isRunningLocalAction } from "../actions-util"; +import * as api from "../api-client"; import { ActionsEnvVars } from "../environment"; +import { GITHUB_DOTCOM_URL } from "../util"; /** The NWO of the standard CodeQL Action repository. */ export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; @@ -28,3 +30,100 @@ export function getCodeQLActionRepository( return action.env.getRequired(ActionsEnvVars.GITHUB_ACTION_REPOSITORY); } + +/**A download source is a pair of strings. */ +export type DownloadSource = [string, string]; + +/** GitHub.com, and the canonical Action. */ +export const DEFAULT_DOWNLOAD_SOURCE: DownloadSource = [ + GITHUB_DOTCOM_URL, + CODEQL_DEFAULT_ACTION_REPOSITORY, +]; + +/** Decides if the two provided download sources are the same. */ +const isSameDownloadSource = ( + [srcUrl, srcRepo]: DownloadSource, + [otherUrl, otherRepo]: DownloadSource, +) => { + return srcUrl === otherUrl && srcRepo === otherRepo; +}; + +/** A download URL is represented as a string. */ +export type DownloadURL = string; + +/** + * Tries to find a download URL for `assetName` in a release tagged with `tagName`. + * + * Depending on where and how the CodeQL Action is running, we may be using different `apiDetails` and there may be + * different options for where to source CodeQL releases from. + * + * This function either returns the download URL for the asset for the first release we find, or + * defaults to the assumed download URL for the asset on the default CodeQL Action repository on GitHub.com. + * In the latter case, this function does not guarantee that the asset actually exists. + * + * @param action The Action state. + * @param apiDetails The details of the GitHub API in use. + * @param tagName The name of the release tag we want to obtain the asset from. + * @param assetName The name of the asset we should look for in the release. + * @param [assetKind="CodeQL bundle"] The kind of asset we are looking for to show in log messages. + * @returns A URL that we can use to download the asset. + */ +export async function getCodeQLAssetDownloadURL( + action: ActionState<["ReadOnlyEnv", "Logger"]>, + apiDetails: api.GitHubApiDetails, + tagName: string, + assetName: string, + assetKind: "CodeQL bundle" = "CodeQL bundle", +): Promise { + const codeQLActionRepository = getCodeQLActionRepository(action); + + const potentialDownloadSources: Array<[string, string]> = [ + // This GitHub instance, and this Action. + [apiDetails.url, codeQLActionRepository], + // This GitHub instance, and the canonical Action. + [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY], + // GitHub.com, and the canonical Action. + DEFAULT_DOWNLOAD_SOURCE, + ]; + + // We now filter out any duplicates. + // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork. + const uniqueDownloadSources = potentialDownloadSources.filter( + (source, index, self) => { + return !self + .slice(0, index) + .some((other) => isSameDownloadSource(source, other)); + }, + ); + + for (const [apiURL, repository] of uniqueDownloadSources) { + // If we've reached the final case, short-circuit the API check since we know the bundle exists and is public. + if (isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [apiURL, repository])) { + break; + } + + const [repositoryOwner, repositoryName] = repository.split("/"); + try { + const release = await api.getApiClient().rest.repos.getReleaseByTag({ + owner: repositoryOwner, + repo: repositoryName, + tag: tagName, + }); + + for (const asset of release.data.assets) { + if (asset.name === assetName) { + action.logger.info( + `Found ${assetKind} ${assetName} in ${repository} on ${apiURL} with URL ${asset.url}.`, + ); + return asset.url; + } + } + } catch (e) { + action.logger.info( + `Looked for ${assetKind} ${assetName} in ${repository} on ${apiURL} but got error ${e}.`, + ); + } + } + + return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; +} From 35f12ded428e57cae1cfa0e0c84b789eb44a4fda Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 16:10:21 +0100 Subject: [PATCH 14/58] Add utility for assertions on sinon stubs with better output by default --- src/testing-utils.ts | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/src/testing-utils.ts b/src/testing-utils.ts index df81f51bb..2b188857a 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -163,6 +163,34 @@ export function setupTests(testFn: TestFn) { }); } +export interface AvaSinonAssertions { + /** + * Asserts that `stub` must have been called once with at least the `expected` arguments. + */ + onceWith: ( + stub: sinon.SinonStub, + ...expected: sinon.MatchPartialArguments + ) => boolean; +} + +/** Adds additional assertions for use with `sinon` to `t`. */ +export function addSinonAssertions( + t: ExecutionContext, +): ExecutionContext & AvaSinonAssertions { + return { + ...t, + onceWith: (stub, ...expected) => { + if (stub.callCount > 0) { + // Reduce the arguments of the first call to the same number that was provided, + // so that extra arguments don't lead to a failure. + return t.deepEqual(stub.args[0].slice(0, expected.length), expected); + } else { + return t.fail("The stub wasn't called."); + } + }, + }; +} + /** * Declare a reusable test implementation, with better type safety than `test.macro`. */ From a4f9f6fc121605c2b77d8dd9d562eb148dba7c13 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 16:11:27 +0100 Subject: [PATCH 15/58] Type the `assetKind` parameter --- src/setup/repository.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 53ca44f3e..4101be677 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -51,6 +51,9 @@ const isSameDownloadSource = ( /** A download URL is represented as a string. */ export type DownloadURL = string; +/** Enumerates log-friendly descriptions of different kinds of assets we might look for in releases. */ +export type ReleaseAssetKind = "CodeQL bundle" | "private registry proxy"; + /** * Tries to find a download URL for `assetName` in a release tagged with `tagName`. * @@ -73,7 +76,7 @@ export async function getCodeQLAssetDownloadURL( apiDetails: api.GitHubApiDetails, tagName: string, assetName: string, - assetKind: "CodeQL bundle" = "CodeQL bundle", + assetKind: ReleaseAssetKind = "CodeQL bundle", ): Promise { const codeQLActionRepository = getCodeQLActionRepository(action); From de99f0ee4b789bac85c60c23cf5617af3a93e08f Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 16:30:20 +0100 Subject: [PATCH 16/58] Add `getDefaultDotComDownloadURL` --- lib/entry-points.js | 5 ++++- src/setup/repository.ts | 10 +++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 71b6915a9..49d38c393 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -175616,6 +175616,9 @@ var DEFAULT_DOWNLOAD_SOURCE = [ var isSameDownloadSource = ([srcUrl, srcRepo], [otherUrl, otherRepo]) => { return srcUrl === otherUrl && srcRepo === otherRepo; }; +function getDefaultDotComDownloadURL(tagName, assetName) { + return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; +} async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, assetKind = "CodeQL bundle") { const codeQLActionRepository = getCodeQLActionRepository(action); const potentialDownloadSources = [ @@ -175656,7 +175659,7 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, ); } } - return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; + return getDefaultDotComDownloadURL(tagName, assetName); } // src/tar.ts diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 4101be677..3d760858e 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -51,6 +51,14 @@ const isSameDownloadSource = ( /** A download URL is represented as a string. */ export type DownloadURL = string; +/** Gets the default GitHub.com download URL for `assetName` in a release tagged `tagName`. */ +export function getDefaultDotComDownloadURL( + tagName: string, + assetName: string, +): DownloadURL { + return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; +} + /** Enumerates log-friendly descriptions of different kinds of assets we might look for in releases. */ export type ReleaseAssetKind = "CodeQL bundle" | "private registry proxy"; @@ -128,5 +136,5 @@ export async function getCodeQLAssetDownloadURL( } } - return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; + return getDefaultDotComDownloadURL(tagName, assetName); } From 133ffebe62eccf0a18bf2fa6f884063a7fd6ff7d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 16:13:32 +0100 Subject: [PATCH 17/58] Use `getCodeQLAssetDownloadURL` for `start-proxy` --- lib/entry-points.js | 62 +++++--------- src/start-proxy-action.ts | 7 +- src/start-proxy.test.ts | 175 +++++++++++++++++++++++++------------- src/start-proxy.ts | 82 +++++------------- 4 files changed, 167 insertions(+), 159 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 49d38c393..84c57c813 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187489,8 +187489,6 @@ async function sendFailedStatusReport(logger2, startedAt, language, unwrappedErr } } var UPDATEJOB_PROXY = "update-job-proxy"; -var UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901"; -var UPDATEJOB_PROXY_URL_PREFIX = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/"; function isPAT(value) { return isAuthToken(value, [ GITHUB_PAT_CLASSIC_PATTERN, @@ -187608,21 +187606,11 @@ function getCredentials(logger2, registrySecrets, registriesCredentials, languag function getProxyPackage(platform2) { return `${UPDATEJOB_PROXY}-${platform2}.tar.gz`; } -function getFallbackUrl(proxyPackage) { - return `${UPDATEJOB_PROXY_URL_PREFIX}${proxyPackage}`; -} -async function getReleaseByVersion(version) { - return getApiClient().rest.repos.getReleaseByTag({ - owner: "github", - repo: "codeql-action", - tag: version - }); -} async function getCliVersionFromFeatures(features) { const gitHubVersion = await getGitHubVersion(); return await features.getEnabledDefaultCliVersions(gitHubVersion.type); } -async function getDownloadUrl(action) { +async function getDownloadUrl(action, apiDetails) { let platform2 = getBundlePlatform(action.platform, action.arch); if (platform2 === void 0) { action.logger.warning( @@ -187639,33 +187627,25 @@ async function getDownloadUrl(action) { cliVersion, tagName: bundleVersion }; - const cliRelease = await getReleaseByVersion(versionInfo.tagName); - for (const asset of cliRelease.data.assets) { - if (asset.name === proxyPackage) { - action.logger.info( - `Found '${proxyPackage}' in release '${versionInfo.tagName}' at '${asset.url}'` - ); - return { - url: asset.url, - // The `update-job-proxy` doesn't have a version as such. Since we now bundle it - // with CodeQL CLI bundle releases, we use the corresponding CLI version to - // differentiate between (potentially) different versions of `update-job-proxy`. - version: versionInfo.cliVersion - }; - } - } + const proxyAssetUrl = await getCodeQLAssetDownloadURL( + action, + apiDetails, + versionInfo.tagName, + proxyPackage, + "private registry proxy" + ); + return { + url: proxyAssetUrl, + // The `update-job-proxy` doesn't have a version as such. Since we now bundle it + // with CodeQL CLI bundle releases, we use the corresponding CLI version to + // differentiate between (potentially) different versions of `update-job-proxy`. + version: versionInfo.cliVersion + }; } catch (ex) { - action.logger.warning( + throw new Error( `Failed to retrieve information about the linked release: ${getErrorMessage(ex)}` ); } - action.logger.info( - `Did not find '${proxyPackage}' in the linked release, falling back to hard-coded version.` - ); - return { - url: getFallbackUrl(proxyPackage), - version: UPDATEJOB_PROXY_VERSION - }; } async function downloadProxy(logger2, url2, authorization) { try { @@ -187708,13 +187688,12 @@ async function cacheProxy(logger2, source, filename, version) { function getProxyFilename() { return process.platform === "win32" ? `${UPDATEJOB_PROXY}.exe` : UPDATEJOB_PROXY; } -async function getProxyBinaryPath(action) { +async function getProxyBinaryPath(action, apiDetails) { const logger2 = action.logger; const proxyFileName = getProxyFilename(); - const proxyInfo = await getDownloadUrl(action); + const proxyInfo = await getDownloadUrl(action, apiDetails); let proxyBin = toolcache4.find(proxyFileName, proxyInfo.version); if (!proxyBin) { - const apiDetails = getApiDetails(); const authorization = getAuthorizationHeaderFor( logger2, apiDetails, @@ -188091,7 +188070,10 @@ async function run7(action) { all_credentials: credentials, ca }; - const proxyBin = await getProxyBinaryPath({ ...action, features }); + const proxyBin = await getProxyBinaryPath( + { ...action, features }, + getApiDetails(action.env) + ); const proxyInfo = await startProxy( proxyBin, proxyConfig, diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index d965a2dd6..b9c7795ef 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -5,7 +5,7 @@ import * as core from "@actions/core"; import { Action, ActionState, runInActions } from "./action-common"; import * as actionsUtil from "./actions-util"; -import { getGitHubVersion } from "./api-client"; +import { getApiDetails, getGitHubVersion } from "./api-client"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; import { Logger } from "./logging"; @@ -98,7 +98,10 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { }; // Start the Proxy - const proxyBin = await getProxyBinaryPath({ ...action, features }); + const proxyBin = await getProxyBinaryPath( + { ...action, features }, + getApiDetails(action.env), + ); const proxyInfo = await startProxy( proxyBin, proxyConfig, diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts index bd2489713..b0bdd7bd3 100644 --- a/src/start-proxy.test.ts +++ b/src/start-proxy.test.ts @@ -6,17 +6,21 @@ import test, { ExecutionContext } from "ava"; import sinon from "sinon"; import { ActionState } from "./action-common"; +import * as actionsUtil from "./actions-util"; import * as apiClient from "./api-client"; import * as defaults from "./defaults.json"; +import { ActionsEnvVars } from "./environment"; import { setUpFeatureFlagTests } from "./feature-flags/testing-util"; import { UnvalidatedObject, validateSchema } from "./json"; import { makeFromSchema } from "./json/testing-util"; import { BuiltInLanguage } from "./languages"; import { getRunnerLogger, Logger } from "./logging"; import { BundlePlatform, getBundlePlatform } from "./platform"; +import * as repository from "./setup/repository"; import * as startProxyExports from "./start-proxy"; import * as statusReport from "./status-report"; import { + addSinonAssertions, assertNotLogged, checkExpectedLogMessages, createFeatures, @@ -24,6 +28,7 @@ import { makeMacro, makeTestToken, RecordingLogger, + SAMPLE_DOTCOM_API_DETAILS, setupTests, withRecordingLoggerAsync, } from "./testing-utils"; @@ -705,15 +710,23 @@ function mockGetApiClient(endpoints: any) { type ReleaseAssets = Array<{ name: string; url?: string }>; -function mockGetReleaseByTag(assets?: ReleaseAssets) { +function mockGetReleaseByTag(expectedTag?: string, assets?: ReleaseAssets) { const getReleaseByTag = assets === undefined ? sinon.stub().rejects() - : sinon.stub().resolves({ - status: 200, - data: { assets }, - headers: {}, - url: "GET /repos/:owner/:repo/releases/tags/:tag", + : sinon.stub().callsFake(({ tag }) => { + if (tag === expectedTag) { + return { + status: 200, + data: { assets }, + headers: {}, + url: "GET /repos/:owner/:repo/releases/tags/:tag", + }; + } else { + return { + status: 404, + }; + } }); return mockGetApiClient({ repos: { getReleaseByTag } }); @@ -751,25 +764,33 @@ test.serial( logger, features, }); - const info = await startProxyExports.getDownloadUrl(state); - t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION); - t.is( - info.url, - startProxyExports.getFallbackUrl( - startProxyExports.getProxyPackage(BundlePlatform.Linux64), - ), + // Stub this to always return `true` so we get the default repo for the tests. + sinon.stub(actionsUtil, "isRunningLocalAction").returns(true); + + const info = await startProxyExports.getDownloadUrl( + state, + SAMPLE_DOTCOM_API_DETAILS, ); t.true( logger.hasMessage(`Unsupported platform android on architecture ppc`), ); + + t.is(info.version, defaults.cliVersion); + t.is( + info.url, + repository.getDefaultDotComDownloadURL( + defaults.bundleVersion, + startProxyExports.getProxyPackage(BundlePlatform.Linux64), + ), + ); }); }, ); test.serial( - "getDownloadUrl returns fallback when `getReleaseByVersion` rejects", + "getDownloadUrl returns default bundle URL for linked version", async (t) => { const logger = new RecordingLogger(); mockGetReleaseByTag(); @@ -777,12 +798,20 @@ test.serial( await withTmpDir(async (tempDir) => { const features = mockOfflineFeatures(tempDir, logger); const state = initAllState({ logger, features }); - const info = await startProxyExports.getDownloadUrl(state); - t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION); + // Stub this to always return `true` so we get the default repo for the tests. + sinon.stub(actionsUtil, "isRunningLocalAction").returns(true); + + const info = await startProxyExports.getDownloadUrl( + state, + SAMPLE_DOTCOM_API_DETAILS, + ); + + t.is(info.version, defaults.cliVersion); t.is( info.url, - startProxyExports.getFallbackUrl( + repository.getDefaultDotComDownloadURL( + defaults.bundleVersion, startProxyExports.getProxyPackage(getTestPlatform(state)), ), ); @@ -791,7 +820,7 @@ test.serial( ); test.serial( - "getDownloadUrl returns fallback when there's no matching release asset", + "getDownloadUrl doesn't check that the default asset exists", async (t) => { const logger = new RecordingLogger(); const testAssets = [[], [{ name: "foo" }]]; @@ -800,14 +829,21 @@ test.serial( const features = mockOfflineFeatures(tempDir, logger); const state = initAllState({ logger, features }); - for (const assets of testAssets) { - const stub = mockGetReleaseByTag(assets); - const info = await startProxyExports.getDownloadUrl(state); + // Stub this to always return `true` so we get the default repo for the tests. + sinon.stub(actionsUtil, "isRunningLocalAction").returns(true); - t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION); + for (const assets of testAssets) { + const stub = mockGetReleaseByTag(defaults.bundleVersion, assets); + const info = await startProxyExports.getDownloadUrl( + state, + SAMPLE_DOTCOM_API_DETAILS, + ); + + t.is(info.version, defaults.cliVersion); t.is( info.url, - startProxyExports.getFallbackUrl( + repository.getDefaultDotComDownloadURL( + defaults.bundleVersion, startProxyExports.getProxyPackage(getTestPlatform(state)), ), ); @@ -828,11 +864,22 @@ test.serial("getDownloadUrl returns matching release asset", async (t) => { url: "url-we-want", }, ]; - mockGetReleaseByTag(assets); + const getReleaseByTag = mockGetReleaseByTag(defaults.bundleVersion, assets); await withTmpDir(async (tempDir) => { + state.env.set(ActionsEnvVars.RUNNER_TEMP, tempDir); const features = mockOfflineFeatures(tempDir, logger); - const info = await startProxyExports.getDownloadUrl({ ...state, features }); + + // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API. + sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); + state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo"); + + const info = await startProxyExports.getDownloadUrl( + { ...state, features }, + SAMPLE_DOTCOM_API_DETAILS, + ); + + t.is(getReleaseByTag.callCount, 1); t.is(info.version, defaults.cliVersion); t.is(info.url, "url-we-want"); @@ -965,9 +1012,13 @@ test.serial( const toolcachePath = "/path/to/proxy/dir"; sinon.stub(toolcache, "find").returns(toolcachePath); + // Stub this to always return `true` so we get the default repo for the tests. + sinon.stub(actionsUtil, "isRunningLocalAction").returns(true); + const features = mockOfflineFeatures(tempDir, logger); const path = await startProxyExports.getProxyBinaryPath( initAllState({ logger, features }), + SAMPLE_DOTCOM_API_DETAILS, ); t.assert(path); @@ -985,7 +1036,7 @@ test.serial( const logger = new RecordingLogger(); const state = initAllState({ logger }); const downloadUrl = "url-we-want"; - mockGetReleaseByTag([ + const getApiClient = mockGetReleaseByTag(defaults.bundleVersion, [ { name: startProxyExports.getProxyPackage(getTestPlatform(state)), url: downloadUrl, @@ -994,11 +1045,6 @@ test.serial( const toolcachePath = "/path/to/proxy/dir"; const find = sinon.stub(toolcache, "find").returns(""); - const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({ - auth: "", - url: "", - apiURL: "", - }); const getAuthorizationHeaderFor = sinon .stub(apiClient, "getAuthorizationHeaderFor") .returns(undefined); @@ -1012,15 +1058,27 @@ test.serial( .resolves(extractedPath); const cacheDir = sinon.stub(toolcache, "cacheDir").resolves(toolcachePath); - const path = await startProxyExports.getProxyBinaryPath({ - ...state, - features: createFeatures([]), - }); + // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API. + sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); + state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo"); + const path = await startProxyExports.getProxyBinaryPath( + { + ...state, + features: createFeatures([]), + }, + SAMPLE_DOTCOM_API_DETAILS, + ); + + t.is(getApiClient.callCount, 1); t.assert(find.calledOnce); - t.assert(getApiDetails.calledOnce); t.assert(getAuthorizationHeaderFor.calledOnce); - t.assert(downloadTool.calledOnceWith(downloadUrl)); + + const st = addSinonAssertions(t); + st.onceWith(downloadTool, downloadUrl); + st.onceWith(extractTar, archivePath); + st.onceWith(cacheDir, extractedPath); + t.assert(extractTar.calledOnceWith(archivePath)); t.assert(cacheDir.calledOnceWith(extractedPath)); t.assert(path); @@ -1030,7 +1088,7 @@ test.serial( ); checkExpectedLogMessages(t, logger.messages, [ - `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${defaults.bundleVersion}' at '${downloadUrl}'`, + `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://github.com with URL ${downloadUrl}`, ]); }, ); @@ -1042,8 +1100,8 @@ test.serial( const state = initAllState({ logger }); const expectedTag = "codeql-bundle-v2.20.1"; const expectedParams = { - owner: "github", - repo: "codeql-action", + owner: "test", + repo: "repo", tag: expectedTag, }; const downloadUrl = "url-we-want"; @@ -1066,11 +1124,6 @@ test.serial( await withTmpDir(async (tempDir) => { const toolcachePath = "/path/to/proxy/dir"; const find = sinon.stub(toolcache, "find").returns(""); - const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({ - auth: "", - url: "", - apiURL: "", - }); const getAuthorizationHeaderFor = sinon .stub(apiClient, "getAuthorizationHeaderFor") .returns(undefined); @@ -1100,22 +1153,28 @@ test.serial( .resolves({ enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }], }); - const path = await startProxyExports.getProxyBinaryPath({ - ...state, - features, - }); + + // Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API. + sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); + state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo"); + + const path = await startProxyExports.getProxyBinaryPath( + { + ...state, + features, + }, + SAMPLE_DOTCOM_API_DETAILS, + ); t.assert(getDefaultCliVersion.calledOnce); - sinon.assert.calledOnceWithMatch( - getReleaseByTag, - sinon.match(expectedParams), - ); + + const st = addSinonAssertions(t); + st.onceWith(getReleaseByTag, expectedParams); t.assert(find.calledOnce); - t.assert(getApiDetails.calledOnce); t.assert(getAuthorizationHeaderFor.calledOnce); - t.assert(downloadTool.calledOnceWith(downloadUrl)); - t.assert(extractTar.calledOnceWith(archivePath)); - t.assert(cacheDir.calledOnceWith(extractedPath)); + st.onceWith(downloadTool, downloadUrl); + st.onceWith(extractTar, archivePath); + st.onceWith(cacheDir, extractedPath); t.assert(path); t.is( @@ -1125,7 +1184,7 @@ test.serial( }); checkExpectedLogMessages(t, logger.messages, [ - `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${expectedTag}' at '${downloadUrl}'`, + `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://github.com with URL url-we-want.`, ]); }, ); diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 6221c9940..9558b119e 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -5,10 +5,9 @@ import * as toolcache from "@actions/tool-cache"; import { ActionState } from "./action-common"; import { - getApiClient, - getApiDetails, getAuthorizationHeaderFor, getGitHubVersion, + GitHubApiDetails, } from "./api-client"; import * as artifactScanner from "./artifact-scanner"; import { Config } from "./config-utils"; @@ -22,6 +21,7 @@ import * as json from "./json"; import { BuiltInLanguage } from "./languages"; import { Logger } from "./logging"; import { BundlePlatform, getBundlePlatform } from "./platform"; +import { getCodeQLAssetDownloadURL } from "./setup/repository"; import { Address, Registry, @@ -171,10 +171,8 @@ export async function sendFailedStatusReport( } } +/** The basename of the proxy artifacts. */ export const UPDATEJOB_PROXY = "update-job-proxy"; -export const UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901"; -const UPDATEJOB_PROXY_URL_PREFIX = - "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/"; function isPAT(value: string) { return artifactScanner.isAuthToken(value, [ @@ -379,30 +377,6 @@ export function getProxyPackage(platform: BundlePlatform): string { return `${UPDATEJOB_PROXY}-${platform}.tar.gz`; } -/** - * Gets the fallback URL for downloading the proxy release asset. - * - * @param proxyPackage The asset name. - * @returns The full URL to download the specified asset from the fallback release. - */ -export function getFallbackUrl(proxyPackage: string): string { - return `${UPDATEJOB_PROXY_URL_PREFIX}${proxyPackage}`; -} - -/** - * Uses the GitHub API to obtain information about the CodeQL CLI bundle release - * that is tagged by `version`. - * - * @returns The response from the GitHub API. - */ -async function getReleaseByVersion(version: string) { - return getApiClient().rest.repos.getReleaseByTag({ - owner: "github", - repo: "codeql-action", - tag: version, - }); -} - /** Uses `features` to determine the default CLI version. */ async function getCliVersionFromFeatures( features: FeatureEnablement, @@ -419,7 +393,8 @@ async function getCliVersionFromFeatures( * @returns Returns the download URL and version of the proxy package we plan to use. */ export async function getDownloadUrl( - action: ActionState<["Base", "Logger", "FeatureFlags"]>, + action: ActionState<["Base", "ReadOnlyEnv", "Logger", "FeatureFlags"]>, + apiDetails: GitHubApiDetails, ): Promise<{ url: string; version: string }> { // Default to linux64 if we don't recognise the platform+arch pair. // This maintains the behaviour we had before switching to `getBundlePlatform` here. @@ -448,37 +423,26 @@ export async function getDownloadUrl( }; // Try to retrieve information about the CLI bundle release identified by `versionInfo`. - const cliRelease = await getReleaseByVersion(versionInfo.tagName); + const proxyAssetUrl = await getCodeQLAssetDownloadURL( + action, + apiDetails, + versionInfo.tagName, + proxyPackage, + "private registry proxy", + ); - // Search the release's assets to find the one we are looking for. - for (const asset of cliRelease.data.assets) { - if (asset.name === proxyPackage) { - action.logger.info( - `Found '${proxyPackage}' in release '${versionInfo.tagName}' at '${asset.url}'`, - ); - return { - url: asset.url, - // The `update-job-proxy` doesn't have a version as such. Since we now bundle it - // with CodeQL CLI bundle releases, we use the corresponding CLI version to - // differentiate between (potentially) different versions of `update-job-proxy`. - version: versionInfo.cliVersion, - }; - } - } + return { + url: proxyAssetUrl, + // The `update-job-proxy` doesn't have a version as such. Since we now bundle it + // with CodeQL CLI bundle releases, we use the corresponding CLI version to + // differentiate between (potentially) different versions of `update-job-proxy`. + version: versionInfo.cliVersion, + }; } catch (ex) { - action.logger.warning( + throw new Error( `Failed to retrieve information about the linked release: ${getErrorMessage(ex)}`, ); } - - // Fallback to the hard-coded URL. - action.logger.info( - `Did not find '${proxyPackage}' in the linked release, falling back to hard-coded version.`, - ); - return { - url: getFallbackUrl(proxyPackage), - version: UPDATEJOB_PROXY_VERSION, - }; } /** @@ -569,15 +533,15 @@ export function getProxyFilename() { * @returns The path to the proxy binary. */ export async function getProxyBinaryPath( - action: ActionState<["Base", "Logger", "FeatureFlags"]>, + action: ActionState<["Base", "ReadOnlyEnv", "Logger", "FeatureFlags"]>, + apiDetails: GitHubApiDetails, ): Promise { const logger = action.logger; const proxyFileName = getProxyFilename(); - const proxyInfo = await getDownloadUrl(action); + const proxyInfo = await getDownloadUrl(action, apiDetails); let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); if (!proxyBin) { - const apiDetails = getApiDetails(); const authorization = getAuthorizationHeaderFor( logger, apiDetails, From f9a9962aa30c39b96d0879722aeb8c3fb5bb9bbf Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 6 Oct 2026 17:26:09 +0100 Subject: [PATCH 18/58] Fix `onceWith` not asserting the `once` part --- src/testing-utils.ts | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 2b188857a..4e8d17520 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -179,13 +179,25 @@ export function addSinonAssertions( ): ExecutionContext & AvaSinonAssertions { return { ...t, - onceWith: (stub, ...expected) => { - if (stub.callCount > 0) { - // Reduce the arguments of the first call to the same number that was provided, - // so that extra arguments don't lead to a failure. - return t.deepEqual(stub.args[0].slice(0, expected.length), expected); + onceWith: ( + stub: sinon.SinonStub, + ...expected: sinon.MatchPartialArguments + ) => { + // Fail if the stub hasn't been called at all so that we can safely compare + // the arguments of the first call in the else branch. + if (stub.callCount === 0) { + t.fail("The stub wasn't called."); } else { - return t.fail("The stub wasn't called."); + // Reduce the arguments of each to the same number that was provided, + // so that extra arguments don't lead to a failure. + const actual = stub.args.map>( + (args: TArgs) => + args.slice( + 0, + expected.length, + ) as sinon.MatchPartialArguments, + ); + return t.deepEqual(actual, [expected]); } }, }; From 9a9f454be59475b0d0e8b38c4ededb813cd423da Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 6 Oct 2026 10:47:23 -0500 Subject: [PATCH 19/58] Hoist core of `changenotes.mts assemble` into own function --- pr-checks/changenotes.ts | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/pr-checks/changenotes.ts b/pr-checks/changenotes.ts index 933d255cd..a5888a411 100755 --- a/pr-checks/changenotes.ts +++ b/pr-checks/changenotes.ts @@ -50,6 +50,28 @@ function getChangenotes(): ChangenoteFile[] { }); } +/** + * Populates the '[UNRELEASED]' section of CHANGELOG.md with the contents + * of the changenotes in {@link CHANGENOTES_DIR} and then deletes those changenotes. + * @param contents The contents of CHANGELOG.md + * @returns The updated contents of CHANGELOG.md + */ +export function transferChangenotesToChangelog(contents: string): string { + const changenotes = getChangenotes(); + const changenoteBodies = changenotes.map((c) => c.content); + const changenotePaths = changenotes.map((c) => c.absolutePath); + + const changelog = parseChangelog(contents); + addBodyLinesToUnreleasedSection(changelog, changenoteBodies); + const updatedChangelog = renderChangelog(changelog); + + for (const p of changenotePaths) { + fs.unlinkSync(p); + } + + return updatedChangelog; +} + const entryPoint = process.argv[1]; if (entryPoint && import.meta.url === pathToFileURL(entryPoint).href) { try { @@ -91,26 +113,13 @@ function usage(): ExitCode { function assemble(): ExitCode { try { - const changenotes = getChangenotes(); - const changenoteBodies = changenotes.map((c) => c.content); - const changenotePaths = changenotes.map((c) => c.absolutePath); - withChangelog((contents) => { - const changelog = parseChangelog(contents); - addBodyLinesToUnreleasedSection(changelog, changenoteBodies); - return renderChangelog(changelog); + return transferChangenotesToChangelog(contents); }, {}); - - // Delete changenotes only after successful processing. - for (const p of changenotePaths) { - fs.unlinkSync(p); - } - return ExitCode.Success; } catch (e) { console.error("Failed to assemble changenotes to 'CHANGELOG.md'", e); } - return ExitCode.Failure; } From fb4048e3e76e624a364b1f97ca4017bd9d92d626 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 6 Oct 2026 10:51:08 -0500 Subject: [PATCH 20/58] Transfer change-notes to CHANGELOG.md via update-release-branch.ts --- pr-checks/update-release-branch.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pr-checks/update-release-branch.ts b/pr-checks/update-release-branch.ts index 93e50f7ad..736e95b61 100755 --- a/pr-checks/update-release-branch.ts +++ b/pr-checks/update-release-branch.ts @@ -23,6 +23,7 @@ import { parseArgs } from "node:util"; import { type ApiClient, getApiClient } from "./api-client"; import * as changelog from "./changelog"; +import { transferChangenotesToChangelog } from "./changenotes"; import { DryRunOption, REPO_ROOT } from "./config"; import { getCurrentVersion, @@ -693,7 +694,10 @@ export async function prepareNewBranch( console.log("Updating changelog"); changelog.withChangelog( - (contents) => changelog.setVersionAndDate(version, contents), + (contents) => { + const populatedContents = transferChangenotesToChangelog(contents); + return changelog.setVersionAndDate(version, populatedContents); + }, { ...options, initChangelog: true }, ); From badda692f46e206a8144c3017fb33d8417b31cc6 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 6 Oct 2026 12:16:16 -0500 Subject: [PATCH 21/58] Trim whitespace of change-notes before insertion --- pr-checks/changenotes.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/changenotes.ts b/pr-checks/changenotes.ts index a5888a411..d05f4ea89 100755 --- a/pr-checks/changenotes.ts +++ b/pr-checks/changenotes.ts @@ -58,7 +58,7 @@ function getChangenotes(): ChangenoteFile[] { */ export function transferChangenotesToChangelog(contents: string): string { const changenotes = getChangenotes(); - const changenoteBodies = changenotes.map((c) => c.content); + const changenoteBodies = changenotes.map((c) => c.content.trim()); const changenotePaths = changenotes.map((c) => c.absolutePath); const changelog = parseChangelog(contents); From 0f6901c9a809585a1989e73114ffc5f81a356445 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 6 Oct 2026 13:52:08 -0500 Subject: [PATCH 22/58] Commit change-note deletions --- pr-checks/update-release-branch.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/update-release-branch.ts b/pr-checks/update-release-branch.ts index 736e95b61..d6d50f628 100755 --- a/pr-checks/update-release-branch.ts +++ b/pr-checks/update-release-branch.ts @@ -701,7 +701,7 @@ export async function prepareNewBranch( { ...options, initChangelog: true }, ); - runGit(["add", "CHANGELOG.md"], { + runGit(["add", "CHANGELOG.md", "unreleased-change-notes"], { dryRun: options.dryRun, }); runGit(["commit", "-m", `Update changelog for v${version}`], { From aae22cc693c64bb85f59e3376879149e16e6889c Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 6 Oct 2026 14:50:28 -0500 Subject: [PATCH 23/58] Use config vars over hardcoded literals --- pr-checks/update-release-branch.ts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pr-checks/update-release-branch.ts b/pr-checks/update-release-branch.ts index d6d50f628..9d46fd3ec 100755 --- a/pr-checks/update-release-branch.ts +++ b/pr-checks/update-release-branch.ts @@ -24,7 +24,12 @@ import { parseArgs } from "node:util"; import { type ApiClient, getApiClient } from "./api-client"; import * as changelog from "./changelog"; import { transferChangenotesToChangelog } from "./changenotes"; -import { DryRunOption, REPO_ROOT } from "./config"; +import { + CHANGELOG_FILE, + CHANGENOTES_DIR, + DryRunOption, + REPO_ROOT, +} from "./config"; import { getCurrentVersion, replaceVersionInPackageJson, @@ -701,7 +706,7 @@ export async function prepareNewBranch( { ...options, initChangelog: true }, ); - runGit(["add", "CHANGELOG.md", "unreleased-change-notes"], { + runGit(["add", CHANGELOG_FILE, CHANGENOTES_DIR], { dryRun: options.dryRun, }); runGit(["commit", "-m", `Update changelog for v${version}`], { From 4f73d1add86c1594c618b23d299266a8c96b616b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 7 Oct 2026 18:15:22 +0100 Subject: [PATCH 24/58] Include primary cache keys as restore key --- lib/entry-points.js | 6 ++++-- src/dependency-caching.ts | 1 + src/overlay/caching.ts | 2 +- src/overlay/status.ts | 2 +- src/trap-caching.ts | 1 + 5 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 93084ea9b..6c4e6c20d 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -174029,7 +174029,7 @@ async function getOverlayStatus(codeql, languages, diskUsage, logger2) { await fs8.promises.mkdir(path9.dirname(statusFile), { recursive: true }); const foundKey = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS, - actionsCache.restoreCache([statusFile], cacheKey3), + actionsCache.restoreCache([statusFile], cacheKey3, [cacheKey3]), () => { logger2.warning("Timed out restoring overlay status from cache."); } @@ -174140,6 +174140,7 @@ async function downloadTrapCaches(codeql, languages, logger2) { const found = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS2, actionsCache2.restoreCache([cacheDir2], preferredKey, [ + preferredKey, // Fall back to any cache with the right key prefix await cachePrefix(codeql, language) ]), @@ -175395,7 +175396,7 @@ async function downloadOverlayBaseDatabaseFromCache(codeql, config, logger2) { actionsCache3.restoreCache( [dbLocation], cacheRestoreKeyPrefix, - void 0, + [cacheRestoreKeyPrefix], { // Azure SDK download (which is the default) uses 128MB segments; see // https://github.com/actions/toolkit/blob/main/packages/cache/README.md. @@ -177680,6 +177681,7 @@ async function downloadDependencyCaches(codeql, features, languages, logger2) { } const primaryKey = await cacheKey2(codeql, features, language, patterns); const restoreKeys = [ + primaryKey, await cachePrefix2(codeql, features, language) ]; logger2.info( diff --git a/src/dependency-caching.ts b/src/dependency-caching.ts index f04d38f46..e6495f3a7 100644 --- a/src/dependency-caching.ts +++ b/src/dependency-caching.ts @@ -313,6 +313,7 @@ export async function downloadDependencyCaches( const primaryKey = await cacheKey(codeql, features, language, patterns); const restoreKeys: string[] = [ + primaryKey, await cachePrefix(codeql, features, language), ]; diff --git a/src/overlay/caching.ts b/src/overlay/caching.ts index d24662678..5fb76625f 100644 --- a/src/overlay/caching.ts +++ b/src/overlay/caching.ts @@ -290,7 +290,7 @@ export async function downloadOverlayBaseDatabaseFromCache( actionsCache.restoreCache( [dbLocation], cacheRestoreKeyPrefix, - undefined, + [cacheRestoreKeyPrefix], { // Azure SDK download (which is the default) uses 128MB segments; see // https://github.com/actions/toolkit/blob/main/packages/cache/README.md. diff --git a/src/overlay/status.ts b/src/overlay/status.ts index 3acf38296..1a321af42 100644 --- a/src/overlay/status.ts +++ b/src/overlay/status.ts @@ -130,7 +130,7 @@ export async function getOverlayStatus( await fs.promises.mkdir(path.dirname(statusFile), { recursive: true }); const foundKey = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS, - actionsCache.restoreCache([statusFile], cacheKey), + actionsCache.restoreCache([statusFile], cacheKey, [cacheKey]), () => { logger.warning("Timed out restoring overlay status from cache."); }, diff --git a/src/trap-caching.ts b/src/trap-caching.ts index a802aac89..093b5399e 100644 --- a/src/trap-caching.ts +++ b/src/trap-caching.ts @@ -99,6 +99,7 @@ export async function downloadTrapCaches( const found = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS, actionsCache.restoreCache([cacheDir], preferredKey, [ + preferredKey, // Fall back to any cache with the right key prefix await cachePrefix(codeql, language), ]), From a36029cea223e8cc6babbebd4d954d613b851760 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 7 Oct 2026 17:55:12 +0000 Subject: [PATCH 25/58] Bump @octokit/plugin-paginate-rest from 15.0.0 to 16.0.0 Bumps [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) from 15.0.0 to 16.0.0. - [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases) - [Commits](https://github.com/octokit/plugin-paginate-rest.js/compare/v15.0.0...v16.0.0) --- updated-dependencies: - dependency-name: "@octokit/plugin-paginate-rest" dependency-version: 16.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- package-lock.json | 27 ++++++--------------------- package.json | 2 +- pr-checks/package.json | 2 +- 3 files changed, 8 insertions(+), 23 deletions(-) diff --git a/package-lock.json b/package-lock.json index 167f0801b..7a3074c86 100644 --- a/package-lock.json +++ b/package-lock.json @@ -23,7 +23,7 @@ "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", "@octokit/core": "^7.0.8", - "@octokit/plugin-paginate-rest": "^15.0.0", + "@octokit/plugin-paginate-rest": "^16.0.0", "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", @@ -2205,12 +2205,12 @@ "license": "MIT" }, "node_modules/@octokit/plugin-paginate-rest": { - "version": "15.0.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-15.0.0.tgz", - "integrity": "sha512-lw9A9YL5s4VPj+VEx8uMxaxQm2YTgrPDkrLEuZuu18R8TK3oPcXF4K6t52nx6xn1RcogZC9i188sAr/4XYJaQQ==", + "version": "16.0.0", + "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-16.0.0.tgz", + "integrity": "sha512-7RtUeGZypAK4EA4LrjTCnsLALNOoUcYh5vOnCNXpdIQVTQCPh4OFu7324iPqAls3KGgVnZktKUnNKZCOKyHrlA==", "license": "MIT", "dependencies": { - "@octokit/types": "^17.0.0" + "@octokit/types": "^18.0.0" }, "engines": { "node": ">= 20" @@ -2219,21 +2219,6 @@ "@octokit/core": ">=6" } }, - "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": { - "version": "28.0.0", - "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", - "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", - "license": "MIT" - }, - "node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": { - "version": "17.0.0", - "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", - "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", - "license": "MIT", - "dependencies": { - "@octokit/openapi-types": "^28.0.0" - } - }, "node_modules/@octokit/plugin-request-log": { "version": "1.0.4", "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.4.tgz", @@ -10500,7 +10485,7 @@ "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", "@octokit/core": "^7.0.8", - "@octokit/plugin-paginate-rest": ">=15.0.0", + "@octokit/plugin-paginate-rest": ">=16.0.0", "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "lite-matter": "^0.1.2", "mdast-util-from-markdown": "^2.0.3", diff --git a/package.json b/package.json index 5ebf14292..d1e8b1188 100644 --- a/package.json +++ b/package.json @@ -31,7 +31,7 @@ "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", "@octokit/core": "^7.0.8", - "@octokit/plugin-paginate-rest": "^15.0.0", + "@octokit/plugin-paginate-rest": "^16.0.0", "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", diff --git a/pr-checks/package.json b/pr-checks/package.json index 3d6b3d07e..468ba3995 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -6,7 +6,7 @@ "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", "@octokit/core": "^7.0.8", - "@octokit/plugin-paginate-rest": ">=15.0.0", + "@octokit/plugin-paginate-rest": ">=16.0.0", "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "lite-matter": "^0.1.2", "mdast-util-from-markdown": "^2.0.3", From c1b620cc0e7973d9e01f4777f33bdafdbb570868 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 14:56:00 +0100 Subject: [PATCH 26/58] Allow `initializeEnvironment` to accept `Env` --- lib/entry-points.js | 12 ++++++------ src/setup/repository.test.ts | 11 ++++++----- src/util.ts | 14 ++++++++------ 3 files changed, 20 insertions(+), 17 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 846ab37e4..9f49031d9 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -169810,12 +169810,12 @@ var ExhaustivityCheckingError = class extends Error { function assertNever(value) { throw new ExhaustivityCheckingError(value); } -function initializeEnvironment(version) { - exportEnvVar("CODEQL_ACTION_FEATURE_MULTI_LANGUAGE" /* FEATURE_MULTI_LANGUAGE */, "false"); - exportEnvVar("CODEQL_ACTION_FEATURE_SANDWICH" /* FEATURE_SANDWICH */, "false"); - exportEnvVar("CODEQL_ACTION_FEATURE_SARIF_COMBINE" /* FEATURE_SARIF_COMBINE */, "true"); - exportEnvVar("CODEQL_ACTION_FEATURE_WILL_UPLOAD" /* FEATURE_WILL_UPLOAD */, "true"); - exportEnvVar("CODEQL_ACTION_VERSION" /* VERSION */, version); +function initializeEnvironment(version, env = getEnv()) { + env.export("CODEQL_ACTION_FEATURE_MULTI_LANGUAGE" /* FEATURE_MULTI_LANGUAGE */, "false"); + env.export("CODEQL_ACTION_FEATURE_SANDWICH" /* FEATURE_SANDWICH */, "false"); + env.export("CODEQL_ACTION_FEATURE_SARIF_COMBINE" /* FEATURE_SARIF_COMBINE */, "true"); + env.export("CODEQL_ACTION_FEATURE_WILL_UPLOAD" /* FEATURE_WILL_UPLOAD */, "true"); + env.export("CODEQL_ACTION_VERSION" /* VERSION */, version); } var HTTPError = class extends Error { status; diff --git a/src/setup/repository.test.ts b/src/setup/repository.test.ts index 56eb74786..d1c6d034c 100644 --- a/src/setup/repository.test.ts +++ b/src/setup/repository.test.ts @@ -5,7 +5,7 @@ import * as sinon from "sinon"; import * as actionsUtil from "../actions-util"; import { ActionsEnvVars } from "../environment"; -import { callee, setupTests } from "../testing-utils"; +import { callee, getTestEnv, setupTests } from "../testing-utils"; import { initializeEnvironment } from "../util"; import { getCodeQLActionRepository } from "./repository"; @@ -13,13 +13,14 @@ import { getCodeQLActionRepository } from "./repository"; setupTests(test); test.serial("getCodeQLActionRepository", async (t) => { - initializeEnvironment("1.2.3"); + const initialEnv = getTestEnv({ + [ActionsEnvVars.RUNNER_TEMP]: path.dirname(__dirname), + }); + initializeEnvironment("1.2.3", initialEnv); const target = callee(getCodeQLActionRepository) .withArgs() - .withEnv((env) => { - env.set(ActionsEnvVars.RUNNER_TEMP, path.dirname(__dirname)); - }); + .withEnv(initialEnv); // isRunningLocalAction() === true await target.passes(t.deepEqual, "github/codeql-action"); diff --git a/src/util.ts b/src/util.ts index 674e2a2ee..3a42d8b94 100644 --- a/src/util.ts +++ b/src/util.ts @@ -19,6 +19,8 @@ import { getRequiredEnvParam, isInTestMode, exportEnvVar, + getEnv, + type Env, } from "./environment"; import * as json from "./json"; import { Language } from "./languages"; @@ -595,12 +597,12 @@ export function assertNever(value: never): never { * Set some initial environment variables that we can set even without * knowing what version of CodeQL we're running. */ -export function initializeEnvironment(version: string) { - exportEnvVar(EnvVar.FEATURE_MULTI_LANGUAGE, "false"); - exportEnvVar(EnvVar.FEATURE_SANDWICH, "false"); - exportEnvVar(EnvVar.FEATURE_SARIF_COMBINE, "true"); - exportEnvVar(EnvVar.FEATURE_WILL_UPLOAD, "true"); - exportEnvVar(EnvVar.VERSION, version); +export function initializeEnvironment(version: string, env: Env = getEnv()) { + env.export(EnvVar.FEATURE_MULTI_LANGUAGE, "false"); + env.export(EnvVar.FEATURE_SANDWICH, "false"); + env.export(EnvVar.FEATURE_SARIF_COMBINE, "true"); + env.export(EnvVar.FEATURE_WILL_UPLOAD, "true"); + env.export(EnvVar.VERSION, version); } export class HTTPError extends Error { From ad8ebce2932d8d44604dd6430e4fae7c3ff55873 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:27:32 +0100 Subject: [PATCH 27/58] Add and use `RepositoryNwoStr` type --- lib/entry-points.js | 13 ++++++++++++- src/repository.ts | 8 ++++++++ src/setup/repository.ts | 19 +++++++++++++++---- 3 files changed, 35 insertions(+), 5 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 9f49031d9..99b2b4fc2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -170631,6 +170631,9 @@ retry.VERSION = VERSION7; var import_undici = __toESM(require_undici()); // src/repository.ts +function isRepositoryNwoStr(val) { + return val.includes("/"); +} function getRepositoryNwo() { return getRepositoryNwoFromEnv("GITHUB_REPOSITORY"); } @@ -175669,7 +175672,15 @@ function getCodeQLActionRepository(action) { ); return CODEQL_DEFAULT_ACTION_REPOSITORY; } - return action.env.getRequired("GITHUB_ACTION_REPOSITORY" /* GITHUB_ACTION_REPOSITORY */); + const actionRepository = action.env.getRequired( + "GITHUB_ACTION_REPOSITORY" /* GITHUB_ACTION_REPOSITORY */ + ); + if (isRepositoryNwoStr(actionRepository)) { + return actionRepository; + } + throw new Error( + `The value of '${"GITHUB_ACTION_REPOSITORY" /* GITHUB_ACTION_REPOSITORY */}' is '${actionRepository}', which does not match the expected 'owner/repo' format.` + ); } var DEFAULT_DOWNLOAD_SOURCE = [ GITHUB_DOTCOM_URL, diff --git a/src/repository.ts b/src/repository.ts index f1e7f369b..652521fe3 100644 --- a/src/repository.ts +++ b/src/repository.ts @@ -6,6 +6,14 @@ export interface RepositoryNwo { repo: string; } +/** An approximation of what a repository NWO string looks like. */ +export type RepositoryNwoStr = `${string}/${string}`; + +/** A basic check that `val` looks like a `RepositoryNwoStr`. */ +export function isRepositoryNwoStr(val: string): val is RepositoryNwoStr { + return val.includes("/"); +} + /** * Get the repository name with owner from the environment variable * `GITHUB_REPOSITORY`. diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 3d760858e..98165ea30 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -2,6 +2,7 @@ import { ActionState } from "../action-common"; import { isRunningLocalAction } from "../actions-util"; import * as api from "../api-client"; import { ActionsEnvVars } from "../environment"; +import { isRepositoryNwoStr, type RepositoryNwoStr } from "../repository"; import { GITHUB_DOTCOM_URL } from "../util"; /** The NWO of the standard CodeQL Action repository. */ @@ -17,7 +18,7 @@ export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; */ export function getCodeQLActionRepository( action: ActionState<["ReadOnlyEnv", "Logger"]>, -): string { +): RepositoryNwoStr { if (isRunningLocalAction(action.env)) { // This handles the case where the Action does not come from an Action repository, // e.g. our integration tests which use the Action code from the current checkout. @@ -28,11 +29,21 @@ export function getCodeQLActionRepository( return CODEQL_DEFAULT_ACTION_REPOSITORY; } - return action.env.getRequired(ActionsEnvVars.GITHUB_ACTION_REPOSITORY); + const actionRepository = action.env.getRequired( + ActionsEnvVars.GITHUB_ACTION_REPOSITORY, + ); + + if (isRepositoryNwoStr(actionRepository)) { + return actionRepository; + } + + throw new Error( + `The value of '${ActionsEnvVars.GITHUB_ACTION_REPOSITORY}' is '${actionRepository}', which does not match the expected 'owner/repo' format.`, + ); } /**A download source is a pair of strings. */ -export type DownloadSource = [string, string]; +export type DownloadSource = [string, RepositoryNwoStr]; /** GitHub.com, and the canonical Action. */ export const DEFAULT_DOWNLOAD_SOURCE: DownloadSource = [ @@ -88,7 +99,7 @@ export async function getCodeQLAssetDownloadURL( ): Promise { const codeQLActionRepository = getCodeQLActionRepository(action); - const potentialDownloadSources: Array<[string, string]> = [ + const potentialDownloadSources: Array<[string, RepositoryNwoStr]> = [ // This GitHub instance, and this Action. [apiDetails.url, codeQLActionRepository], // This GitHub instance, and the canonical Action. From 1a92e13c5e077a3c134060c2c5042760c9d9ae42 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:28:08 +0100 Subject: [PATCH 28/58] Use `GITHUB_DOTCOM_URL` in `getDefaultDotComDownloadURL` --- lib/entry-points.js | 2 +- src/setup/repository.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 99b2b4fc2..507d2ddf5 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -175690,7 +175690,7 @@ var isSameDownloadSource = ([srcUrl, srcRepo], [otherUrl, otherRepo]) => { return srcUrl === otherUrl && srcRepo === otherRepo; }; function getDefaultDotComDownloadURL(tagName, assetName) { - return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; + return `${GITHUB_DOTCOM_URL}/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; } async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, assetKind = "CodeQL bundle") { const codeQLActionRepository = getCodeQLActionRepository(action); diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 98165ea30..0cdfaa173 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -67,7 +67,7 @@ export function getDefaultDotComDownloadURL( tagName: string, assetName: string, ): DownloadURL { - return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; + return `${GITHUB_DOTCOM_URL}/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; } /** Enumerates log-friendly descriptions of different kinds of assets we might look for in releases. */ From e93db40ccef689468ceaf388bd289a07b47c052d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:28:55 +0100 Subject: [PATCH 29/58] Use "asset" in comment --- src/setup/repository.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 0cdfaa173..004beb1dc 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -119,7 +119,7 @@ export async function getCodeQLAssetDownloadURL( ); for (const [apiURL, repository] of uniqueDownloadSources) { - // If we've reached the final case, short-circuit the API check since we know the bundle exists and is public. + // If we've reached the final case, short-circuit the API check since we know the asset exists and is public. if (isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [apiURL, repository])) { break; } From fdc069b4ec7f588ddf76a7e600213d2112842d04 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:29:50 +0100 Subject: [PATCH 30/58] Use `DownloadSource` for `potentialDownloadSources` --- src/setup/repository.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 004beb1dc..f4e69797e 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -99,7 +99,7 @@ export async function getCodeQLAssetDownloadURL( ): Promise { const codeQLActionRepository = getCodeQLActionRepository(action); - const potentialDownloadSources: Array<[string, RepositoryNwoStr]> = [ + const potentialDownloadSources: DownloadSource[] = [ // This GitHub instance, and this Action. [apiDetails.url, codeQLActionRepository], // This GitHub instance, and the canonical Action. From 06bd6e2f9d18767c683a39083f38deaa106e46ce Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:31:11 +0100 Subject: [PATCH 31/58] `DotCom` => `Dotcom` --- lib/entry-points.js | 4 ++-- src/setup/repository.ts | 4 ++-- src/start-proxy.test.ts | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 507d2ddf5..a6e80b84e 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -175689,7 +175689,7 @@ var DEFAULT_DOWNLOAD_SOURCE = [ var isSameDownloadSource = ([srcUrl, srcRepo], [otherUrl, otherRepo]) => { return srcUrl === otherUrl && srcRepo === otherRepo; }; -function getDefaultDotComDownloadURL(tagName, assetName) { +function getDefaultDotcomDownloadURL(tagName, assetName) { return `${GITHUB_DOTCOM_URL}/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`; } async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, assetKind = "CodeQL bundle") { @@ -175732,7 +175732,7 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, ); } } - return getDefaultDotComDownloadURL(tagName, assetName); + return getDefaultDotcomDownloadURL(tagName, assetName); } // src/tar.ts diff --git a/src/setup/repository.ts b/src/setup/repository.ts index f4e69797e..636787024 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -63,7 +63,7 @@ const isSameDownloadSource = ( export type DownloadURL = string; /** Gets the default GitHub.com download URL for `assetName` in a release tagged `tagName`. */ -export function getDefaultDotComDownloadURL( +export function getDefaultDotcomDownloadURL( tagName: string, assetName: string, ): DownloadURL { @@ -147,5 +147,5 @@ export async function getCodeQLAssetDownloadURL( } } - return getDefaultDotComDownloadURL(tagName, assetName); + return getDefaultDotcomDownloadURL(tagName, assetName); } diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts index b0bdd7bd3..ed2007fe6 100644 --- a/src/start-proxy.test.ts +++ b/src/start-proxy.test.ts @@ -780,7 +780,7 @@ test.serial( t.is(info.version, defaults.cliVersion); t.is( info.url, - repository.getDefaultDotComDownloadURL( + repository.getDefaultDotcomDownloadURL( defaults.bundleVersion, startProxyExports.getProxyPackage(BundlePlatform.Linux64), ), @@ -810,7 +810,7 @@ test.serial( t.is(info.version, defaults.cliVersion); t.is( info.url, - repository.getDefaultDotComDownloadURL( + repository.getDefaultDotcomDownloadURL( defaults.bundleVersion, startProxyExports.getProxyPackage(getTestPlatform(state)), ), @@ -842,7 +842,7 @@ test.serial( t.is(info.version, defaults.cliVersion); t.is( info.url, - repository.getDefaultDotComDownloadURL( + repository.getDefaultDotcomDownloadURL( defaults.bundleVersion, startProxyExports.getProxyPackage(getTestPlatform(state)), ), From 3d7016f5140155c81cbea404bdd435836d97ae56 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:39:38 +0100 Subject: [PATCH 32/58] Log more in `getProxyBinaryPath` --- lib/entry-points.js | 47 +++++++++++++++++++++++++-------------- src/start-proxy.ts | 54 +++++++++++++++++++++++++++++++-------------- 2 files changed, 67 insertions(+), 34 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index a6e80b84e..a2951f159 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187759,25 +187759,38 @@ function getProxyFilename() { } async function getProxyBinaryPath(action, apiDetails) { const logger2 = action.logger; - const proxyFileName = getProxyFilename(); - const proxyInfo = await getDownloadUrl(action, apiDetails); - let proxyBin = toolcache4.find(proxyFileName, proxyInfo.version); - if (!proxyBin) { - const authorization = getAuthorizationHeaderFor( - logger2, - apiDetails, - proxyInfo.url - ); - const temp = await downloadProxy(logger2, proxyInfo.url, authorization); - const extracted = await extractProxy(logger2, temp); - proxyBin = await cacheProxy( - logger2, - extracted, - proxyFileName, - proxyInfo.version + logger2.startGroup("Setting up authentication proxy"); + try { + const proxyFileName = getProxyFilename(); + const proxyInfo = await getDownloadUrl(action, apiDetails); + logger2.info( + `Using authentication proxy from CodeQL release ${proxyInfo.version}.` ); + let proxyBin = toolcache4.find(proxyFileName, proxyInfo.version); + if (!proxyBin) { + logger2.info( + `Authentication proxy is not in the toolcache. Will try to download it from '${proxyInfo.url}'.` + ); + const authorization = getAuthorizationHeaderFor( + logger2, + apiDetails, + proxyInfo.url + ); + const temp = await downloadProxy(logger2, proxyInfo.url, authorization); + logger2.info(`Downloaded the authentication proxy assset to '${temp}'.`); + const extracted = await extractProxy(logger2, temp); + proxyBin = await cacheProxy( + logger2, + extracted, + proxyFileName, + proxyInfo.version + ); + logger2.info(`Extracted the authentication proxy to '${proxyBin}'.`); + } + return path27.join(proxyBin, proxyFileName); + } finally { + logger2.endGroup(); } - return path27.join(proxyBin, proxyFileName); } // src/start-proxy/ca.ts diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 9558b119e..ca2f5c2b5 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -537,24 +537,44 @@ export async function getProxyBinaryPath( apiDetails: GitHubApiDetails, ): Promise { const logger = action.logger; - const proxyFileName = getProxyFilename(); - const proxyInfo = await getDownloadUrl(action, apiDetails); + logger.startGroup("Setting up authentication proxy"); - let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); - if (!proxyBin) { - const authorization = getAuthorizationHeaderFor( - logger, - apiDetails, - proxyInfo.url, - ); - const temp = await downloadProxy(logger, proxyInfo.url, authorization); - const extracted = await extractProxy(logger, temp); - proxyBin = await cacheProxy( - logger, - extracted, - proxyFileName, - proxyInfo.version, + try { + const proxyFileName = getProxyFilename(); + const proxyInfo = await getDownloadUrl(action, apiDetails); + + logger.info( + `Using authentication proxy from CodeQL release ${proxyInfo.version}.`, ); + + let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); + + if (!proxyBin) { + logger.info( + `Authentication proxy is not in the toolcache. Will try to download it from '${proxyInfo.url}'.`, + ); + + const authorization = getAuthorizationHeaderFor( + logger, + apiDetails, + proxyInfo.url, + ); + const temp = await downloadProxy(logger, proxyInfo.url, authorization); + + logger.info(`Downloaded the authentication proxy assset to '${temp}'.`); + + const extracted = await extractProxy(logger, temp); + proxyBin = await cacheProxy( + logger, + extracted, + proxyFileName, + proxyInfo.version, + ); + + logger.info(`Extracted the authentication proxy to '${proxyBin}'.`); + } + return path.join(proxyBin, proxyFileName); + } finally { + logger.endGroup(); } - return path.join(proxyBin, proxyFileName); } From dd3898ae5842543c91979b8a9b9b3f47bfdee874 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:40:20 +0100 Subject: [PATCH 33/58] Await `toolcache.downloadTool` --- lib/entry-points.js | 2 +- src/start-proxy.ts | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index a2951f159..f22ad311f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187718,7 +187718,7 @@ async function getDownloadUrl(action, apiDetails) { } async function downloadProxy(logger2, url2, authorization) { try { - return toolcache4.downloadTool( + return await toolcache4.downloadTool( url2, /* dest: */ void 0, diff --git a/src/start-proxy.ts b/src/start-proxy.ts index ca2f5c2b5..21a5012f1 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -461,9 +461,14 @@ export async function downloadProxy( try { // Download the proxy archive from `url`. We let `downloadTool` choose where // to store it. The path to the downloaded file will be returned if successful. - return toolcache.downloadTool(url, /* dest: */ undefined, authorization, { - accept: "application/octet-stream", - }); + return await toolcache.downloadTool( + url, + /* dest: */ undefined, + authorization, + { + accept: "application/octet-stream", + }, + ); } catch (error) { logger.error( `Failed to download proxy archive from ${url}: ${getErrorMessage(error)}`, From ac44fd090137600c00845d6ea3297cda7fefdad7 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:41:25 +0100 Subject: [PATCH 34/58] Remove duplicated assertions --- src/start-proxy.test.ts | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts index ed2007fe6..b8de01c07 100644 --- a/src/start-proxy.test.ts +++ b/src/start-proxy.test.ts @@ -1079,8 +1079,6 @@ test.serial( st.onceWith(extractTar, archivePath); st.onceWith(cacheDir, extractedPath); - t.assert(extractTar.calledOnceWith(archivePath)); - t.assert(cacheDir.calledOnceWith(extractedPath)); t.assert(path); t.is( path, From a1794a03ffd7b772215b9612f0024299630d2c6c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:45:21 +0100 Subject: [PATCH 35/58] Fix `mockGetReleaseByTag` usage --- src/start-proxy.test.ts | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts index b8de01c07..d01543e70 100644 --- a/src/start-proxy.test.ts +++ b/src/start-proxy.test.ts @@ -729,7 +729,10 @@ function mockGetReleaseByTag(expectedTag?: string, assets?: ReleaseAssets) { } }); - return mockGetApiClient({ repos: { getReleaseByTag } }); + return { + getReleaseByTag, + getApiClient: mockGetApiClient({ repos: { getReleaseByTag } }), + }; } function mockOfflineFeatures(tempDir: string, logger: Logger) { @@ -833,7 +836,7 @@ test.serial( sinon.stub(actionsUtil, "isRunningLocalAction").returns(true); for (const assets of testAssets) { - const stub = mockGetReleaseByTag(defaults.bundleVersion, assets); + const stubs = mockGetReleaseByTag(defaults.bundleVersion, assets); const info = await startProxyExports.getDownloadUrl( state, SAMPLE_DOTCOM_API_DETAILS, @@ -848,7 +851,9 @@ test.serial( ), ); - stub.restore(); + // mockGetReleaseByTag stubs the global getApiClient; since we are calling + // that in a loop, we need to manually restore it here + stubs.getApiClient.restore(); } }); }, @@ -864,7 +869,7 @@ test.serial("getDownloadUrl returns matching release asset", async (t) => { url: "url-we-want", }, ]; - const getReleaseByTag = mockGetReleaseByTag(defaults.bundleVersion, assets); + const stubs = mockGetReleaseByTag(defaults.bundleVersion, assets); await withTmpDir(async (tempDir) => { state.env.set(ActionsEnvVars.RUNNER_TEMP, tempDir); @@ -879,7 +884,7 @@ test.serial("getDownloadUrl returns matching release asset", async (t) => { SAMPLE_DOTCOM_API_DETAILS, ); - t.is(getReleaseByTag.callCount, 1); + t.is(stubs.getReleaseByTag.callCount, 1); t.is(info.version, defaults.cliVersion); t.is(info.url, "url-we-want"); @@ -1036,7 +1041,7 @@ test.serial( const logger = new RecordingLogger(); const state = initAllState({ logger }); const downloadUrl = "url-we-want"; - const getApiClient = mockGetReleaseByTag(defaults.bundleVersion, [ + const stubs = mockGetReleaseByTag(defaults.bundleVersion, [ { name: startProxyExports.getProxyPackage(getTestPlatform(state)), url: downloadUrl, @@ -1070,7 +1075,7 @@ test.serial( SAMPLE_DOTCOM_API_DETAILS, ); - t.is(getApiClient.callCount, 1); + t.is(stubs.getReleaseByTag.callCount, 1); t.assert(find.calledOnce); t.assert(getAuthorizationHeaderFor.calledOnce); From 8fed29eed7c56f2ad5ff4886a0b5bac4a7d60868 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:47:52 +0100 Subject: [PATCH 36/58] Rename `apiURL` to `instanceURL` --- lib/entry-points.js | 8 ++++---- src/setup/repository.ts | 10 ++++++---- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index f22ad311f..6e080eaa5 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -175707,8 +175707,8 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, return !self2.slice(0, index2).some((other) => isSameDownloadSource(source, other)); } ); - for (const [apiURL, repository] of uniqueDownloadSources) { - if (isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [apiURL, repository])) { + for (const [instanceURL, repository] of uniqueDownloadSources) { + if (isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [instanceURL, repository])) { break; } const [repositoryOwner, repositoryName] = repository.split("/"); @@ -175721,14 +175721,14 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, for (const asset of release2.data.assets) { if (asset.name === assetName) { action.logger.info( - `Found ${assetKind} ${assetName} in ${repository} on ${apiURL} with URL ${asset.url}.` + `Found ${assetKind} ${assetName} in ${repository} on ${instanceURL} with URL ${asset.url}.` ); return asset.url; } } } catch (e) { action.logger.info( - `Looked for ${assetKind} ${assetName} in ${repository} on ${apiURL} but got error ${e}.` + `Looked for ${assetKind} ${assetName} in ${repository} on ${instanceURL} but got error ${e}.` ); } } diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 636787024..2e5387297 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -118,9 +118,11 @@ export async function getCodeQLAssetDownloadURL( }, ); - for (const [apiURL, repository] of uniqueDownloadSources) { + for (const [instanceURL, repository] of uniqueDownloadSources) { // If we've reached the final case, short-circuit the API check since we know the asset exists and is public. - if (isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [apiURL, repository])) { + if ( + isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [instanceURL, repository]) + ) { break; } @@ -135,14 +137,14 @@ export async function getCodeQLAssetDownloadURL( for (const asset of release.data.assets) { if (asset.name === assetName) { action.logger.info( - `Found ${assetKind} ${assetName} in ${repository} on ${apiURL} with URL ${asset.url}.`, + `Found ${assetKind} ${assetName} in ${repository} on ${instanceURL} with URL ${asset.url}.`, ); return asset.url; } } } catch (e) { action.logger.info( - `Looked for ${assetKind} ${assetName} in ${repository} on ${apiURL} but got error ${e}.`, + `Looked for ${assetKind} ${assetName} in ${repository} on ${instanceURL} but got error ${e}.`, ); } } From 5aa103d050a3985a691d3cb0c4d2f1055d523cd1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 12 Oct 2026 15:52:22 +0100 Subject: [PATCH 37/58] Add `InstanceURL` and use in `DownloadSource` --- src/setup/repository.ts | 4 ++-- src/util.ts | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 2e5387297..959ca4b8d 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -3,7 +3,7 @@ import { isRunningLocalAction } from "../actions-util"; import * as api from "../api-client"; import { ActionsEnvVars } from "../environment"; import { isRepositoryNwoStr, type RepositoryNwoStr } from "../repository"; -import { GITHUB_DOTCOM_URL } from "../util"; +import { GITHUB_DOTCOM_URL, type InstanceURL } from "../util"; /** The NWO of the standard CodeQL Action repository. */ export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; @@ -43,7 +43,7 @@ export function getCodeQLActionRepository( } /**A download source is a pair of strings. */ -export type DownloadSource = [string, RepositoryNwoStr]; +export type DownloadSource = [InstanceURL, RepositoryNwoStr]; /** GitHub.com, and the canonical Action. */ export const DEFAULT_DOWNLOAD_SOURCE: DownloadSource = [ diff --git a/src/util.ts b/src/util.ts index 3a42d8b94..0b10e0f04 100644 --- a/src/util.ts +++ b/src/util.ts @@ -46,10 +46,13 @@ const BASE_DATABASE_OIDS_FILE_NAME = "base-database-oids.json"; */ const BROKEN_VERSIONS = ["0.0.0-20211207"]; +/** A string representing a GitHub instance. */ +export type InstanceURL = string; + /** * The URL for github.com. */ -export const GITHUB_DOTCOM_URL = "https://github.com"; +export const GITHUB_DOTCOM_URL: InstanceURL = "https://github.com"; /** * Default name of the debugging artifact. From b67b5abe29b2f646e6cb9afe110070e2f422b873 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 13 Oct 2026 12:13:59 +0100 Subject: [PATCH 38/58] Use `parseRepositoryNwo` in `getCodeQLAssetDownloadURL` --- lib/entry-points.js | 2 +- src/setup/repository.ts | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 6e080eaa5..30df46a5b 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -175711,7 +175711,7 @@ async function getCodeQLAssetDownloadURL(action, apiDetails, tagName, assetName, if (isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [instanceURL, repository])) { break; } - const [repositoryOwner, repositoryName] = repository.split("/"); + const { owner: repositoryOwner, repo: repositoryName } = parseRepositoryNwo(repository); try { const release2 = await getApiClient().rest.repos.getReleaseByTag({ owner: repositoryOwner, diff --git a/src/setup/repository.ts b/src/setup/repository.ts index 959ca4b8d..6da0ea3e9 100644 --- a/src/setup/repository.ts +++ b/src/setup/repository.ts @@ -2,7 +2,11 @@ import { ActionState } from "../action-common"; import { isRunningLocalAction } from "../actions-util"; import * as api from "../api-client"; import { ActionsEnvVars } from "../environment"; -import { isRepositoryNwoStr, type RepositoryNwoStr } from "../repository"; +import { + isRepositoryNwoStr, + parseRepositoryNwo, + type RepositoryNwoStr, +} from "../repository"; import { GITHUB_DOTCOM_URL, type InstanceURL } from "../util"; /** The NWO of the standard CodeQL Action repository. */ @@ -126,7 +130,8 @@ export async function getCodeQLAssetDownloadURL( break; } - const [repositoryOwner, repositoryName] = repository.split("/"); + const { owner: repositoryOwner, repo: repositoryName } = + parseRepositoryNwo(repository); try { const release = await api.getApiClient().rest.repos.getReleaseByTag({ owner: repositoryOwner, From aa80ca0686300d00833eb4f65641ac310b892784 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 13 Oct 2026 18:59:11 +0100 Subject: [PATCH 39/58] Move `start-proxy` status report handling into its own file --- lib/entry-points.js | 128 +++++++++++------------ src/start-proxy.test.ts | 88 +--------------- src/start-proxy.ts | 142 +------------------------- src/start-proxy/status-report.test.ts | 94 +++++++++++++++++ src/start-proxy/status-report.ts | 140 +++++++++++++++++++++++++ 5 files changed, 305 insertions(+), 287 deletions(-) create mode 100644 src/start-proxy/status-report.test.ts create mode 100644 src/start-proxy/status-report.ts diff --git a/lib/entry-points.js b/lib/entry-points.js index 373cdedc0..f3d3022b0 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187524,11 +187524,72 @@ var core25 = __toESM(require_core()); // src/start-proxy.ts var path27 = __toESM(require("path")); -var core24 = __toESM(require_core()); var toolcache4 = __toESM(require_tool_cache()); -// src/start-proxy/validation.ts +// src/start-proxy/status-report.ts var core23 = __toESM(require_core()); +async function sendSuccessStatusReport(startedAt, config, registry_types, logger2) { + const statusReportBase = await createStatusReportBase( + "start-proxy" /* StartProxy */, + "success", + startedAt, + config, + await checkDiskUsage(logger2), + logger2 + ); + if (statusReportBase !== void 0) { + const statusReport = { + ...statusReportBase, + registry_types: registry_types.join(",") + }; + await sendStatusReport(statusReport); + } +} +function getStartProxyErrorMessage(errorType) { + switch (errorType) { + case 0 /* DownloadFailed */: + return "Failed to download proxy archive."; + case 1 /* ExtractionFailed */: + return "Failed to extract proxy archive."; + case 2 /* CacheFailed */: + return "Failed to add proxy to toolcache"; + } +} +var StartProxyError = class extends Error { + errorType; + constructor(errorType) { + super(); + this.errorType = errorType; + } +}; +function getSafeErrorMessage(error3) { + if (error3 instanceof StartProxyError) { + return getStartProxyErrorMessage(error3.errorType); + } + return `Error from start-proxy Action omitted (${error3.constructor.name}).`; +} +async function sendFailedStatusReport(logger2, startedAt, language, unwrappedError) { + const error3 = wrapError(unwrappedError); + core23.setFailed(`start-proxy action failed: ${error3.message}`); + const statusReportMessage = getSafeErrorMessage(error3); + const errorStatusReportBase = await createStatusReportBase( + "start-proxy" /* StartProxy */, + getActionsStatus(error3), + startedAt, + { + languages: language === void 0 ? void 0 : [language] + }, + await checkDiskUsage(logger2), + logger2, + statusReportMessage + ); + if (errorStatusReportBase !== void 0) { + await sendStatusReport(errorStatusReportBase); + } +} + +// src/start-proxy/validation.ts +var core24 = __toESM(require_core()); function cloneCredential(schema, obj) { const result = {}; for (const key of Object.keys(schema)) { @@ -187547,14 +187608,14 @@ function getAuthConfig(config) { } if (isToken(config)) { if (isDefined2(config.token)) { - core23.setSecret(config.token); + core24.setSecret(config.token); } return cloneCredential(tokenSchema, config); } else { let username = void 0; let password = void 0; if ("password" in config && isString(config.password)) { - core23.setSecret(config.password); + core24.setSecret(config.password); password = config.password; } if ("username" in config && isString(config.username)) { @@ -187568,65 +187629,6 @@ function getAuthConfig(config) { } // src/start-proxy.ts -function getStartProxyErrorMessage(errorType) { - switch (errorType) { - case 0 /* DownloadFailed */: - return "Failed to download proxy archive."; - case 1 /* ExtractionFailed */: - return "Failed to extract proxy archive."; - case 2 /* CacheFailed */: - return "Failed to add proxy to toolcache"; - } -} -var StartProxyError = class extends Error { - errorType; - constructor(errorType) { - super(); - this.errorType = errorType; - } -}; -async function sendSuccessStatusReport(startedAt, config, registry_types, logger2) { - const statusReportBase = await createStatusReportBase( - "start-proxy" /* StartProxy */, - "success", - startedAt, - config, - await checkDiskUsage(logger2), - logger2 - ); - if (statusReportBase !== void 0) { - const statusReport = { - ...statusReportBase, - registry_types: registry_types.join(",") - }; - await sendStatusReport(statusReport); - } -} -function getSafeErrorMessage(error3) { - if (error3 instanceof StartProxyError) { - return getStartProxyErrorMessage(error3.errorType); - } - return `Error from start-proxy Action omitted (${error3.constructor.name}).`; -} -async function sendFailedStatusReport(logger2, startedAt, language, unwrappedError) { - const error3 = wrapError(unwrappedError); - core24.setFailed(`start-proxy action failed: ${error3.message}`); - const statusReportMessage = getSafeErrorMessage(error3); - const errorStatusReportBase = await createStatusReportBase( - "start-proxy" /* StartProxy */, - getActionsStatus(error3), - startedAt, - { - languages: language === void 0 ? void 0 : [language] - }, - await checkDiskUsage(logger2), - logger2, - statusReportMessage - ); - if (errorStatusReportBase !== void 0) { - await sendStatusReport(errorStatusReportBase); - } -} var UPDATEJOB_PROXY = "update-job-proxy"; var UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901"; var UPDATEJOB_PROXY_URL_PREFIX = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/"; diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts index bd2489713..86bb99348 100644 --- a/src/start-proxy.test.ts +++ b/src/start-proxy.test.ts @@ -1,6 +1,5 @@ import * as filepath from "path"; -import * as core from "@actions/core"; import * as toolcache from "@actions/tool-cache"; import test, { ExecutionContext } from "ava"; import sinon from "sinon"; @@ -15,7 +14,6 @@ import { BuiltInLanguage } from "./languages"; import { getRunnerLogger, Logger } from "./logging"; import { BundlePlatform, getBundlePlatform } from "./platform"; import * as startProxyExports from "./start-proxy"; -import * as statusReport from "./status-report"; import { assertNotLogged, checkExpectedLogMessages, @@ -27,94 +25,10 @@ import { setupTests, withRecordingLoggerAsync, } from "./testing-utils"; -import { - ConfigurationError, - GitHubVariant, - GitHubVersion, - withTmpDir, -} from "./util"; +import { GitHubVariant, GitHubVersion, withTmpDir } from "./util"; setupTests(test); -const sendFailedStatusReportTest = makeMacro({ - exec: async ( - t: ExecutionContext, - err: Error, - expectedMessage: string, - expectedStatus: statusReport.ActionStatus = "failure", - ) => { - const now = new Date(); - - // Override core.setFailed to avoid it setting the program's exit code - sinon.stub(core, "setFailed").returns(); - - const createStatusReportBase = sinon.stub( - statusReport, - "createStatusReportBase", - ); - createStatusReportBase.resolves(undefined); - - await withRecordingLoggerAsync(async (logger) => { - await startProxyExports.sendFailedStatusReport( - logger, - now, - undefined, - err, - ); - - // Check that the stub has been called exactly once, with the expected arguments, - // but not with the message from the error. - sinon.assert.calledOnceWithExactly( - createStatusReportBase, - statusReport.ActionName.StartProxy, - expectedStatus, - now, - sinon.match.any, - sinon.match.any, - sinon.match.any, - expectedMessage, - ); - t.false( - createStatusReportBase.calledWith( - statusReport.ActionName.StartProxy, - expectedStatus, - now, - sinon.match.any, - sinon.match.any, - sinon.match.any, - sinon.match((msg: string) => msg.includes(err.message)), - ), - "createStatusReportBase was called with the error message", - ); - }); - }, - - title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`, -}); - -sendFailedStatusReportTest.serial( - "reports generic error message for non-StartProxyError error", - new Error("Something went wrong today"), - "Error from start-proxy Action omitted (Error).", -); - -sendFailedStatusReportTest.serial( - "reports generic error message for non-StartProxyError error with safe error message", - new Error( - startProxyExports.getStartProxyErrorMessage( - startProxyExports.StartProxyErrorType.DownloadFailed, - ), - ), - "Error from start-proxy Action omitted (Error).", -); - -sendFailedStatusReportTest.serial( - "reports generic error message for ConfigurationError error", - new ConfigurationError("Something went wrong today"), - "Error from start-proxy Action omitted (ConfigurationError).", - "user-error", -); - const toEncodedJSON = (data: any) => Buffer.from(JSON.stringify(data)).toString("base64"); diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 6221c9940..84ed5fb17 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -1,6 +1,5 @@ import * as path from "path"; -import * as core from "@actions/core"; import * as toolcache from "@actions/tool-cache"; import { ActionState } from "./action-common"; @@ -11,7 +10,6 @@ import { getGitHubVersion, } from "./api-client"; import * as artifactScanner from "./artifact-scanner"; -import { Config } from "./config-utils"; import * as defaults from "./defaults.json"; import { CodeQLDefaultVersionInfo, @@ -22,6 +20,10 @@ import * as json from "./json"; import { BuiltInLanguage } from "./languages"; import { Logger } from "./logging"; import { BundlePlatform, getBundlePlatform } from "./platform"; +import { + StartProxyError, + StartProxyErrorType, +} from "./start-proxy/status-report"; import { Address, Registry, @@ -32,144 +34,10 @@ import { RawCredential, } from "./start-proxy/types"; import { getAuthConfig } from "./start-proxy/validation"; -import { - ActionName, - createStatusReportBase, - getActionsStatus, - sendStatusReport, - StatusReportBase, -} from "./status-report"; -import * as util from "./util"; import { ConfigurationError, getErrorMessage, isDefined } from "./util"; export * from "./start-proxy/types"; - -/** - * Enumerates specific error types for which we have corresponding error messages that - * are safe to include in status reports. - */ -export enum StartProxyErrorType { - DownloadFailed, - ExtractionFailed, - CacheFailed, -} - -/** - * @returns The error message corresponding to the error type. - */ -export function getStartProxyErrorMessage( - errorType: StartProxyErrorType, -): string { - switch (errorType) { - case StartProxyErrorType.DownloadFailed: - return "Failed to download proxy archive."; - case StartProxyErrorType.ExtractionFailed: - return "Failed to extract proxy archive."; - case StartProxyErrorType.CacheFailed: - return "Failed to add proxy to toolcache"; - } -} - -/** - * We want to avoid accidentally leaking secrets that may be contained in exception - * messages in the `start-proxy` action. Consequently, we don't report the messages - * of arbitrary exceptions. This type of error ensures that the message is one from - * `StartProxyErrorType` and therefore safe to include in a status report. - */ -export class StartProxyError extends Error { - public readonly errorType: StartProxyErrorType; - - constructor(errorType: StartProxyErrorType) { - super(); - this.errorType = errorType; - } -} - -/** - * Sends a status report for the `start-proxy` action indicating a successful outcome. - * - * @param startedAt When the action was started. - * @param config The configuration used. - * @param registry_types The types of registries that are configured. - * @param logger The logger to use. - */ -export async function sendSuccessStatusReport( - startedAt: Date, - config: Partial, - registry_types: string[], - logger: Logger, -) { - const statusReportBase = await createStatusReportBase( - ActionName.StartProxy, - "success", - startedAt, - config, - await util.checkDiskUsage(logger), - logger, - ); - if (statusReportBase !== undefined) { - const statusReport: StatusReportBase = { - ...statusReportBase, - registry_types: registry_types.join(","), - }; - await sendStatusReport(statusReport); - } -} - -/** - * Returns an error message for `error` that can safely be reported in a status report, - * i.e. that does not contain sensitive information. - * - * @param error The error for which to get an error message. - */ -export function getSafeErrorMessage(error: Error): string { - // If the error is a `StartProxyError`, resolve the error type to the corresponding - // error message. - if (error instanceof StartProxyError) { - return getStartProxyErrorMessage(error.errorType); - } - - // Otherwise, omit the actual error message. - return `Error from start-proxy Action omitted (${error.constructor.name}).`; -} - -/** - * Sends a status report for the `start-proxy` action indicating a failure. - * - * @param logger The logger to use. - * @param startedAt When the action was started. - * @param language The language provided as input, if any. - * @param unwrappedError The exception that was thrown. - */ -export async function sendFailedStatusReport( - logger: Logger, - startedAt: Date, - language: BuiltInLanguage | undefined, - unwrappedError: unknown, -) { - const error = util.wrapError(unwrappedError); - core.setFailed(`start-proxy action failed: ${error.message}`); - - // To avoid the possibility of leaking sensitive information into the telemetry, - // we don't include arbitrary error messages. Instead, `getSafeErrorMessage` will - // return a generic message that includes the type of the error, unless it can decide - // that the message is safe to include. - const statusReportMessage = getSafeErrorMessage(error); - const errorStatusReportBase = await createStatusReportBase( - ActionName.StartProxy, - getActionsStatus(error), - startedAt, - { - languages: language === undefined ? undefined : [language], - }, - await util.checkDiskUsage(logger), - logger, - statusReportMessage, - ); - if (errorStatusReportBase !== undefined) { - await sendStatusReport(errorStatusReportBase); - } -} +export * from "./start-proxy/status-report"; export const UPDATEJOB_PROXY = "update-job-proxy"; export const UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901"; diff --git a/src/start-proxy/status-report.test.ts b/src/start-proxy/status-report.test.ts new file mode 100644 index 000000000..15772872b --- /dev/null +++ b/src/start-proxy/status-report.test.ts @@ -0,0 +1,94 @@ +import * as core from "@actions/core"; +import test, { ExecutionContext } from "ava"; +import sinon from "sinon"; + +import * as statusReport from "../status-report"; +import { + makeMacro, + setupTests, + withRecordingLoggerAsync, +} from "../testing-utils"; +import { ConfigurationError } from "../util"; + +import * as startProxyExports from "./status-report"; + +setupTests(test); + +const sendFailedStatusReportTest = makeMacro({ + exec: async ( + t: ExecutionContext, + err: Error, + expectedMessage: string, + expectedStatus: statusReport.ActionStatus = "failure", + ) => { + const now = new Date(); + + // Override core.setFailed to avoid it setting the program's exit code + sinon.stub(core, "setFailed").returns(); + + const createStatusReportBase = sinon.stub( + statusReport, + "createStatusReportBase", + ); + createStatusReportBase.resolves(undefined); + + await withRecordingLoggerAsync(async (logger) => { + await startProxyExports.sendFailedStatusReport( + logger, + now, + undefined, + err, + ); + + // Check that the stub has been called exactly once, with the expected arguments, + // but not with the message from the error. + sinon.assert.calledOnceWithExactly( + createStatusReportBase, + statusReport.ActionName.StartProxy, + expectedStatus, + now, + sinon.match.any, + sinon.match.any, + sinon.match.any, + expectedMessage, + ); + t.false( + createStatusReportBase.calledWith( + statusReport.ActionName.StartProxy, + expectedStatus, + now, + sinon.match.any, + sinon.match.any, + sinon.match.any, + sinon.match((msg: string) => msg.includes(err.message)), + ), + "createStatusReportBase was called with the error message", + ); + }); + }, + + title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`, +}); + +sendFailedStatusReportTest.serial( + "reports generic error message for non-StartProxyError error", + new Error("Something went wrong today"), + "Error from start-proxy Action omitted (Error).", +); + +sendFailedStatusReportTest.serial( + "reports generic error message for non-StartProxyError error with safe error message", + new Error( + startProxyExports.getStartProxyErrorMessage( + startProxyExports.StartProxyErrorType.DownloadFailed, + ), + ), + "Error from start-proxy Action omitted (Error).", +); + +sendFailedStatusReportTest.serial( + "reports generic error message for ConfigurationError error", + new ConfigurationError("Something went wrong today"), + "Error from start-proxy Action omitted (ConfigurationError).", + "user-error", +); diff --git a/src/start-proxy/status-report.ts b/src/start-proxy/status-report.ts new file mode 100644 index 000000000..081078034 --- /dev/null +++ b/src/start-proxy/status-report.ts @@ -0,0 +1,140 @@ +import * as core from "@actions/core"; + +import type { Config } from "../config-utils"; +import type { BuiltInLanguage } from "../languages"; +import type { Logger } from "../logging"; +import { + ActionName, + createStatusReportBase, + getActionsStatus, + sendStatusReport, + type StatusReportBase, +} from "../status-report"; +import * as util from "../util"; + +/** + * Sends a status report for the `start-proxy` action indicating a successful outcome. + * + * @param startedAt When the action was started. + * @param config The configuration used. + * @param registry_types The types of registries that are configured. + * @param logger The logger to use. + */ +export async function sendSuccessStatusReport( + startedAt: Date, + config: Partial, + registry_types: string[], + logger: Logger, +) { + const statusReportBase = await createStatusReportBase( + ActionName.StartProxy, + "success", + startedAt, + config, + await util.checkDiskUsage(logger), + logger, + ); + if (statusReportBase !== undefined) { + const statusReport: StatusReportBase = { + ...statusReportBase, + registry_types: registry_types.join(","), + }; + await sendStatusReport(statusReport); + } +} + +/** + * Enumerates specific error types for which we have corresponding error messages that + * are safe to include in status reports. + */ +export enum StartProxyErrorType { + DownloadFailed, + ExtractionFailed, + CacheFailed, +} + +/** + * @returns The error message corresponding to the error type. + */ +export function getStartProxyErrorMessage( + errorType: StartProxyErrorType, +): string { + switch (errorType) { + case StartProxyErrorType.DownloadFailed: + return "Failed to download proxy archive."; + case StartProxyErrorType.ExtractionFailed: + return "Failed to extract proxy archive."; + case StartProxyErrorType.CacheFailed: + return "Failed to add proxy to toolcache"; + } +} + +/** + * We want to avoid accidentally leaking secrets that may be contained in exception + * messages in the `start-proxy` action. Consequently, we don't report the messages + * of arbitrary exceptions. This type of error ensures that the message is one from + * `StartProxyErrorType` and therefore safe to include in a status report. + */ +export class StartProxyError extends Error { + public readonly errorType: StartProxyErrorType; + + constructor(errorType: StartProxyErrorType) { + super(); + this.errorType = errorType; + } +} + +/** + * Returns an error message for `error` that can safely be reported in a status report, + * i.e. that does not contain sensitive information. + * + * @param error The error for which to get an error message. + */ +export function getSafeErrorMessage(error: Error): string { + // If the error is a `StartProxyError`, resolve the error type to the corresponding + // error message. + if (error instanceof StartProxyError) { + return getStartProxyErrorMessage(error.errorType); + } + + // Otherwise, omit the actual error message. + return `Error from start-proxy Action omitted (${error.constructor.name}).`; +} + +/** + * Sends a status report for the `start-proxy` action indicating a failure. + * + * @param logger The logger to use. + * @param startedAt When the action was started. + * @param language The language provided as input, if any. + * @param unwrappedError The exception that was thrown. + */ +export async function sendFailedStatusReport( + logger: Logger, + startedAt: Date, + language: BuiltInLanguage | undefined, + unwrappedError: unknown, +) { + const error = util.wrapError(unwrappedError); + core.setFailed(`start-proxy action failed: ${error.message}`); + + // To avoid the possibility of leaking sensitive information into the telemetry, + // we don't include arbitrary error messages. Instead, `getSafeErrorMessage` will + // return a generic message that includes the type of the error, unless it can decide + // that the message is safe to include. + const statusReportMessage = getSafeErrorMessage(error); + const errorStatusReportBase = await createStatusReportBase( + ActionName.StartProxy, + getActionsStatus(error), + startedAt, + { + languages: language === undefined ? undefined : [language], + }, + await util.checkDiskUsage(logger), + logger, + statusReportMessage, + ); + if (errorStatusReportBase !== undefined) { + await sendStatusReport(errorStatusReportBase); + } +} From 6308e366c9d998b0750856f929c0c17ed1014b89 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 13 Oct 2026 19:06:14 +0100 Subject: [PATCH 40/58] Return release version from `getProxyBinaryPath` --- lib/entry-points.js | 7 +++++-- src/start-proxy-action.ts | 2 +- src/start-proxy.test.ts | 16 +++++++++++----- src/start-proxy.ts | 20 +++++++++++++++++--- 4 files changed, 34 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index f3d3022b0..00309ef50 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187870,7 +187870,10 @@ async function getProxyBinaryPath(action) { proxyInfo.version ); } - return path27.join(proxyBin, proxyFileName); + return { + path: path27.join(proxyBin, proxyFileName), + version: proxyInfo.version + }; } // src/start-proxy/ca.ts @@ -188235,7 +188238,7 @@ async function run7(action) { const actionWithFeatures = extendActionState(action, { features }); const proxyBin = await getProxyBinaryPath(actionWithFeatures); const proxyInfo = await startProxy( - proxyBin, + proxyBin.path, proxyConfig, proxyLogFilePath, logger2 diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index bc3351da5..9f96e1503 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -106,7 +106,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { const actionWithFeatures = extendActionState(action, { features }); const proxyBin = await getProxyBinaryPath(actionWithFeatures); const proxyInfo = await startProxy( - proxyBin, + proxyBin.path, proxyConfig, proxyLogFilePath, logger, diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts index 86bb99348..66edd0c62 100644 --- a/src/start-proxy.test.ts +++ b/src/start-proxy.test.ts @@ -886,9 +886,10 @@ test.serial( t.assert(path); t.is( - path, + path.path, filepath.join(toolcachePath, startProxyExports.getProxyFilename()), ); + t.is(path.version, startProxyExports.UPDATEJOB_PROXY_VERSION); }); }, ); @@ -939,9 +940,10 @@ test.serial( t.assert(cacheDir.calledOnceWith(extractedPath)); t.assert(path); t.is( - path, + path.path, filepath.join(toolcachePath, startProxyExports.getProxyFilename()), ); + t.is(path.version, defaults.cliVersion); checkExpectedLogMessages(t, logger.messages, [ `Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${defaults.bundleVersion}' at '${downloadUrl}'`, @@ -954,7 +956,8 @@ test.serial( async (t) => { const logger = new RecordingLogger(); const state = initAllState({ logger }); - const expectedTag = "codeql-bundle-v2.20.1"; + const expectedVersion = "2.20.1"; + const expectedTag = `codeql-bundle-v${expectedVersion}`; const expectedParams = { owner: "github", repo: "codeql-action", @@ -1012,7 +1015,9 @@ test.serial( const getDefaultCliVersion = sinon .stub(features, "getEnabledDefaultCliVersions") .resolves({ - enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }], + enabledVersions: [ + { cliVersion: expectedVersion, tagName: expectedTag }, + ], }); const path = await startProxyExports.getProxyBinaryPath({ ...state, @@ -1033,9 +1038,10 @@ test.serial( t.assert(path); t.is( - path, + path.path, filepath.join(toolcachePath, startProxyExports.getProxyFilename()), ); + t.is(path.version, expectedVersion); }); checkExpectedLogMessages(t, logger.messages, [ diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 84ed5fb17..e22346d3a 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -428,17 +428,27 @@ export function getProxyFilename() { : UPDATEJOB_PROXY; } +export type ProxyBinary = { + /** The path to the proxy binary to run. */ + path: string; + /** + * The version associated with the proxy binary. + * This usually corresponds to the CodeQL CLI release that the binary was obtained from. + */ + version: string; +}; + /** * Gets a path to the proxy binary. If possible, this function will find the proxy in the * runner's tool cache. Otherwise, it downloads and extracts the proxy binary, * and stores it in the tool cache. * * @param action The action state. - * @returns The path to the proxy binary. + * @returns The path to the proxy binary and its version. */ export async function getProxyBinaryPath( action: ActionState<["Base", "Logger", "FeatureFlags"]>, -): Promise { +): Promise { const logger = action.logger; const proxyFileName = getProxyFilename(); const proxyInfo = await getDownloadUrl(action); @@ -460,5 +470,9 @@ export async function getProxyBinaryPath( proxyInfo.version, ); } - return path.join(proxyBin, proxyFileName); + + return { + path: path.join(proxyBin, proxyFileName), + version: proxyInfo.version, + }; } From 43db2c064ca6c19f843f4791c5cfa3fc73138669 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 13 Oct 2026 19:12:13 +0100 Subject: [PATCH 41/58] Include proxy version in telemetry --- lib/entry-points.js | 6 ++++-- src/start-proxy-action.ts | 1 + src/start-proxy/status-report.ts | 15 ++++++++++++++- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 00309ef50..d4c353c9f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187528,7 +187528,7 @@ var toolcache4 = __toESM(require_tool_cache()); // src/start-proxy/status-report.ts var core23 = __toESM(require_core()); -async function sendSuccessStatusReport(startedAt, config, registry_types, logger2) { +async function sendSuccessStatusReport(startedAt, config, registry_types, status, logger2) { const statusReportBase = await createStatusReportBase( "start-proxy" /* StartProxy */, "success", @@ -187540,7 +187540,8 @@ async function sendSuccessStatusReport(startedAt, config, registry_types, logger if (statusReportBase !== void 0) { const statusReport = { ...statusReportBase, - registry_types: registry_types.join(",") + registry_types: registry_types.join(","), + start_proxy: status }; await sendStatusReport(statusReport); } @@ -188250,6 +188251,7 @@ async function run7(action) { languages: language === void 0 ? void 0 : [language] }, proxyConfig.all_credentials.map((c) => c.type), + { proxy_version: proxyBin.version }, logger2 ); } catch (unwrappedError) { diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 9f96e1503..8a5f5af14 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -122,6 +122,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { languages: language === undefined ? undefined : [language], }, proxyConfig.all_credentials.map((c) => c.type), + { proxy_version: proxyBin.version }, logger, ); } catch (unwrappedError) { diff --git a/src/start-proxy/status-report.ts b/src/start-proxy/status-report.ts index 081078034..685be3dbe 100644 --- a/src/start-proxy/status-report.ts +++ b/src/start-proxy/status-report.ts @@ -12,18 +12,30 @@ import { } from "../status-report"; import * as util from "../util"; +/** Additional status report data from `start-proxy`. */ +export interface StartProxyStatus { + proxy_version: string; +} + +/** The type of successful status reports from `start-proxy`. */ +type StartProxySuccessReport = StatusReportBase & { + start_proxy: StartProxyStatus; +}; + /** * Sends a status report for the `start-proxy` action indicating a successful outcome. * * @param startedAt When the action was started. * @param config The configuration used. * @param registry_types The types of registries that are configured. + * @param status Status information. * @param logger The logger to use. */ export async function sendSuccessStatusReport( startedAt: Date, config: Partial, registry_types: string[], + status: StartProxyStatus, logger: Logger, ) { const statusReportBase = await createStatusReportBase( @@ -35,9 +47,10 @@ export async function sendSuccessStatusReport( logger, ); if (statusReportBase !== undefined) { - const statusReport: StatusReportBase = { + const statusReport: StartProxySuccessReport = { ...statusReportBase, registry_types: registry_types.join(","), + start_proxy: status, }; await sendStatusReport(statusReport); } From 6aee1f8ef9c4cb021dafe1c97ea41122dd03b98b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 10:30:14 +0100 Subject: [PATCH 42/58] Sort `registry_types` in status report --- lib/entry-points.js | 2 +- src/start-proxy/status-report.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index d4c353c9f..1b67d38e1 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187540,7 +187540,7 @@ async function sendSuccessStatusReport(startedAt, config, registry_types, status if (statusReportBase !== void 0) { const statusReport = { ...statusReportBase, - registry_types: registry_types.join(","), + registry_types: registry_types.sort().join(","), start_proxy: status }; await sendStatusReport(statusReport); diff --git a/src/start-proxy/status-report.ts b/src/start-proxy/status-report.ts index 685be3dbe..76ad3c8da 100644 --- a/src/start-proxy/status-report.ts +++ b/src/start-proxy/status-report.ts @@ -49,7 +49,7 @@ export async function sendSuccessStatusReport( if (statusReportBase !== undefined) { const statusReport: StartProxySuccessReport = { ...statusReportBase, - registry_types: registry_types.join(","), + registry_types: registry_types.sort().join(","), start_proxy: status, }; await sendStatusReport(statusReport); From 15800587e38e5a271757432b15bc7ab06517df43 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 10:31:29 +0100 Subject: [PATCH 43/58] Add unit test for `sendSuccessStatusReport` --- src/start-proxy/status-report.test.ts | 42 +++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/src/start-proxy/status-report.test.ts b/src/start-proxy/status-report.test.ts index 15772872b..c73478396 100644 --- a/src/start-proxy/status-report.test.ts +++ b/src/start-proxy/status-report.test.ts @@ -4,7 +4,9 @@ import sinon from "sinon"; import * as statusReport from "../status-report"; import { + createTestConfig, makeMacro, + RecordingLogger, setupTests, withRecordingLoggerAsync, } from "../testing-utils"; @@ -14,6 +16,46 @@ import * as startProxyExports from "./status-report"; setupTests(test); +test.serial("sendSuccessStatusReport", async (t) => { + const logger = new RecordingLogger(); + const now = new Date(); + const config = createTestConfig({}); + const proxy_version = "1.2.3"; + const registry_types = ["git_source", "docker_registry"]; + + const createStatusReportBase = sinon.stub( + statusReport, + "createStatusReportBase", + ); + createStatusReportBase.resolves({ + action_name: statusReport.ActionName.StartProxy, + } as statusReport.StatusReportBase); + + const sendStatusReport = sinon + .stub(statusReport, "sendStatusReport") + .resolves(); + + await startProxyExports.sendSuccessStatusReport( + now, + config, + registry_types, + { proxy_version }, + logger, + ); + + t.is(createStatusReportBase.callCount, 1); + + t.is(sendStatusReport.callCount, 1); + t.is(sendStatusReport.args[0].length, 1); + + const arg = sendStatusReport.args[0][0]; + t.like(arg, { + action_name: statusReport.ActionName.StartProxy, + registry_types: "docker_registry,git_source", + start_proxy: { proxy_version }, + }); +}); + const sendFailedStatusReportTest = makeMacro({ exec: async ( t: ExecutionContext, From efdb69c1d759ed1f924e3f7b296fac7c53339b9a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 09:49:53 +0000 Subject: [PATCH 44/58] Bump the npm-minor group across 1 directory with 7 updates Bumps the npm-minor group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) | `5.2.0` | `5.3.0` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.0` | `1.16.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.2` | `5.4.3` | | [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `65.0.1` | `65.2.0` | | [globals](https://github.com/sindresorhus/globals) | `17.12.0` | `17.13.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.70.1` | `8.71.1` | | [mdast-util-from-markdown](https://github.com/syntax-tree/mdast-util-from-markdown) | `2.0.3` | `2.1.0` | Updates `@actions/cache` from 5.2.0 to 5.3.0 - [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache) Updates `follow-redirects` from 1.16.0 to 1.16.1 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.16.0...v1.16.1) Updates `js-yaml` from 5.4.2 to 5.4.3 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.4.2...5.4.3) Updates `eslint-plugin-jsdoc` from 65.0.1 to 65.2.0 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](https://github.com/gajus/eslint-plugin-jsdoc/compare/v65.0.1...v65.2.0) Updates `globals` from 17.12.0 to 17.13.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.12.0...v17.13.0) Updates `typescript-eslint` from 8.70.1 to 8.71.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.1/packages/typescript-eslint) Updates `mdast-util-from-markdown` from 2.0.3 to 2.1.0 - [Release notes](https://github.com/syntax-tree/mdast-util-from-markdown/releases) - [Commits](https://github.com/syntax-tree/mdast-util-from-markdown/compare/2.0.3...2.1.0) --- updated-dependencies: - dependency-name: "@actions/cache" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: follow-redirects dependency-version: 1.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: js-yaml dependency-version: 5.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-jsdoc dependency-version: 65.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: globals dependency-version: 17.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.71.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: mdast-util-from-markdown dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 178 ++++++++++++++++++++--------------------- package.json | 12 +-- pr-checks/package.json | 2 +- 3 files changed, 96 insertions(+), 96 deletions(-) diff --git a/package-lock.json b/package-lock.json index 050ff1e48..391d707ef 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14,7 +14,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.2.0", + "@actions/cache": "^5.3.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -28,10 +28,10 @@ "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", - "follow-redirects": "^1.16.0", + "follow-redirects": "^1.16.1", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.4.2", + "js-yaml": "^5.4.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", @@ -58,14 +58,14 @@ "eslint-import-resolver-typescript": "^4.4.5", "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", - "eslint-plugin-jsdoc": "^65.0.1", + "eslint-plugin-jsdoc": "^65.2.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.12.0", + "globals": "^17.13.0", "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.70.1" + "typescript-eslint": "^8.71.1" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -459,19 +459,19 @@ } }, "node_modules/@actions/cache": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz", - "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==", + "version": "5.3.0", + "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.3.0.tgz", + "integrity": "sha512-VqJBlQFt1lpp7op7o/Z0syWywX9cN8TxjFCPjHyGHmXCiczU5NII5ZdEpGpTelUnOGFG2bO7viUx9q3q7WR/Gg==", "license": "MIT", "dependencies": { - "@actions/core": "^2.0.0", + "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/glob": "^0.5.1", "@actions/http-client": "^3.0.2", "@actions/io": "^2.0.0", "@azure/abort-controller": "^1.1.0", - "@azure/core-rest-pipeline": "^1.22.0", - "@azure/storage-blob": "^12.29.1", + "@azure/core-rest-pipeline": "^1.25.0", + "@azure/storage-blob": "^12.34.0", "@protobuf-ts/runtime-rpc": "^2.11.1", "semver": "^6.3.1" } @@ -2718,17 +2718,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.70.1.tgz", - "integrity": "sha512-nDNrUQ/4ruSNYbu749TRY7cfrzPtoLHEXSNBI8aaNY32LlZCajixqRf3FqcKC4p5Cam4VOHYx/t+i5+nKXvrqA==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.71.1.tgz", + "integrity": "sha512-nNlBf6HuotqMgZvSkWD5hNdemiBIxQ2NmrlgfcUIeZRs+BbakjscCQRq/Hb74EFVnFiSWWdL12JruqwBy3ERDw==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.70.1", - "@typescript-eslint/type-utils": "8.70.1", - "@typescript-eslint/utils": "8.70.1", - "@typescript-eslint/visitor-keys": "8.70.1", + "@typescript-eslint/scope-manager": "8.71.1", + "@typescript-eslint/type-utils": "8.71.1", + "@typescript-eslint/utils": "8.71.1", + "@typescript-eslint/visitor-keys": "8.71.1", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2741,7 +2741,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.70.1", + "@typescript-eslint/parser": "^8.71.1", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2757,16 +2757,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.70.1.tgz", - "integrity": "sha512-nO974WLllwhSFWQXnMLj6nDGa8f0khKEz1JzpPJ1u7Vm/4X1X6ZHajpoknU4bb41vJyMB0HHVyS2GqdhWfIXZw==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.71.1.tgz", + "integrity": "sha512-oM/5sAqz/l1v/zYK1qTOPrn2+JIrBGC1V6uNYucRO5gh6eT9vWJ/RhPbGE59byvZEUQ4VP6XkLBaS5Jti5jpvw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.70.1", - "@typescript-eslint/types": "8.70.1", - "@typescript-eslint/typescript-estree": "8.70.1", - "@typescript-eslint/visitor-keys": "8.70.1", + "@typescript-eslint/scope-manager": "8.71.1", + "@typescript-eslint/types": "8.71.1", + "@typescript-eslint/typescript-estree": "8.71.1", + "@typescript-eslint/visitor-keys": "8.71.1", "debug": "^4.4.3" }, "engines": { @@ -2800,14 +2800,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.1.tgz", - "integrity": "sha512-62xOgboPfwc3/IgPSX/W6oQR3ZbF04194FPGUGH8HL8iLFHbt/456/8Ph1wLNUgVF+s94FlHoipBsz+v7+LMnA==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.71.1.tgz", + "integrity": "sha512-Oijc9RUsohHjncg6iGi7gCtjnEjYt9FWv9u6ygK8uKcHK5eLjLAkqERQ9BaytbpceOFdk6kifPCS/zAZE+A99g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.70.1", - "@typescript-eslint/types": "^8.70.1", + "@typescript-eslint/tsconfig-utils": "^8.71.1", + "@typescript-eslint/types": "^8.71.1", "debug": "^4.4.3" }, "engines": { @@ -2840,14 +2840,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.1.tgz", - "integrity": "sha512-Pa0EeSeAusQc1WbjQMac+YfenewYTBu0KjgYvkUKwhXaHUKbFog23Dm/rp0DX/6tyYOQ3Xl1a+3EcFNZynGHCw==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.71.1.tgz", + "integrity": "sha512-1YUDZXdTnXLlob03SFHBipdyMBsDVm7zoSz0ytTJ39dk5J1TgsTK03VlR/dLXG/RLLUrPcYbD4rp23BmHxHP0w==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.70.1", - "@typescript-eslint/visitor-keys": "8.70.1" + "@typescript-eslint/types": "8.71.1", + "@typescript-eslint/visitor-keys": "8.71.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2858,9 +2858,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.1.tgz", - "integrity": "sha512-jumze1fPI+sDOaM2TWGQdn39PDxTr7TZGeuyLkAbNyx2vtMT3uRnVKChN0hfht5V2TugphJzF6bYXvBcE09qqg==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.71.1.tgz", + "integrity": "sha512-oTvkml5SxXhgg+WWKhod5qWQICDXtOB+/Hi9VdPKFAANJ2b7YOgMffgvzXuqog7R6A/JtrzRf128dsxummyWhg==", "dev": true, "license": "MIT", "engines": { @@ -2875,15 +2875,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.70.1.tgz", - "integrity": "sha512-7zKTnyvaVWqzLZHPFQtX1hVHqgkMC+WebPWakNCSyrQVbIP1AM0L0TlBZtACldIRb6PptI8Odk+jyZ5kP3B1VA==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.71.1.tgz", + "integrity": "sha512-kH3t3jZCYv2PZSBEWPKTariLrCaoF1CLoPitYFBJOhAGEwWnSRAtGEifrfrpBa4K9JlwWNZotgA5w3/wLSk/FQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.70.1", - "@typescript-eslint/typescript-estree": "8.70.1", - "@typescript-eslint/utils": "8.70.1", + "@typescript-eslint/types": "8.71.1", + "@typescript-eslint/typescript-estree": "8.71.1", + "@typescript-eslint/utils": "8.71.1", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2918,9 +2918,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.1.tgz", - "integrity": "sha512-Dm1ypdhhrGCTyyehxElhgJ6kgk8MVCv5qXdoOVqPr1uqk42jX8KjrZqhROvdShczA8qrDoYiOWn1ykWlx2k81Q==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.71.1.tgz", + "integrity": "sha512-ybYnPTUwg3VQQOFEiBPLs8Jxl1ry2vXdn1kVKguomBbvxpetdu3MKTNDqFNUrlG8ylP9MpZosmXMFYlGQHk1oQ==", "dev": true, "license": "MIT", "engines": { @@ -2932,16 +2932,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.1.tgz", - "integrity": "sha512-TU8PwyGN0PQJUcE96mw8eCQ44SmxGdQlJmlWakHaHQ15eIuuvye5yNtmh/i6oS88jzXVQB71xdNkbkB/fMwL0g==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.71.1.tgz", + "integrity": "sha512-pSKSEK1JJpHs6KiKVtABCE4iJK5d7FLFzDXQNBQ2oRY7LEd3UwOt3TZemTgu9syTIf56dJWlTn/pdmrO9oKUXQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.70.1", - "@typescript-eslint/tsconfig-utils": "8.70.1", - "@typescript-eslint/types": "8.70.1", - "@typescript-eslint/visitor-keys": "8.70.1", + "@typescript-eslint/project-service": "8.71.1", + "@typescript-eslint/tsconfig-utils": "8.71.1", + "@typescript-eslint/types": "8.71.1", + "@typescript-eslint/visitor-keys": "8.71.1", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -3017,16 +3017,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.1.tgz", - "integrity": "sha512-Esgul8MsnKnRLdYU2Eb2cRV9bS5HJYtKj1ByJnOzzG2M58DGdSUQ1jUuILxipqcpB2h9WLrbD5GijIWUjX/Tqw==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.71.1.tgz", + "integrity": "sha512-CBjT6gfAz3DW2j9Q4moFnqt208Aq+506sVGXfpRcyAeqn0EpayL0mjdWoCO2t3RC7GewNrFxdeehuEaPg6DMzQ==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.70.1", - "@typescript-eslint/types": "8.70.1", - "@typescript-eslint/typescript-estree": "8.70.1" + "@typescript-eslint/scope-manager": "8.71.1", + "@typescript-eslint/types": "8.71.1", + "@typescript-eslint/typescript-estree": "8.71.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -3041,13 +3041,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.1.tgz", - "integrity": "sha512-Vwj9lUIW5Xq3wQ9w6gv3R86g1hMK8f2zNOdGTAgeXUMMXFK78G9ruCjjqutHMNJc0+CH7LYRnHeUB9IT8wFmcw==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.71.1.tgz", + "integrity": "sha512-0GxiUGqMU0qXJt58cBsiG3DP8lUmBaFo2vChtUX+CT7PnR3v/VGLLrzVP4K9r1lNiZXjHYefMBbPunplr09v6w==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.70.1", + "@typescript-eslint/types": "8.71.1", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -5381,9 +5381,9 @@ } }, "node_modules/eslint-plugin-jsdoc": { - "version": "65.0.1", - "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.0.1.tgz", - "integrity": "sha512-7IvB+ZS71WCw5tGKh6f6D5k55qtXKdrGTnIpQTBKWdpyZ5IfhGHfh0i6ArWlCJ4JEtz22YRk5Bqu1MvbOlpMKQ==", + "version": "65.2.0", + "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-65.2.0.tgz", + "integrity": "sha512-IMZaNwdDa5otUQYGWN1pzywZLsGKswitvFFNhcO8IOsBfaWpWIDXYuZh2sYhe9MNyKN9hz0YryOFaKdpbTP5Bw==", "dev": true, "license": "BSD-3-Clause", "dependencies": { @@ -6007,9 +6007,9 @@ "license": "ISC" }, "node_modules/follow-redirects": { - "version": "1.16.0", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", - "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", + "version": "1.16.1", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz", + "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==", "funding": [ { "type": "individual", @@ -6293,9 +6293,9 @@ } }, "node_modules/globals": { - "version": "17.12.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.12.0.tgz", - "integrity": "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA==", + "version": "17.13.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz", + "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==", "dev": true, "license": "MIT", "engines": { @@ -7136,9 +7136,9 @@ } }, "node_modules/js-yaml": { - "version": "5.4.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz", - "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==", + "version": "5.4.3", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.3.tgz", + "integrity": "sha512-yzzNtgczwgoVHNigCyKTXcQJU4Y8t/ikU4UxXW0BvrLfHTGWZhsNcOT2s/a7vn81/4KqVnNmHjaUEPlvWnNwVw==", "funding": [ { "type": "github", @@ -7494,9 +7494,9 @@ } }, "node_modules/mdast-util-from-markdown": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.3.tgz", - "integrity": "sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==", + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.1.0.tgz", + "integrity": "sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==", "license": "MIT", "dependencies": { "@types/mdast": "^4.0.0", @@ -9996,16 +9996,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.70.1", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.70.1.tgz", - "integrity": "sha512-AcWG7KDjZ2THNXsgwttMaGmzVi0VFRlFYfqFHYQRbDpF3owuYbuiL8c7UUrd2k8s3PoSfIQrWfrGXfcElrWLYA==", + "version": "8.71.1", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.71.1.tgz", + "integrity": "sha512-oiNVPC3/NbV1FpaHU07l8O6ynqG9v4PAiW2WvTrAmZdR0f2HI/gE668ElMLCK7Xbsu5k2fK5C4fXNiq05j7/nQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.70.1", - "@typescript-eslint/parser": "8.70.1", - "@typescript-eslint/typescript-estree": "8.70.1", - "@typescript-eslint/utils": "8.70.1" + "@typescript-eslint/eslint-plugin": "8.71.1", + "@typescript-eslint/parser": "8.71.1", + "@typescript-eslint/typescript-estree": "8.71.1", + "@typescript-eslint/utils": "8.71.1" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -10503,7 +10503,7 @@ "@octokit/plugin-paginate-rest": ">=15.0.0", "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "lite-matter": "^0.1.2", - "mdast-util-from-markdown": "^2.0.3", + "mdast-util-from-markdown": "^2.1.0", "semver": "^7.8.5", "yaml": "^2.9.1" }, diff --git a/package.json b/package.json index 51fd4a450..c627b9358 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.2.0", + "@actions/cache": "^5.3.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -36,10 +36,10 @@ "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", - "follow-redirects": "^1.16.0", + "follow-redirects": "^1.16.1", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.4.2", + "js-yaml": "^5.4.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", @@ -66,14 +66,14 @@ "eslint-import-resolver-typescript": "^4.4.5", "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", - "eslint-plugin-jsdoc": "^65.0.1", + "eslint-plugin-jsdoc": "^65.2.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.12.0", + "globals": "^17.13.0", "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.70.1" + "typescript-eslint": "^8.71.1" }, "overrides": { "@actions/tool-cache": { diff --git a/pr-checks/package.json b/pr-checks/package.json index 3d6b3d07e..a6e67e527 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -9,7 +9,7 @@ "@octokit/plugin-paginate-rest": ">=15.0.0", "@octokit/plugin-rest-endpoint-methods": "^18.0.0", "lite-matter": "^0.1.2", - "mdast-util-from-markdown": "^2.0.3", + "mdast-util-from-markdown": "^2.1.0", "semver": "^7.8.5", "yaml": "^2.9.1" }, From 25fe42ad78275cee8b1b655ade6fd15224aba711 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 09:51:41 +0000 Subject: [PATCH 45/58] Rebuild --- lib/entry-points.js | 92 ++++++++++++++++++++++++++++----------------- 1 file changed, 58 insertions(+), 34 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 373cdedc0..4bda95685 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -100013,7 +100013,7 @@ var require_package = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "5.2.0", + version: "5.3.0", preview: true, description: "Actions cache lib", keywords: [ @@ -100050,22 +100050,22 @@ var require_package = __commonJS({ url: "https://github.com/actions/toolkit/issues" }, dependencies: { - "@actions/core": "^2.0.0", + "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/glob": "^0.5.1", - "@protobuf-ts/runtime-rpc": "^2.11.1", "@actions/http-client": "^3.0.2", "@actions/io": "^2.0.0", "@azure/abort-controller": "^1.1.0", - "@azure/core-rest-pipeline": "^1.22.0", - "@azure/storage-blob": "^12.29.1", + "@azure/core-rest-pipeline": "^1.25.0", + "@azure/storage-blob": "^12.34.0", + "@protobuf-ts/runtime-rpc": "^2.11.1", semver: "^6.3.1" }, devDependencies: { - "@types/node": "^24.1.0", - "@types/semver": "^6.0.0", - "@protobuf-ts/plugin": "^2.9.4", - typescript: "^5.2.2" + "@protobuf-ts/plugin": "^2.11.1", + "@types/node": "^24.13.6", + "@types/semver": "^6.2.7", + typescript: "^5.9.3" }, overrides: { "uri-js": "npm:uri-js-replace@^1.0.1", @@ -105592,6 +105592,7 @@ var require_tar = __commonJS({ exports2.listTar = listTar; exports2.extractTar = extractTar3; exports2.createTar = createTar; + var core29 = __importStar2(require_core()); var exec_1 = require_exec(); var io9 = __importStar2(require_io()); var fs_1 = require("fs"); @@ -105644,7 +105645,7 @@ var require_tar = __commonJS({ args.push("--posix", "-cf", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "--exclude", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "--files-from", constants_1.ManifestFilename); break; case "extract": - args.push("-xf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path30.sep}`, "g"), "/")); + args.push("-xf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P", "-C", BSD_TAR_ZSTD ? quoteAbsolutePath(workingDirectory) : workingDirectory.replace(new RegExp(`\\${path30.sep}`, "g"), "/")); break; case "list": args.push("-tf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P"); @@ -105675,16 +105676,19 @@ var require_tar = __commonJS({ } else { args = [[...tarArgs].join(" "), [...compressionArgs].join(" ")]; } - if (BSD_TAR_ZSTD) { - return args; - } - return [args.join(" ")]; + return { + commands: BSD_TAR_ZSTD ? args : [args.join(" ")], + requiresTempDirectory: BSD_TAR_ZSTD && type !== "create" + }; }); } function getWorkingDirectory() { var _a6; return (_a6 = process.env["GITHUB_WORKSPACE"]) !== null && _a6 !== void 0 ? _a6 : process.cwd(); } + function quoteAbsolutePath(filePath) { + return `"${path30.resolve(filePath).replace(new RegExp(`\\${path30.sep}`, "g"), "/")}"`; + } function getDecompressionProgram(tarPath, compressionMethod, archivePath) { return __awaiter2(this, void 0, void 0, function* () { const BSD_TAR_ZSTD = tarPath.type === constants_1.ArchiveToolType.BSD && compressionMethod !== constants_1.CompressionMethod.Gzip && IS_WINDOWS; @@ -105693,17 +105697,13 @@ var require_tar = __commonJS({ return BSD_TAR_ZSTD ? [ "zstd -d --long=30 --force -o", constants_1.TarFilename, - archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/") + quoteAbsolutePath(archivePath) ] : [ "--use-compress-program", IS_WINDOWS ? '"zstd -d --long=30"' : "unzstd --long=30" ]; case constants_1.CompressionMethod.ZstdWithoutLong: - return BSD_TAR_ZSTD ? [ - "zstd -d --force -o", - constants_1.TarFilename, - archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/") - ] : ["--use-compress-program", IS_WINDOWS ? '"zstd -d"' : "unzstd"]; + return BSD_TAR_ZSTD ? ["zstd -d --force -o", constants_1.TarFilename, quoteAbsolutePath(archivePath)] : ["--use-compress-program", IS_WINDOWS ? '"zstd -d"' : "unzstd"]; default: return ["-z"]; } @@ -105748,24 +105748,39 @@ var require_tar = __commonJS({ } }); } + function execReadCommands(archivePath, compressionMethod, type) { + return __awaiter2(this, void 0, void 0, function* () { + const { commands, requiresTempDirectory } = yield getCommands(compressionMethod, type, archivePath); + const tempDirectory = requiresTempDirectory ? yield utils.createTempDirectory() : void 0; + try { + yield execCommands(commands, tempDirectory); + } finally { + if (tempDirectory) { + try { + yield io9.rmRF(tempDirectory); + } catch (error3) { + core29.debug(`Failed to delete temporary tar directory: ${error3}`); + } + } + } + }); + } function listTar(archivePath, compressionMethod) { return __awaiter2(this, void 0, void 0, function* () { - const commands = yield getCommands(compressionMethod, "list", archivePath); - yield execCommands(commands); + yield execReadCommands(archivePath, compressionMethod, "list"); }); } function extractTar3(archivePath, compressionMethod) { return __awaiter2(this, void 0, void 0, function* () { const workingDirectory = getWorkingDirectory(); yield io9.mkdirP(workingDirectory); - const commands = yield getCommands(compressionMethod, "extract", archivePath); - yield execCommands(commands); + yield execReadCommands(archivePath, compressionMethod, "extract"); }); } function createTar(archiveFolder, sourceDirectories, compressionMethod) { return __awaiter2(this, void 0, void 0, function* () { (0, fs_1.writeFileSync)(path30.join(archiveFolder, constants_1.ManifestFilename), sourceDirectories.join("\n")); - const commands = yield getCommands(compressionMethod, "create"); + const { commands } = yield getCommands(compressionMethod, "create"); yield execCommands(commands, archiveFolder); }); } @@ -107381,6 +107396,12 @@ var require_follow_redirects = __commonJS({ RedirectableRequest.prototype._sanitizeOptions = function(options) { if (!options.headers) { options.headers = {}; + } else if (Array.isArray(options.headers)) { + var headerList = options.headers; + options.headers = {}; + for (var i = 0; i < headerList.length; i += 2) { + options.headers[headerList[i]] = headerList[i + 1]; + } } if (!isArray2(options.sensitiveHeaders)) { options.sensitiveHeaders = []; @@ -107655,7 +107676,7 @@ var require_follow_redirects = __commonJS({ return URL2 && value instanceof URL2; } function escapeRegex(regex) { - return regex.replace(/[\]\\/()*+?.$]/g, "\\$&"); + return regex.replace(/[[\]\\/()*+?.^$|]/g, "\\$&"); } module2.exports = wrap({ http, https: https3 }); module2.exports.wrap = wrap; @@ -168147,7 +168168,7 @@ function readBlockScalar(state, parentIndent, props) { state.position = linePosition + column; throwError(state, "tab characters must not be used in indentation"); } - if (column < maxLeadingIndent) { + if (column >= parentIndent && column < maxLeadingIndent) { state.position = linePosition + column; throwError(state, "bad indentation of a mapping entry"); } @@ -168357,13 +168378,16 @@ function readBlockMapping(state, nodeIndent, flowIndent, props) { ch = state.input.charCodeAt(++state.position); if (!isWsOrEolOrEnd(ch)) throwError(state, "a whitespace character is expected after the key-value separator within a block mapping"); if (!mappingOpened) { - restoreState(state, beforeKey); - addMappingEvent(state, beforeKey.position, props.anchorStart, props.anchorEnd, props.tagStart, props.tagEnd, COLLECTION_STYLE.BLOCK); + state.events.splice(beforeKey.eventsLength, 0, { + type: EVENT_ID.MAPPING, + start: beforeKey.position, + anchorStart: props.anchorStart, + anchorEnd: props.anchorEnd, + tagStart: props.tagStart, + tagEnd: props.tagEnd, + style: COLLECTION_STYLE.BLOCK + }); mappingOpened = true; - parseNode(state, flowIndent, CONTEXT_FLOW_OUT, false, true); - ch = state.input.charCodeAt(state.position); - while (isWhiteSpace(ch)) ch = state.input.charCodeAt(++state.position); - state.position++; } detected = true; atExplicitKey = false; @@ -188637,7 +188661,7 @@ tmp/lib/tmp.js: *) js-yaml/dist/js-yaml.mjs: - (*! js-yaml 5.4.2 https://github.com/nodeca/js-yaml @license MIT *) + (*! js-yaml 5.4.3 https://github.com/nodeca/js-yaml @license MIT *) long/index.js: (** From 71ad3a794a9edd2ecb4843da2d0d24bab3908a2e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 13:57:43 +0100 Subject: [PATCH 46/58] Fix typo in log message --- lib/entry-points.js | 2 +- src/start-proxy.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index e6beeaf6d..9f141a078 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187870,7 +187870,7 @@ async function getProxyBinaryPath(action, apiDetails) { proxyInfo.url ); const temp = await downloadProxy(logger2, proxyInfo.url, authorization); - logger2.info(`Downloaded the authentication proxy assset to '${temp}'.`); + logger2.info(`Downloaded the authentication proxy asset to '${temp}'.`); const extracted = await extractProxy(logger2, temp); proxyBin = await cacheProxy( logger2, diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 21a5012f1..b0cfd6270 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -566,7 +566,7 @@ export async function getProxyBinaryPath( ); const temp = await downloadProxy(logger, proxyInfo.url, authorization); - logger.info(`Downloaded the authentication proxy assset to '${temp}'.`); + logger.info(`Downloaded the authentication proxy asset to '${temp}'.`); const extracted = await extractProxy(logger, temp); proxyBin = await cacheProxy( From 962aaad9386547e14df8ca7552245b0a9b3e8218 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 13:58:37 +0100 Subject: [PATCH 47/58] Rename `proxyBin` to `proxyDir` --- lib/entry-points.js | 10 +++++----- src/start-proxy.ts | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 9f141a078..8d6df2f78 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -187859,8 +187859,8 @@ async function getProxyBinaryPath(action, apiDetails) { logger2.info( `Using authentication proxy from CodeQL release ${proxyInfo.version}.` ); - let proxyBin = toolcache4.find(proxyFileName, proxyInfo.version); - if (!proxyBin) { + let proxyDir = toolcache4.find(proxyFileName, proxyInfo.version); + if (!proxyDir) { logger2.info( `Authentication proxy is not in the toolcache. Will try to download it from '${proxyInfo.url}'.` ); @@ -187872,15 +187872,15 @@ async function getProxyBinaryPath(action, apiDetails) { const temp = await downloadProxy(logger2, proxyInfo.url, authorization); logger2.info(`Downloaded the authentication proxy asset to '${temp}'.`); const extracted = await extractProxy(logger2, temp); - proxyBin = await cacheProxy( + proxyDir = await cacheProxy( logger2, extracted, proxyFileName, proxyInfo.version ); - logger2.info(`Extracted the authentication proxy to '${proxyBin}'.`); + logger2.info(`Extracted the authentication proxy to '${proxyDir}'.`); } - return path27.join(proxyBin, proxyFileName); + return path27.join(proxyDir, proxyFileName); } finally { logger2.endGroup(); } diff --git a/src/start-proxy.ts b/src/start-proxy.ts index b0cfd6270..c3826ed6e 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -552,9 +552,9 @@ export async function getProxyBinaryPath( `Using authentication proxy from CodeQL release ${proxyInfo.version}.`, ); - let proxyBin = toolcache.find(proxyFileName, proxyInfo.version); + let proxyDir = toolcache.find(proxyFileName, proxyInfo.version); - if (!proxyBin) { + if (!proxyDir) { logger.info( `Authentication proxy is not in the toolcache. Will try to download it from '${proxyInfo.url}'.`, ); @@ -569,16 +569,16 @@ export async function getProxyBinaryPath( logger.info(`Downloaded the authentication proxy asset to '${temp}'.`); const extracted = await extractProxy(logger, temp); - proxyBin = await cacheProxy( + proxyDir = await cacheProxy( logger, extracted, proxyFileName, proxyInfo.version, ); - logger.info(`Extracted the authentication proxy to '${proxyBin}'.`); + logger.info(`Extracted the authentication proxy to '${proxyDir}'.`); } - return path.join(proxyBin, proxyFileName); + return path.join(proxyDir, proxyFileName); } finally { logger.endGroup(); } From 28d5dd981873bfedbe4f650248813f333fe96451 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 15:07:40 +0100 Subject: [PATCH 48/58] Revert "Allow logging functions to accept `string[]` directly" This reverts commit 909fda1468f8ef25624848914b92c3faeba7cfe7. --- lib/entry-points.js | 20 ++++---------------- src/logging.test.ts | 17 ----------------- src/logging.ts | 43 ++++++++----------------------------------- src/testing-utils.ts | 14 +++++++------- 4 files changed, 19 insertions(+), 75 deletions(-) delete mode 100644 src/logging.test.ts diff --git a/lib/entry-points.js b/lib/entry-points.js index 8d6df2f78..e56668bbe 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -170475,24 +170475,12 @@ function fixCodeQualityCategory(logger2, category, env = getEnv()) { // src/logging.ts var core5 = __toESM(require_core()); -var joinMessageStrings = (message) => { - if (Array.isArray(message)) { - return message.join(" "); - } else { - return message; - } -}; -var autoJoinMessageStrings = (fn) => { - return (message) => { - return fn(joinMessageStrings(message)); - }; -}; function getActionsLogger() { return { - debug: autoJoinMessageStrings(core5.debug), - info: autoJoinMessageStrings(core5.info), - warning: autoJoinMessageStrings(core5.warning), - error: autoJoinMessageStrings(core5.error), + debug: core5.debug, + info: core5.info, + warning: core5.warning, + error: core5.error, isDebug: core5.isDebug, startGroup: core5.startGroup, endGroup: core5.endGroup diff --git a/src/logging.test.ts b/src/logging.test.ts deleted file mode 100644 index 33f6f8c16..000000000 --- a/src/logging.test.ts +++ /dev/null @@ -1,17 +0,0 @@ -import test from "ava"; - -import { joinMessageStrings } from "./logging"; -import { setupTests } from "./testing-utils"; - -setupTests(test); - -test("joinMessageStrings", async (t) => { - // For strings and errors, it is the identity function. - t.deepEqual(joinMessageStrings("Hello"), "Hello"); - - const error = new Error("Some error"); - t.deepEqual(joinMessageStrings(error), error); - - // For arrays of strings, we get a join-ed string. - t.deepEqual(joinMessageStrings(["foo", "bar"]), "foo bar"); -}); diff --git a/src/logging.ts b/src/logging.ts index 177aca6c7..2c34cb54d 100644 --- a/src/logging.ts +++ b/src/logging.ts @@ -1,16 +1,10 @@ import * as core from "@actions/core"; -/** Types that all of our logging functions accept. */ -export type Loggable = string | string[]; - -/** Some logging functions also accept errors directly. */ -export type LoggableError = Loggable | Error; - export interface Logger { - debug: (message: Loggable) => void; - info: (message: Loggable) => void; - warning: (message: LoggableError) => void; - error: (message: LoggableError) => void; + debug: (message: string) => void; + info: (message: string) => void; + warning: (message: string | Error) => void; + error: (message: string | Error) => void; isDebug: () => boolean; @@ -18,33 +12,12 @@ export interface Logger { endGroup: () => void; } -/** If `message` is an array of strings, the array is `join`-ed into one string separated by spaces. */ -export const joinMessageStrings = ( - message: string[] | string | T, -): string | T => { - if (Array.isArray(message)) { - return message.join(" "); - } else { - return message; - } -}; - -/** - * Wraps a logging function so that `joinMessageStrings` is applied to the input before - * calling the wrapped logging function. - */ -const autoJoinMessageStrings = (fn: (msg: string | T) => void) => { - return (message: string[] | string | T) => { - return fn(joinMessageStrings(message)); - }; -}; - export function getActionsLogger(): Logger { return { - debug: autoJoinMessageStrings(core.debug), - info: autoJoinMessageStrings(core.info), - warning: autoJoinMessageStrings(core.warning), - error: autoJoinMessageStrings(core.error), + debug: core.debug, + info: core.info, + warning: core.warning, + error: core.error, isDebug: core.isDebug, startGroup: core.startGroup, endGroup: core.endGroup, diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 4ff4d4934..d48f9e90f 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -30,7 +30,7 @@ import { featureConfig, FeatureEnablement, } from "./feature-flags"; -import { joinMessageStrings, Loggable, LoggableError, Logger } from "./logging"; +import { Logger } from "./logging"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import { getBundlePlatform } from "./platform"; import { ActionName } from "./status-report"; @@ -658,8 +658,8 @@ export class RecordingLogger implements Logger { constructor(private readonly logToConsole: boolean = true) {} - private addMessage(level: LogLevel, message: LoggableError): void { - this.messages.push({ type: level, message: joinMessageStrings(message) }); + private addMessage(level: LogLevel, message: string | Error): void { + this.messages.push({ type: level, message }); if (this.logToConsole) { // eslint-disable-next-line no-console @@ -684,19 +684,19 @@ export class RecordingLogger implements Logger { return true; } - debug(message: Loggable) { + debug(message: string) { this.addMessage("debug", message); } - info(message: Loggable) { + info(message: string) { this.addMessage("info", message); } - warning(message: LoggableError) { + warning(message: string | Error) { this.addMessage("warning", message); } - error(message: LoggableError) { + error(message: string | Error) { this.addMessage("error", message); } From c98271eca28faaceae6b197b4e5d2a3a7991cc5a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 15:57:53 +0100 Subject: [PATCH 49/58] Add change note for #4148 --- unreleased-change-notes/analyze-checkout-path-validation.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 unreleased-change-notes/analyze-checkout-path-validation.md diff --git a/unreleased-change-notes/analyze-checkout-path-validation.md b/unreleased-change-notes/analyze-checkout-path-validation.md new file mode 100644 index 000000000..4704376a4 --- /dev/null +++ b/unreleased-change-notes/analyze-checkout-path-validation.md @@ -0,0 +1 @@ +- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148) From c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 16:03:37 +0100 Subject: [PATCH 50/58] Add change note for #4198 --- unreleased-change-notes/start-proxy-setup-logic.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 unreleased-change-notes/start-proxy-setup-logic.md diff --git a/unreleased-change-notes/start-proxy-setup-logic.md b/unreleased-change-notes/start-proxy-setup-logic.md new file mode 100644 index 000000000..fc3582843 --- /dev/null +++ b/unreleased-change-notes/start-proxy-setup-logic.md @@ -0,0 +1 @@ +- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198) From a897ed5c2eeeb4862bf224c65f62a8b2478eb581 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 14 Oct 2026 16:05:40 +0100 Subject: [PATCH 51/58] Add change note for #4206 --- unreleased-change-notes/restore-keys.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 unreleased-change-notes/restore-keys.md diff --git a/unreleased-change-notes/restore-keys.md b/unreleased-change-notes/restore-keys.md new file mode 100644 index 000000000..3612c1b60 --- /dev/null +++ b/unreleased-change-notes/restore-keys.md @@ -0,0 +1 @@ +- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206) From 8844fb33e01ffb0746f6742ae0068740c09fd4c3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 21:24:28 +0000 Subject: [PATCH 52/58] Bump the actions-minor group across 1 directory with 3 updates Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/setup-node](https://github.com/actions/setup-node) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/__analysis-kinds.yml | 4 ++-- .github/workflows/__config-export.yml | 2 +- .github/workflows/__config-input.yml | 2 +- .github/workflows/__diagnostics-export.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__job-run-uuid-sarif.yml | 2 +- .../__packaging-codescanning-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-js.yml | 2 +- .github/workflows/__packaging-inputs-js.yml | 2 +- .github/workflows/codescanning-config-cli.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/pr-checks.yml | 8 ++++---- .github/workflows/query-filters.yml | 2 +- .github/workflows/rebuild.yml | 2 +- .github/workflows/update-bundle.yml | 2 +- .../update-supported-enterprise-server-versions.yml | 2 +- 19 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml index 5d0576e2f..5353c1095 100644 --- a/.github/workflows/__analysis-kinds.yml +++ b/.github/workflows/__analysis-kinds.yml @@ -87,7 +87,7 @@ jobs: post-processed-sarif-path: '${{ runner.temp }}/post-processed' - name: Upload SARIF files - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: | analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }} @@ -95,7 +95,7 @@ jobs: retention-days: 7 - name: Upload post-processed SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: | post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }} diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index 0c7a2cc15..f8d0ecf0c 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -65,7 +65,7 @@ jobs: output: '${{ runner.temp }}/results' upload-database: false - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json path: '${{ runner.temp }}/results/javascript.sarif' diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index f3f248cda..c015526c6 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -47,7 +47,7 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x cache: npm diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index c55f3de9b..32361c922 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -76,7 +76,7 @@ jobs: output: '${{ runner.temp }}/results' upload-database: false - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json path: '${{ runner.temp }}/results/javascript.sarif' diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index acdb09908..597c7ce9b 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -97,7 +97,7 @@ jobs: with: output: '${{ runner.temp }}/results' - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json path: '${{ runner.temp }}/results/javascript.sarif' diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index 429a69494..b24ab3900 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -62,7 +62,7 @@ jobs: with: output: '${{ runner.temp }}/results' - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json path: '${{ runner.temp }}/results/javascript.sarif' diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 4cb0499d6..27139c831 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -80,7 +80,7 @@ jobs: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false - name: Install Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x cache: npm diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index ed049214e..9844c4348 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -80,7 +80,7 @@ jobs: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false - name: Install Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x cache: npm diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 7cf99882b..916e89276 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -80,7 +80,7 @@ jobs: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false - name: Install Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x cache: npm diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 6b488a7cf..01ddb5dc3 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -80,7 +80,7 @@ jobs: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false - name: Install Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 20.x cache: npm diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index 54474d58f..782031948 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -57,7 +57,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: 'npm' diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 936fe6e95..c61bd6b17 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -89,7 +89,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download all artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 - name: Check expected artifacts exist run: | LANGUAGES="cpp csharp go java javascript python" diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 8792aea32..6d162d9c0 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -82,7 +82,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download all artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 - name: Check expected artifacts exist run: | VERSIONS="stable-v2.20.7 default linked nightly-latest" diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index c493c2a38..354da0afd 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -47,7 +47,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # ensure we have all tags and can push commits - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: 'npm' diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 2ae059440..ccbe4a6d2 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ matrix.node-version }} cache: "npm" @@ -110,7 +110,7 @@ jobs: fi - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: "npm" @@ -175,7 +175,7 @@ jobs: - name: Upload repo size comment if: steps.fetch-base.outcome == 'success' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: repo-size-comment path: ${{ runner.temp }}/repo-size/ @@ -223,7 +223,7 @@ jobs: steps: - name: Download repo size comment - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: repo-size-comment path: repo-size-comment diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 87b934eb6..1891f4195 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -33,7 +33,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: npm diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index c9522bf9a..1c174ac7a 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -30,7 +30,7 @@ jobs: ref: ${{ env.HEAD_REF }} - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: 'npm' diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index d3ee924e5..43708f573 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -41,7 +41,7 @@ jobs: git config --global user.name "github-actions[bot]" - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: 'npm' diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index ee2649ad0..6510f11e2 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -26,7 +26,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 cache: 'npm' From 3afe9c01dbfdb5af5310cf68f38e3fa546b6b901 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 21:26:52 +0000 Subject: [PATCH 53/58] Rebuild --- pr-checks/checks/analysis-kinds.yml | 4 ++-- pr-checks/checks/config-export.yml | 2 +- pr-checks/checks/diagnostics-export.yml | 2 +- pr-checks/checks/export-file-baseline-information.yml | 2 +- pr-checks/checks/job-run-uuid-sarif.yml | 2 +- pr-checks/sync.ts | 4 ++-- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/pr-checks/checks/analysis-kinds.yml b/pr-checks/checks/analysis-kinds.yml index 5b2aaf4aa..ef7cb80e1 100644 --- a/pr-checks/checks/analysis-kinds.yml +++ b/pr-checks/checks/analysis-kinds.yml @@ -46,7 +46,7 @@ steps: post-processed-sarif-path: "${{ runner.temp }}/post-processed" - name: Upload SARIF files - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: | analysis-kinds-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }} @@ -54,7 +54,7 @@ steps: retention-days: 7 - name: Upload post-processed SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: | post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }} diff --git a/pr-checks/checks/config-export.yml b/pr-checks/checks/config-export.yml index 93c640735..205754151 100644 --- a/pr-checks/checks/config-export.yml +++ b/pr-checks/checks/config-export.yml @@ -14,7 +14,7 @@ steps: output: "${{ runner.temp }}/results" upload-database: false - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json path: "${{ runner.temp }}/results/javascript.sarif" diff --git a/pr-checks/checks/diagnostics-export.yml b/pr-checks/checks/diagnostics-export.yml index 61b9ae5ef..93b3a8f60 100644 --- a/pr-checks/checks/diagnostics-export.yml +++ b/pr-checks/checks/diagnostics-export.yml @@ -27,7 +27,7 @@ steps: output: "${{ runner.temp }}/results" upload-database: false - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json path: "${{ runner.temp }}/results/javascript.sarif" diff --git a/pr-checks/checks/export-file-baseline-information.yml b/pr-checks/checks/export-file-baseline-information.yml index ce22ec5d5..da3237238 100644 --- a/pr-checks/checks/export-file-baseline-information.yml +++ b/pr-checks/checks/export-file-baseline-information.yml @@ -27,7 +27,7 @@ steps: with: output: "${{ runner.temp }}/results" - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json path: "${{ runner.temp }}/results/javascript.sarif" diff --git a/pr-checks/checks/job-run-uuid-sarif.yml b/pr-checks/checks/job-run-uuid-sarif.yml index b86725d94..879da226c 100644 --- a/pr-checks/checks/job-run-uuid-sarif.yml +++ b/pr-checks/checks/job-run-uuid-sarif.yml @@ -12,7 +12,7 @@ steps: with: output: "${{ runner.temp }}/results" - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json path: "${{ runner.temp }}/results/javascript.sarif" diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 8dc1dd1d1..d6382786c 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -215,8 +215,8 @@ const languageSetups: LanguageSetups = { name: "Install Node.js", uses: pinnedUses( "actions/setup-node", - "820762786026740c76f36085b0efc47a31fe5020", - "v7.0.0", + "949feb2413d6458794dcd2491c4babbbce0c15c1", + "v7.1.0", ), with: { "node-version": defaultLanguageVersions.javascript, From 8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 15 Oct 2026 11:03:10 +0100 Subject: [PATCH 54/58] Rename `path` to `result` in tests --- src/start-proxy.test.ts | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/src/start-proxy.test.ts b/src/start-proxy.test.ts index 22a9537cd..78704a38a 100644 --- a/src/start-proxy.test.ts +++ b/src/start-proxy.test.ts @@ -935,17 +935,17 @@ test.serial( sinon.stub(actionsUtil, "isRunningLocalAction").returns(true); const features = mockOfflineFeatures(tempDir, logger); - const path = await startProxyExports.getProxyBinaryPath( + const result = await startProxyExports.getProxyBinaryPath( initAllState({ logger, features }), SAMPLE_DOTCOM_API_DETAILS, ); - t.assert(path); + t.assert(result); t.is( - path.path, + result.path, filepath.join(toolcachePath, startProxyExports.getProxyFilename()), ); - t.is(path.version, defaults.cliVersion); + t.is(result.version, defaults.cliVersion); }); }, ); @@ -982,7 +982,7 @@ test.serial( sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo"); - const path = await startProxyExports.getProxyBinaryPath( + const result = await startProxyExports.getProxyBinaryPath( { ...state, features: createFeatures([]), @@ -999,12 +999,12 @@ test.serial( st.onceWith(extractTar, archivePath); st.onceWith(cacheDir, extractedPath); - t.assert(path); + t.assert(result); t.is( - path.path, + result.path, filepath.join(toolcachePath, startProxyExports.getProxyFilename()), ); - t.is(path.version, defaults.cliVersion); + t.is(result.version, defaults.cliVersion); checkExpectedLogMessages(t, logger.messages, [ `Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://github.com with URL ${downloadUrl}`, @@ -1080,7 +1080,7 @@ test.serial( sinon.stub(actionsUtil, "isRunningLocalAction").returns(false); state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo"); - const path = await startProxyExports.getProxyBinaryPath( + const result = await startProxyExports.getProxyBinaryPath( { ...state, features, @@ -1098,12 +1098,12 @@ test.serial( st.onceWith(extractTar, archivePath); st.onceWith(cacheDir, extractedPath); - t.assert(path); + t.assert(result); t.is( - path.path, + result.path, filepath.join(toolcachePath, startProxyExports.getProxyFilename()), ); - t.is(path.version, expectedVersion); + t.is(result.version, expectedVersion); }); checkExpectedLogMessages(t, logger.messages, [ From 444333376e064d207fe1dc74e881528bf11649c1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:34:02 +0000 Subject: [PATCH 55/58] Update changelog for v4.39.0 --- CHANGELOG.md | 5 ++++- unreleased-change-notes/analyze-checkout-path-validation.md | 1 - unreleased-change-notes/restore-keys.md | 1 - unreleased-change-notes/start-proxy-setup-logic.md | 1 - 4 files changed, 4 insertions(+), 4 deletions(-) delete mode 100644 unreleased-change-notes/analyze-checkout-path-validation.md delete mode 100644 unreleased-change-notes/restore-keys.md delete mode 100644 unreleased-change-notes/start-proxy-setup-logic.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 8ce2edd61..1a55f7e09 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,12 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.39.0 - 15 Oct 2026 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205) +- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148) +- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206) +- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198) ## 4.38.3 - 08 Oct 2026 diff --git a/unreleased-change-notes/analyze-checkout-path-validation.md b/unreleased-change-notes/analyze-checkout-path-validation.md deleted file mode 100644 index 4704376a4..000000000 --- a/unreleased-change-notes/analyze-checkout-path-validation.md +++ /dev/null @@ -1 +0,0 @@ -- The `codeql-action/analyze` step now validates that a correct argument for the `checkout_path` input has been provided. The `checkout_path` input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by `codeql-action/init`, then the CodeQL Action now produces a warning. [#4148](https://github.com/github/codeql-action/pull/4148) diff --git a/unreleased-change-notes/restore-keys.md b/unreleased-change-notes/restore-keys.md deleted file mode 100644 index 3612c1b60..000000000 --- a/unreleased-change-notes/restore-keys.md +++ /dev/null @@ -1 +0,0 @@ -- Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. [#4206](https://github.com/github/codeql-action/pull/4206) diff --git a/unreleased-change-notes/start-proxy-setup-logic.md b/unreleased-change-notes/start-proxy-setup-logic.md deleted file mode 100644 index fc3582843..000000000 --- a/unreleased-change-notes/start-proxy-setup-logic.md +++ /dev/null @@ -1 +0,0 @@ -- The `codeql-action/start-proxy` step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as `codeql-action/init`. This primarily benefits customers who are using GitHub instances other than `github.com` where the `codeql-action/start-proxy` step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. [#4198](https://github.com/github/codeql-action/pull/4198) From eb1c428e6e3725d2b527aec0ee5db4303c8f669d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Thu, 15 Oct 2026 11:39:58 +0100 Subject: [PATCH 56/58] Trigger workflows From 2edace40f1e5c872d3d716e1ba7d855811e3c47d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:57:06 +0000 Subject: [PATCH 57/58] Update changelog and version after v4.39.0 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1a55f7e09..b63b79671 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.39.0 - 15 Oct 2026 - _Breaking change_: Bump the minimum required CodeQL bundle version to 2.20.7. [#4205](https://github.com/github/codeql-action/pull/4205) diff --git a/package-lock.json b/package-lock.json index 42ba4bf1c..d702b0f6f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.39.0", + "version": "4.39.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.39.0", + "version": "4.39.1", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index 755d561f1..209ded679 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.39.0", + "version": "4.39.1", "private": true, "description": "CodeQL action", "scripts": { From 46d3daa879c9e3d2fad3711ac53836cf88e33e53 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 10:57:15 +0000 Subject: [PATCH 58/58] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 650857e9c..824d554ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -170183,7 +170183,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.39.0"; + return "4.39.1"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);