github/codeql-action
1
0
Fork 0
mirror of https://github.com/github/codeql-action.git synced 2026-10-30 17:39:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into mbg/diagnostics/failed-sarif

Browse Source
This commit is contained in:
Michael B. Gale
2026-10-15 14:26:52 +01:00
parent 4061d4ea89 7a6e2f798f
commit f80ca03949
68 changed files with 2429 additions and 1638 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/actions-util.ts
View File

@@ -93,7 +93,7 @@ export function getActionVersion(): string {
*
* This will be "dynamic" for default setup workflow runs.
*/
export function getWorkflowEventName(env: Env = getEnv()) {
export function getWorkflowEventName(env: ReadOnlyEnv = getEnv()) {
return env.getRequired(ActionsEnvVars.GITHUB_EVENT_NAME);
}
@@ -101,7 +101,7 @@ export function getWorkflowEventName(env: Env = getEnv()) {
* Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
* a workflow on the codeql-action repo itself.
*/
export function isRunningLocalAction(env: Env = getEnv()): boolean {
export function isRunningLocalAction(env: ReadOnlyEnv = getEnv()): boolean {
const relativeScriptPath = getRelativeScriptPath(env);
return (
relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath)
@@ -113,14 +113,14 @@ export function isRunningLocalAction(env: Env = getEnv()): boolean {
*
* This can be used to get the Action's name or tell if we're running a local Action.
*/
function getRelativeScriptPath(env: Env): string {
function getRelativeScriptPath(env: ReadOnlyEnv): string {
const runnerTemp = env.getRequired(ActionsEnvVars.RUNNER_TEMP);
const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
return path.relative(actionsDirectory, __filename);
}
/** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
export function getWorkflowEvent(env: Env = getEnv()): any {
export function getWorkflowEvent(env: ReadOnlyEnv = getEnv()): any {
const eventJsonFile = env.getRequired(ActionsEnvVars.GITHUB_EVENT_PATH);
try {
return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));

2
src/analyze-action.test.ts
View File

@@ -45,6 +45,7 @@ test.serial(
requiredInputStub.withArgs("token").returns("fake-token");
requiredInputStub.withArgs("upload-database").returns("false");
requiredInputStub.withArgs("output").returns("out");
requiredInputStub.withArgs("checkout_path").returns("");
const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
optionalInputStub.withArgs("expect-error").returns("false");
sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
@@ -104,6 +105,7 @@ test.serial(
requiredInputStub.withArgs("token").returns("fake-token");
requiredInputStub.withArgs("upload-database").returns("false");
requiredInputStub.withArgs("output").returns("out");
requiredInputStub.withArgs("checkout_path").returns("");
const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
optionalInputStub.withArgs("expect-error").returns("false");
sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);

27
src/analyze-action.ts
View File

@@ -4,12 +4,18 @@ import { performance } from "perf_hooks";
import * as core from "@actions/core";
import { Action, ActionState, runInActions } from "./action-common";
import {
Action,
ActionState,
extendActionState,
runInActions,
} from "./action-common";
import * as actionsUtil from "./actions-util";
import * as analyses from "./analyses";
import {
CodeQLAnalysisError,
dbIsFinalized,
determineCheckoutPath,
QueriesStatusReport,
runFinalize,
runQueries,
@@ -212,14 +218,11 @@ async function runAutobuildIfLegacyGoWorkflow(config: Config, logger: Logger) {
await runAutobuild(config, BuiltInLanguage.go, logger);
}
async function run({
startedAt,
env,
logger,
actions,
}: ActionState<["Base", "Env", "Logger", "Actions"]>) {
async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
// To capture errors appropriately, keep as much code within the try-catch as
// possible, and only use safe functions outside.
const startedAt = action.startedAt;
const logger = action.logger;
let uploadResults:
| Partial<Record<analyses.AnalysisKind, UploadResult>>
@@ -277,7 +280,7 @@ async function run({
const apiDetails = getApiDetails();
const outputDir = actionsUtil.getRequiredInput("output");
env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
action.env.export(EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
const threads = util.getThreadsFlag(
actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"],
logger,
@@ -301,7 +304,7 @@ async function run({
logger,
);
const checkoutPath = actions.getRequiredInput("checkout_path");
const checkoutPath = await determineCheckoutPath(action, config);
// Setup diff informed analysis if needed (based on whether init created the file)
const diffRangePackDir = await setupDiffInformedQueryRun(
@@ -393,11 +396,13 @@ async function run({
checkoutPath,
);
const actionWithFeatures = extendActionState(action, { features });
// Possibly upload the database bundles for remote queries.
// Note: Take care with the ordering of this call since databases may be cleaned up
// at the `overlay` or `clear` level.
databaseUploadResults = await cleanupAndUploadDatabases(
{ logger, features },
actionWithFeatures,
repositoryNwo,
codeql,
config,
@@ -446,7 +451,7 @@ async function run({
`expect-error input was set to true but no error was thrown.`,
);
}
env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
action.env.export(EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
} catch (unwrappedError) {
const error = util.wrapError(unwrappedError);
if (

88
src/analyze.test.ts
View File

@@ -10,10 +10,12 @@ import {
resolveQuerySuiteAlias,
addSarifExtension,
diffRangeExtensionPackContents,
determineCheckoutPath,
} from "./analyze";
import { createStubCodeQL } from "./codeql";
import { defaultSuites } from "./config/db-config";
import { Feature } from "./feature-flags";
import * as gitUtils from "./git-utils";
import { BuiltInLanguage } from "./languages";
import { getRunnerLogger } from "./logging";
import {
@@ -21,12 +23,98 @@ import {
setupActionsVars,
createFeatures,
createTestConfig,
callee,
} from "./testing-utils";
import * as uploadLib from "./upload-lib";
import * as util from "./util";
setupTests(test);
test.serial(
"determineCheckoutPath - logs when checkout_path is not in a work tree",
async (t) => {
const expectedPath = path.resolve("/checkout/path");
const target = callee(determineCheckoutPath)
.withActions((actions) => {
sinon
.stub(actions, "getRequiredInput")
.withArgs("checkout_path")
.returns(expectedPath);
})
.withArgs(createTestConfig({}));
sinon.stub(gitUtils, "getGitRoot").resolves(undefined);
await target
.logs(t, "is not in the work tree of a git repository")
.passes(t.is, expectedPath);
},
);
test.serial(
"determineCheckoutPath - logs when checkout_path is not a repo root",
async (t) => {
const expectedPath = path.resolve("/checkout/path");
const target = callee(determineCheckoutPath)
.withActions((actions) => {
sinon
.stub(actions, "getRequiredInput")
.withArgs("checkout_path")
.returns(expectedPath);
})
.withArgs(createTestConfig({}));
sinon.stub(gitUtils, "getGitRoot").resolves("/checkout");
await target
.logs(t, "is not the root of the repository")
.passes(t.is, expectedPath);
},
);
test.serial(
"determineCheckoutPath - logs when checkout_path is not the same as repo root in config",
async (t) => {
const expectedPath = path.resolve("/checkout/path");
const target = callee(determineCheckoutPath)
.withActions((actions) => {
sinon
.stub(actions, "getRequiredInput")
.withArgs("checkout_path")
.returns(expectedPath);
})
.withArgs(createTestConfig({ repositoryRoot: "/some/other/path" }));
sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
await target
.logs(t, "does not match that found by the 'codeql-action/init' step")
.passes(t.is, expectedPath);
},
);
test.serial(
"determineCheckoutPath - doesn't log any of the messages when all is as expected",
async (t) => {
const expectedPath = path.resolve("/checkout/path");
const target = callee(determineCheckoutPath)
.withActions((actions) => {
sinon
.stub(actions, "getRequiredInput")
.withArgs("checkout_path")
.returns(expectedPath);
})
.withArgs(createTestConfig({ repositoryRoot: expectedPath }));
sinon.stub(gitUtils, "getGitRoot").resolves(expectedPath);
await target
.notLogs(
t,
"is not in the work tree of a git repository",
"is not the root of the repository",
"does not match that found by the 'codeql-action/init' step",
)
.passes(t.is, expectedPath);
},
);
/**
* Checks the status report produced by the analyze Action.
*

54
src/analyze.ts
View File

@@ -5,6 +5,7 @@ import { performance } from "perf_hooks";
import * as io from "@actions/io";
import * as yaml from "js-yaml";
import type { ActionState } from "./action-common";
import { getTemporaryDirectory } from "./actions-util";
import * as analyses from "./analyses";
import { setupCppAutobuild } from "./autobuild";
@@ -23,6 +24,7 @@ import {
} from "./diff-informed-analysis-utils";
import { EnvVar } from "./environment";
import { FeatureEnablement, Feature } from "./feature-flags";
import { getGitRoot } from "./git-utils";
import { BuiltInLanguage, Language } from "./languages";
import { Logger, withGroupAsync } from "./logging";
import { OverlayDatabaseMode } from "./overlay/overlay-database-mode";
@@ -87,6 +89,58 @@ export interface QueriesStatusReport
event_reports?: EventReport[];
}
/**
* Determines the path at which the repository being analysed is checked out at.
* Returns the value of the required `checkout_path` input and validates that it
* refers to the root of a repository.
*
* @param action The action state.
* @param config The CodeQL Action configuration state.
*/
export async function determineCheckoutPath(
action: ActionState<["Logger", "Actions"]>,
config: configUtils.Config,
) {
const checkoutPathInput = action.actions.getRequiredInput("checkout_path");
// Try to obtain the root path of the repository and validate that it matches the input.
const absCheckoutPathInput = path.resolve(checkoutPathInput);
const repositoryRoot = await getGitRoot(absCheckoutPathInput);
if (repositoryRoot === undefined) {
action.logger.warning(
[
`The directory at '${absCheckoutPathInput}' is not in the work tree of a git repository.`,
"If the repository being analyzed is checked out elsewhere,",
"you must explicitly set the 'checkout_path' input for the 'codeql-action/analyze' step to",
"the checkout path.",
].join(" "),
);
} else if (repositoryRoot !== absCheckoutPathInput) {
action.logger.warning(
[
`The directory at '${absCheckoutPathInput}' is not the root of the repository ('${repositoryRoot}').`,
"Set the 'checkout_path' input for the 'codeql-action/analyze' step to the root path of the checkout.",
].join(" "),
);
} else if (
config.repositoryRoot !== undefined &&
repositoryRoot !== config.repositoryRoot
) {
// The repository root that was persisted by the `init` step doesn't match the one we have found here.
action.logger.warning(
[
`The repository path at '${repositoryRoot}' does not match that found by the 'codeql-action/init' step: '${config.repositoryRoot}'.`,
"Ensure that the 'checkout_path' input for the 'codeql-action/analyze' step is set to the path of the same repository that",
"the 'codeql-action/init' step determined. This is either the GitHub Actions workspace or the repository root corresponding to",
"the 'source-root' input if that was provided.",
].join(" "),
);
}
return absCheckoutPathInput;
}
async function setupPythonExtractor(logger: Logger) {
const codeqlPython = process.env["CODEQL_PYTHON"];
if (codeqlPython === undefined || codeqlPython.length === 0) {

2
src/codeql.ts
View File

@@ -1230,7 +1230,7 @@ export async function getTrapCachingExtractorConfigArgsForLang(
): Promise<string[]> {
const cacheDir = config.trapCaches[language];
if (cacheDir === undefined) return [];
const write = await isAnalyzingDefaultBranch();
const write = await isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot);
return [
`-O=${language}.trap.cache.dir=${cacheDir}`,
`-O=${language}.trap.cache.bound=${TRAP_CACHE_SIZE_MB}`,

12
src/config-utils.test.ts
View File

@@ -172,6 +172,7 @@ test.serial("load empty config", async (t) => {
createTestInitConfigInputs({
languagesInput: languages,
repository: { owner: "github", repo: "example" },
sourceRoot: tempDir,
tempDir,
codeql,
logger,
@@ -186,6 +187,7 @@ test.serial("load empty config", async (t) => {
logger,
}),
{},
undefined,
);
t.deepEqual(config, expectedConfig);
@@ -216,6 +218,7 @@ test.serial("load code quality config", async (t) => {
analysisKinds: [AnalysisKind.CodeQuality],
languagesInput: languages,
repository: { owner: "github", repo: "example" },
sourceRoot: tempDir,
tempDir,
codeql,
logger,
@@ -296,6 +299,7 @@ test.serial(
analysisKinds: [AnalysisKind.CodeQuality],
languagesInput: languages,
repository: { owner: "github", repo: "example" },
sourceRoot: tempDir,
tempDir,
codeql,
repositoryProperties,
@@ -518,6 +522,7 @@ test.serial("load non-empty input", async (t) => {
// And the config we expect it to parse to
const expectedConfig = createTestConfig({
languages: [BuiltInLanguage.javascript],
repositoryRoot: undefined,
buildMode: BuildMode.None,
originalUserInput: userConfig,
computedConfig: userConfig,
@@ -538,6 +543,7 @@ test.serial("load non-empty input", async (t) => {
state,
createTestInitConfigInputs({
languagesInput,
sourceRoot: tempDir,
buildModeInput: "none",
configFile: configFilePath,
debugArtifactName: "my-artifact",
@@ -1105,11 +1111,6 @@ const checkOverlayEnablementMacro = makeMacro({
return lang === BuiltInLanguage.java;
});
// Mock git root detection
if (setup.gitRoot !== undefined) {
sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot);
}
// Mock submodule detection
sinon.stub(gitUtils, "hasSubmodules").returns(setup.hasSubmodules);
@@ -1122,6 +1123,7 @@ const checkOverlayEnablementMacro = makeMacro({
codeql,
features,
setup.languages,
setup.gitRoot, // repositoryRoot
tempDir, // sourceRoot
setup.buildMode,
undefined,

29
src/config-utils.ts
View File

@@ -49,7 +49,7 @@ import {
makeTelemetryDiagnostic,
} from "./diagnostics";
import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils";
import { EnvVar, exportEnvVar } from "./environment";
import { EnvVar, exportEnvVar, getEnv } from "./environment";
import * as errorMessages from "./error-messages";
import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags";
import {
@@ -390,6 +390,7 @@ export async function initActionState(
enableFileCoverageInformation,
}: InitConfigInputs,
userConfig: UserConfig,
repositoryRoot: string | undefined,
): Promise<Config> {
const languages = await getLanguages(
codeql,
@@ -441,6 +442,7 @@ export async function initActionState(
return {
version: getActionVersion(),
repositoryRoot,
analysisKinds,
languages,
buildMode,
@@ -470,12 +472,18 @@ async function downloadCacheWithTime(
codeQL: CodeQL,
languages: Language[],
logger: Logger,
repositoryRoot: string | undefined,
): Promise<{
trapCaches: { [language: string]: string };
trapCacheDownloadTime: number;
}> {
const start = performance.now();
const trapCaches = await downloadTrapCaches(codeQL, languages, logger);
const trapCaches = await downloadTrapCaches(
codeQL,
languages,
logger,
repositoryRoot,
);
const trapCacheDownloadTime = performance.now() - start;
return { trapCaches, trapCacheDownloadTime };
}
@@ -723,6 +731,7 @@ export async function checkOverlayEnablement(
codeql: CodeQL,
features: FeatureEnablement,
languages: Language[],
repositoryRoot: string | undefined,
sourceRoot: string,
buildMode: BuildMode | undefined,
ramInput: string | undefined,
@@ -752,6 +761,7 @@ export async function checkOverlayEnablement(
true,
codeql,
languages,
repositoryRoot,
sourceRoot,
buildMode,
gitVersion,
@@ -825,7 +835,7 @@ export async function checkOverlayEnablement(
`Setting overlay database mode to ${overlayDatabaseMode} ` +
"with caching because we are analyzing a pull request.",
);
} else if (await isAnalyzingDefaultBranch()) {
} else if (await isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) {
overlayDatabaseMode = OverlayDatabaseMode.OverlayBase;
logger.info(
`Setting overlay database mode to ${overlayDatabaseMode} ` +
@@ -841,6 +851,7 @@ export async function checkOverlayEnablement(
false,
codeql,
languages,
repositoryRoot,
sourceRoot,
buildMode,
gitVersion,
@@ -860,6 +871,7 @@ async function validateOverlayDatabaseMode(
overlayModeSetExplicitly: boolean,
codeql: CodeQL,
languages: Language[],
repositoryRoot: string | undefined,
sourceRoot: string,
buildMode: BuildMode | undefined,
gitVersion: GitVersionInfo | undefined,
@@ -895,8 +907,7 @@ async function validateOverlayDatabaseMode(
);
return new Failure(OverlayDisabledReason.IncompatibleCodeQl);
}
const gitRoot = await getGitRoot(sourceRoot);
if (gitRoot === undefined) {
if (repositoryRoot === undefined) {
logger.warning(
`Cannot build an ${overlayDatabaseMode} database because ` +
`the source root "${sourceRoot}" is not inside a git repository. ` +
@@ -904,7 +915,7 @@ async function validateOverlayDatabaseMode(
);
return new Failure(OverlayDisabledReason.NoGitRoot);
}
if (hasSubmodules(gitRoot)) {
if (hasSubmodules(repositoryRoot)) {
if (gitVersion === undefined) {
logger.warning(
`Cannot build an ${overlayDatabaseMode} database because ` +
@@ -1156,9 +1167,11 @@ export async function initConfig(
const { logger, features } = actionState;
const { tempDir } = inputs;
const repositoryRoot = await getGitRoot(inputs.sourceRoot);
const userConfig = await determineUserConfig(actionState, tempDir, inputs);
const config = await initActionState(inputs, userConfig);
const config = await initActionState(inputs, userConfig, repositoryRoot);
// If Code Quality analysis is the only enabled analysis kind, then we will initialise
// the database for Code Quality. That entails disabling the default queries and only
@@ -1240,6 +1253,7 @@ export async function initConfig(
inputs.codeql,
inputs.features,
config.languages,
repositoryRoot,
inputs.sourceRoot,
config.buildMode,
inputs.ramInput,
@@ -1293,6 +1307,7 @@ export async function initConfig(
inputs.codeql,
config.languages,
logger,
repositoryRoot,
);
config.trapCaches = trapCaches;
config.trapCacheDownloadTime = trapCacheDownloadTime;

5
src/config/action-config.ts
View File

@@ -16,6 +16,11 @@ export interface Config {
* The version of the CodeQL Action that the configuration is for.
*/
version: string;
/**
* The path at which the repository being analysed is checked out at, if available.
* Persisted in the CodeQL Action configuration state, so that we can consult it in later workflow steps.
*/
repositoryRoot: string | undefined;
/**
* Set of analysis kinds that are enabled.
*/

6
src/database-upload.ts
View File

@@ -46,7 +46,7 @@ export interface DatabaseUploadResult {
}
export async function cleanupAndUploadDatabases(
action: ActionState<["Logger", "FeatureFlags"]>,
action: ActionState<["ReadOnlyEnv", "Logger", "FeatureFlags"]>,
repositoryNwo: RepositoryNwo,
codeql: CodeQL,
config: Config,
@@ -81,7 +81,7 @@ export async function cleanupAndUploadDatabases(
return [];
}
if (!(await gitUtils.isAnalyzingDefaultBranch())) {
if (!(await gitUtils.isAnalyzingDefaultBranch(action.env, checkoutPath))) {
// We only want to upload a database if we are analyzing the default branch.
logger.debug("Not analyzing default branch. Skipping upload.");
return [];
@@ -113,7 +113,7 @@ export async function cleanupAndUploadDatabases(
includeDiagnostics: false,
});
bundledDbSize = fs.statSync(bundledDb).size;
const commitOid = await gitUtils.getCommitOid(checkoutPath);
const commitOid = await gitUtils.getCommitOid(action.env, checkoutPath);
// Upload with manual retry logic. We disable Octokit's built-in retries
// because the request body is a ReadStream, which can only be consumed
// once.

1
src/dependency-caching.ts
View File

@@ -313,6 +313,7 @@ export async function downloadDependencyCaches(
const primaryKey = await cacheKey(codeql, features, language, patterns);
const restoreKeys: string[] = [
primaryKey,
await cachePrefix(codeql, features, language),
];

7
src/environment.ts
View File

@@ -346,6 +346,13 @@ export class Env<
this.changed = true;
}
/** Sets all environment variables given by `vars`. */
public setAll(vars: Record<string, T>): void {
for (const [key, val] of Object.entries(vars)) {
this.set(key, val);
}
}
/**
* Wrapper around `core.exportVariable` which does not call `core.exportVariable`
* when running unit tests. This is important, because otherwise `core.exportVariable`

175
src/git-utils.test.ts
View File

@@ -7,35 +7,42 @@ import test from "ava";
import * as sinon from "sinon";
import * as actionsUtil from "./actions-util";
import { ActionsEnvVars, EnvVar } from "./environment";
import * as gitUtils from "./git-utils";
import { setupActionsVars, setupTests } from "./testing-utils";
import { getTestEnv, setupActionsVars, setupTests } from "./testing-utils";
import { withTmpDir } from "./util";
setupTests(test);
test.serial("getRef() throws on the empty string", async (t) => {
process.env["GITHUB_REF"] = "";
await t.throwsAsync(gitUtils.getRef);
test("getRef() throws on the empty string", async (t) => {
const env = getTestEnv({ [ActionsEnvVars.GITHUB_REF]: "" });
await t.throwsAsync(() => gitUtils.getRef(env, ""));
});
test.serial(
"getRef() returns merge PR ref if GITHUB_SHA still checked out",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
const expectedRef = "refs/pull/1/merge";
const currentSha = "a".repeat(40);
process.env["GITHUB_REF"] = expectedRef;
process.env["GITHUB_SHA"] = currentSha;
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
env.setAll({
[ActionsEnvVars.GITHUB_REF]: expectedRef,
[ActionsEnvVars.GITHUB_SHA]: currentSha,
});
const callback = sinon.stub(gitUtils, "getCommitOid");
callback.withArgs(sinon.match.string, "HEAD").resolves(currentSha);
callback
.withArgs(sinon.match.any, sinon.match.string, "HEAD")
.resolves(currentSha);
const actualRef = await gitUtils.getRef();
const actualRef = await gitUtils.getRef(env, tmpDir);
t.deepEqual(actualRef, expectedRef);
t.is(callback.callCount, 1);
t.true(callback.calledOnceWith(tmpDir, "HEAD"));
t.true(callback.calledOnceWith(env, tmpDir, "HEAD"));
});
},
);
@@ -44,24 +51,33 @@ test.serial(
"getRef() returns merge PR ref if GITHUB_REF still checked out but sha has changed (actions checkout@v1)",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
const expectedRef = "refs/pull/1/merge";
process.env["GITHUB_REF"] = expectedRef;
process.env["GITHUB_SHA"] = "b".repeat(40);
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
env.setAll({
[ActionsEnvVars.GITHUB_REF]: expectedRef,
[ActionsEnvVars.GITHUB_SHA]: "b".repeat(40),
});
const sha = "a".repeat(40);
const callback = sinon.stub(gitUtils, "getCommitOid");
callback
.withArgs(sinon.match.string, "refs/remotes/pull/1/merge")
.withArgs(
sinon.match.any,
sinon.match.string,
"refs/remotes/pull/1/merge",
)
.resolves(sha);
callback
.withArgs(sinon.match.any, sinon.match.string, "HEAD")
.resolves(sha);
callback.withArgs(sinon.match.any, "HEAD").resolves(sha);
const actualRef = await gitUtils.getRef();
const actualRef = await gitUtils.getRef(env, tmpDir);
t.deepEqual(actualRef, expectedRef);
t.is(callback.callCount, 2);
t.true(callback.calledWith(tmpDir, "HEAD"));
t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
t.true(callback.calledWith(env, tmpDir, "HEAD"));
t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge"));
});
},
);
@@ -70,23 +86,28 @@ test.serial(
"getRef() returns head PR ref if GITHUB_REF no longer checked out",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
process.env["GITHUB_REF"] = "refs/pull/1/merge";
process.env["GITHUB_SHA"] = "a".repeat(40);
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
env.setAll({
[ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge",
[ActionsEnvVars.GITHUB_SHA]: "a".repeat(40),
});
const callback = sinon.stub(gitUtils, "getCommitOid");
callback
.withArgs(tmpDir, "refs/remotes/pull/1/merge")
.withArgs(sinon.match.any, tmpDir, "refs/remotes/pull/1/merge")
.resolves("a".repeat(40));
callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40));
callback
.withArgs(sinon.match.any, tmpDir, "HEAD")
.resolves("b".repeat(40));
callback.throws(new Error("Unexpected getCommitOid call in test."));
const actualRef = await gitUtils.getRef();
const actualRef = await gitUtils.getRef(env, tmpDir);
t.deepEqual(actualRef, "refs/pull/1/head");
t.is(callback.callCount, 2);
t.true(callback.calledWith(tmpDir, "refs/remotes/pull/1/merge"));
t.true(callback.calledWith(tmpDir, "HEAD"));
t.true(callback.calledWith(env, tmpDir, "refs/remotes/pull/1/merge"));
t.true(callback.calledWith(env, tmpDir, "HEAD"));
});
},
);
@@ -95,7 +116,6 @@ test.serial(
"getRef() returns ref provided as an input and ignores current HEAD",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
const getAdditionalInputStub = sinon.stub(
actionsUtil,
"getOptionalInput",
@@ -104,14 +124,22 @@ test.serial(
getAdditionalInputStub.withArgs("sha").resolves("b".repeat(40));
// These values are be ignored
process.env["GITHUB_REF"] = "refs/pull/1/merge";
process.env["GITHUB_SHA"] = "a".repeat(40);
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
env.setAll({
[ActionsEnvVars.GITHUB_REF]: "refs/pull/1/merge",
[ActionsEnvVars.GITHUB_SHA]: "a".repeat(40),
});
const callback = sinon.stub(gitUtils, "getCommitOid");
callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("b".repeat(40));
callback.withArgs(sinon.match.any, "HEAD").resolves("b".repeat(40));
callback
.withArgs(sinon.match.any, tmpDir, "refs/pull/1/merge")
.resolves("b".repeat(40));
callback
.withArgs(sinon.match.any, sinon.match.string, "HEAD")
.resolves("b".repeat(40));
const actualRef = await gitUtils.getRef();
const actualRef = await gitUtils.getRef(env, tmpDir);
t.deepEqual(actualRef, "refs/pull/2/merge");
// getCommitOid shouldn't be called, because the ref should be taken from the input
@@ -124,14 +152,17 @@ test.serial(
"getRef() returns CODE_SCANNING_REF as a fallback for GITHUB_REF",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
const expectedRef = "refs/pull/1/HEAD";
const currentSha = "a".repeat(40);
process.env["CODE_SCANNING_REF"] = expectedRef;
process.env["GITHUB_REF"] = "";
process.env["GITHUB_SHA"] = currentSha;
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
env.setAll({
[EnvVar.CODE_SCANNING_REF]: expectedRef,
[ActionsEnvVars.GITHUB_REF]: "",
[ActionsEnvVars.GITHUB_SHA]: currentSha,
});
const actualRef = await gitUtils.getRef();
const actualRef = await gitUtils.getRef(env, tmpDir);
t.deepEqual(actualRef, expectedRef);
});
},
@@ -141,14 +172,17 @@ test.serial(
"getRef() returns GITHUB_REF over CODE_SCANNING_REF if both are provided",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
const expectedRef = "refs/pull/1/merge";
const currentSha = "a".repeat(40);
process.env["CODE_SCANNING_REF"] = "refs/pull/1/HEAD";
process.env["GITHUB_REF"] = expectedRef;
process.env["GITHUB_SHA"] = currentSha;
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
env.setAll({
[EnvVar.CODE_SCANNING_REF]: "refs/pull/1/HEAD",
[ActionsEnvVars.GITHUB_REF]: expectedRef,
[ActionsEnvVars.GITHUB_SHA]: currentSha,
});
const actualRef = await gitUtils.getRef();
const actualRef = await gitUtils.getRef(env, tmpDir);
t.deepEqual(actualRef, expectedRef);
});
},
@@ -158,7 +192,9 @@ test.serial(
"getRef() throws an error if only `ref` is provided as an input",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
const getAdditionalInputStub = sinon.stub(
actionsUtil,
"getOptionalInput",
@@ -167,7 +203,7 @@ test.serial(
await t.throwsAsync(
async () => {
await gitUtils.getRef();
await gitUtils.getRef(env, tmpDir);
},
{
instanceOf: Error,
@@ -183,8 +219,12 @@ test.serial(
"getRef() throws an error if only `sha` is provided as an input",
async (t) => {
await withTmpDir(async (tmpDir: string) => {
setupActionsVars(tmpDir, tmpDir);
process.env["GITHUB_WORKSPACE"] = "/tmp";
const env = getTestEnv();
setupActionsVars(tmpDir, tmpDir, {}, env);
env.setAll({
[ActionsEnvVars.GITHUB_WORKSPACE]: "/tmp",
});
const getAdditionalInputStub = sinon.stub(
actionsUtil,
"getOptionalInput",
@@ -193,7 +233,7 @@ test.serial(
await t.throwsAsync(
async () => {
await gitUtils.getRef();
await gitUtils.getRef(env, tmpDir);
},
{
instanceOf: Error,
@@ -206,13 +246,16 @@ test.serial(
);
test.serial("isAnalyzingDefaultBranch()", async (t) => {
process.env["GITHUB_EVENT_NAME"] = "push";
process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "true";
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);
process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "false";
const env = getTestEnv({
[ActionsEnvVars.GITHUB_EVENT_NAME]: "push",
CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: "true",
});
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, ""), true);
env.set("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH", "false");
await withTmpDir(async (tmpDir) => {
setupActionsVars(tmpDir, tmpDir);
setupActionsVars(tmpDir, tmpDir, {}, env);
const envFile = path.join(tmpDir, "event.json");
fs.writeFileSync(
envFile,
@@ -222,17 +265,17 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
},
}),
);
process.env["GITHUB_EVENT_PATH"] = envFile;
env.set(ActionsEnvVars.GITHUB_EVENT_PATH, envFile);
process.env["GITHUB_REF"] = "main";
process.env["GITHUB_SHA"] = "1234";
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);
env.set(ActionsEnvVars.GITHUB_REF, "main");
env.set(ActionsEnvVars.GITHUB_SHA, "1234");
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
process.env["GITHUB_REF"] = "refs/heads/main";
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);
env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
process.env["GITHUB_REF"] = "feature";
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false);
env.set(ActionsEnvVars.GITHUB_REF, "feature");
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false);
fs.writeFileSync(
envFile,
@@ -240,9 +283,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
schedule: "0 0 * * *",
}),
);
process.env["GITHUB_EVENT_NAME"] = "schedule";
process.env["GITHUB_REF"] = "refs/heads/main";
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), true);
env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule");
env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), true);
const getAdditionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
getAdditionalInputStub
@@ -251,9 +294,9 @@ test.serial("isAnalyzingDefaultBranch()", async (t) => {
getAdditionalInputStub
.withArgs("sha")
.resolves("0000000000000000000000000000000000000000");
process.env["GITHUB_EVENT_NAME"] = "schedule";
process.env["GITHUB_REF"] = "refs/heads/main";
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(), false);
env.set(ActionsEnvVars.GITHUB_EVENT_NAME, "schedule");
env.set(ActionsEnvVars.GITHUB_REF, "refs/heads/main");
t.deepEqual(await gitUtils.isAnalyzingDefaultBranch(env, tmpDir), false);
});
});

47
src/git-utils.ts
View File

@@ -13,6 +13,7 @@ import {
getWorkflowEvent,
getWorkflowEventName,
} from "./actions-util";
import { ActionsEnvVars, EnvVar, type ReadOnlyEnv } from "./environment";
import { ConfigurationError, getRequiredEnvParam } from "./util";
/**
@@ -101,6 +102,7 @@ export const runGitCommand = async function (
* Gets the SHA of the commit that is currently checked out.
*/
export const getCommitOid = async function (
env: ReadOnlyEnv,
checkoutPath: string,
ref = "HEAD",
): Promise<string> {
@@ -119,7 +121,9 @@ export const getCommitOid = async function (
);
return stdout.trim();
} catch {
return getOptionalInput("sha") || getRequiredEnvParam("GITHUB_SHA");
return (
getOptionalInput("sha") || env.getRequired(ActionsEnvVars.GITHUB_SHA)
);
}
};
@@ -241,7 +245,7 @@ export const getGitRoot = async function (
["rev-parse", "--show-toplevel"],
`Cannot find Git repository root from the source root ${sourceRoot}.`,
);
return stdout.trim();
return path.resolve(stdout.trim());
} catch {
// Errors are already logged by runGitCommand()
return undefined;
@@ -314,18 +318,18 @@ export const getFileOidsUnderPath = async function (
return fileOidMap;
};
function getRefFromEnv(): string {
function getRefFromEnv(env: ReadOnlyEnv): string {
// To workaround a limitation of Actions dynamic workflows not setting
// the GITHUB_REF in some cases, we accept also the ref within the
// CODE_SCANNING_REF variable. When possible, however, we prefer to use
// the GITHUB_REF as that is a protected variable and cannot be overwritten.
let refEnv: string;
try {
refEnv = getRequiredEnvParam("GITHUB_REF");
refEnv = env.getRequired(ActionsEnvVars.GITHUB_REF);
} catch (e) {
// If the GITHUB_REF is not set, we try to rescue by getting the
// CODE_SCANNING_REF.
const maybeRef = process.env["CODE_SCANNING_REF"];
const maybeRef = env.getOptional(EnvVar.CODE_SCANNING_REF);
if (maybeRef === undefined || maybeRef.length === 0) {
throw e;
}
@@ -337,15 +341,16 @@ function getRefFromEnv(): string {
/**
* Get the ref currently being analyzed.
*/
export async function getRef(): Promise<string> {
export async function getRef(
env: ReadOnlyEnv,
checkoutPath: string | undefined,
): Promise<string> {
// Will be in the form "refs/heads/master" on a push event
// or in the form "refs/pull/N/merge" on a pull_request event
const refInput = getOptionalInput("ref");
const shaInput = getOptionalInput("sha");
const checkoutPath =
getOptionalInput("checkout_path") ||
getOptionalInput("source-root") ||
getRequiredEnvParam("GITHUB_WORKSPACE");
checkoutPath =
checkoutPath ?? env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE);
const hasRefInput = !!refInput;
const hasShaInput = !!shaInput;
@@ -356,8 +361,8 @@ export async function getRef(): Promise<string> {
);
}
const ref = refInput || getRefFromEnv();
const sha = shaInput || getRequiredEnvParam("GITHUB_SHA");
const ref = refInput || getRefFromEnv(env);
const sha = shaInput || env.getRequired(ActionsEnvVars.GITHUB_SHA);
// If the ref is a user-provided input, we have to skip logic
// and assume that it is really where they want to upload the results.
@@ -374,7 +379,7 @@ export async function getRef(): Promise<string> {
return ref;
}
const head = await getCommitOid(checkoutPath, "HEAD");
const head = await getCommitOid(env, checkoutPath, "HEAD");
// in actions/checkout@v2+ we can check if git rev-parse HEAD == GITHUB_SHA
// in actions/checkout@v1 this may not be true as it checks out the repository
@@ -384,6 +389,7 @@ export async function getRef(): Promise<string> {
const hasChangedRef =
sha !== head &&
(await getCommitOid(
env,
checkoutPath,
ref.replace(/^refs\/pull\//, "refs/remotes/pull/"),
)) !== head;
@@ -410,20 +416,23 @@ function removeRefsHeadsPrefix(ref: string): string {
* environment variable can be set in cases where repository information might not be available, for
* example dynamic workflows.
*/
export async function isAnalyzingDefaultBranch(): Promise<boolean> {
if (process.env.CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH === "true") {
export async function isAnalyzingDefaultBranch(
env: ReadOnlyEnv,
checkoutPath: string | undefined,
): Promise<boolean> {
if (env.getOptional("CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH") === "true") {
return true;
}
// Get the current ref and trim and refs/heads/ prefix
let currentRef = await getRef();
let currentRef = await getRef(env, checkoutPath);
currentRef = removeRefsHeadsPrefix(currentRef);
const event = getWorkflowEvent();
const event = getWorkflowEvent(env);
let defaultBranch = event?.repository?.default_branch;
if (getWorkflowEventName() === "schedule") {
defaultBranch = removeRefsHeadsPrefix(getRefFromEnv());
if (getWorkflowEventName(env) === "schedule") {
defaultBranch = removeRefsHeadsPrefix(getRefFromEnv(env));
}
return currentRef === defaultBranch;

12
src/init-action-post-helper.ts
View File

@@ -51,7 +51,7 @@ import {
} from "./util";
import {
getCategoryInputOrThrow,
getCheckoutPathInputOrThrow,
getRepositoryRootOrThrow,
getUploadInputOrThrow,
getWorkflow,
} from "./workflow";
@@ -156,7 +156,15 @@ async function prepareFailedSarif(
});
}
const category = getCategoryInputOrThrow(workflow, jobName, matrix);
const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix);
// Try to determine the path at which the repository that we failed to analyse is checked out at.
// We need this to relativise the paths in the SARIF.
const checkoutPath = getRepositoryRootOrThrow(
workflow,
jobName,
matrix,
config,
);
const result = await generateFailedSarif(
logger,

5
src/init-action-post.ts
View File

@@ -117,7 +117,10 @@ async function run(action: ActionState<["Base", "Logger", "Env"]>) {
// do this under these circumstances to avoid slowing down analyses for PRs
// and where caching may not be enabled.
if (
(await gitUtils.isAnalyzingDefaultBranch()) &&
(await gitUtils.isAnalyzingDefaultBranch(
action.env,
config.repositoryRoot,
)) &&
hasConfigKey(config, "dependencyCachingEnabled") &&
config.dependencyCachingEnabled !== CachingKind.None
) {

5
src/overlay/caching.ts
View File

@@ -15,6 +15,7 @@ import {
CleanupLevel,
getBaseDatabaseOidsFilePath,
getCodeQLDatabasePath,
getEnv,
getErrorMessage,
isInTestMode,
tryGetFolderBytes,
@@ -290,7 +291,7 @@ export async function downloadOverlayBaseDatabaseFromCache(
actionsCache.restoreCache(
[dbLocation],
cacheRestoreKeyPrefix,
undefined,
[cacheRestoreKeyPrefix],
{
// Azure SDK download (which is the default) uses 128MB segments; see
// https://github.com/actions/toolkit/blob/main/packages/cache/README.md.
@@ -377,7 +378,7 @@ export async function getCacheSaveKey(
`Failed to get workflow run ID or attempt ID. Reason: ${getErrorMessage(e)}`,
);
}
const sha = await getCommitOid(checkoutPath);
const sha = await getCommitOid(getEnv(), checkoutPath);
const restoreKeyPrefix = await getCacheRestoreKeyPrefix(
config,
codeQlVersion,

2
src/overlay/status.ts
View File

@@ -130,7 +130,7 @@ export async function getOverlayStatus(
await fs.promises.mkdir(path.dirname(statusFile), { recursive: true });
const foundKey = await waitForResultWithTimeLimit(
MAX_CACHE_OPERATION_MS,
actionsCache.restoreCache([statusFile], cacheKey),
actionsCache.restoreCache([statusFile], cacheKey, [cacheKey]),
() => {
logger.warning("Timed out restoring overlay status from cache.");
},

8
src/repository.ts
View File

@@ -6,6 +6,14 @@ export interface RepositoryNwo {
repo: string;
}
/** An approximation of what a repository NWO string looks like. */
export type RepositoryNwoStr = `${string}/${string}`;
/** A basic check that `val` looks like a `RepositoryNwoStr`. */
export function isRepositoryNwoStr(val: string): val is RepositoryNwoStr {
return val.includes("/");
}
/**
* Get the repository name with owner from the environment variable
* `GITHUB_REPOSITORY`.

18
src/setup-codeql.test.ts
View File

@@ -126,24 +126,6 @@ test.serial("convert to semver", (t) => {
}
});
test.serial("getCodeQLActionRepository", (t) => {
const logger = getRunnerLogger(true);
initializeEnvironment("1.2.3");
// isRunningLocalAction() === true
delete process.env["GITHUB_ACTION_REPOSITORY"];
process.env["RUNNER_TEMP"] = path.dirname(__dirname);
const repoLocalRunner = setupCodeql.getCodeQLActionRepository(logger);
t.deepEqual(repoLocalRunner, "github/codeql-action");
// isRunningLocalAction() === false
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy";
const repoEnv = setupCodeql.getCodeQLActionRepository(logger);
t.deepEqual(repoEnv, "xxx/yyy");
});
test.serial(
"getCodeQLSource sets CLI version for a semver tagged bundle",
async (t) => {

82
src/setup-codeql.ts
View File

@@ -4,7 +4,6 @@ import * as path from "path";
import { performance } from "perf_hooks";
import * as toolcache from "@actions/tool-cache";
import { default as deepEqual } from "fast-deep-equal";
import * as semver from "semver";
import { v4 as uuidV4 } from "uuid";
@@ -13,7 +12,6 @@ import {
isAnalyzingPullRequest,
isDynamicWorkflow,
isGitHubHostedRunner,
isRunningLocalAction,
} from "./actions-util";
import * as api from "./api-client";
import {
@@ -44,6 +42,7 @@ import {
logPerLanguageBundleFallback,
} from "./per-language-bundles";
import { getBundlePlatform } from "./platform";
import { getCodeQLAssetDownloadURL } from "./setup/repository";
import * as tar from "./tar";
import {
deleteToolcacheBundles,
@@ -65,7 +64,6 @@ export enum ToolsSource {
Download = "DOWNLOAD",
}
const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
const CODEQL_NIGHTLIES_REPOSITORY_OWNER = "dsp-testing";
const CODEQL_NIGHTLIES_REPOSITORY_NAME = "codeql-cli-nightlies";
@@ -73,75 +71,6 @@ const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"];
const CODEQL_NIGHTLY_TOOLS_INPUTS = ["nightly", "nightly-latest"];
const CODEQL_TOOLCACHE_INPUT = "toolcache";
export function getCodeQLActionRepository(logger: Logger): string {
if (isRunningLocalAction()) {
// This handles the case where the Action does not come from an Action repository,
// e.g. our integration tests which use the Action code from the current checkout.
// In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
logger.info(
"The CodeQL Action is checked out locally. Using the default CodeQL Action repository.",
);
return CODEQL_DEFAULT_ACTION_REPOSITORY;
}
return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY");
}
async function getCodeQLBundleDownloadURL(
tagName: string,
apiDetails: api.GitHubApiDetails,
codeQLBundleName: string,
logger: Logger,
): Promise<string> {
const codeQLActionRepository = getCodeQLActionRepository(logger);
const potentialDownloadSources = [
// This GitHub instance, and this Action.
[apiDetails.url, codeQLActionRepository],
// This GitHub instance, and the canonical Action.
[apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY],
// GitHub.com, and the canonical Action.
[util.GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY],
];
// We now filter out any duplicates.
// Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
const uniqueDownloadSources = potentialDownloadSources.filter(
(source, index, self) => {
return !self.slice(0, index).some((other) => deepEqual(source, other));
},
);
for (const downloadSource of uniqueDownloadSources) {
const [apiURL, repository] = downloadSource;
// If we've reached the final case, short-circuit the API check since we know the bundle exists and is public.
if (
apiURL === util.GITHUB_DOTCOM_URL &&
repository === CODEQL_DEFAULT_ACTION_REPOSITORY
) {
break;
}
const [repositoryOwner, repositoryName] = repository.split("/");
try {
const release = await api.getApiClient().rest.repos.getReleaseByTag({
owner: repositoryOwner,
repo: repositoryName,
tag: tagName,
});
for (const asset of release.data.assets) {
if (asset.name === codeQLBundleName) {
logger.info(
`Found CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} with URL ${asset.url}.`,
);
return asset.url;
}
}
} catch (e) {
logger.info(
`Looked for CodeQL bundle ${codeQLBundleName} in ${repository} on ${apiURL} but got error ${e}.`,
);
}
}
return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${codeQLBundleName}`;
}
function tryGetBundleVersionFromTagName(
tagName: string,
logger: Logger,
@@ -720,9 +649,10 @@ export async function getCodeQLSource(
? "zstd"
: "gzip";
const action = { env: getEnv(), logger };
const platform = getBundlePlatform();
const perLanguageBundleLanguage = await getPerLanguageBundleLanguage(
{ env: getEnv(), features, logger },
{ ...action, features },
{
rawLanguages,
otherLanguagePacksReason,
@@ -735,11 +665,11 @@ export async function getCodeQLSource(
// Resolves the combined or per-language bundle URL for the requested release.
const resolveBundleURL = (language?: BuiltInLanguage) =>
getCodeQLBundleDownloadURL(
bundleTagName,
getCodeQLAssetDownloadURL(
action,
apiDetails,
bundleTagName,
getCodeQLBundleName(compressionMethod, platform, language),
logger,
);
const combinedBundleURL = await resolveBundleURL();

35
src/setup/repository.test.ts Normal file
View File

@@ -0,0 +1,35 @@
import * as path from "path";
import test from "ava";
import * as sinon from "sinon";
import * as actionsUtil from "../actions-util";
import { ActionsEnvVars } from "../environment";
import { callee, getTestEnv, setupTests } from "../testing-utils";
import { initializeEnvironment } from "../util";
import { getCodeQLActionRepository } from "./repository";
setupTests(test);
test.serial("getCodeQLActionRepository", async (t) => {
const initialEnv = getTestEnv({
[ActionsEnvVars.RUNNER_TEMP]: path.dirname(__dirname),
});
initializeEnvironment("1.2.3", initialEnv);
const target = callee(getCodeQLActionRepository)
.withArgs()
.withEnv(initialEnv);
// isRunningLocalAction() === true
await target.passes(t.deepEqual, "github/codeql-action");
// isRunningLocalAction() === false
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
await target
.withEnv((env) => {
env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "xxx/yyy");
})
.passes(t.deepEqual, "xxx/yyy");
});

158
src/setup/repository.ts Normal file
View File

@@ -0,0 +1,158 @@
import { ActionState } from "../action-common";
import { isRunningLocalAction } from "../actions-util";
import * as api from "../api-client";
import { ActionsEnvVars } from "../environment";
import {
isRepositoryNwoStr,
parseRepositoryNwo,
type RepositoryNwoStr,
} from "../repository";
import { GITHUB_DOTCOM_URL, type InstanceURL } from "../util";
/** The NWO of the standard CodeQL Action repository. */
export const CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
/**
* Retrieves the NWO of the repository that the CodeQL Action is loaded from.
* Typically, this will be `github/codeql-action`, but it may be something else for
* forks of the Action or in environments other than GitHub.com.
*
* If this function detects that we are running the Action locally (e.g. in tests),
* then we default to `CODEQL_DEFAULT_ACTION_REPOSITORY`.
*/
export function getCodeQLActionRepository(
action: ActionState<["ReadOnlyEnv", "Logger"]>,
): RepositoryNwoStr {
if (isRunningLocalAction(action.env)) {
// This handles the case where the Action does not come from an Action repository,
// e.g. our integration tests which use the Action code from the current checkout.
// In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
action.logger.info(
"The CodeQL Action is checked out locally. Using the default CodeQL Action repository.",
);
return CODEQL_DEFAULT_ACTION_REPOSITORY;
}
const actionRepository = action.env.getRequired(
ActionsEnvVars.GITHUB_ACTION_REPOSITORY,
);
if (isRepositoryNwoStr(actionRepository)) {
return actionRepository;
}
throw new Error(
`The value of '${ActionsEnvVars.GITHUB_ACTION_REPOSITORY}' is '${actionRepository}', which does not match the expected 'owner/repo' format.`,
);
}
/**A download source is a pair of strings. */
export type DownloadSource = [InstanceURL, RepositoryNwoStr];
/** GitHub.com, and the canonical Action. */
export const DEFAULT_DOWNLOAD_SOURCE: DownloadSource = [
GITHUB_DOTCOM_URL,
CODEQL_DEFAULT_ACTION_REPOSITORY,
];
/** Decides if the two provided download sources are the same. */
const isSameDownloadSource = (
[srcUrl, srcRepo]: DownloadSource,
[otherUrl, otherRepo]: DownloadSource,
) => {
return srcUrl === otherUrl && srcRepo === otherRepo;
};
/** A download URL is represented as a string. */
export type DownloadURL = string;
/** Gets the default GitHub.com download URL for `assetName` in a release tagged `tagName`. */
export function getDefaultDotcomDownloadURL(
tagName: string,
assetName: string,
): DownloadURL {
return `${GITHUB_DOTCOM_URL}/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`;
}
/** Enumerates log-friendly descriptions of different kinds of assets we might look for in releases. */
export type ReleaseAssetKind = "CodeQL bundle" | "private registry proxy";
/**
* Tries to find a download URL for `assetName` in a release tagged with `tagName`.
*
* Depending on where and how the CodeQL Action is running, we may be using different `apiDetails` and there may be
* different options for where to source CodeQL releases from.
*
* This function either returns the download URL for the asset for the first release we find, or
* defaults to the assumed download URL for the asset on the default CodeQL Action repository on GitHub.com.
* In the latter case, this function does not guarantee that the asset actually exists.
*
* @param action The Action state.
* @param apiDetails The details of the GitHub API in use.
* @param tagName The name of the release tag we want to obtain the asset from.
* @param assetName The name of the asset we should look for in the release.
* @param [assetKind="CodeQL bundle"] The kind of asset we are looking for to show in log messages.
* @returns A URL that we can use to download the asset.
*/
export async function getCodeQLAssetDownloadURL(
action: ActionState<["ReadOnlyEnv", "Logger"]>,
apiDetails: api.GitHubApiDetails,
tagName: string,
assetName: string,
assetKind: ReleaseAssetKind = "CodeQL bundle",
): Promise<DownloadURL> {
const codeQLActionRepository = getCodeQLActionRepository(action);
const potentialDownloadSources: DownloadSource[] = [
// This GitHub instance, and this Action.
[apiDetails.url, codeQLActionRepository],
// This GitHub instance, and the canonical Action.
[apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY],
// GitHub.com, and the canonical Action.
DEFAULT_DOWNLOAD_SOURCE,
];
// We now filter out any duplicates.
// Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
const uniqueDownloadSources = potentialDownloadSources.filter(
(source, index, self) => {
return !self
.slice(0, index)
.some((other) => isSameDownloadSource(source, other));
},
);
for (const [instanceURL, repository] of uniqueDownloadSources) {
// If we've reached the final case, short-circuit the API check since we know the asset exists and is public.
if (
isSameDownloadSource(DEFAULT_DOWNLOAD_SOURCE, [instanceURL, repository])
) {
break;
}
const { owner: repositoryOwner, repo: repositoryName } =
parseRepositoryNwo(repository);
try {
const release = await api.getApiClient().rest.repos.getReleaseByTag({
owner: repositoryOwner,
repo: repositoryName,
tag: tagName,
});
for (const asset of release.data.assets) {
if (asset.name === assetName) {
action.logger.info(
`Found ${assetKind} ${assetName} in ${repository} on ${instanceURL} with URL ${asset.url}.`,
);
return asset.url;
}
}
} catch (e) {
action.logger.info(
`Looked for ${assetKind} ${assetName} in ${repository} on ${instanceURL} but got error ${e}.`,
);
}
}
return getDefaultDotcomDownloadURL(tagName, assetName);
}

10
src/start-proxy-action.ts
View File

@@ -10,7 +10,7 @@ import {
runInActions,
} from "./action-common";
import * as actionsUtil from "./actions-util";
import { getGitHubVersion } from "./api-client";
import { getApiDetails, getGitHubVersion } from "./api-client";
import { FeatureEnablement, initFeatures } from "./feature-flags";
import { BuiltInLanguage, parseBuiltInLanguage } from "./languages";
import { Logger } from "./logging";
@@ -104,9 +104,12 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
// Start the Proxy
const actionWithFeatures = extendActionState(action, { features });
const proxyBin = await getProxyBinaryPath(actionWithFeatures);
const proxyBin = await getProxyBinaryPath(
actionWithFeatures,
getApiDetails(action.env),
);
const proxyInfo = await startProxy(
proxyBin,
proxyBin.path,
proxyConfig,
proxyLogFilePath,
logger,
@@ -122,6 +125,7 @@ async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) {
languages: language === undefined ? undefined : [language],
},
proxyConfig.all_credentials.map((c) => c.type),
{ proxy_version: proxyBin.version },
logger,
);
} catch (unwrappedError) {

310
src/start-proxy.test.ts
View File

@@ -1,22 +1,24 @@
import * as filepath from "path";
import * as core from "@actions/core";
import * as toolcache from "@actions/tool-cache";
import test, { ExecutionContext } from "ava";
import sinon from "sinon";
import { ActionState } from "./action-common";
import * as actionsUtil from "./actions-util";
import * as apiClient from "./api-client";
import * as defaults from "./defaults.json";
import { ActionsEnvVars } from "./environment";
import { setUpFeatureFlagTests } from "./feature-flags/testing-util";
import { UnvalidatedObject, validateSchema } from "./json";
import { makeFromSchema } from "./json/testing-util";
import { BuiltInLanguage } from "./languages";
import { getRunnerLogger, Logger } from "./logging";
import { BundlePlatform, getBundlePlatform } from "./platform";
import * as repository from "./setup/repository";
import * as startProxyExports from "./start-proxy";
import * as statusReport from "./status-report";
import {
addSinonAssertions,
assertNotLogged,
checkExpectedLogMessages,
createFeatures,
@@ -24,97 +26,14 @@ import {
makeMacro,
makeTestToken,
RecordingLogger,
SAMPLE_DOTCOM_API_DETAILS,
setupTests,
withRecordingLoggerAsync,
} from "./testing-utils";
import {
ConfigurationError,
GitHubVariant,
GitHubVersion,
withTmpDir,
} from "./util";
import { GitHubVariant, GitHubVersion, withTmpDir } from "./util";
setupTests(test);
const sendFailedStatusReportTest = makeMacro({
exec: async (
t: ExecutionContext<unknown>,
err: Error,
expectedMessage: string,
expectedStatus: statusReport.ActionStatus = "failure",
) => {
const now = new Date();
// Override core.setFailed to avoid it setting the program's exit code
sinon.stub(core, "setFailed").returns();
const createStatusReportBase = sinon.stub(
statusReport,
"createStatusReportBase",
);
createStatusReportBase.resolves(undefined);
await withRecordingLoggerAsync(async (logger) => {
await startProxyExports.sendFailedStatusReport(
logger,
now,
undefined,
err,
);
// Check that the stub has been called exactly once, with the expected arguments,
// but not with the message from the error.
sinon.assert.calledOnceWithExactly(
createStatusReportBase,
statusReport.ActionName.StartProxy,
expectedStatus,
now,
sinon.match.any,
sinon.match.any,
sinon.match.any,
expectedMessage,
);
t.false(
createStatusReportBase.calledWith(
statusReport.ActionName.StartProxy,
expectedStatus,
now,
sinon.match.any,
sinon.match.any,
sinon.match.any,
sinon.match((msg: string) => msg.includes(err.message)),
),
"createStatusReportBase was called with the error message",
);
});
},
title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`,
});
sendFailedStatusReportTest.serial(
"reports generic error message for non-StartProxyError error",
new Error("Something went wrong today"),
"Error from start-proxy Action omitted (Error).",
);
sendFailedStatusReportTest.serial(
"reports generic error message for non-StartProxyError error with safe error message",
new Error(
startProxyExports.getStartProxyErrorMessage(
startProxyExports.StartProxyErrorType.DownloadFailed,
),
),
"Error from start-proxy Action omitted (Error).",
);
sendFailedStatusReportTest.serial(
"reports generic error message for ConfigurationError error",
new ConfigurationError("Something went wrong today"),
"Error from start-proxy Action omitted (ConfigurationError).",
"user-error",
);
const toEncodedJSON = (data: any) =>
Buffer.from(JSON.stringify(data)).toString("base64");
@@ -705,18 +624,29 @@ function mockGetApiClient(endpoints: any) {
type ReleaseAssets = Array<{ name: string; url?: string }>;
function mockGetReleaseByTag(assets?: ReleaseAssets) {
function mockGetReleaseByTag(expectedTag?: string, assets?: ReleaseAssets) {
const getReleaseByTag =
assets === undefined
? sinon.stub().rejects()
: sinon.stub().resolves({
status: 200,
data: { assets },
headers: {},
url: "GET /repos/:owner/:repo/releases/tags/:tag",
: sinon.stub().callsFake(({ tag }) => {
if (tag === expectedTag) {
return {
status: 200,
data: { assets },
headers: {},
url: "GET /repos/:owner/:repo/releases/tags/:tag",
};
} else {
return {
status: 404,
};
}
});
return mockGetApiClient({ repos: { getReleaseByTag } });
return {
getReleaseByTag,
getApiClient: mockGetApiClient({ repos: { getReleaseByTag } }),
};
}
function mockOfflineFeatures(tempDir: string, logger: Logger) {
@@ -751,25 +681,33 @@ test.serial(
logger,
features,
});
const info = await startProxyExports.getDownloadUrl(state);
t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
t.is(
info.url,
startProxyExports.getFallbackUrl(
startProxyExports.getProxyPackage(BundlePlatform.Linux64),
),
// Stub this to always return `true` so we get the default repo for the tests.
sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
const info = await startProxyExports.getDownloadUrl(
state,
SAMPLE_DOTCOM_API_DETAILS,
);
t.true(
logger.hasMessage(`Unsupported platform android on architecture ppc`),
);
t.is(info.version, defaults.cliVersion);
t.is(
info.url,
repository.getDefaultDotcomDownloadURL(
defaults.bundleVersion,
startProxyExports.getProxyPackage(BundlePlatform.Linux64),
),
);
});
},
);
test.serial(
"getDownloadUrl returns fallback when `getReleaseByVersion` rejects",
"getDownloadUrl returns default bundle URL for linked version",
async (t) => {
const logger = new RecordingLogger();
mockGetReleaseByTag();
@@ -777,12 +715,20 @@ test.serial(
await withTmpDir(async (tempDir) => {
const features = mockOfflineFeatures(tempDir, logger);
const state = initAllState({ logger, features });
const info = await startProxyExports.getDownloadUrl(state);
t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
// Stub this to always return `true` so we get the default repo for the tests.
sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
const info = await startProxyExports.getDownloadUrl(
state,
SAMPLE_DOTCOM_API_DETAILS,
);
t.is(info.version, defaults.cliVersion);
t.is(
info.url,
startProxyExports.getFallbackUrl(
repository.getDefaultDotcomDownloadURL(
defaults.bundleVersion,
startProxyExports.getProxyPackage(getTestPlatform(state)),
),
);
@@ -791,7 +737,7 @@ test.serial(
);
test.serial(
"getDownloadUrl returns fallback when there's no matching release asset",
"getDownloadUrl doesn't check that the default asset exists",
async (t) => {
const logger = new RecordingLogger();
const testAssets = [[], [{ name: "foo" }]];
@@ -800,19 +746,28 @@ test.serial(
const features = mockOfflineFeatures(tempDir, logger);
const state = initAllState({ logger, features });
for (const assets of testAssets) {
const stub = mockGetReleaseByTag(assets);
const info = await startProxyExports.getDownloadUrl(state);
// Stub this to always return `true` so we get the default repo for the tests.
sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
t.is(info.version, startProxyExports.UPDATEJOB_PROXY_VERSION);
for (const assets of testAssets) {
const stubs = mockGetReleaseByTag(defaults.bundleVersion, assets);
const info = await startProxyExports.getDownloadUrl(
state,
SAMPLE_DOTCOM_API_DETAILS,
);
t.is(info.version, defaults.cliVersion);
t.is(
info.url,
startProxyExports.getFallbackUrl(
repository.getDefaultDotcomDownloadURL(
defaults.bundleVersion,
startProxyExports.getProxyPackage(getTestPlatform(state)),
),
);
stub.restore();
// mockGetReleaseByTag stubs the global getApiClient; since we are calling
// that in a loop, we need to manually restore it here
stubs.getApiClient.restore();
}
});
},
@@ -828,11 +783,22 @@ test.serial("getDownloadUrl returns matching release asset", async (t) => {
url: "url-we-want",
},
];
mockGetReleaseByTag(assets);
const stubs = mockGetReleaseByTag(defaults.bundleVersion, assets);
await withTmpDir(async (tempDir) => {
state.env.set(ActionsEnvVars.RUNNER_TEMP, tempDir);
const features = mockOfflineFeatures(tempDir, logger);
const info = await startProxyExports.getDownloadUrl({ ...state, features });
// Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
const info = await startProxyExports.getDownloadUrl(
{ ...state, features },
SAMPLE_DOTCOM_API_DETAILS,
);
t.is(stubs.getReleaseByTag.callCount, 1);
t.is(info.version, defaults.cliVersion);
t.is(info.url, "url-we-want");
@@ -965,16 +931,21 @@ test.serial(
const toolcachePath = "/path/to/proxy/dir";
sinon.stub(toolcache, "find").returns(toolcachePath);
// Stub this to always return `true` so we get the default repo for the tests.
sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
const features = mockOfflineFeatures(tempDir, logger);
const path = await startProxyExports.getProxyBinaryPath(
const result = await startProxyExports.getProxyBinaryPath(
initAllState({ logger, features }),
SAMPLE_DOTCOM_API_DETAILS,
);
t.assert(path);
t.assert(result);
t.is(
path,
result.path,
filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
);
t.is(result.version, defaults.cliVersion);
});
},
);
@@ -985,7 +956,7 @@ test.serial(
const logger = new RecordingLogger();
const state = initAllState({ logger });
const downloadUrl = "url-we-want";
mockGetReleaseByTag([
const stubs = mockGetReleaseByTag(defaults.bundleVersion, [
{
name: startProxyExports.getProxyPackage(getTestPlatform(state)),
url: downloadUrl,
@@ -994,11 +965,6 @@ test.serial(
const toolcachePath = "/path/to/proxy/dir";
const find = sinon.stub(toolcache, "find").returns("");
const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({
auth: "",
url: "",
apiURL: "",
});
const getAuthorizationHeaderFor = sinon
.stub(apiClient, "getAuthorizationHeaderFor")
.returns(undefined);
@@ -1012,25 +978,36 @@ test.serial(
.resolves(extractedPath);
const cacheDir = sinon.stub(toolcache, "cacheDir").resolves(toolcachePath);
const path = await startProxyExports.getProxyBinaryPath({
...state,
features: createFeatures([]),
});
// Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
t.assert(find.calledOnce);
t.assert(getApiDetails.calledOnce);
t.assert(getAuthorizationHeaderFor.calledOnce);
t.assert(downloadTool.calledOnceWith(downloadUrl));
t.assert(extractTar.calledOnceWith(archivePath));
t.assert(cacheDir.calledOnceWith(extractedPath));
t.assert(path);
t.is(
path,
filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
const result = await startProxyExports.getProxyBinaryPath(
{
...state,
features: createFeatures([]),
},
SAMPLE_DOTCOM_API_DETAILS,
);
t.is(stubs.getReleaseByTag.callCount, 1);
t.assert(find.calledOnce);
t.assert(getAuthorizationHeaderFor.calledOnce);
const st = addSinonAssertions(t);
st.onceWith(downloadTool, downloadUrl);
st.onceWith(extractTar, archivePath);
st.onceWith(cacheDir, extractedPath);
t.assert(result);
t.is(
result.path,
filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
);
t.is(result.version, defaults.cliVersion);
checkExpectedLogMessages(t, logger.messages, [
`Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${defaults.bundleVersion}' at '${downloadUrl}'`,
`Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://github.com with URL ${downloadUrl}`,
]);
},
);
@@ -1040,10 +1017,11 @@ test.serial(
async (t) => {
const logger = new RecordingLogger();
const state = initAllState({ logger });
const expectedTag = "codeql-bundle-v2.20.1";
const expectedVersion = "2.20.1";
const expectedTag = `codeql-bundle-v${expectedVersion}`;
const expectedParams = {
owner: "github",
repo: "codeql-action",
owner: "test",
repo: "repo",
tag: expectedTag,
};
const downloadUrl = "url-we-want";
@@ -1066,11 +1044,6 @@ test.serial(
await withTmpDir(async (tempDir) => {
const toolcachePath = "/path/to/proxy/dir";
const find = sinon.stub(toolcache, "find").returns("");
const getApiDetails = sinon.stub(apiClient, "getApiDetails").returns({
auth: "",
url: "",
apiURL: "",
});
const getAuthorizationHeaderFor = sinon
.stub(apiClient, "getAuthorizationHeaderFor")
.returns(undefined);
@@ -1098,34 +1071,43 @@ test.serial(
const getDefaultCliVersion = sinon
.stub(features, "getEnabledDefaultCliVersions")
.resolves({
enabledVersions: [{ cliVersion: "2.20.1", tagName: expectedTag }],
enabledVersions: [
{ cliVersion: expectedVersion, tagName: expectedTag },
],
});
const path = await startProxyExports.getProxyBinaryPath({
...state,
features,
});
// Stub this to always return `false` so we force `getCodeQLAssetDownloadURL` to use the (mocked) API.
sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
state.env.set(ActionsEnvVars.GITHUB_ACTION_REPOSITORY, "test/repo");
const result = await startProxyExports.getProxyBinaryPath(
{
...state,
features,
},
SAMPLE_DOTCOM_API_DETAILS,
);
t.assert(getDefaultCliVersion.calledOnce);
sinon.assert.calledOnceWithMatch(
getReleaseByTag,
sinon.match(expectedParams),
);
t.assert(find.calledOnce);
t.assert(getApiDetails.calledOnce);
t.assert(getAuthorizationHeaderFor.calledOnce);
t.assert(downloadTool.calledOnceWith(downloadUrl));
t.assert(extractTar.calledOnceWith(archivePath));
t.assert(cacheDir.calledOnceWith(extractedPath));
t.assert(path);
const st = addSinonAssertions(t);
st.onceWith(getReleaseByTag, expectedParams);
t.assert(find.calledOnce);
t.assert(getAuthorizationHeaderFor.calledOnce);
st.onceWith(downloadTool, downloadUrl);
st.onceWith(extractTar, archivePath);
st.onceWith(cacheDir, extractedPath);
t.assert(result);
t.is(
path,
result.path,
filepath.join(toolcachePath, startProxyExports.getProxyFilename()),
);
t.is(result.version, expectedVersion);
});
checkExpectedLogMessages(t, logger.messages, [
`Found '${startProxyExports.getProxyPackage(getTestPlatform(state))}' in release '${expectedTag}' at '${downloadUrl}'`,
`Found private registry proxy ${startProxyExports.getProxyPackage(getTestPlatform(state))} in test/repo on https://github.com with URL url-we-want.`,
]);
},
);

304
src/start-proxy.ts
View File

@@ -1,17 +1,14 @@
import * as path from "path";
import * as core from "@actions/core";
import * as toolcache from "@actions/tool-cache";
import { ActionState } from "./action-common";
import {
getApiClient,
getApiDetails,
getAuthorizationHeaderFor,
getGitHubVersion,
GitHubApiDetails,
} from "./api-client";
import * as artifactScanner from "./artifact-scanner";
import { Config } from "./config-utils";
import * as defaults from "./defaults.json";
import {
CodeQLDefaultVersionInfo,
@@ -22,6 +19,11 @@ import * as json from "./json";
import { BuiltInLanguage } from "./languages";
import { Logger } from "./logging";
import { BundlePlatform, getBundlePlatform } from "./platform";
import { getCodeQLAssetDownloadURL } from "./setup/repository";
import {
StartProxyError,
StartProxyErrorType,
} from "./start-proxy/status-report";
import {
Address,
Registry,
@@ -32,149 +34,13 @@ import {
RawCredential,
} from "./start-proxy/types";
import { getAuthConfig } from "./start-proxy/validation";
import {
ActionName,
createStatusReportBase,
getActionsStatus,
sendStatusReport,
StatusReportBase,
} from "./status-report";
import * as util from "./util";
import { ConfigurationError, getErrorMessage, isDefined } from "./util";
export * from "./start-proxy/types";
export * from "./start-proxy/status-report";
/**
* Enumerates specific error types for which we have corresponding error messages that
* are safe to include in status reports.
*/
export enum StartProxyErrorType {
DownloadFailed,
ExtractionFailed,
CacheFailed,
}
/**
* @returns The error message corresponding to the error type.
*/
export function getStartProxyErrorMessage(
errorType: StartProxyErrorType,
): string {
switch (errorType) {
case StartProxyErrorType.DownloadFailed:
return "Failed to download proxy archive.";
case StartProxyErrorType.ExtractionFailed:
return "Failed to extract proxy archive.";
case StartProxyErrorType.CacheFailed:
return "Failed to add proxy to toolcache";
}
}
/**
* We want to avoid accidentally leaking secrets that may be contained in exception
* messages in the `start-proxy` action. Consequently, we don't report the messages
* of arbitrary exceptions. This type of error ensures that the message is one from
* `StartProxyErrorType` and therefore safe to include in a status report.
*/
export class StartProxyError extends Error {
public readonly errorType: StartProxyErrorType;
constructor(errorType: StartProxyErrorType) {
super();
this.errorType = errorType;
}
}
/**
* Sends a status report for the `start-proxy` action indicating a successful outcome.
*
* @param startedAt When the action was started.
* @param config The configuration used.
* @param registry_types The types of registries that are configured.
* @param logger The logger to use.
*/
export async function sendSuccessStatusReport(
startedAt: Date,
config: Partial<Config>,
registry_types: string[],
logger: Logger,
) {
const statusReportBase = await createStatusReportBase(
ActionName.StartProxy,
"success",
startedAt,
config,
await util.checkDiskUsage(logger),
logger,
);
if (statusReportBase !== undefined) {
const statusReport: StatusReportBase = {
...statusReportBase,
registry_types: registry_types.join(","),
};
await sendStatusReport(statusReport);
}
}
/**
* Returns an error message for `error` that can safely be reported in a status report,
* i.e. that does not contain sensitive information.
*
* @param error The error for which to get an error message.
*/
export function getSafeErrorMessage(error: Error): string {
// If the error is a `StartProxyError`, resolve the error type to the corresponding
// error message.
if (error instanceof StartProxyError) {
return getStartProxyErrorMessage(error.errorType);
}
// Otherwise, omit the actual error message.
return `Error from start-proxy Action omitted (${error.constructor.name}).`;
}
/**
* Sends a status report for the `start-proxy` action indicating a failure.
*
* @param logger The logger to use.
* @param startedAt When the action was started.
* @param language The language provided as input, if any.
* @param unwrappedError The exception that was thrown.
*/
export async function sendFailedStatusReport(
logger: Logger,
startedAt: Date,
language: BuiltInLanguage | undefined,
unwrappedError: unknown,
) {
const error = util.wrapError(unwrappedError);
core.setFailed(`start-proxy action failed: ${error.message}`);
// To avoid the possibility of leaking sensitive information into the telemetry,
// we don't include arbitrary error messages. Instead, `getSafeErrorMessage` will
// return a generic message that includes the type of the error, unless it can decide
// that the message is safe to include.
const statusReportMessage = getSafeErrorMessage(error);
const errorStatusReportBase = await createStatusReportBase(
ActionName.StartProxy,
getActionsStatus(error),
startedAt,
{
languages: language === undefined ? undefined : [language],
},
await util.checkDiskUsage(logger),
logger,
statusReportMessage,
);
if (errorStatusReportBase !== undefined) {
await sendStatusReport(errorStatusReportBase);
}
}
/** The basename of the proxy artifacts. */
export const UPDATEJOB_PROXY = "update-job-proxy";
export const UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901";
const UPDATEJOB_PROXY_URL_PREFIX =
"https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/";
function isPAT(value: string) {
return artifactScanner.isAuthToken(value, [
@@ -379,30 +245,6 @@ export function getProxyPackage(platform: BundlePlatform): string {
return `${UPDATEJOB_PROXY}-${platform}.tar.gz`;
}
/**
* Gets the fallback URL for downloading the proxy release asset.
*
* @param proxyPackage The asset name.
* @returns The full URL to download the specified asset from the fallback release.
*/
export function getFallbackUrl(proxyPackage: string): string {
return `${UPDATEJOB_PROXY_URL_PREFIX}${proxyPackage}`;
}
/**
* Uses the GitHub API to obtain information about the CodeQL CLI bundle release
* that is tagged by `version`.
*
* @returns The response from the GitHub API.
*/
async function getReleaseByVersion(version: string) {
return getApiClient().rest.repos.getReleaseByTag({
owner: "github",
repo: "codeql-action",
tag: version,
});
}
/** Uses `features` to determine the default CLI version. */
async function getCliVersionFromFeatures(
features: FeatureEnablement,
@@ -419,7 +261,8 @@ async function getCliVersionFromFeatures(
* @returns Returns the download URL and version of the proxy package we plan to use.
*/
export async function getDownloadUrl(
action: ActionState<["Base", "Logger", "FeatureFlags"]>,
action: ActionState<["Base", "ReadOnlyEnv", "Logger", "FeatureFlags"]>,
apiDetails: GitHubApiDetails,
): Promise<{ url: string; version: string }> {
// Default to linux64 if we don't recognise the platform+arch pair.
// This maintains the behaviour we had before switching to `getBundlePlatform` here.
@@ -448,37 +291,26 @@ export async function getDownloadUrl(
};
// Try to retrieve information about the CLI bundle release identified by `versionInfo`.
const cliRelease = await getReleaseByVersion(versionInfo.tagName);
const proxyAssetUrl = await getCodeQLAssetDownloadURL(
action,
apiDetails,
versionInfo.tagName,
proxyPackage,
"private registry proxy",
);
// Search the release's assets to find the one we are looking for.
for (const asset of cliRelease.data.assets) {
if (asset.name === proxyPackage) {
action.logger.info(
`Found '${proxyPackage}' in release '${versionInfo.tagName}' at '${asset.url}'`,
);
return {
url: asset.url,
// The `update-job-proxy` doesn't have a version as such. Since we now bundle it
// with CodeQL CLI bundle releases, we use the corresponding CLI version to
// differentiate between (potentially) different versions of `update-job-proxy`.
version: versionInfo.cliVersion,
};
}
}
return {
url: proxyAssetUrl,
// The `update-job-proxy` doesn't have a version as such. Since we now bundle it
// with CodeQL CLI bundle releases, we use the corresponding CLI version to
// differentiate between (potentially) different versions of `update-job-proxy`.
version: versionInfo.cliVersion,
};
} catch (ex) {
action.logger.warning(
throw new Error(
`Failed to retrieve information about the linked release: ${getErrorMessage(ex)}`,
);
}
// Fallback to the hard-coded URL.
action.logger.info(
`Did not find '${proxyPackage}' in the linked release, falling back to hard-coded version.`,
);
return {
url: getFallbackUrl(proxyPackage),
version: UPDATEJOB_PROXY_VERSION,
};
}
/**
@@ -497,9 +329,14 @@ export async function downloadProxy(
try {
// Download the proxy archive from `url`. We let `downloadTool` choose where
// to store it. The path to the downloaded file will be returned if successful.
return toolcache.downloadTool(url, /* dest: */ undefined, authorization, {
accept: "application/octet-stream",
});
return await toolcache.downloadTool(
url,
/* dest: */ undefined,
authorization,
{
accept: "application/octet-stream",
},
);
} catch (error) {
logger.error(
`Failed to download proxy archive from ${url}: ${getErrorMessage(error)}`,
@@ -560,37 +397,70 @@ export function getProxyFilename() {
: UPDATEJOB_PROXY;
}
export type ProxyBinary = {
/** The path to the proxy binary to run. */
path: string;
/**
* The version associated with the proxy binary.
* This usually corresponds to the CodeQL CLI release that the binary was obtained from.
*/
version: string;
};
/**
* Gets a path to the proxy binary. If possible, this function will find the proxy in the
* runner's tool cache. Otherwise, it downloads and extracts the proxy binary,
* and stores it in the tool cache.
*
* @param action The action state.
* @returns The path to the proxy binary.
* @returns The path to the proxy binary and its version.
*/
export async function getProxyBinaryPath(
action: ActionState<["Base", "Logger", "FeatureFlags"]>,
): Promise<string> {
action: ActionState<["Base", "ReadOnlyEnv", "Logger", "FeatureFlags"]>,
apiDetails: GitHubApiDetails,
): Promise<ProxyBinary> {
const logger = action.logger;
const proxyFileName = getProxyFilename();
const proxyInfo = await getDownloadUrl(action);
logger.startGroup("Setting up authentication proxy");
let proxyBin = toolcache.find(proxyFileName, proxyInfo.version);
if (!proxyBin) {
const apiDetails = getApiDetails();
const authorization = getAuthorizationHeaderFor(
logger,
apiDetails,
proxyInfo.url,
);
const temp = await downloadProxy(logger, proxyInfo.url, authorization);
const extracted = await extractProxy(logger, temp);
proxyBin = await cacheProxy(
logger,
extracted,
proxyFileName,
proxyInfo.version,
try {
const proxyFileName = getProxyFilename();
const proxyInfo = await getDownloadUrl(action, apiDetails);
logger.info(
`Using authentication proxy from CodeQL release ${proxyInfo.version}.`,
);
let proxyDir = toolcache.find(proxyFileName, proxyInfo.version);
if (!proxyDir) {
logger.info(
`Authentication proxy is not in the toolcache. Will try to download it from '${proxyInfo.url}'.`,
);
const authorization = getAuthorizationHeaderFor(
logger,
apiDetails,
proxyInfo.url,
);
const temp = await downloadProxy(logger, proxyInfo.url, authorization);
logger.info(`Downloaded the authentication proxy asset to '${temp}'.`);
const extracted = await extractProxy(logger, temp);
proxyDir = await cacheProxy(
logger,
extracted,
proxyFileName,
proxyInfo.version,
);
logger.info(`Extracted the authentication proxy to '${proxyDir}'.`);
}
return {
path: path.join(proxyDir, proxyFileName),
version: proxyInfo.version,
};
} finally {
logger.endGroup();
}
return path.join(proxyBin, proxyFileName);
}

136
src/start-proxy/status-report.test.ts Normal file
View File

@@ -0,0 +1,136 @@
import * as core from "@actions/core";
import test, { ExecutionContext } from "ava";
import sinon from "sinon";
import * as statusReport from "../status-report";
import {
createTestConfig,
makeMacro,
RecordingLogger,
setupTests,
withRecordingLoggerAsync,
} from "../testing-utils";
import { ConfigurationError } from "../util";
import * as startProxyExports from "./status-report";
setupTests(test);
test.serial("sendSuccessStatusReport", async (t) => {
const logger = new RecordingLogger();
const now = new Date();
const config = createTestConfig({});
const proxy_version = "1.2.3";
const registry_types = ["git_source", "docker_registry"];
const createStatusReportBase = sinon.stub(
statusReport,
"createStatusReportBase",
);
createStatusReportBase.resolves({
action_name: statusReport.ActionName.StartProxy,
} as statusReport.StatusReportBase);
const sendStatusReport = sinon
.stub(statusReport, "sendStatusReport")
.resolves();
await startProxyExports.sendSuccessStatusReport(
now,
config,
registry_types,
{ proxy_version },
logger,
);
t.is(createStatusReportBase.callCount, 1);
t.is(sendStatusReport.callCount, 1);
t.is(sendStatusReport.args[0].length, 1);
const arg = sendStatusReport.args[0][0];
t.like(arg, {
action_name: statusReport.ActionName.StartProxy,
registry_types: "docker_registry,git_source",
start_proxy: { proxy_version },
});
});
const sendFailedStatusReportTest = makeMacro({
exec: async (
t: ExecutionContext<unknown>,
err: Error,
expectedMessage: string,
expectedStatus: statusReport.ActionStatus = "failure",
) => {
const now = new Date();
// Override core.setFailed to avoid it setting the program's exit code
sinon.stub(core, "setFailed").returns();
const createStatusReportBase = sinon.stub(
statusReport,
"createStatusReportBase",
);
createStatusReportBase.resolves(undefined);
await withRecordingLoggerAsync(async (logger) => {
await startProxyExports.sendFailedStatusReport(
logger,
now,
undefined,
err,
);
// Check that the stub has been called exactly once, with the expected arguments,
// but not with the message from the error.
sinon.assert.calledOnceWithExactly(
createStatusReportBase,
statusReport.ActionName.StartProxy,
expectedStatus,
now,
sinon.match.any,
sinon.match.any,
sinon.match.any,
expectedMessage,
);
t.false(
createStatusReportBase.calledWith(
statusReport.ActionName.StartProxy,
expectedStatus,
now,
sinon.match.any,
sinon.match.any,
sinon.match.any,
sinon.match((msg: string) => msg.includes(err.message)),
),
"createStatusReportBase was called with the error message",
);
});
},
title: (providedTitle = "") => `sendFailedStatusReport - ${providedTitle}`,
});
sendFailedStatusReportTest.serial(
"reports generic error message for non-StartProxyError error",
new Error("Something went wrong today"),
"Error from start-proxy Action omitted (Error).",
);
sendFailedStatusReportTest.serial(
"reports generic error message for non-StartProxyError error with safe error message",
new Error(
startProxyExports.getStartProxyErrorMessage(
startProxyExports.StartProxyErrorType.DownloadFailed,
),
),
"Error from start-proxy Action omitted (Error).",
);
sendFailedStatusReportTest.serial(
"reports generic error message for ConfigurationError error",
new ConfigurationError("Something went wrong today"),
"Error from start-proxy Action omitted (ConfigurationError).",
"user-error",
);

153
src/start-proxy/status-report.ts Normal file
View File

@@ -0,0 +1,153 @@
import * as core from "@actions/core";
import type { Config } from "../config-utils";
import type { BuiltInLanguage } from "../languages";
import type { Logger } from "../logging";
import {
ActionName,
createStatusReportBase,
getActionsStatus,
sendStatusReport,
type StatusReportBase,
} from "../status-report";
import * as util from "../util";
/** Additional status report data from `start-proxy`. */
export interface StartProxyStatus {
proxy_version: string;
}
/** The type of successful status reports from `start-proxy`. */
type StartProxySuccessReport = StatusReportBase & {
start_proxy: StartProxyStatus;
};
/**
* Sends a status report for the `start-proxy` action indicating a successful outcome.
*
* @param startedAt When the action was started.
* @param config The configuration used.
* @param registry_types The types of registries that are configured.
* @param status Status information.
* @param logger The logger to use.
*/
export async function sendSuccessStatusReport(
startedAt: Date,
config: Partial<Config>,
registry_types: string[],
status: StartProxyStatus,
logger: Logger,
) {
const statusReportBase = await createStatusReportBase(
ActionName.StartProxy,
"success",
startedAt,
config,
await util.checkDiskUsage(logger),
logger,
);
if (statusReportBase !== undefined) {
const statusReport: StartProxySuccessReport = {
...statusReportBase,
registry_types: registry_types.sort().join(","),
start_proxy: status,
};
await sendStatusReport(statusReport);
}
}
/**
* Enumerates specific error types for which we have corresponding error messages that
* are safe to include in status reports.
*/
export enum StartProxyErrorType {
DownloadFailed,
ExtractionFailed,
CacheFailed,
}
/**
* @returns The error message corresponding to the error type.
*/
export function getStartProxyErrorMessage(
errorType: StartProxyErrorType,
): string {
switch (errorType) {
case StartProxyErrorType.DownloadFailed:
return "Failed to download proxy archive.";
case StartProxyErrorType.ExtractionFailed:
return "Failed to extract proxy archive.";
case StartProxyErrorType.CacheFailed:
return "Failed to add proxy to toolcache";
}
}
/**
* We want to avoid accidentally leaking secrets that may be contained in exception
* messages in the `start-proxy` action. Consequently, we don't report the messages
* of arbitrary exceptions. This type of error ensures that the message is one from
* `StartProxyErrorType` and therefore safe to include in a status report.
*/
export class StartProxyError extends Error {
public readonly errorType: StartProxyErrorType;
constructor(errorType: StartProxyErrorType) {
super();
this.errorType = errorType;
}
}
/**
* Returns an error message for `error` that can safely be reported in a status report,
* i.e. that does not contain sensitive information.
*
* @param error The error for which to get an error message.
*/
export function getSafeErrorMessage(error: Error): string {
// If the error is a `StartProxyError`, resolve the error type to the corresponding
// error message.
if (error instanceof StartProxyError) {
return getStartProxyErrorMessage(error.errorType);
}
// Otherwise, omit the actual error message.
return `Error from start-proxy Action omitted (${error.constructor.name}).`;
}
/**
* Sends a status report for the `start-proxy` action indicating a failure.
*
* @param logger The logger to use.
* @param startedAt When the action was started.
* @param language The language provided as input, if any.
* @param unwrappedError The exception that was thrown.
*/
export async function sendFailedStatusReport(
logger: Logger,
startedAt: Date,
language: BuiltInLanguage | undefined,
unwrappedError: unknown,
) {
const error = util.wrapError(unwrappedError);
core.setFailed(`start-proxy action failed: ${error.message}`);
// To avoid the possibility of leaking sensitive information into the telemetry,
// we don't include arbitrary error messages. Instead, `getSafeErrorMessage` will
// return a generic message that includes the type of the error, unless it can decide
// that the message is safe to include.
const statusReportMessage = getSafeErrorMessage(error);
const errorStatusReportBase = await createStatusReportBase(
ActionName.StartProxy,
getActionsStatus(error),
startedAt,
{
languages: language === undefined ? undefined : [language],
},
await util.checkDiskUsage(logger),
logger,
statusReportMessage,
);
if (errorStatusReportBase !== undefined) {
await sendStatusReport(errorStatusReportBase);
}
}

2
src/status-report.ts
View File

@@ -378,7 +378,7 @@ export async function createStatusReportBase(
try {
const commitOid =
getOptionalInput("sha") || process.env["GITHUB_SHA"] || "";
const ref = await getRef();
const ref = await getRef(getEnv(), config?.repositoryRoot);
const jobRunUUID = process.env[EnvVar.JOB_RUN_UUID] || "";
const workflowRunID = getWorkflowRunID();
const workflowRunAttempt = getWorkflowRunAttempt();

41
src/testing-utils.ts
View File

@@ -163,6 +163,46 @@ export function setupTests(testFn: TestFn<any>) {
});
}
export interface AvaSinonAssertions {
/**
* Asserts that `stub` must have been called once with at least the `expected` arguments.
*/
onceWith: <TArgs extends readonly any[]>(
stub: sinon.SinonStub<TArgs>,
...expected: sinon.MatchPartialArguments<TArgs>
) => boolean;
}
/** Adds additional assertions for use with `sinon` to `t`. */
export function addSinonAssertions(
t: ExecutionContext<unknown>,
): ExecutionContext<unknown> & AvaSinonAssertions {
return {
...t,
onceWith: <TArgs extends readonly any[]>(
stub: sinon.SinonStub<TArgs>,
...expected: sinon.MatchPartialArguments<TArgs>
) => {
// Fail if the stub hasn't been called at all so that we can safely compare
// the arguments of the first call in the else branch.
if (stub.callCount === 0) {
t.fail("The stub wasn't called.");
} else {
// Reduce the arguments of each to the same number that was provided,
// so that extra arguments don't lead to a failure.
const actual = stub.args.map<sinon.MatchPartialArguments<TArgs>>(
(args: TArgs) =>
args.slice(
0,
expected.length,
) as sinon.MatchPartialArguments<TArgs>,
);
return t.deepEqual(actual, [expected]);
}
},
};
}
/**
* Declare a reusable test implementation, with better type safety than `test.macro`.
*/
@@ -966,6 +1006,7 @@ export function createTestConfig(overrides: Partial<Config>): Config {
{},
{
version: getActionVersion(),
repositoryRoot: undefined,
analysisKinds: [AnalysisKind.CodeScanning],
languages: [],
buildMode: undefined,

1
src/trap-caching.test.ts
View File

@@ -182,6 +182,7 @@ test.serial(
stubCodeql,
[BuiltInLanguage.javascript, BuiltInLanguage.cpp],
logger,
undefined,
);
t.assert(
stubRestore.calledOnceWith(

19
src/trap-caching.ts
View File

@@ -14,6 +14,7 @@ import { Language } from "./languages";
import { Logger } from "./logging";
import {
asHTTPError,
getEnv,
getErrorMessage,
tryGetFolderBytes,
waitForResultWithTimeLimit,
@@ -43,6 +44,7 @@ const MAX_CACHE_OPERATION_MS = 120_000; // Two minutes
* @param codeql The CodeQL instance to use.
* @param languages The languages being analyzed.
* @param logger A logger to record some informational messages to.
* @param repositoryRoot The path at which the repository is checked out at.
* @returns A partial map from languages to TRAP cache paths on disk, with
* languages for which we shouldn't use TRAP caching omitted.
*/
@@ -50,6 +52,7 @@ export async function downloadTrapCaches(
codeql: CodeQL,
languages: Language[],
logger: Logger,
repositoryRoot: string | undefined,
): Promise<{ [language: string]: string }> {
const result: { [language: string]: string } = {};
const languagesSupportingCaching = await getLanguagesSupportingCaching(
@@ -72,7 +75,7 @@ export async function downloadTrapCaches(
result[language] = cacheDir;
}
if (await gitUtils.isAnalyzingDefaultBranch()) {
if (await gitUtils.isAnalyzingDefaultBranch(getEnv(), repositoryRoot)) {
logger.info(
"Analyzing default branch. Skipping downloading of TRAP caches.",
);
@@ -99,6 +102,7 @@ export async function downloadTrapCaches(
const found = await waitForResultWithTimeLimit(
MAX_CACHE_OPERATION_MS,
actionsCache.restoreCache([cacheDir], preferredKey, [
preferredKey,
// Fall back to any cache with the right key prefix
await cachePrefix(codeql, language),
]),
@@ -132,7 +136,12 @@ export async function uploadTrapCaches(
config: Config,
logger: Logger,
): Promise<boolean> {
if (!(await gitUtils.isAnalyzingDefaultBranch())) return false; // Only upload caches from the default branch
// Only upload caches from the default branch
if (
!(await gitUtils.isAnalyzingDefaultBranch(getEnv(), config.repositoryRoot))
) {
return false;
}
for (const language of config.languages) {
const cacheDir = config.trapCaches[language];
@@ -180,6 +189,8 @@ export async function cleanupTrapCaches(
features: FeatureEnablement,
logger: Logger,
): Promise<TrapCacheCleanupStatusReport> {
const env = getEnv();
if (!(await features.getValue(Feature.CleanupTrapCaches))) {
return {
trap_cache_cleanup_skipped_because: "feature disabled",
@@ -189,7 +200,7 @@ export async function cleanupTrapCaches(
"TRAP cache cleanup is deprecated and will be removed in May 2026. " +
"We recommend instead disabling TRAP caching by passing the `trap-caching: false` input to the `init` Action.",
);
if (!(await gitUtils.isAnalyzingDefaultBranch())) {
if (!(await gitUtils.isAnalyzingDefaultBranch(env, config.repositoryRoot))) {
return {
trap_cache_cleanup_skipped_because: "not analyzing default branch",
};
@@ -200,7 +211,7 @@ export async function cleanupTrapCaches(
const allCaches = await apiClient.listActionsCaches(
CODEQL_TRAP_CACHE_PREFIX,
await gitUtils.getRef(),
await gitUtils.getRef(env, config.repositoryRoot),
);
for (const language of config.languages) {

9
src/upload-lib.ts
View File

@@ -14,7 +14,7 @@ import { getGitHubVersion, wrapApiConfigurationError } from "./api-client";
import { CodeQL, getCodeQL } from "./codeql";
import { getConfig } from "./config-utils";
import { readDiffRangesJsonFile } from "./diff-informed-analysis-utils";
import { EnvVar, exportEnvVar } from "./environment";
import { ActionsEnvVars, EnvVar, exportEnvVar } from "./environment";
import { FeatureEnablement } from "./feature-flags";
import * as fingerprints from "./fingerprints";
import * as gitUtils from "./git-utils";
@@ -767,12 +767,13 @@ export async function uploadPostProcessedFiles(
const zippedSarif = zlib.gzipSync(sarifPayload).toString("base64");
const checkoutURI = url.pathToFileURL(checkoutPath).href;
const env = util.getEnv();
const payload = uploadTarget.transformPayload(
buildPayload(
await gitUtils.getCommitOid(checkoutPath),
await gitUtils.getRef(),
await gitUtils.getCommitOid(env, checkoutPath),
await gitUtils.getRef(env, checkoutPath),
postProcessingResults.analysisKey,
util.getRequiredEnvParam("GITHUB_WORKFLOW"),
env.getRequired(ActionsEnvVars.GITHUB_WORKFLOW),
zippedSarif,
actionsUtil.getWorkflowRunID(),
actionsUtil.getWorkflowRunAttempt(),

19
src/util.ts
View File

@@ -20,6 +20,8 @@ import {
getRequiredEnvParam,
isInTestMode,
exportEnvVar,
getEnv,
type Env,
} from "./environment";
import * as json from "./json";
import { Language } from "./languages";
@@ -45,10 +47,13 @@ const BASE_DATABASE_OIDS_FILE_NAME = "base-database-oids.json";
*/
const BROKEN_VERSIONS = ["0.0.0-20211207"];
/** A string representing a GitHub instance. */
export type InstanceURL = string;
/**
* The URL for github.com.
*/
export const GITHUB_DOTCOM_URL = "https://github.com";
export const GITHUB_DOTCOM_URL: InstanceURL = "https://github.com";
/**
* Default name of the debugging artifact.
@@ -599,12 +604,12 @@ export function assertNever(value: never): never {
* Set some initial environment variables that we can set even without
* knowing what version of CodeQL we're running.
*/
export function initializeEnvironment(version: string) {
exportEnvVar(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
exportEnvVar(EnvVar.FEATURE_SANDWICH, "false");
exportEnvVar(EnvVar.FEATURE_SARIF_COMBINE, "true");
exportEnvVar(EnvVar.FEATURE_WILL_UPLOAD, "true");
exportEnvVar(EnvVar.VERSION, version);
export function initializeEnvironment(version: string, env: Env = getEnv()) {
env.export(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
env.export(EnvVar.FEATURE_SANDWICH, "false");
env.export(EnvVar.FEATURE_SARIF_COMBINE, "true");
env.export(EnvVar.FEATURE_WILL_UPLOAD, "true");
env.export(EnvVar.VERSION, version);
}
export class HTTPError extends Error {

125
src/workflow.test.ts
View File

@@ -4,10 +4,12 @@ import * as sinon from "sinon";
import * as actionsUtil from "./actions-util";
import { createStubCodeQL, getCodeQLForTesting } from "./codeql";
import { EnvVar } from "./environment";
import { ActionsEnvVars, EnvVar } from "./environment";
import {
checkExpectedLogMessages,
createTestConfig,
getRecordingLogger,
getTestEnv,
LoggedMessage,
setupTests,
} from "./testing-utils";
@@ -1002,3 +1004,124 @@ test.serial(
t.is(messages.length, 0);
},
);
test("getRepositoryRootOrThrow - gets root from config", async (t) => {
const expectedRoot = "/path/to/root";
const repositoryRoot = workflow.getRepositoryRootOrThrow(
{},
"testJob",
{},
createTestConfig({ repositoryRoot: expectedRoot }),
getTestEnv(),
);
t.is(repositoryRoot, expectedRoot);
});
test("getRepositoryRootOrThrow - gets root from workflow", async (t) => {
const expectedRoot = "/path/to/root";
const repositoryRoot = workflow.getRepositoryRootOrThrow(
{
jobs: {
testJob: {
steps: [
{
uses: "github/codeql-action/analyze",
with: { checkout_path: expectedRoot },
},
],
},
},
},
"testJob",
{},
createTestConfig({}),
getTestEnv(),
);
t.is(repositoryRoot, expectedRoot);
});
test("getRepositoryRootOrThrow - gets root from environment", async (t) => {
const expectedRoot = "/path/to/root";
const repositoryRoot = workflow.getRepositoryRootOrThrow(
{
jobs: { testJob: { steps: [{ uses: "github/codeql-action/analyze" }] } },
},
"testJob",
{},
createTestConfig({}),
getTestEnv({ [ActionsEnvVars.GITHUB_WORKSPACE]: expectedRoot }),
);
t.is(repositoryRoot, expectedRoot);
});
test("getRepositoryRootOrThrow - throws if there's no matching job", async (t) => {
t.throws(
() =>
workflow.getRepositoryRootOrThrow(
{
jobs: {
otherJob: {
steps: [
{
uses: "github/codeql-action/analyze",
with: { checkout_path: "/some/path" },
},
],
},
},
},
"testJob",
{},
createTestConfig({}),
getTestEnv(),
),
{ message: /since the workflow has no job named testJob./ },
);
});
test("getRepositoryRootOrThrow - throws if there's no analyze step", async (t) => {
t.throws(
() =>
workflow.getRepositoryRootOrThrow(
{
jobs: {
testJob: { steps: [] },
},
},
"testJob",
{},
createTestConfig({}),
getTestEnv(),
),
{ message: /since the testJob job does not call/ },
);
});
test("getRepositoryRootOrThrow - throws if the env var is not set", async (t) => {
t.throws(
() =>
workflow.getRepositoryRootOrThrow(
{
jobs: {
testJob: {
steps: [
{
uses: "github/codeql-action/analyze",
},
],
},
},
},
"testJob",
{},
createTestConfig({}),
getTestEnv(),
),
{
message: `${ActionsEnvVars.GITHUB_WORKSPACE} environment variable must be set`,
},
);
});

33
src/workflow.ts
View File

@@ -8,7 +8,8 @@ import * as yaml from "js-yaml";
import { isDynamicWorkflow } from "./actions-util";
import * as api from "./api-client";
import { CodeQL } from "./codeql";
import { EnvVar } from "./environment";
import type { Config } from "./config-utils";
import { ActionsEnvVars, EnvVar, getEnv, ReadOnlyEnv } from "./environment";
import { Logger } from "./logging";
import {
getRequiredEnvParam,
@@ -441,27 +442,45 @@ export function getUploadInputOrThrow(
}
/**
* Makes a best effort attempt to retrieve the checkout_path input for the
* particular job, given a set of matrix variables.
* Makes a best effort attempt to determine the root path of the repository that the analysis
* relates to. We need that to make paths in SARIF files relative.
*
* - If available, we take the `repositoryRoot` from the `config`.
* - If it isn't, we fall back to trying to extract a `checkout_path` input from the `workflow`.
* - Finally, we fall back to the value of `GITHUB_WORKSPACE`.
*
* Typically you'll want to wrap this function in a try/catch block and handle the error.
*
* @returns the checkout_path input
* @throws an error if the checkout_path input could not be determined
* @param workflow The workflow specification of the currently running workflow.
* @param jobName The name of the job that is currently running.
* @param matrixVars The matrix variables, if any.
* @param config The CodeQL Action configuration state.
* @param env The environment variables.
*
* @returns The repository root path, or its best approximation.
* @throws `Error` if the repository root could not be determined.
*/
export function getCheckoutPathInputOrThrow(
export function getRepositoryRootOrThrow(
workflow: Workflow,
jobName: string,
matrixVars: { [key: string]: string } | undefined,
config: Partial<Config>,
env: ReadOnlyEnv = getEnv(),
): string {
return (
// If the CodeQL Action already has a persisted repository root, then we can just use that.
config.repositoryRoot ??
// Otherwise, try to retrieve it from a `checkout_path` input in the workflow specification.
getInputOrThrow(
workflow,
jobName,
getAnalyzeActionName(),
"checkout_path",
matrixVars,
) || getRequiredEnvParam("GITHUB_WORKSPACE") // if unspecified, checkout_path defaults to ${{ github.workspace }}
) ??
// Finally, if all of the above fail, just use the value of `GITHUB_WORKSPACE` since that
// is what is used by default.
env.getRequired(ActionsEnvVars.GITHUB_WORKSPACE)
);
}