Test workflow with feature flag and hardcoded in single DB

.github/check-sarif/action.yml

@@ -1,20 +0,0 @@
-name: Check SARIF
-description: Checks a SARIF file to see if certain queries were run and others were not run.
-inputs:
-  sarif-file:
-    required: true
-    description: The SARIF file to check
-
-  queries-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should be included in this SARIF file.
-
-  queries-not-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should NOT be included in this SARIF file.
-
-runs:
-  using: node12
-  main: index.js

.github/check-sarif/index.js

@@ -1,43 +0,0 @@
-'use strict'
-
-const core = require('@actions/core')
-const fs = require('fs')
-
-const sarif = JSON.parse(fs.readFileSync(core.getInput('sarif-file'), 'utf8'))
-const rules = sarif.runs[0].tool.extensions.flatMap(ext => ext.rules || [])
-const ruleIds = rules.map(rule => rule.id)
-
-// Check that all the expected queries ran
-const expectedQueriesRun = getQueryIdsInput('queries-run')
-const queriesThatShouldHaveRunButDidNot = expectedQueriesRun.filter(queryId => !ruleIds.includes(queryId))
-
-if (queriesThatShouldHaveRunButDidNot.length > 0) {
-  core.setFailed(`The following queries were expected to run but did not: ${queriesThatShouldHaveRunButDidNot.join(', ')}`)
-}
-
-// Check that all the unexpected queries did not run
-const expectedQueriesNotRun = getQueryIdsInput('queries-not-run')
-
-const queriesThatShouldNotHaveRunButDid = expectedQueriesNotRun.filter(queryId => ruleIds.includes(queryId))
-
-if (queriesThatShouldNotHaveRunButDid.length > 0) {
-  core.setFailed(`The following queries were NOT expected to have run but did: ${queriesThatShouldNotHaveRunButDid.join(', ')}`)
-}
-
-
-core.startGroup('All queries run')
-rules.forEach(rule => {
-  core.info(`${rule.id}: ${(rule.properties && rule.properties.name) || rule.name}`)
-})
-core.endGroup()
-
-core.startGroup('Full SARIF')
-core.info(JSON.stringify(sarif, null, 2))
-core.endGroup()
-
-function getQueryIdsInput(name) {
-  return core.getInput(name)
-    .split(',')
-    .map(q => q.trim())
-    .filter(q => q.length > 0)
-}

.github/query-filter-test/action.yml

@@ -1,52 +0,0 @@
-name: Query Filter Test
-description: Runs a test of query filters using the check sarif action
-inputs:
-  sarif-file:
-    required: true
-    description: The SARIF file to check
-
-  queries-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should be included in this SARIF file.
-
-  queries-not-run:
-    required: true
-    description: |
-      Comma separated list of query ids that should NOT be included in this SARIF file.
-
-  config-file:
-    required: true
-    description: |
-      The location of the codeql configuration file to use.
-
-  tools:
-    required: true
-    description: |
-      The url of codeql to use.
-
-runs:
-  using: composite
-  steps:
-    - uses: ./../action/init
-      with:
-        languages: javascript
-        config-file: ${{ inputs.config-file }}
-        tools: ${{ inputs.tools }}
-        db-location: ${{ runner.temp }}/query-filter-test
-    - uses: ./../action/analyze
-      with:
-        output: ${{ runner.temp }}/results
-        upload-database: false
-        upload: false
-      env:
-        TEST_MODE: "true"
-    - name: Check SARIF
-      uses: ./../action/.github/check-sarif
-      with:
-        sarif-file:  ${{ inputs.sarif-file }}
-        queries-run: ${{ inputs.queries-run}}
-        queries-not-run: ${{ inputs.queries-not-run}}
-    - name: Cleanup after test
-      shell: bash
-      run: rm -rf "$RUNNER_TEMP/results" "$RUNNER_TEMP//query-filter-test"

.github/workflows/__debug-artifacts.yml

@@ -13,6 +13,7 @@ on:
     - main
     - releases/v1
     - releases/v2
+    - edoardo/test-workflow
   pull_request:
     types:
     - opened
@@ -25,30 +26,8 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20210308
-        - os: macos-latest
-          version: stable-20210308
-        - os: ubuntu-latest
-          version: stable-20210319
-        - os: macos-latest
-          version: stable-20210319
-        - os: ubuntu-latest
-          version: stable-20210809
-        - os: macos-latest
-          version: stable-20210809
-        - os: ubuntu-latest
-          version: cached
-        - os: macos-latest
-          version: cached
-        - os: ubuntu-latest
-          version: latest
         - os: macos-latest
           version: latest
-        - os: ubuntu-latest
-          version: nightly-latest
-        - os: macos-latest
-          version: nightly-latest
     name: Debug artifact upload
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
@@ -63,34 +42,17 @@ jobs:
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}
-        debug: true
-        debug-artifact-name: my-debug-artifacts
-        debug-database-name: my-db
+        languages: csharp, go
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
       id: analysis
-    - uses: actions/download-artifact@v3
+      timeout-minutes: 1
+      env:
+        SEMMLE_DEBUG_TRACER: 10000
+    - uses: actions/upload-artifact@v3
+      if: always()
       with:
-        name: my-debug-artifacts-${{ matrix.os }}-${{ matrix.version }}
-    - shell: bash
-      run: |
-        LANGUAGES="cpp csharp go java javascript python"
-        for language in $LANGUAGES; do
-          echo "Checking $language"
-          if [[ ! -f "$language.sarif" ]] ; then
-            echo "Missing a SARIF file for $language"
-            exit 1
-          fi
-          if [[ ! -f "my-db-$language.zip" ]] ; then
-            echo "Missing a database bundle for $language"
-            exit 1
-          fi
-          if [[ ! -d "$language/log" ]] ; then
-            echo "Missing logs for $language"
-            exit 1
-          fi
-        done
-    env:
-      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true
+        name: debug-artifact-log
+        path: /Users/runner/work/_temp/codeql_databases/

.github/workflows/expected-queries-runs.yml

@@ -1,49 +0,0 @@
-name: Expected queries runs
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-on:
-  push:
-    branches:
-    - main
-    - releases/v1
-    - releases/v2
-  pull_request:
-    types:
-    - opened
-    - synchronize
-    - reopened
-    - ready_for_review
-  workflow_dispatch: {}
-
-jobs:
-  expected-queries:
-    name: Expected Queries Tests
-    timeout-minutes: 45
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v3
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/prepare-test
-      with:
-        version: latest
-    - uses: ./../action/init
-      with:
-        languages: javascript
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - uses: ./../action/analyze
-      with:
-        output: ${{ runner.temp }}/results
-        upload-database: false
-        upload: false
-      env:
-        TEST_MODE: true
-
-    - name: Check Sarif
-      uses: ./../action/.github/check-sarif
-      with:
-        sarif-file: ${{ runner.temp }}/results/javascript.sarif
-        queries-run: js/incomplete-hostname-regexp,js/path-injection
-        queries-not-run: foo,bar

.github/workflows/script/update-required-checks.sh

@@ -21,7 +21,7 @@ fi
 echo "Getting checks for $GITHUB_SHA"
 
 # Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
-CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") or contains("update") | not)] | unique | sort')"
+CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") | not)] | sort')"
 
 echo "$CHECKS" | jq
 

CHANGELOG.md

@@ -2,10 +2,6 @@
 
 ## [UNRELEASED]
 
-No user facing changes.
-
-## 2.1.13 - 21 Jun 2022
-
 - Update default CodeQL bundle version to 2.9.4. [#1100](https://github.com/github/codeql-action/pull/1100)
 
 ## 2.1.12 - 01 Jun 2022

lib/api-compatibility.json

@@ -1 +1 @@
-{ "maximumVersion": "3.6", "minimumVersion": "3.2" }
+{ "maximumVersion": "3.5", "minimumVersion": "3.1" }

lib/codeql.js

@@ -77,7 +77,7 @@ const CODEQL_VERSION_SARIF_GROUP = "2.5.3";
 exports.CODEQL_VERSION_COUNTS_LINES = "2.6.2";
 const CODEQL_VERSION_CUSTOM_QUERY_HELP = "2.7.1";
 exports.CODEQL_VERSION_ML_POWERED_QUERIES = "2.7.5";
-const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.10.0";
+const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.9.3";
 /**
  * This variable controls using the new style of tracing from the CodeQL
  * CLI. In particular, with versions above this we will use both indirect
@@ -538,6 +538,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 "database",
                 "trace-command",
                 ...getExtraOptionsFromEnv(["database", "trace-command"]),
+                "--internal-use-lua-tracing",
                 databasePath,
                 "--",
                 traceCommand,

lib/config-utils.test.js

@@ -925,10 +925,4 @@ const mlPoweredQueriesMacro = ava_1.default.macro({
 (0, ava_1.default)(mlPoweredQueriesMacro, "2.9.0", true, undefined, "security-and-quality", "~0.2.0");
 // Test that we don't inject an ML-powered query pack if the user has already specified one.
 (0, ava_1.default)(mlPoweredQueriesMacro, "2.9.0", true, "codeql/javascript-experimental-atm-queries@0.0.1", "security-and-quality", "0.0.1");
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL
-// CLI 2.9.3+.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.3", true, undefined, "security-extended", "~0.3.0");
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.9.3+.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.3", true, undefined, "security-and-quality", "~0.3.0");
 //# sourceMappingURL=config-utils.test.js.map

lib/util.js

@@ -552,17 +552,10 @@ exports.ML_POWERED_JS_QUERIES_PACK_NAME = "codeql/javascript-experimental-atm-qu
  * queries beta.
  */
 async function getMlPoweredJsQueriesPack(codeQL) {
-    let version;
-    if (await codeQlVersionAbove(codeQL, "2.9.3")) {
-        version = `~0.3.0`;
+    if (await codeQlVersionAbove(codeQL, "2.8.4")) {
+        return `${exports.ML_POWERED_JS_QUERIES_PACK_NAME}@~0.2.0`;
     }
-    else if (await codeQlVersionAbove(codeQL, "2.8.4")) {
-        version = `~0.2.0`;
-    }
-    else {
-        version = `~0.1.0`;
-    }
-    return `${exports.ML_POWERED_JS_QUERIES_PACK_NAME}@${version}`;
+    return `${exports.ML_POWERED_JS_QUERIES_PACK_NAME}@~0.1.0`;
 }
 exports.getMlPoweredJsQueriesPack = getMlPoweredJsQueriesPack;
 /**

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.1.14",
+  "version": "2.1.13",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.1.14",
+  "version": "2.1.13",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.1.14",
+      "version": "2.1.13",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.0.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.1.14",
+  "version": "2.1.13",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

src/api-compatibility.json

@@ -1 +1 @@
-{"maximumVersion": "3.6", "minimumVersion": "3.2"}
+{"maximumVersion": "3.5", "minimumVersion": "3.1"}

src/codeql.ts

@@ -222,7 +222,7 @@ const CODEQL_VERSION_SARIF_GROUP = "2.5.3";
 export const CODEQL_VERSION_COUNTS_LINES = "2.6.2";
 const CODEQL_VERSION_CUSTOM_QUERY_HELP = "2.7.1";
 export const CODEQL_VERSION_ML_POWERED_QUERIES = "2.7.5";
-const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.10.0";
+const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.9.3";
 
 /**
  * This variable controls using the new style of tracing from the CodeQL
@@ -829,6 +829,7 @@ async function getCodeQLForCmd(
           "database",
           "trace-command",
           ...getExtraOptionsFromEnv(["database", "trace-command"]),
+          "--internal-use-lua-tracing",
           databasePath,
           "--",
           traceCommand,

src/config-utils.test.ts

@@ -1865,23 +1865,3 @@ test(
   "security-and-quality",
   "0.0.1"
 );
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL
-// CLI 2.9.3+.
-test(
-  mlPoweredQueriesMacro,
-  "2.9.3",
-  true,
-  undefined,
-  "security-extended",
-  "~0.3.0"
-);
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.9.3+.
-test(
-  mlPoweredQueriesMacro,
-  "2.9.3",
-  true,
-  undefined,
-  "security-and-quality",
-  "~0.3.0"
-);

src/util.ts

@@ -664,15 +664,10 @@ export const ML_POWERED_JS_QUERIES_PACK_NAME =
 export async function getMlPoweredJsQueriesPack(
   codeQL: CodeQL
 ): Promise<string> {
-  let version;
-  if (await codeQlVersionAbove(codeQL, "2.9.3")) {
-    version = `~0.3.0`;
-  } else if (await codeQlVersionAbove(codeQL, "2.8.4")) {
-    version = `~0.2.0`;
-  } else {
-    version = `~0.1.0`;
+  if (await codeQlVersionAbove(codeQL, "2.8.4")) {
+    return `${ML_POWERED_JS_QUERIES_PACK_NAME}@~0.2.0`;
   }
-  return `${ML_POWERED_JS_QUERIES_PACK_NAME}@${version}`;
+  return `${ML_POWERED_JS_QUERIES_PACK_NAME}@~0.1.0`;
 }
 
 /**