Add threat-models as a property to config file and inputs

There's a lot of changes here, but it's pretty formulaic. It follows the
approach used by the `queries` input and config property.
`threat-models` can appear as an input or in the config file. If it
appears in the input, then we need to either merge it with the
threat-models in the config (if prefixed with `+`) or overwrite it.

There's no danger if someone uses `threat-models` with an older CLI
since the CLI can handle configs with extra properties.

.github/actions/setup-swift/action.yml

@@ -1,18 +1,18 @@
 name: "Set up Swift"
-description: Performs necessary steps to set up appropriate Swift version.
+description: Sets up an appropriate Swift version if Swift is enabled via CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT.
 inputs:
   codeql-path:
+    description: Path to the CodeQL CLI executable.
     required: true
 runs:
   using: "composite"
   steps:
     - name: Get Swift version
       id: get_swift_version
-      # We don't support Swift on Windows or prior versions of CLI.
-      if: "(runner.os != 'Windows') && (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
+      if: env.CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT == 'true'
       shell: bash
       env: 
-        CODEQL_PATH: ${{inputs.codeql-path}}
+        CODEQL_PATH: ${{ inputs.codeql-path }}
       run: |
         if [ $RUNNER_OS = "macOS" ]; then
           PLATFORM="osx64"
@@ -27,6 +27,6 @@ runs:
         fi
         echo "version=$VERSION" | tee -a $GITHUB_OUTPUT
     - uses: swift-actions/setup-swift@65540b95f51493d65f5e59e97dcef9629ddf11bf # Please update the corresponding SHA in the CLI's CodeQL Action Integration Test.
-      if: "(runner.os != 'Windows') && (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
+      if: env.CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT == 'true'
       with:
-        swift-version: "${{steps.get_swift_version.outputs.version}}"
+        swift-version: "${{ steps.get_swift_version.outputs.version }}"

.github/actions/update-bundle/index.ts

@@ -13,57 +13,55 @@ interface Defaults {
   priorCliVersion: string;
 }
 
-const CODEQL_BUNDLE_PREFIX = 'codeql-bundle-';
-
 function getCodeQLCliVersionForRelease(release): string {
   // We do not currently tag CodeQL bundles based on the CLI version they contain.
   // Instead, we use a marker file `cli-version-<version>.txt` to record the CLI version.
   // This marker file is uploaded as a release asset for all new CodeQL bundles.
   const cliVersionsFromMarkerFiles = release.assets
-  .map((asset) => asset.name.match(/cli-version-(.*)\.txt/)?.[1])
-  .filter((v) => v)
-  .map((v) => v as string);
+    .map((asset) => asset.name.match(/cli-version-(.*)\.txt/)?.[1])
+    .filter((v) => v)
+    .map((v) => v as string);
   if (cliVersionsFromMarkerFiles.length > 1) {
     throw new Error(
       `Release ${release.tag_name} has multiple CLI version marker files.`
-      );
-    } else if (cliVersionsFromMarkerFiles.length === 0) {
-      throw new Error(
-        `Failed to find the CodeQL CLI version for release ${release.tag_name}.`
-        );
-      }
-      return cliVersionsFromMarkerFiles[0];
-    }
+    );
+  } else if (cliVersionsFromMarkerFiles.length === 0) {
+    throw new Error(
+      `Failed to find the CodeQL CLI version for release ${release.tag_name}.`
+    );
+  }
+  return cliVersionsFromMarkerFiles[0];
+}
 
-    async function getBundleInfoFromRelease(release): Promise<BundleInfo> {
-      return {
-        bundleVersion: release.tag_name.substring(CODEQL_BUNDLE_PREFIX.length),
-        cliVersion: getCodeQLCliVersionForRelease(release)
-      };
-    }
+async function getBundleInfoFromRelease(release): Promise<BundleInfo> {
+  return {
+    bundleVersion: release.tag_name,
+    cliVersion: getCodeQLCliVersionForRelease(release)
+  };
+}
 
-    async function getNewDefaults(currentDefaults: Defaults): Promise<Defaults> {
-      const release = github.context.payload.release;
-      console.log('Updating default bundle as a result of the following release: ' +
-      `${JSON.stringify(release)}.`)
+async function getNewDefaults(currentDefaults: Defaults): Promise<Defaults> {
+  const release = github.context.payload.release;
+  console.log('Updating default bundle as a result of the following release: ' +
+    `${JSON.stringify(release)}.`)
 
-      const bundleInfo = await getBundleInfoFromRelease(release);
-      return {
-        bundleVersion: bundleInfo.bundleVersion,
-        cliVersion: bundleInfo.cliVersion,
-        priorBundleVersion: currentDefaults.bundleVersion,
-        priorCliVersion: currentDefaults.cliVersion
-      };
-    }
+  const bundleInfo = await getBundleInfoFromRelease(release);
+  return {
+    bundleVersion: bundleInfo.bundleVersion,
+    cliVersion: bundleInfo.cliVersion,
+    priorBundleVersion: currentDefaults.bundleVersion,
+    priorCliVersion: currentDefaults.cliVersion
+  };
+}
 
-    async function main() {
-      const previousDefaults: Defaults = JSON.parse(fs.readFileSync('../../../src/defaults.json', 'utf8'));
-      const newDefaults = await getNewDefaults(previousDefaults);
-      // Update the source file in the repository. Calling workflows should subsequently rebuild
-      // the Action to update `lib/defaults.json`.
-      fs.writeFileSync('../../../src/defaults.json', JSON.stringify(newDefaults, null, 2) + "\n");
-    }
+async function main() {
+  const previousDefaults: Defaults = JSON.parse(fs.readFileSync('../../../src/defaults.json', 'utf8'));
+  const newDefaults = await getNewDefaults(previousDefaults);
+  // Update the source file in the repository. Calling workflows should subsequently rebuild
+  // the Action to update `lib/defaults.json`.
+  fs.writeFileSync('../../../src/defaults.json', JSON.stringify(newDefaults, null, 2) + "\n");
+}
 
-    // Ideally, we'd await main() here, but that doesn't work well with `ts-node`.
-    // So instead we rely on the fact that Node won't exit until the event loop is empty.
-    main();
+// Ideally, we'd await main() here, but that doesn't work well with `ts-node`.
+// So instead we rely on the fact that Node won't exit until the event loop is empty.
+main();

.github/workflows/__analyze-ref-input.yml

@@ -25,24 +25,30 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: windows-2019
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
-        - os: windows-2019
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: windows-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: windows-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
+        - os: windows-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -72,11 +78,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__autobuild-action.yml

@@ -42,6 +42,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: csharp

.github/workflows/__config-export.yml

@@ -48,6 +48,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: javascript

.github/workflows/__diagnostics-export.yml

@@ -54,6 +54,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       id: init
       with:

.github/workflows/__export-file-baseline-information.yml

@@ -42,6 +42,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       id: init
       with:
@@ -70,7 +81,10 @@ jobs:
       shell: bash
       run: |
         cd "$RUNNER_TEMP/results"
-        expected_baseline_languages="cpp cs go java js py rb swift"
+        expected_baseline_languages="cpp cs go java js py rb"
+        if [[ $RUNNER_OS != "Windows" ]]; then
+          expected_baseline_languages+=" swift"
+        fi
 
         for lang in ${expected_baseline_languages}; do
           rule_name="${lang}/baseline/expected-extracted-files"
@@ -84,5 +98,4 @@ jobs:
           fi
         done
     env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: true # Remove when Swift is GA.
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__extractor-ram-threads.yml

@@ -38,6 +38,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: java

.github/workflows/__go-custom-queries.yml

@@ -25,24 +25,30 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: windows-2019
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
-        - os: windows-2019
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: windows-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: windows-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
+        - os: windows-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -72,11 +78,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -25,18 +25,22 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -60,11 +64,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -25,18 +25,22 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -60,11 +64,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -25,18 +25,22 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -60,11 +64,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__init-with-registries.yml

@@ -54,6 +54,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Init with registries
       uses: ./../action/init
       with:

.github/workflows/__javascript-source-root.yml

@@ -42,6 +42,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Move codeql-action
       shell: bash
       run: |

.github/workflows/__ml-powered-queries.yml

@@ -25,12 +25,30 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20220120
+        - os: ubuntu-latest
+          version: stable-20220401
         - os: macos-latest
-          version: stable-20220120
-        - os: windows-2019
-          version: stable-20220120
+          version: stable-20220401
+        - os: windows-latest
+          version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: windows-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: windows-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
+        - os: windows-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -60,11 +78,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: javascript
@@ -87,7 +111,7 @@ jobs:
     - name: Check sarif
       uses: ./../action/.github/actions/check-sarif
     # Running on Windows requires CodeQL CLI 2.9.0+.
-      if: "!(matrix.version == 'stable-20220120' && runner.os == 'Windows')"
+      if: "!(matrix.version == 'stable-20220401' && runner.os == 'Windows')"
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
         queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
@@ -96,7 +120,7 @@ jobs:
     - name: Check results
       env:
       # Running on Windows requires CodeQL CLI 2.9.0+.
-        SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220120' &&
+        SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220401' &&
           runner.os == 'Windows') }}
       shell: bash
       run: |

.github/workflows/__multi-language-autodetect.yml

@@ -25,18 +25,22 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -60,11 +64,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       id: init
       with:
@@ -73,7 +83,7 @@ jobs:
 
     - uses: ./../action/.github/actions/setup-swift
       with:
-        codeql-path: ${{steps.init.outputs.codeql-path}}
+        codeql-path: ${{ steps.init.outputs.codeql-path }}
 
     - name: Build code
       shell: bash
@@ -119,8 +129,7 @@ jobs:
         fi
 
     - name: Check language autodetect for Ruby
-      if: (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version
-        == 'nightly-latest')
+      if: env.CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT == 'true'
       shell: bash
       run: |
         RUBY_DB=${{ fromJson(steps.analysis.outputs.db-locations).ruby }}
@@ -130,8 +139,7 @@ jobs:
         fi
 
     - name: Check language autodetect for Swift
-      if: (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version
-        == 'nightly-latest')
+      if: env.CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT == 'true'
       shell: bash
       run: |
         SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
@@ -140,5 +148,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -54,6 +54,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging3.yml

.github/workflows/__packaging-config-inputs-js.yml

@@ -54,6 +54,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging3.yml

.github/workflows/__packaging-config-js.yml

@@ -54,6 +54,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging.yml

.github/workflows/__packaging-inputs-js.yml

@@ -54,6 +54,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging2.yml

.github/workflows/__remote-config.yml

@@ -25,24 +25,30 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: windows-2019
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
-        - os: windows-2019
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: windows-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: windows-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
+        - os: windows-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -72,11 +78,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__rubocop-multi-language.yml

@@ -38,6 +38,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

.github/workflows/__ruby.yml

@@ -48,6 +48,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: ruby

.github/workflows/__split-workflow.yml

@@ -48,6 +48,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging3.yml

.github/workflows/__submit-sarif-failure.yml

@@ -42,6 +42,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: actions/checkout@v3
     - uses: ./init
       with:

.github/workflows/__swift-custom-build.yml

@@ -48,6 +48,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       id: init
       with:
@@ -75,6 +86,5 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__test-autobuild-working-dir.yml

@@ -38,6 +38,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Test setup
       shell: bash
       run: |

.github/workflows/__test-local-codeql.yml

@@ -38,15 +38,30 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Fetch a CodeQL bundle
       shell: bash
       env:
         CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
       run: |
         wget "$CODEQL_URL"
-    - uses: ./../action/init
+    - id: init
+      uses: ./../action/init
       with:
         tools: ./codeql-bundle.tar.gz
+    - uses: ./../action/.github/actions/setup-swift
+      with:
+        codeql-path: ${{ steps.init.outputs.codeql-path }}
     - name: Build code
       shell: bash
       run: ./build.sh

.github/workflows/__test-proxy.yml

@@ -38,6 +38,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: javascript

.github/workflows/__unset-environment.yml

@@ -25,12 +25,14 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: ubuntu-latest
@@ -48,15 +50,25 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
+      id: init
       with:
         db-location: ${{ runner.temp }}/customDbLocation
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+    - uses: ./../action/.github/actions/setup-swift
+      with:
+        codeql-path: ${{ steps.init.outputs.codeql-path }}
     - name: Build code
       shell: bash
     # Disable Kotlin analysis while it's incompatible with Kotlin 1.8, until we find a

.github/workflows/__upload-ref-sha-input.yml

@@ -25,24 +25,30 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: windows-2019
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
-        - os: windows-2019
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: windows-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: windows-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
+        - os: windows-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -72,11 +78,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__with-checkout-path.yml

@@ -25,24 +25,30 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: windows-2019
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
-        - os: windows-2019
-          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
+        - os: ubuntu-latest
+          version: stable-20220615
+        - os: macos-latest
+          version: stable-20220615
+        - os: windows-latest
+          version: stable-20220615
+        - os: ubuntu-latest
+          version: stable-20220908
+        - os: macos-latest
+          version: stable-20220908
+        - os: windows-latest
+          version: stable-20220908
+        - os: ubuntu-latest
+          version: stable-20221211
+        - os: macos-latest
+          version: stable-20221211
+        - os: windows-latest
+          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -72,11 +78,17 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v4
-      with:
-        go-version: ^1.13.1
+    - name: Set environment variable for Swift enablement
+      if: >-
+        runner.os != 'Windows' && (
+            matrix.version == '20220908' ||
+            matrix.version == '20221211' ||
+            matrix.version == 'cached' ||
+            matrix.version == 'latest' ||
+            matrix.version == 'nightly-latest'
+        )
+      shell: bash
+      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: actions/checkout@v3
       with:
         ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6

.github/workflows/debug-artifacts.yml

@@ -21,31 +21,17 @@ jobs:
   upload-artifacts:
     strategy:
       matrix:
-        include:
-        - os: ubuntu-20.04
-          version: stable-20211005
-        - os: macos-latest
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: macos-latest
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
-        - os: ubuntu-latest
-          version: cached
-        - os: macos-latest
-          version: cached
-        - os: ubuntu-latest
-          version: latest
-        - os: macos-latest
-          version: latest
-        - os: ubuntu-latest
-          version: nightly-latest
-        - os: macos-latest
-          version: nightly-latest
+        os:
+        - ubuntu-latest
+        - macos-latest
+        version:
+        - stable-20220401
+        - stable-20220615
+        - stable-20220908
+        - stable-20221211
+        - cached
+        - latest
+        - nightly-latest
     name: Upload debug artifacts
     env:
       CODEQL_ACTION_TEST_MODE: true
@@ -84,17 +70,10 @@ jobs:
       - name: Check expected artifacts exist
         shell: bash
         run: |
-          VERSIONS="stable-20211005 stable-20220120 stable-20220401 cached latest nightly-latest"
+          VERSIONS="stable-20220401 stable-20220615 stable-20220908 stable-20221211 cached latest nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
-            if [[ "$version" =~ stable-(20211005|20220120|20210809) ]]; then
-              # Note the absence of the period in "ubuntu-2004": this is present in the image name
-              # but not the artifact name
-              OPERATING_SYSTEMS="ubuntu-2004 macos-latest"
-            else
-              OPERATING_SYSTEMS="ubuntu-latest macos-latest"
-            fi
-            for os in $OPERATING_SYSTEMS; do
+            for os in ubuntu-latest macos-latest; do
               pushd "./my-debug-artifacts-$os-$version"
               echo "Artifacts from version $version on $os:"
               for language in $LANGUAGES; do

CHANGELOG.md

@@ -2,7 +2,8 @@
 
 ## [UNRELEASED]
 
-No user facing changes.
+- Update default CodeQL bundle version to 2.13.0. [#1649](https://github.com/github/codeql-action/pull/1649)
+- Bump the minimum CodeQL bundle version to 2.8.5. [#1618](https://github.com/github/codeql-action/pull/1618)
 
 ## 2.2.12 - 13 Apr 2023
 

init/action.yml

@@ -45,17 +45,22 @@ inputs:
     description: Path where CodeQL databases should be created. If not specified, a temporary directory will be used.
     required: false
   queries:
-    description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
+    description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to combine both sets of queries.
     required: false
   packs:
     description: >-
       [Experimental] Comma-separated list of packs to run. Reference a pack in the format `scope/name[@version]`. If `version` is not
       specified, then the latest version of the pack is used. By default, this overrides the same setting in a
-      configuration file; prefix with "+" to use both sets of packs.
+      configuration file; prefix with "+" to combine both sets of packs.
 
       This input is only available in single-language analyses. To use packs in multi-language
       analyses, you must specify packs in the codeql-config.yml file.
     required: false
+  threat-models:
+    description: >-
+      [Experimental] Comma-separated list of threat models to include in this analysis. By default, this overrides the same setting in a
+      configuration file; prefix with "+" to combine both sets of threat-models.
+    required: false
   external-repository-token:
     description: A token for fetching external config files and queries if they reside in a private repository in the same GitHub instance that is running this action.
     required: false

lib/analysis-paths.test.js

@@ -29,6 +29,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
 const analysisPaths = __importStar(require("./analysis-paths"));
+const config_utils_1 = require("./config-utils");
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
 (0, testing_utils_1.setupTests)(ava_1.default);
@@ -48,11 +49,7 @@ const util = __importStar(require("./util"));
             debugMode: false,
             debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
             debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-            augmentationProperties: {
-                injectedMlQueries: false,
-                packsInputCombines: false,
-                queriesInputCombines: false,
-            },
+            augmentationProperties: config_utils_1.defaultAugmentationProperties,
             trapCaches: {},
             trapCacheDownloadTime: 0,
         };
@@ -78,11 +75,7 @@ const util = __importStar(require("./util"));
             debugMode: false,
             debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
             debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-            augmentationProperties: {
-                injectedMlQueries: false,
-                packsInputCombines: false,
-                queriesInputCombines: false,
-            },
+            augmentationProperties: config_utils_1.defaultAugmentationProperties,
             trapCaches: {},
             trapCacheDownloadTime: 0,
         };
@@ -108,11 +101,7 @@ const util = __importStar(require("./util"));
         debugMode: false,
         debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
         debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-        augmentationProperties: {
-            injectedMlQueries: false,
-            packsInputCombines: false,
-            queriesInputCombines: false,
-        },
+        augmentationProperties: config_utils_1.defaultAugmentationProperties,
         trapCaches: {},
         trapCacheDownloadTime: 0,
     };

lib/analysis-paths.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AAEvB,gEAAkD;AAClD,mDAA6C;AAC7C,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;YACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACpD,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,sBAAsB,EAAE;gBACtB,iBAAiB,EAAE,KAAK;gBACxB,kBAAkB,EAAE,KAAK;gBACzB,oBAAoB,EAAE,KAAK;aAC5B;YACD,UAAU,EAAE,EAAE;YACd,qBAAqB,EAAE,CAAC;SACzB,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YACrC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3C,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;YACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACpD,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,sBAAsB,EAAE;gBACtB,iBAAiB,EAAE,KAAK;gBACxB,kBAAkB,EAAE,KAAK;gBACzB,oBAAoB,EAAE,KAAK;aAC5B;YACD,UAAU,EAAE,EAAE;YACd,qBAAqB,EAAE,CAAC;SACzB,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CACF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACjC,gGAAgG,CACjG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,EAAE;QACT,iBAAiB,EAAE,EAAE;QACrB,OAAO;QACP,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;QACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrD,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;QACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;QACnD,sBAAsB,EAAE;YACtB,iBAAiB,EAAE,KAAK;YACxB,kBAAkB,EAAE,KAAK;YACzB,oBAAoB,EAAE,KAAK;SAC5B;QACD,UAAU,EAAE,EAAE;QACd,qBAAqB,EAAE,CAAC;KACzB,CAAC;IACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC9D,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AAEvB,gEAAkD;AAClD,iDAA+D;AAC/D,mDAA6C;AAC7C,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;YACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACpD,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,sBAAsB,EAAE,4CAA6B;YACrD,UAAU,EAAE,EAAE;YACd,qBAAqB,EAAE,CAAC;SACzB,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YACrC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3C,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;YACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACpD,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,sBAAsB,EAAE,4CAA6B;YACrD,UAAU,EAAE,EAAE;YACd,qBAAqB,EAAE,CAAC;SACzB,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CACF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACjC,gGAAgG,CACjG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,EAAE;QACT,iBAAiB,EAAE,EAAE;QACrB,OAAO;QACP,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;QACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrD,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;QACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;QACnD,sBAAsB,EAAE,4CAA6B;QACrD,UAAU,EAAE,EAAE;QACd,qBAAqB,EAAE,CAAC;KACzB,CAAC;IACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC9D,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC"}

lib/analyze-action.js

@@ -155,7 +155,6 @@ async function run() {
         if (hasBadExpectErrorInput()) {
             throw new Error("`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork.");
         }
-        await (0, codeql_1.enrichEnvironment)(await (0, codeql_1.getCodeQL)(config.codeQLCmd));
         const apiDetails = (0, api_client_1.getApiDetails)();
         const outputDir = actionsUtil.getRequiredInput("output");
         const threads = util.getThreadsFlag(actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"], logger);

lib/analyze.js

@@ -37,7 +37,6 @@ const analysisPaths = __importStar(require("./analysis-paths"));
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
 const languages_1 = require("./languages");
-const sharedEnv = __importStar(require("./shared-environment"));
 const tracer_config_1 = require("./tracer-config");
 const util = __importStar(require("./util"));
 class CodeQLAnalysisError extends Error {
@@ -283,20 +282,13 @@ async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger) {
     }
     await fs.promises.mkdir(outputDir, { recursive: true });
     const timings = await finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger);
-    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     // WARNING: This does not _really_ end tracing, as the tracer will restore its
     // critical environment variables and it'll still be active for all processes
     // launched from this build step.
     // However, it will stop tracing for all steps past the codeql-action/analyze
     // step.
-    if (await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
-        // Delete variables as specified by the end-tracing script
-        await (0, tracer_config_1.endTracingForCluster)(config);
-    }
-    else {
-        // Delete the tracer config env var to avoid tracing ourselves
-        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
-    }
+    // Delete variables as specified by the end-tracing script
+    await (0, tracer_config_1.endTracingForCluster)(config);
     return timings;
 }
 exports.runFinalize = runFinalize;

lib/analyze.test.js

@@ -33,6 +33,7 @@ const yaml = __importStar(require("js-yaml"));
 const sinon = __importStar(require("sinon"));
 const analyze_1 = require("./analyze");
 const codeql_1 = require("./codeql");
+const config_utils_1 = require("./config-utils");
 const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
@@ -115,11 +116,7 @@ const util = __importStar(require("./util"));
                 debugMode: false,
                 debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
                 debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-                augmentationProperties: {
-                    injectedMlQueries: false,
-                    packsInputCombines: false,
-                    queriesInputCombines: false,
-                },
+                augmentationProperties: config_utils_1.defaultAugmentationProperties,
                 trapCaches: {},
                 trapCacheDownloadTime: 0,
             };
@@ -215,11 +212,7 @@ function createBaseConfig(tmpDir) {
         debugMode: false,
         debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
         debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-        augmentationProperties: {
-            injectedMlQueries: false,
-            packsInputCombines: false,
-            queriesInputCombines: false,
-        },
+        augmentationProperties: config_utils_1.defaultAugmentationProperties,
         trapCaches: {},
         trapCacheDownloadTime: 0,
     };

lib/codeql.js

@@ -23,10 +23,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.enrichEnvironment = exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = exports.CODEQL_VERSION_NEW_TRACING = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
+exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const yaml = __importStar(require("js-yaml"));
 const actions_util_1 = require("./actions-util");
@@ -35,7 +34,6 @@ const error_matcher_1 = require("./error-matcher");
 const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const setupCodeql = __importStar(require("./setup-codeql"));
-const shared_environment_1 = require("./shared-environment");
 const toolrunner_error_catcher_1 = require("./toolrunner-error-catcher");
 const trap_caching_1 = require("./trap-caching");
 const util = __importStar(require("./util"));
@@ -62,7 +60,7 @@ let cachedCodeQL = undefined;
  * The version flags below can be used to conditionally enable certain features
  * on versions newer than this.
  */
-const CODEQL_MINIMUM_VERSION = "2.6.3";
+const CODEQL_MINIMUM_VERSION = "2.8.5";
 /**
  * Versions of CodeQL that version-flag certain functionality in the Action.
  * For convenience, please keep these in descending order. Once a version
@@ -73,21 +71,6 @@ const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.10.0";
 const CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED = "2.10.4";
 exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = "2.10.4";
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
-/**
- * This variable controls using the new style of tracing from the CodeQL
- * CLI. In particular, with versions above this we will use both indirect
- * tracing, and multi-language tracing together with database clusters.
- *
- * Note that there were bugs in both of these features that were fixed in
- * release 2.7.0 of the CodeQL CLI, therefore this flag is only enabled for
- * versions above that.
- */
-exports.CODEQL_VERSION_NEW_TRACING = "2.7.0";
-/**
- * Versions 2.7.3+ of the CodeQL CLI support build tracing with glibc 2.34 on Linux. Versions before
- * this cannot perform build tracing when running on the Actions `ubuntu-22.04` runner image.
- */
-exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = "2.7.3";
 /**
  * Versions 2.9.0+ of the CodeQL CLI run machine learning models from a temporary directory, which
  * resolves an issue on Windows where TensorFlow models are not correctly loaded due to the path of
@@ -177,8 +160,6 @@ function setCodeQL(partialCodeql) {
         getPath: resolveFunction(partialCodeql, "getPath", () => "/tmp/dummy-path"),
         getVersion: resolveFunction(partialCodeql, "getVersion", () => new Promise((resolve) => resolve("1.0.0"))),
         printVersion: resolveFunction(partialCodeql, "printVersion"),
-        getTracerEnv: resolveFunction(partialCodeql, "getTracerEnv"),
-        databaseInit: resolveFunction(partialCodeql, "databaseInit"),
         databaseInitCluster: resolveFunction(partialCodeql, "databaseInitCluster"),
         runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),
         extractScannedLanguage: resolveFunction(partialCodeql, "extractScannedLanguage"),
@@ -245,73 +226,6 @@ async function getCodeQLForCmd(cmd, checkVersion) {
         async printVersion() {
             await runTool(cmd, ["version", "--format=json"]);
         },
-        async getTracerEnv(databasePath) {
-            // Write tracer-env.js to a temp location.
-            // BEWARE: The name and location of this file is recognized by `codeql database
-            // trace-command` in order to enable special support for concatenable tracer
-            // configurations. Consequently the name must not be changed.
-            // (This warning can be removed once a different way to recognize the
-            // action/runner has been implemented in `codeql database trace-command`
-            // _and_ is present in the latest supported CLI release.)
-            const tracerEnvJs = path.resolve(databasePath, "working", "tracer-env.js");
-            fs.mkdirSync(path.dirname(tracerEnvJs), { recursive: true });
-            fs.writeFileSync(tracerEnvJs, `
-        const fs = require('fs');
-        const env = {};
-        for (let entry of Object.entries(process.env)) {
-          const key = entry[0];
-          const value = entry[1];
-          if (typeof value !== 'undefined' && key !== '_' && !key.startsWith('JAVA_MAIN_CLASS_')) {
-            env[key] = value;
-          }
-        }
-        process.stdout.write(process.argv[2]);
-        fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');`);
-            // BEWARE: The name and location of this file is recognized by `codeql database
-            // trace-command` in order to enable special support for concatenable tracer
-            // configurations. Consequently the name must not be changed.
-            // (This warning can be removed once a different way to recognize the
-            // action/runner has been implemented in `codeql database trace-command`
-            // _and_ is present in the latest supported CLI release.)
-            const envFile = path.resolve(databasePath, "working", "env.tmp");
-            try {
-                await runTool(cmd, [
-                    "database",
-                    "trace-command",
-                    databasePath,
-                    ...getExtraOptionsFromEnv(["database", "trace-command"]),
-                    process.execPath,
-                    tracerEnvJs,
-                    envFile,
-                ]);
-            }
-            catch (e) {
-                if (e instanceof CommandInvocationError &&
-                    e.output.includes("undefined symbol: __libc_dlopen_mode, version GLIBC_PRIVATE") &&
-                    process.platform === "linux" &&
-                    !(await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_TRACING_GLIBC_2_34))) {
-                    throw new util.UserError("The CodeQL CLI is incompatible with the version of glibc on your system. " +
-                        `Please upgrade to CodeQL CLI version ${exports.CODEQL_VERSION_TRACING_GLIBC_2_34} or ` +
-                        "later. If you cannot upgrade to a newer version of the CodeQL CLI, you can " +
-                        `alternatively run your workflow on another runner image such as "ubuntu-20.04" ` +
-                        "that has glibc 2.33 or earlier installed.");
-                }
-                else {
-                    throw e;
-                }
-            }
-            return JSON.parse(fs.readFileSync(envFile, "utf-8"));
-        },
-        async databaseInit(databasePath, language, sourceRoot) {
-            await runTool(cmd, [
-                "database",
-                "init",
-                databasePath,
-                `--language=${language}`,
-                `--source-root=${sourceRoot}`,
-                ...getExtraOptionsFromEnv(["database", "init"]),
-            ]);
-        },
         async databaseInitCluster(config, sourceRoot, processName, features, qlconfigFile, logger) {
             const extraArgs = config.languages.map((language) => `--language=${language}`);
             if (config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l)).length > 0) {
@@ -829,6 +743,23 @@ async function generateCodeScanningConfig(codeql, config, features, logger) {
             augmentedConfig.packs["javascript"].push(packString);
         }
     }
+    // Inject the threat-models from the input
+    if (config.augmentationProperties.threatModelsInput) {
+        if (config.augmentationProperties.threatModelsInputCombines) {
+            // threat-models input combines with threat-models from the config file
+            // (if any were defined).
+            augmentedConfig["threat-models"] = (augmentedConfig["threat-models"] || []).concat(config.augmentationProperties.threatModelsInput);
+        }
+        else {
+            // threat-models input overrides threat-models from the config file
+            augmentedConfig["threat-models"] =
+                config.augmentationProperties.threatModelsInput;
+        }
+    }
+    if (Array.isArray(augmentedConfig["threat-models"]) &&
+        !augmentedConfig["threat-models"].length) {
+        delete augmentedConfig["threat-models"];
+    }
     logger.info(`Writing augmented user configuration file to ${codeScanningConfigFile}`);
     logger.startGroup("Augmented user configuration file contents");
     logger.info(yaml.dump(augmentedConfig));
@@ -853,19 +784,4 @@ async function getCodeScanningConfigExportArguments(config, codeql, features) {
     }
     return [];
 }
-/**
- * Enrich the environment variables with further flags that we cannot
- * know the value of until we know what version of CodeQL we're running.
- */
-async function enrichEnvironment(codeql) {
-    if (await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_NEW_TRACING)) {
-        core.exportVariable(shared_environment_1.EnvVar.FEATURE_MULTI_LANGUAGE, "false");
-        core.exportVariable(shared_environment_1.EnvVar.FEATURE_SANDWICH, "false");
-    }
-    else {
-        core.exportVariable(shared_environment_1.EnvVar.FEATURE_MULTI_LANGUAGE, "true");
-        core.exportVariable(shared_environment_1.EnvVar.FEATURE_SANDWICH, "true");
-    }
-}
-exports.enrichEnvironment = enrichEnvironment;
 //# sourceMappingURL=codeql.js.map

lib/codeql.test.js

@@ -83,6 +83,7 @@ ava_1.default.beforeEach(() => {
         debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
         debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
         augmentationProperties: {
+            threatModelsInputCombines: false,
             injectedMlQueries: false,
             packsInputCombines: false,
             queriesInputCombines: false,
@@ -447,6 +448,7 @@ for (const isBundleVersionInUrl of [true, false]) {
             ...stubConfig,
             tempDir,
             augmentationProperties: {
+                threatModelsInputCombines: false,
                 injectedMlQueries: false,
                 queriesInputCombines: false,
                 packsInputCombines: false,
@@ -491,11 +493,13 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: false,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
 }, {}, {});
 (0, ava_1.default)("injected ML queries", injectedConfigMacro, {
     injectedMlQueries: true,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
 }, {}, {
     packs: ["codeql/javascript-experimental-atm-queries@~0.4.0"],
 });
@@ -503,6 +507,7 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: true,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
 }, {
     originalUserInput: {
         packs: { javascript: ["codeql/something-else"] },
@@ -519,6 +524,7 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: true,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
 }, {
     originalUserInput: {
         packs: { cpp: ["codeql/something-else"] },
@@ -534,6 +540,7 @@ const injectedConfigMacro = ava_1.default.macro({
     queriesInputCombines: false,
     packsInputCombines: false,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
 }, {}, {
     packs: ["xxx", "yyy"],
 });
@@ -542,6 +549,7 @@ const injectedConfigMacro = ava_1.default.macro({
     queriesInputCombines: false,
     packsInputCombines: true,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
 }, {
     originalUserInput: {
         packs: {
@@ -558,6 +566,7 @@ const injectedConfigMacro = ava_1.default.macro({
     queriesInputCombines: false,
     packsInputCombines: false,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
 }, {
     originalUserInput: {
         packs: {
@@ -572,6 +581,7 @@ const injectedConfigMacro = ava_1.default.macro({
     queriesInputCombines: false,
     packsInputCombines: false,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
 }, {
     originalUserInput: {
         packs: {
@@ -586,6 +596,7 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: false,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
 }, {}, {
     queries: [
@@ -601,6 +612,7 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: false,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
 }, {
     originalUserInput: {
@@ -620,6 +632,7 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: false,
     queriesInputCombines: true,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
 }, {
     originalUserInput: {
@@ -642,6 +655,7 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: false,
     queriesInputCombines: true,
     packsInputCombines: true,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
 }, {}, {
     queries: [
@@ -657,6 +671,7 @@ const injectedConfigMacro = ava_1.default.macro({
     injectedMlQueries: false,
     queriesInputCombines: true,
     packsInputCombines: true,
+    threatModelsInputCombines: false,
     queriesInput: [],
     packsInput: [],
 }, {
@@ -665,6 +680,50 @@ const injectedConfigMacro = ava_1.default.macro({
         queries: [],
     },
 }, {});
+(0, ava_1.default)("threat model from config", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    threatModelsInputCombines: false,
+    queriesInput: [],
+    packsInput: [],
+}, {
+    originalUserInput: {
+        "threat-models": ["a", "b"],
+    },
+}, {
+    "threat-models": ["a", "b"],
+});
+(0, ava_1.default)("threat model from input overrides config", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    threatModelsInputCombines: false,
+    threatModelsInput: ["a", "b"],
+    queriesInput: [],
+    packsInput: [],
+}, {
+    originalUserInput: {
+        "threat-models": ["c", "d"],
+    },
+}, {
+    "threat-models": ["a", "b"],
+});
+(0, ava_1.default)("threat model from input combines with config", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    threatModelsInputCombines: true,
+    threatModelsInput: ["a", "b"],
+    queriesInput: [],
+    packsInput: [],
+}, {
+    originalUserInput: {
+        "threat-models": ["c", "d"],
+    },
+}, {
+    "threat-models": ["c", "d", "a", "b"],
+});
 (0, ava_1.default)("does not pass a code scanning config or qlconfig file to the CLI when CLI config passing is disabled", async (t) => {
     await util.withTmpDir(async (tempDir) => {
         const runnerConstructorStub = stubToolRunnerConstructor();

lib/config-utils.js

@@ -51,9 +51,11 @@ const PACKS_PROPERTY = "packs";
 exports.defaultAugmentationProperties = {
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
     injectedMlQueries: false,
     packsInput: undefined,
     queriesInput: undefined,
+    threatModelsInput: undefined,
 };
 /**
  * A list of queries from https://github.com/github/codeql that
@@ -527,7 +529,7 @@ function shouldAddConfigFileQueries(queriesInput) {
 /**
  * Get the default config for when the user has not supplied one.
  */
-async function getDefaultConfig(languagesInput, rawQueriesInput, rawPacksInput, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
+async function getDefaultConfig(languagesInput, rawQueriesInput, rawPacksInput, rawThreatModelsInput, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
     const languages = await getLanguages(codeQL, languagesInput, repository, logger);
     const queries = {};
     for (const language of languages) {
@@ -537,7 +539,7 @@ async function getDefaultConfig(languagesInput, rawQueriesInput, rawPacksInput,
         };
     }
     await addDefaultQueries(codeQL, languages, queries);
-    const augmentationProperties = calculateAugmentation(rawPacksInput, rawQueriesInput, languages);
+    const augmentationProperties = calculateAugmentation(rawPacksInput, rawQueriesInput, rawThreatModelsInput, languages);
     const packs = augmentationProperties.packsInput
         ? {
             [languages[0]]: augmentationProperties.packsInput,
@@ -581,7 +583,7 @@ async function downloadCacheWithTime(trapCachingEnabled, codeQL, languages, logg
 /**
  * Load the config from the given file.
  */
-async function loadConfig(languagesInput, rawQueriesInput, rawPacksInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
+async function loadConfig(languagesInput, rawQueriesInput, rawPacksInput, rawThreatModelsInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
     let parsedYAML;
     if (isLocal(configFile)) {
         // Treat the config file as relative to the workspace
@@ -621,7 +623,7 @@ async function loadConfig(languagesInput, rawQueriesInput, rawPacksInput, config
     if (!disableDefaultQueries) {
         await addDefaultQueries(codeQL, languages, queries);
     }
-    const augmentationProperties = calculateAugmentation(rawPacksInput, rawQueriesInput, languages);
+    const augmentationProperties = calculateAugmentation(rawPacksInput, rawQueriesInput, rawThreatModelsInput, languages);
     const packs = parsePacks(parsedYAML[PACKS_PROPERTY] ?? {}, rawPacksInput, augmentationProperties.packsInputCombines, languages, configFile, logger);
     // If queries were provided using `with` in the action configuration,
     // they should take precedence over the queries in the config file
@@ -705,17 +707,21 @@ async function loadConfig(languagesInput, rawQueriesInput, rawPacksInput, config
  *     not have exactly one language.
  */
 // exported for testing.
-function calculateAugmentation(rawPacksInput, rawQueriesInput, languages) {
+function calculateAugmentation(rawPacksInput, rawQueriesInput, rawThreatModelsInput, languages) {
     const packsInputCombines = shouldCombine(rawPacksInput);
     const packsInput = parsePacksFromInput(rawPacksInput, languages, packsInputCombines);
     const queriesInputCombines = shouldCombine(rawQueriesInput);
     const queriesInput = parseQueriesFromInput(rawQueriesInput, queriesInputCombines);
+    const threatModelsInputCombines = shouldCombine(rawThreatModelsInput);
+    const threatModelsInput = parseThreatModelsFromInput(rawThreatModelsInput, threatModelsInputCombines);
     return {
         injectedMlQueries: false,
         packsInputCombines,
         packsInput: packsInput?.[languages[0]],
         queriesInput,
         queriesInputCombines,
+        threatModelsInputCombines,
+        threatModelsInput,
     };
 }
 exports.calculateAugmentation = calculateAugmentation;
@@ -801,6 +807,19 @@ function parsePacksFromInput(rawPacksInput, languages, packsInputCombines) {
         }, []),
     };
 }
+function parseThreatModelsFromInput(rawThreatModelsInput, threatModelsInputCombines) {
+    if (!rawThreatModelsInput?.trim()) {
+        return undefined;
+    }
+    rawThreatModelsInput = rawThreatModelsInput.trim();
+    if (threatModelsInputCombines) {
+        rawThreatModelsInput = rawThreatModelsInput.trim().substring(1).trim();
+        if (!rawThreatModelsInput) {
+            throw new Error(getConfigFilePropertyError(undefined, "threat-models", "A '+' was used in the 'threat-models' input to specify that you wished to add some packs to your CodeQL analysis. However, no threat models were specified. Please either remove the '+' or specify some threat models."));
+        }
+    }
+    return rawThreatModelsInput.split(",").map((t) => t.trim());
+}
 /**
  * Validates that this package specification is syntactically correct.
  * It may not point to any real package, but after this function returns
@@ -932,15 +951,15 @@ function dbLocationOrDefault(dbLocation, tempDir) {
  * This will parse the config from the user input if present, or generate
  * a default config. The parsed config is then stored to a known location.
  */
-async function initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
+async function initConfig(languagesInput, queriesInput, packsInput, threatModelsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
     let config;
     // If no config file was provided create an empty one
     if (!configFile) {
         logger.debug("No configuration file was provided");
-        config = await getDefaultConfig(languagesInput, queriesInput, packsInput, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
+        config = await getDefaultConfig(languagesInput, queriesInput, packsInput, threatModelsInput, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
     }
     else {
-        config = await loadConfig(languagesInput, queriesInput, packsInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
+        config = await loadConfig(languagesInput, queriesInput, packsInput, threatModelsInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
     }
     // When using the codescanning config in the CLI, pack downloads
     // happen in the CLI during the `database init` command, so no need

lib/config-utils.test.js

@@ -102,8 +102,8 @@ function mockListLanguages(languages) {
                 return { packs: [] };
             },
         });
-        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
-        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger));
+        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
+        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger));
     });
 });
 (0, ava_1.default)("loading config saves config", async (t) => {
@@ -128,7 +128,7 @@ function mockListLanguages(languages) {
         t.false(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // Sanity check that getConfig returns undefined before we have called initConfig
         t.deepEqual(await configUtils.getConfig(tmpDir, logger), undefined);
-        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
+        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
         // The saved config file should now exist
         t.true(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // And that same newly-initialised config should now be returned by getConfig
@@ -144,7 +144,7 @@ function mockListLanguages(languages) {
 (0, ava_1.default)("load input outside of workspace", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, "../input", undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, "../input", undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -157,7 +157,7 @@ function mockListLanguages(languages) {
         // no filename given, just a repo
         const configFile = "octo-org/codeql-config@main";
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -171,7 +171,7 @@ function mockListLanguages(languages) {
         const configFile = "input";
         t.false(fs.existsSync(path.join(tmpDir, configFile)));
         try {
-            await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -247,7 +247,7 @@ function mockListLanguages(languages) {
         };
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        const actualConfig = await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, false, false, "my-artifact", "my-db", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const actualConfig = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFilePath, undefined, false, false, "my-artifact", "my-db", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Should exactly equal the object we constructed earlier
         t.deepEqual(actualConfig, expectedConfig);
     });
@@ -286,7 +286,7 @@ function mockListLanguages(languages) {
         fs.mkdirSync(path.join(tmpDir, "foo"));
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolve queries was called correctly
         t.deepEqual(resolveQueriesArgs.length, 1);
         t.deepEqual(resolveQueriesArgs[0].queries, [
@@ -332,7 +332,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries
         // and once for `./foo` from the config file.
@@ -368,7 +368,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries and once for `./override`,
         // but won't be called for './foo' from the config file.
@@ -403,7 +403,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for `./workflow-query`,
         // but won't be called for the default one since that was disabled
@@ -432,7 +432,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly:
         // It'll be called once for the default queries,
         // and then once for each of the two queries from the workflow
@@ -474,7 +474,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries,
         // once for each of additional1 and additional2,
@@ -516,7 +516,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         try {
-            await configUtils.initConfig(languages, queries, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(languages, queries, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             t.fail("initConfig did not throw error");
         }
         catch (err) {
@@ -562,7 +562,7 @@ function queriesToResolvedQueryForm(queries) {
         fs.mkdirSync(path.join(tmpDir, "foo/bar/dev"), { recursive: true });
         const configFile = "octo-org/codeql-config/config.yaml@main";
         const languages = "javascript";
-        await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         t.assert(spyGetContents.called);
     });
 });
@@ -572,7 +572,7 @@ function queriesToResolvedQueryForm(queries) {
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, repoReference, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, repoReference, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -588,7 +588,7 @@ function queriesToResolvedQueryForm(queries) {
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, repoReference, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, repoReference, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -608,7 +608,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -620,7 +620,7 @@ function queriesToResolvedQueryForm(queries) {
     return await util.withTmpDir(async (tmpDir) => {
         const languages = "rubbish,english";
         try {
-            await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -651,7 +651,7 @@ function queriesToResolvedQueryForm(queries) {
         const configFile = path.join(tmpDir, "codeql-config.yaml");
         fs.writeFileSync(configFile, inputFileContents);
         const languages = "javascript";
-        const { packs } = await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const { packs } = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         t.deepEqual(packs, {
             [languages_1.Language.javascript]: ["a/b@1.2.3"],
         });
@@ -688,7 +688,7 @@ function queriesToResolvedQueryForm(queries) {
         fs.writeFileSync(configFile, inputFileContents);
         fs.mkdirSync(path.join(tmpDir, "foo"));
         const languages = "javascript,python,cpp";
-        const { packs, queries } = await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const { packs, queries } = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         t.deepEqual(packs, {
             [languages_1.Language.javascript]: ["a/b@1.2.3"],
             [languages_1.Language.python]: ["c/d@1.2.3"],
@@ -734,7 +734,7 @@ function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGen
             const inputFile = path.join(tmpDir, configFile);
             fs.writeFileSync(inputFile, inputFileContents, "utf8");
             try {
-                await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+                await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
                 throw new Error("initConfig did not throw error");
             }
             catch (err) {
@@ -991,7 +991,7 @@ const mlPoweredQueriesMacro = ava_1.default.macro({
                     return { packs: [] };
                 },
             });
-            const { packs } = await configUtils.initConfig("javascript", queriesInput, packsInput, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)(isMlPoweredQueriesEnabled ? [feature_flags_1.Feature.MlPoweredQueriesEnabled] : []), (0, logging_1.getRunnerLogger)(true));
+            const { packs } = await configUtils.initConfig("javascript", queriesInput, packsInput, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)(isMlPoweredQueriesEnabled ? [feature_flags_1.Feature.MlPoweredQueriesEnabled] : []), (0, logging_1.getRunnerLogger)(true));
             if (expectedVersionString !== undefined) {
                 t.deepEqual(packs, {
                     [languages_1.Language.javascript]: [
@@ -1046,58 +1046,87 @@ const mlPoweredQueriesMacro = ava_1.default.macro({
 // CLI 2.12.1+.
 (0, ava_1.default)(mlPoweredQueriesMacro, "2.12.1", true, undefined, "security-experimental", "~0.4.0");
 const calculateAugmentationMacro = ava_1.default.macro({
-    exec: async (t, _title, rawPacksInput, rawQueriesInput, languages, expectedAugmentationProperties) => {
-        const actualAugmentationProperties = configUtils.calculateAugmentation(rawPacksInput, rawQueriesInput, languages);
+    exec: async (t, _title, rawPacksInput, rawQueriesInput, rawThreatModelsInput, languages, expectedAugmentationProperties) => {
+        const actualAugmentationProperties = configUtils.calculateAugmentation(rawPacksInput, rawQueriesInput, rawThreatModelsInput, languages);
         t.deepEqual(actualAugmentationProperties, expectedAugmentationProperties);
     },
     title: (_, title) => `Calculate Augmentation: ${title}`,
 });
-(0, ava_1.default)(calculateAugmentationMacro, "All empty", undefined, undefined, [languages_1.Language.javascript], {
+(0, ava_1.default)(calculateAugmentationMacro, "All empty", undefined, undefined, undefined, [languages_1.Language.javascript], {
     queriesInputCombines: false,
     queriesInput: undefined,
     packsInputCombines: false,
     packsInput: undefined,
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With queries", undefined, " a, b , c, d", [languages_1.Language.javascript], {
+(0, ava_1.default)(calculateAugmentationMacro, "With queries", undefined, " a, b , c, d", undefined, [languages_1.Language.javascript], {
     queriesInputCombines: false,
     queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
     packsInputCombines: false,
     packsInput: undefined,
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With queries combining", undefined, "   +   a, b , c, d ", [languages_1.Language.javascript], {
+(0, ava_1.default)(calculateAugmentationMacro, "With queries combining", undefined, "   +   a, b , c, d ", undefined, [languages_1.Language.javascript], {
     queriesInputCombines: true,
     queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
     packsInputCombines: false,
     packsInput: undefined,
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With packs", "   codeql/a , codeql/b   , codeql/c  , codeql/d  ", undefined, [languages_1.Language.javascript], {
+(0, ava_1.default)(calculateAugmentationMacro, "With packs", "   codeql/a , codeql/b   , codeql/c  , codeql/d  ", undefined, undefined, [languages_1.Language.javascript], {
     queriesInputCombines: false,
     queriesInput: undefined,
     packsInputCombines: false,
     packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With packs combining", "   +   codeql/a, codeql/b, codeql/c, codeql/d", undefined, [languages_1.Language.javascript], {
+(0, ava_1.default)(calculateAugmentationMacro, "With packs combining", "   +   codeql/a, codeql/b, codeql/c, codeql/d", undefined, undefined, [languages_1.Language.javascript], {
     queriesInputCombines: false,
     queriesInput: undefined,
     packsInputCombines: true,
     packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
+    injectedMlQueries: false,
+});
+(0, ava_1.default)(calculateAugmentationMacro, "With threat model", undefined, undefined, "   a , b   , c  , d  ", [languages_1.Language.javascript], {
+    queriesInputCombines: false,
+    queriesInput: undefined,
+    packsInput: undefined,
+    packsInputCombines: false,
+    threatModelsInput: ["a", "b", "c", "d"],
+    threatModelsInputCombines: false,
+    injectedMlQueries: false,
+});
+(0, ava_1.default)(calculateAugmentationMacro, "With threat model combining", undefined, undefined, " +  a , b   , c  , d  ", [languages_1.Language.javascript], {
+    queriesInput: undefined,
+    queriesInputCombines: false,
+    packsInput: undefined,
+    packsInputCombines: false,
+    threatModelsInput: ["a", "b", "c", "d"],
+    threatModelsInputCombines: true,
     injectedMlQueries: false,
 });
 const calculateAugmentationErrorMacro = ava_1.default.macro({
-    exec: async (t, _title, rawPacksInput, rawQueriesInput, languages, expectedError) => {
-        t.throws(() => configUtils.calculateAugmentation(rawPacksInput, rawQueriesInput, languages), { message: expectedError });
+    exec: async (t, _title, rawPacksInput, rawQueriesInput, rawThreatModelsInput, languages, expectedError) => {
+        t.throws(() => configUtils.calculateAugmentation(rawPacksInput, rawQueriesInput, rawThreatModelsInput, languages), { message: expectedError });
     },
     title: (_, title) => `Calculate Augmentation Error: ${title}`,
 });
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (queries)", undefined, "   +   ", [languages_1.Language.javascript], /The workflow property "queries" is invalid/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (packs)", "   +   ", undefined, [languages_1.Language.javascript], /The workflow property "packs" is invalid/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with multiple languages", "   +  a/b, c/d ", undefined, [languages_1.Language.javascript, languages_1.Language.java], /Cannot specify a 'packs' input in a multi-language analysis/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with no languages", "   +  a/b, c/d ", undefined, [], /No languages specified/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Invalid packs", " a-pack-without-a-scope ", undefined, [languages_1.Language.javascript], /"a-pack-without-a-scope" is not a valid pack/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (queries)", undefined, "   +   ", undefined, [languages_1.Language.javascript], /The workflow property "queries" is invalid/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (packs)", "   +   ", undefined, undefined, [languages_1.Language.javascript], /The workflow property "packs" is invalid/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with multiple languages", "   +  a/b, c/d ", undefined, undefined, [languages_1.Language.javascript, languages_1.Language.java], /Cannot specify a 'packs' input in a multi-language analysis/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with no languages", "   +  a/b, c/d ", undefined, undefined, [], /No languages specified/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Invalid packs", " a-pack-without-a-scope ", undefined, undefined, [languages_1.Language.javascript], /"a-pack-without-a-scope" is not a valid pack/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Invalid threat-models", undefined, undefined, "   + ", [languages_1.Language.javascript], /A '\+' was used in the 'threat-models'/);
 (0, ava_1.default)("downloadPacks-no-registries", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         const packDownloadStub = sinon.stub();

lib/debug-artifacts.js

@@ -74,7 +74,6 @@ async function uploadSarifDebugArtifact(config, outputDir) {
 }
 exports.uploadSarifDebugArtifact = uploadSarifDebugArtifact;
 async function uploadLogsDebugArtifact(config) {
-    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     let toUpload = [];
     for (const language of config.languages) {
         const databaseDirectory = (0, util_1.getCodeQLDatabasePath)(config, language);
@@ -83,21 +82,12 @@ async function uploadLogsDebugArtifact(config) {
             toUpload = toUpload.concat((0, util_1.listFolder)(logsDirectory));
         }
     }
-    if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
-        // Multilanguage tracing: there are additional logs in the root of the cluster
-        const multiLanguageTracingLogsDirectory = path.resolve(config.dbLocation, "log");
-        if ((0, util_1.doesDirectoryExist)(multiLanguageTracingLogsDirectory)) {
-            toUpload = toUpload.concat((0, util_1.listFolder)(multiLanguageTracingLogsDirectory));
-        }
+    // Multilanguage tracing: there are additional logs in the root of the cluster
+    const multiLanguageTracingLogsDirectory = path.resolve(config.dbLocation, "log");
+    if ((0, util_1.doesDirectoryExist)(multiLanguageTracingLogsDirectory)) {
+        toUpload = toUpload.concat((0, util_1.listFolder)(multiLanguageTracingLogsDirectory));
     }
     await uploadDebugArtifacts(toUpload, config.dbLocation, config.debugArtifactName);
-    // Before multi-language tracing, we wrote a compound-build-tracer.log in the temp dir
-    if (!(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING))) {
-        const compoundBuildTracerLogDirectory = path.resolve(config.tempDir, "compound-build-tracer.log");
-        if ((0, util_1.doesDirectoryExist)(compoundBuildTracerLogDirectory)) {
-            await uploadDebugArtifacts([compoundBuildTracerLogDirectory], config.tempDir, config.debugArtifactName);
-        }
-    }
 }
 exports.uploadLogsDebugArtifact = uploadLogsDebugArtifact;
 /**

lib/debug-artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"debug-artifacts.js","sourceRoot":"","sources":["../src/debug-artifacts.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oDAAsC;AACtC,sDAA6B;AAC7B,8CAAsB;AAEtB,iDAAkD;AAClD,uCAA0C;AAC1C,qCAAiE;AAIjE,iCAMgB;AAEhB,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAFD,kDAEC;AAEM,KAAK,UAAU,oBAAoB,CACxC,QAAkB,EAClB,OAAe,EACf,YAAoB;IAEpB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACzB,OAAO;KACR;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE;QACV,IAAI;YACF,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAC9B,CAAC,IAAI,EAAE;gBACN,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;SAC7B;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,IAAI,CACP,+HAA+H,CAChI,CAAC;SACH;KACF;IACD,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,cAAc,CACpC,mBAAmB,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,EAC/C,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AA3BD,oDA2BC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC,IAAA,yBAAkB,EAAC,SAAS,CAAC,EAAE;QAClC,OAAO;KACR;IAED,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;YAC5B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACvC;KACF;IACD,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAhBD,4DAgBC;AAEM,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,iBAAiB,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,IAAA,yBAAkB,EAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,aAAa,CAAC,CAAC,CAAC;SACvD;KACF;IAED,IAAI,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,mCAA0B,CAAC,EAAE;QAChE,8EAA8E;QAC9E,MAAM,iCAAiC,GAAG,IAAI,CAAC,OAAO,CACpD,MAAM,CAAC,UAAU,EACjB,KAAK,CACN,CAAC;QACF,IAAI,IAAA,yBAAkB,EAAC,iCAAiC,CAAC,EAAE;YACzD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,iCAAiC,CAAC,CAAC,CAAC;SAC3E;KACF;IACD,MAAM,oBAAoB,CACxB,QAAQ,EACR,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;IAEF,sFAAsF;IACtF,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,mCAA0B,CAAC,CAAC,EAAE;QACnE,MAAM,+BAA+B,GAAG,IAAI,CAAC,OAAO,CAClD,MAAM,CAAC,OAAO,EACd,2BAA2B,CAC5B,CAAC;QACF,IAAI,IAAA,yBAAkB,EAAC,+BAA+B,CAAC,EAAE;YACvD,MAAM,oBAAoB,CACxB,CAAC,+BAA+B,CAAC,EACjC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;KACF;AACH,CAAC;AA1CD,0DA0CC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,MAAc,EACd,QAAkB;IAElB,MAAM,YAAY,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CACrC,MAAM,CAAC,UAAU,EACjB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,cAAc,CACtD,CAAC;IACF,IAAI,CAAC,IAAI,CACP,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,2DAA2D,kBAAkB,KAAK,CAC1H,CAAC;IACF,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QACrC,MAAM,IAAA,aAAG,EAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KAChD;IACD,MAAM,GAAG,GAAG,IAAI,iBAAM,EAAE,CAAC;IACzB,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAkB;IAElB,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,MAAM,IAAA,eAAQ,EACvC,MAAM,EACN,QAAQ,EACR,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,EACjC,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,EAAE,CAC1C,CAAC;IACF,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,IAAI,kBAA0B,CAAC;YAC/B,IAAI,CAAC,IAAA,uBAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC5C,kBAAkB,GAAG,MAAM,2BAA2B,CACpD,MAAM,EACN,QAAQ,CACT,CAAC;aACH;iBAAM;gBACL,kBAAkB,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACtE;YACD,MAAM,oBAAoB,CACxB,CAAC,kBAAkB,CAAC,EACpB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,IAAI,CAAC,IAAI,CACP,8CAA8C,MAAM,CAAC,iBAAiB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAC/F,CAAC;SACH;KACF;AACH,CAAC;AA1BD,8EA0BC"}
+{"version":3,"file":"debug-artifacts.js","sourceRoot":"","sources":["../src/debug-artifacts.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oDAAsC;AACtC,sDAA6B;AAC7B,8CAAsB;AAEtB,iDAAkD;AAClD,uCAA0C;AAC1C,qCAAqC;AAIrC,iCAKgB;AAEhB,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAFD,kDAEC;AAEM,KAAK,UAAU,oBAAoB,CACxC,QAAkB,EAClB,OAAe,EACf,YAAoB;IAEpB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACzB,OAAO;KACR;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE;QACV,IAAI;YACF,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAC9B,CAAC,IAAI,EAAE;gBACN,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;SAC7B;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,IAAI,CACP,+HAA+H,CAChI,CAAC;SACH;KACF;IACD,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,cAAc,CACpC,mBAAmB,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,EAC/C,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AA3BD,oDA2BC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC,IAAA,yBAAkB,EAAC,SAAS,CAAC,EAAE;QAClC,OAAO;KACR;IAED,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;YAC5B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACvC;KACF;IACD,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAhBD,4DAgBC;AAEM,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,iBAAiB,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,IAAA,yBAAkB,EAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,aAAa,CAAC,CAAC,CAAC;SACvD;KACF;IAED,8EAA8E;IAC9E,MAAM,iCAAiC,GAAG,IAAI,CAAC,OAAO,CACpD,MAAM,CAAC,UAAU,EACjB,KAAK,CACN,CAAC;IACF,IAAI,IAAA,yBAAkB,EAAC,iCAAiC,CAAC,EAAE;QACzD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,iCAAiC,CAAC,CAAC,CAAC;KAC3E;IAED,MAAM,oBAAoB,CACxB,QAAQ,EACR,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;AACJ,CAAC;AAxBD,0DAwBC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,MAAc,EACd,QAAkB;IAElB,MAAM,YAAY,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CACrC,MAAM,CAAC,UAAU,EACjB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,cAAc,CACtD,CAAC;IACF,IAAI,CAAC,IAAI,CACP,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,2DAA2D,kBAAkB,KAAK,CAC1H,CAAC;IACF,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QACrC,MAAM,IAAA,aAAG,EAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KAChD;IACD,MAAM,GAAG,GAAG,IAAI,iBAAM,EAAE,CAAC;IACzB,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAkB;IAElB,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,MAAM,IAAA,eAAQ,EACvC,MAAM,EACN,QAAQ,EACR,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,EACjC,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,EAAE,CAC1C,CAAC;IACF,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,IAAI,kBAA0B,CAAC;YAC/B,IAAI,CAAC,IAAA,uBAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC5C,kBAAkB,GAAG,MAAM,2BAA2B,CACpD,MAAM,EACN,QAAQ,CACT,CAAC;aACH;iBAAM;gBACL,kBAAkB,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACtE;YACD,MAAM,oBAAoB,CACxB,CAAC,kBAAkB,CAAC,EACpB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,IAAI,CAAC,IAAI,CACP,8CAA8C,MAAM,CAAC,iBAAiB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAC/F,CAAC;SACH;KACF;AACH,CAAC;AA1BD,8EA0BC"}

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-    "bundleVersion": "codeql-bundle-20230403",
-    "cliVersion": "2.12.6",
-    "priorBundleVersion": "codeql-bundle-20230317",
-    "priorCliVersion": "2.12.5"
+    "bundleVersion": "codeql-bundle-20230414",
+    "cliVersion": "2.13.0",
+    "priorBundleVersion": "codeql-bundle-20230403",
+    "priorCliVersion": "2.12.6"
 }

lib/init-action.js

@@ -27,7 +27,6 @@ const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
 const actions_util_1 = require("./actions-util");
 const api_client_1 = require("./api-client");
-const codeql_1 = require("./codeql");
 const feature_flags_1 = require("./feature-flags");
 const init_1 = require("./init");
 const languages_1 = require("./languages");
@@ -129,8 +128,7 @@ async function run() {
         toolsDownloadDurationMs = initCodeQLResult.toolsDownloadDurationMs;
         toolsVersion = initCodeQLResult.toolsVersion;
         toolsSource = initCodeQLResult.toolsSource;
-        await (0, codeql_1.enrichEnvironment)(codeql);
-        config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), registriesInput, (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), getTrapCachingEnabled(), 
+        config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), (0, actions_util_1.getOptionalInput)("threat-models"), registriesInput, (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), getTrapCachingEnabled(), 
         // Debug mode is enabled if:
         // - The `init` Action is passed `debug: true`.
         // - Actions step debugging is enabled (e.g. by [enabling debug logging for a rerun](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs#re-running-all-the-jobs-in-a-workflow),
@@ -178,10 +176,6 @@ async function run() {
             for (const [key, value] of Object.entries(tracerConfig.env)) {
                 core.exportVariable(key, value);
             }
-            if (process.platform === "win32" &&
-                !(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING))) {
-                await (0, init_1.injectWindowsTracer)("Runner.Worker.exe", undefined, config, codeql, tracerConfig);
-            }
         }
         core.setOutput("codeql-path", config.codeQLCmd);
     }

lib/init.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.installPythonDeps = exports.injectWindowsTracer = exports.runInit = exports.initConfig = exports.initCodeQL = exports.ToolsSource = void 0;
+exports.installPythonDeps = exports.runInit = exports.initConfig = exports.initCodeQL = exports.ToolsSource = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
@@ -33,7 +33,6 @@ const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
 const tracer_config_1 = require("./tracer-config");
 const util = __importStar(require("./util"));
-const util_1 = require("./util");
 var ToolsSource;
 (function (ToolsSource) {
     ToolsSource["Unknown"] = "UNKNOWN";
@@ -49,9 +48,9 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe
     return { codeql, toolsDownloadDurationMs, toolsSource, toolsVersion };
 }
 exports.initCodeQL = initCodeQL;
-async function initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
+async function initConfig(languagesInput, queriesInput, packsInput, threatModelsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
     logger.startGroup("Load language configuration");
-    const config = await configUtils.initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
+    const config = await configUtils.initConfig(languagesInput, queriesInput, packsInput, threatModelsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
     analysisPaths.printPathFiltersWarning(config, logger);
     logger.endGroup();
     return config;
@@ -60,35 +59,27 @@ exports.initConfig = initConfig;
 async function runInit(codeql, config, sourceRoot, processName, registriesInput, features, apiDetails, logger) {
     fs.mkdirSync(config.dbLocation, { recursive: true });
     try {
-        if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
-            // When parsing the codeql config in the CLI, we have not yet created the qlconfig file.
-            // So, create it now.
-            // If we are parsing the config file in the Action, then the qlconfig file was already created
-            // before the `pack download` command was invoked. It is not required for the init command.
-            let registriesAuthTokens;
-            let qlconfigFile;
-            if (await util.useCodeScanningConfigInCli(codeql, features)) {
-                ({ registriesAuthTokens, qlconfigFile } =
-                    await configUtils.generateRegistries(registriesInput, codeql, config.tempDir, logger));
-            }
-            await configUtils.wrapEnvironment({
-                GITHUB_TOKEN: apiDetails.auth,
-                CODEQL_REGISTRIES_AUTH: registriesAuthTokens,
-            }, 
-            // Init a database cluster
-            async () => await codeql.databaseInitCluster(config, sourceRoot, processName, features, qlconfigFile, logger));
-        }
-        else {
-            for (const language of config.languages) {
-                // Init language database
-                await codeql.databaseInit(util.getCodeQLDatabasePath(config, language), language, sourceRoot);
-            }
+        // When parsing the codeql config in the CLI, we have not yet created the qlconfig file.
+        // So, create it now.
+        // If we are parsing the config file in the Action, then the qlconfig file was already created
+        // before the `pack download` command was invoked. It is not required for the init command.
+        let registriesAuthTokens;
+        let qlconfigFile;
+        if (await util.useCodeScanningConfigInCli(codeql, features)) {
+            ({ registriesAuthTokens, qlconfigFile } =
+                await configUtils.generateRegistries(registriesInput, codeql, config.tempDir, logger));
         }
+        await configUtils.wrapEnvironment({
+            GITHUB_TOKEN: apiDetails.auth,
+            CODEQL_REGISTRIES_AUTH: registriesAuthTokens,
+        }, 
+        // Init a database cluster
+        async () => await codeql.databaseInitCluster(config, sourceRoot, processName, features, qlconfigFile, logger));
     }
     catch (e) {
         throw processError(e);
     }
-    return await (0, tracer_config_1.getCombinedTracerConfig)(config, codeql);
+    return await (0, tracer_config_1.getCombinedTracerConfig)(config);
 }
 exports.runInit = runInit;
 /**
@@ -119,89 +110,6 @@ function processError(e) {
     }
     return e;
 }
-// Runs a powershell script to inject the tracer into a parent process
-// so it can tracer future processes, hopefully including the build process.
-// If processName is given then injects into the nearest parent process with
-// this name, otherwise uses the processLevel-th parent if defined, otherwise
-// defaults to the 3rd parent as a rough guess.
-async function injectWindowsTracer(processName, processLevel, config, codeql, tracerConfig) {
-    let script;
-    if (processName !== undefined) {
-        script = `
-      Param(
-          [Parameter(Position=0)]
-          [String]
-          $tracer
-      )
-
-      $id = $PID
-      while ($true) {
-        $p = Get-CimInstance -Class Win32_Process -Filter "ProcessId = $id"
-        Write-Host "Found process: $p"
-        if ($p -eq $null) {
-          throw "Could not determine ${processName} process"
-        }
-        if ($p[0].Name -eq "${processName}") {
-          Break
-        } else {
-          $id = $p[0].ParentProcessId
-        }
-      }
-      Write-Host "Final process: $p"
-
-      Invoke-Expression "&$tracer --inject=$id"`;
-    }
-    else {
-        // If the level is not defined then guess at the 3rd parent process.
-        // This won't be correct in every setting but it should be enough in most settings,
-        // and overestimating is likely better in this situation so we definitely trace
-        // what we want, though this does run the risk of interfering with future CI jobs.
-        // Note that the default of 3 doesn't work on github actions, so we include a
-        // special case in the script that checks for Runner.Worker.exe so we can still work
-        // on actions if the runner is invoked there.
-        processLevel = processLevel || 3;
-        script = `
-      Param(
-          [Parameter(Position=0)]
-          [String]
-          $tracer
-      )
-
-      $id = $PID
-      for ($i = 0; $i -le ${processLevel}; $i++) {
-        $p = Get-CimInstance -Class Win32_Process -Filter "ProcessId = $id"
-        Write-Host "Parent process \${i}: $p"
-        if ($p -eq $null) {
-          throw "Process tree ended before reaching required level"
-        }
-        # Special case just in case the runner is used on actions
-        if ($p[0].Name -eq "Runner.Worker.exe") {
-          Write-Host "Found Runner.Worker.exe process which means we are running on GitHub Actions"
-          Write-Host "Aborting search early and using process: $p"
-          Break
-        } elseif ($p[0].Name -eq "Agent.Worker.exe") {
-          Write-Host "Found Agent.Worker.exe process which means we are running on Azure Pipelines"
-          Write-Host "Aborting search early and using process: $p"
-          Break
-        } else {
-          $id = $p[0].ParentProcessId
-        }
-      }
-      Write-Host "Final process: $p"
-
-      Invoke-Expression "&$tracer --inject=$id"`;
-    }
-    const injectTracerPath = path.join(config.tempDir, "inject-tracer.ps1");
-    fs.writeFileSync(injectTracerPath, script);
-    await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [
-        "-ExecutionPolicy",
-        "Bypass",
-        "-file",
-        injectTracerPath,
-        path.resolve(path.dirname(codeql.getPath()), "tools", "win64", "tracer.exe"),
-    ], { env: { ODASA_TRACER_CONFIGURATION: tracerConfig.spec } }).exec();
-}
-exports.injectWindowsTracer = injectWindowsTracer;
 async function installPythonDeps(codeql, logger) {
     logger.startGroup("Setup Python dependencies");
     const scriptsFolder = path.resolve(__dirname, "../python-setup");

lib/tracer-config.js

@@ -23,20 +23,10 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCombinedTracerConfig = exports.concatTracerConfigs = exports.getTracerConfigForLanguage = exports.getTracerConfigForCluster = exports.endTracingForCluster = void 0;
+exports.getCombinedTracerConfig = exports.getTracerConfigForCluster = exports.endTracingForCluster = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const codeql_1 = require("./codeql");
 const languages_1 = require("./languages");
-const util = __importStar(require("./util"));
-const util_1 = require("./util");
-const CRITICAL_TRACER_VARS = new Set([
-    "SEMMLE_PRELOAD_libtrace",
-    "SEMMLE_RUNNER",
-    "SEMMLE_COPY_EXECUTABLES_ROOT",
-    "SEMMLE_DEPTRACE_SOCKET",
-    "SEMMLE_JAVA_TOOL_OPTIONS",
-]);
 async function endTracingForCluster(config) {
     // If there are no traced languages, we don't need to do anything.
     if (!config.languages.some((l) => (0, languages_1.isTracedLanguage)(l)))
@@ -64,162 +54,17 @@ exports.endTracingForCluster = endTracingForCluster;
 async function getTracerConfigForCluster(config) {
     const tracingEnvVariables = JSON.parse(fs.readFileSync(path.resolve(config.dbLocation, "temp/tracingEnvironment/start-tracing.json"), "utf8"));
     return {
-        spec: tracingEnvVariables["ODASA_TRACER_CONFIGURATION"],
         env: tracingEnvVariables,
     };
 }
 exports.getTracerConfigForCluster = getTracerConfigForCluster;
-async function getTracerConfigForLanguage(codeql, config, language) {
-    const env = await codeql.getTracerEnv(util.getCodeQLDatabasePath(config, language));
-    const spec = env["ODASA_TRACER_CONFIGURATION"];
-    const info = { spec, env: {} };
-    // Extract critical tracer variables from the environment
-    for (const entry of Object.entries(env)) {
-        const key = entry[0];
-        const value = entry[1];
-        // skip ODASA_TRACER_CONFIGURATION as it is handled separately
-        if (key === "ODASA_TRACER_CONFIGURATION") {
-            continue;
-        }
-        // skip undefined values
-        if (typeof value === "undefined") {
-            continue;
-        }
-        // Keep variables that do not exist in current environment. In addition always keep
-        // critical and CODEQL_ variables
-        if (typeof process.env[key] === "undefined" ||
-            CRITICAL_TRACER_VARS.has(key) ||
-            key.startsWith("CODEQL_")) {
-            info.env[key] = value;
-        }
-    }
-    return info;
-}
-exports.getTracerConfigForLanguage = getTracerConfigForLanguage;
-function concatTracerConfigs(tracerConfigs, config, writeBothEnvironments = false) {
-    // A tracer config is a map containing additional environment variables and a tracer 'spec' file.
-    // A tracer 'spec' file has the following format [log_file, number_of_blocks, blocks_text]
-    // Merge the environments
-    const env = {};
-    let copyExecutables = false;
-    let envSize = 0;
-    for (const v of Object.values(tracerConfigs)) {
-        for (const e of Object.entries(v.env)) {
-            const name = e[0];
-            const value = e[1];
-            // skip SEMMLE_COPY_EXECUTABLES_ROOT as it is handled separately
-            if (name === "SEMMLE_COPY_EXECUTABLES_ROOT") {
-                copyExecutables = true;
-            }
-            else if (name in env) {
-                if (env[name] !== value) {
-                    throw Error(`Incompatible values in environment parameter ${name}: ${env[name]} and ${value}`);
-                }
-            }
-            else {
-                env[name] = value;
-                envSize += 1;
-            }
-        }
-    }
-    // Concatenate spec files into a new spec file
-    const languages = Object.keys(tracerConfigs);
-    const cppIndex = languages.indexOf("cpp");
-    // Make sure cpp is the last language, if it's present since it must be concatenated last
-    if (cppIndex !== -1) {
-        const lastLang = languages[languages.length - 1];
-        languages[languages.length - 1] = languages[cppIndex];
-        languages[cppIndex] = lastLang;
-    }
-    const totalLines = [];
-    let totalCount = 0;
-    for (const lang of languages) {
-        const lines = fs
-            .readFileSync(tracerConfigs[lang].spec, "utf8")
-            .split(/\r?\n/);
-        const count = parseInt(lines[1], 10);
-        totalCount += count;
-        totalLines.push(...lines.slice(2));
-    }
-    const newLogFilePath = path.resolve(config.tempDir, "compound-build-tracer.log");
-    const spec = path.resolve(config.tempDir, "compound-spec");
-    const compoundTempFolder = path.resolve(config.tempDir, "compound-temp");
-    const newSpecContent = [
-        newLogFilePath,
-        totalCount.toString(10),
-        ...totalLines,
-    ];
-    if (copyExecutables) {
-        env["SEMMLE_COPY_EXECUTABLES_ROOT"] = compoundTempFolder;
-        envSize += 1;
-    }
-    fs.writeFileSync(spec, newSpecContent.join("\n"));
-    if (writeBothEnvironments || process.platform !== "win32") {
-        // Prepare the content of the compound environment file on Unix
-        let buffer = Buffer.alloc(4);
-        buffer.writeInt32LE(envSize, 0);
-        for (const e of Object.entries(env)) {
-            const key = e[0];
-            const value = e[1];
-            const lineBuffer = Buffer.from(`${key}=${value}\0`, "utf8");
-            const sizeBuffer = Buffer.alloc(4);
-            sizeBuffer.writeInt32LE(lineBuffer.length, 0);
-            buffer = Buffer.concat([buffer, sizeBuffer, lineBuffer]);
-        }
-        // Write the compound environment for Unix
-        const envPath = `${spec}.environment`;
-        fs.writeFileSync(envPath, buffer);
-    }
-    if (writeBothEnvironments || process.platform === "win32") {
-        // Prepare the content of the compound environment file on Windows
-        let bufferWindows = Buffer.alloc(0);
-        let length = 0;
-        for (const e of Object.entries(env)) {
-            const key = e[0];
-            const value = e[1];
-            const string = `${key}=${value}\0`;
-            length += string.length;
-            const lineBuffer = Buffer.from(string, "utf16le");
-            bufferWindows = Buffer.concat([bufferWindows, lineBuffer]);
-        }
-        const sizeBuffer = Buffer.alloc(4);
-        sizeBuffer.writeInt32LE(length + 1, 0); // Add one for trailing null character marking end
-        const trailingNull = Buffer.from(`\0`, "utf16le");
-        bufferWindows = Buffer.concat([sizeBuffer, bufferWindows, trailingNull]);
-        // Write the compound environment for Windows
-        const envPathWindows = `${spec}.win32env`;
-        fs.writeFileSync(envPathWindows, bufferWindows);
-    }
-    return { env, spec };
-}
-exports.concatTracerConfigs = concatTracerConfigs;
-async function getCombinedTracerConfig(config, codeql) {
+async function getCombinedTracerConfig(config) {
     // Abort if there are no traced languages as there's nothing to do
     const tracedLanguages = config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l));
     if (tracedLanguages.length === 0) {
         return undefined;
     }
-    let mainTracerConfig;
-    if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
-        mainTracerConfig = await getTracerConfigForCluster(config);
-    }
-    else {
-        // Get all the tracer configs and combine them together
-        const tracedLanguageConfigs = {};
-        for (const language of tracedLanguages) {
-            tracedLanguageConfigs[language] = await getTracerConfigForLanguage(codeql, config, language);
-        }
-        mainTracerConfig = concatTracerConfigs(tracedLanguageConfigs, config);
-        // Add a couple more variables
-        mainTracerConfig.env["ODASA_TRACER_CONFIGURATION"] = mainTracerConfig.spec;
-        const codeQLDir = path.dirname(codeql.getPath());
-        if (process.platform === "darwin") {
-            mainTracerConfig.env["DYLD_INSERT_LIBRARIES"] = path.join(codeQLDir, "tools", "osx64", "libtrace.dylib");
-        }
-        else if (process.platform !== "win32") {
-            mainTracerConfig.env["LD_PRELOAD"] = path.join(codeQLDir, "tools", "linux64", "${LIB}trace.so");
-        }
-    }
+    const mainTracerConfig = await getTracerConfigForCluster(config);
     // On macos it's necessary to prefix the build command with the runner executable
     // on order to trace when System Integrity Protection is enabled.
     // The executable also exists and works for other platforms so we output this env

lib/tracer-config.test.js

@@ -29,7 +29,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
-const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
 const languages_1 = require("./languages");
 const testing_utils_1 = require("./testing-utils");
@@ -56,267 +55,35 @@ function getTestConfig(tmpDir) {
         trapCacheDownloadTime: 0,
     };
 }
-// A very minimal setup
-(0, ava_1.default)("getTracerConfigForLanguage - minimal setup", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        const config = getTestConfig(tmpDir);
-        const codeQL = (0, codeql_1.setCodeQL)({
-            async getTracerEnv() {
-                return {
-                    ODASA_TRACER_CONFIGURATION: "abc",
-                    foo: "bar",
-                };
-            },
-        });
-        const result = await (0, tracer_config_1.getTracerConfigForLanguage)(codeQL, config, languages_1.Language.javascript);
-        t.deepEqual(result, { spec: "abc", env: { foo: "bar" } });
-    });
-});
-// Existing vars should not be overwritten, unless they are critical or prefixed with CODEQL_
-(0, ava_1.default)("getTracerConfigForLanguage - existing / critical vars", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        const config = getTestConfig(tmpDir);
-        // Set up some variables in the environment
-        process.env["foo"] = "abc";
-        process.env["SEMMLE_PRELOAD_libtrace"] = "abc";
-        process.env["SEMMLE_RUNNER"] = "abc";
-        process.env["SEMMLE_COPY_EXECUTABLES_ROOT"] = "abc";
-        process.env["SEMMLE_DEPTRACE_SOCKET"] = "abc";
-        process.env["SEMMLE_JAVA_TOOL_OPTIONS"] = "abc";
-        process.env["CODEQL_VAR"] = "abc";
-        // Now CodeQL returns all these variables, and one more, with different values
-        const codeQL = (0, codeql_1.setCodeQL)({
-            async getTracerEnv() {
-                return {
-                    ODASA_TRACER_CONFIGURATION: "abc",
-                    foo: "bar",
-                    baz: "qux",
-                    SEMMLE_PRELOAD_libtrace: "SEMMLE_PRELOAD_libtrace",
-                    SEMMLE_RUNNER: "SEMMLE_RUNNER",
-                    SEMMLE_COPY_EXECUTABLES_ROOT: "SEMMLE_COPY_EXECUTABLES_ROOT",
-                    SEMMLE_DEPTRACE_SOCKET: "SEMMLE_DEPTRACE_SOCKET",
-                    SEMMLE_JAVA_TOOL_OPTIONS: "SEMMLE_JAVA_TOOL_OPTIONS",
-                    CODEQL_VAR: "CODEQL_VAR",
-                };
-            },
-        });
-        const result = await (0, tracer_config_1.getTracerConfigForLanguage)(codeQL, config, languages_1.Language.javascript);
-        t.deepEqual(result, {
-            spec: "abc",
-            env: {
-                // Should contain all variables except 'foo', because that already existed in the
-                // environment with a different value, and is not deemed a "critical" variable.
-                baz: "qux",
-                SEMMLE_PRELOAD_libtrace: "SEMMLE_PRELOAD_libtrace",
-                SEMMLE_RUNNER: "SEMMLE_RUNNER",
-                SEMMLE_COPY_EXECUTABLES_ROOT: "SEMMLE_COPY_EXECUTABLES_ROOT",
-                SEMMLE_DEPTRACE_SOCKET: "SEMMLE_DEPTRACE_SOCKET",
-                SEMMLE_JAVA_TOOL_OPTIONS: "SEMMLE_JAVA_TOOL_OPTIONS",
-                CODEQL_VAR: "CODEQL_VAR",
-            },
-        });
-    });
-});
-(0, ava_1.default)("concatTracerConfigs - minimal configs correctly combined", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        const config = getTestConfig(tmpDir);
-        const spec1 = path.join(tmpDir, "spec1");
-        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
-        const tc1 = {
-            spec: spec1,
-            env: {
-                a: "a",
-                b: "b",
-            },
-        };
-        const spec2 = path.join(tmpDir, "spec2");
-        fs.writeFileSync(spec2, "foo.log\n1\nghi");
-        const tc2 = {
-            spec: spec2,
-            env: {
-                c: "c",
-            },
-        };
-        const result = (0, tracer_config_1.concatTracerConfigs)({ javascript: tc1, python: tc2 }, config);
-        t.deepEqual(result, {
-            spec: path.join(tmpDir, "compound-spec"),
-            env: {
-                a: "a",
-                b: "b",
-                c: "c",
-            },
-        });
-        t.true(fs.existsSync(result.spec));
-        t.deepEqual(fs.readFileSync(result.spec, "utf8"), `${path.join(tmpDir, "compound-build-tracer.log")}\n3\nabc\ndef\nghi`);
-    });
-});
-(0, ava_1.default)("concatTracerConfigs - conflicting env vars", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        const config = getTestConfig(tmpDir);
-        const spec = path.join(tmpDir, "spec");
-        fs.writeFileSync(spec, "foo.log\n0");
-        // Ok if env vars have the same name and the same value
-        t.deepEqual((0, tracer_config_1.concatTracerConfigs)({
-            javascript: { spec, env: { a: "a", b: "b" } },
-            python: { spec, env: { b: "b", c: "c" } },
-        }, config).env, {
-            a: "a",
-            b: "b",
-            c: "c",
-        });
-        // Throws if env vars have same name but different values
-        const e = t.throws(() => (0, tracer_config_1.concatTracerConfigs)({
-            javascript: { spec, env: { a: "a", b: "b" } },
-            python: { spec, env: { b: "c" } },
-        }, config));
-        // If e is undefined, then the previous assertion will fail.
-        if (e !== undefined) {
-            t.deepEqual(e.message, "Incompatible values in environment parameter b: b and c");
-        }
-    });
-});
-(0, ava_1.default)("concatTracerConfigs - cpp spec lines come last if present", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        const config = getTestConfig(tmpDir);
-        const spec1 = path.join(tmpDir, "spec1");
-        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
-        const tc1 = {
-            spec: spec1,
-            env: {
-                a: "a",
-                b: "b",
-            },
-        };
-        const spec2 = path.join(tmpDir, "spec2");
-        fs.writeFileSync(spec2, "foo.log\n1\nghi");
-        const tc2 = {
-            spec: spec2,
-            env: {
-                c: "c",
-            },
-        };
-        const result = (0, tracer_config_1.concatTracerConfigs)({ cpp: tc1, python: tc2 }, config);
-        t.deepEqual(result, {
-            spec: path.join(tmpDir, "compound-spec"),
-            env: {
-                a: "a",
-                b: "b",
-                c: "c",
-            },
-        });
-        t.true(fs.existsSync(result.spec));
-        t.deepEqual(fs.readFileSync(result.spec, "utf8"), `${path.join(tmpDir, "compound-build-tracer.log")}\n3\nghi\nabc\ndef`);
-    });
-});
-(0, ava_1.default)("concatTracerConfigs - SEMMLE_COPY_EXECUTABLES_ROOT is updated to point to compound spec", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        const config = getTestConfig(tmpDir);
-        const spec = path.join(tmpDir, "spec");
-        fs.writeFileSync(spec, "foo.log\n0");
-        const result = (0, tracer_config_1.concatTracerConfigs)({
-            javascript: { spec, env: { a: "a", b: "b" } },
-            python: { spec, env: { SEMMLE_COPY_EXECUTABLES_ROOT: "foo" } },
-        }, config);
-        t.deepEqual(result.env, {
-            a: "a",
-            b: "b",
-            SEMMLE_COPY_EXECUTABLES_ROOT: path.join(tmpDir, "compound-temp"),
-        });
-    });
-});
-(0, ava_1.default)("concatTracerConfigs - compound environment file is created correctly", async (t) => {
-    await util.withTmpDir(async (tmpDir) => {
-        const config = getTestConfig(tmpDir);
-        const spec1 = path.join(tmpDir, "spec1");
-        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
-        const tc1 = {
-            spec: spec1,
-            env: {
-                a: "a",
-            },
-        };
-        const spec2 = path.join(tmpDir, "spec2");
-        fs.writeFileSync(spec2, "foo.log\n1\nghi");
-        const tc2 = {
-            spec: spec2,
-            env: {
-                foo: "bar_baz",
-            },
-        };
-        const result = (0, tracer_config_1.concatTracerConfigs)({ javascript: tc1, python: tc2 }, config, true);
-        // Check binary contents for the Unix file
-        const envPath = `${result.spec}.environment`;
-        t.true(fs.existsSync(envPath));
-        const buffer = fs.readFileSync(envPath);
-        t.deepEqual(buffer.length, 28);
-        t.deepEqual(buffer.readInt32LE(0), 2); // number of env vars
-        t.deepEqual(buffer.readInt32LE(4), 4); // length of env var definition
-        t.deepEqual(buffer.toString("utf8", 8, 12), "a=a\0"); // [key]=[value]\0
-        t.deepEqual(buffer.readInt32LE(12), 12); // length of env var definition
-        t.deepEqual(buffer.toString("utf8", 16, 28), "foo=bar_baz\0"); // [key]=[value]\0
-        // Check binary contents for the Windows file
-        const envPathWindows = `${result.spec}.win32env`;
-        t.true(fs.existsSync(envPathWindows));
-        const bufferWindows = fs.readFileSync(envPathWindows);
-        t.deepEqual(bufferWindows.length, 38);
-        t.deepEqual(bufferWindows.readInt32LE(0), 4 + 12 + 1); // number of tchars to represent the environment
-        t.deepEqual(bufferWindows.toString("utf16le", 4, 12), "a=a\0"); // [key]=[value]\0
-        t.deepEqual(bufferWindows.toString("utf16le", 12, 36), "foo=bar_baz\0"); // [key]=[value]\0
-        t.deepEqual(bufferWindows.toString("utf16le", 36, 38), "\0"); // trailing null character
-    });
-});
 (0, ava_1.default)("getCombinedTracerConfig - return undefined when no languages are traced languages", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         const config = getTestConfig(tmpDir);
         // No traced languages
         config.languages = [languages_1.Language.javascript, languages_1.Language.python];
-        const codeQL = (0, codeql_1.setCodeQL)({
-            async getTracerEnv() {
-                return {
-                    ODASA_TRACER_CONFIGURATION: "abc",
-                    CODEQL_DIST: "/",
-                    foo: "bar",
-                };
-            },
-        });
-        t.deepEqual(await (0, tracer_config_1.getCombinedTracerConfig)(config, codeQL), undefined);
+        t.deepEqual(await (0, tracer_config_1.getCombinedTracerConfig)(config), undefined);
     });
 });
-(0, ava_1.default)("getCombinedTracerConfig - valid spec file", async (t) => {
+(0, ava_1.default)("getCombinedTracerConfig - with start-tracing.json environment file", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         const config = getTestConfig(tmpDir);
-        const spec = path.join(tmpDir, "spec");
-        fs.writeFileSync(spec, "foo.log\n2\nabc\ndef");
         const bundlePath = path.join(tmpDir, "bundle");
         const codeqlPlatform = process.platform === "win32"
             ? "win64"
             : process.platform === "darwin"
                 ? "osx64"
                 : "linux64";
-        const codeQL = (0, codeql_1.setCodeQL)({
-            async getTracerEnv() {
-                return {
-                    ODASA_TRACER_CONFIGURATION: spec,
-                    CODEQL_DIST: bundlePath,
-                    CODEQL_PLATFORM: codeqlPlatform,
-                    foo: "bar",
-                };
-            },
-        });
-        const result = await (0, tracer_config_1.getCombinedTracerConfig)(config, codeQL);
-        t.notDeepEqual(result, undefined);
-        const expectedEnv = {
+        const startTracingEnv = {
             foo: "bar",
             CODEQL_DIST: bundlePath,
             CODEQL_PLATFORM: codeqlPlatform,
-            ODASA_TRACER_CONFIGURATION: result.spec,
         };
-        if (process.platform === "darwin") {
-            expectedEnv["DYLD_INSERT_LIBRARIES"] = path.join(path.dirname(codeQL.getPath()), "tools", "osx64", "libtrace.dylib");
-        }
-        else if (process.platform !== "win32") {
-            expectedEnv["LD_PRELOAD"] = path.join(path.dirname(codeQL.getPath()), "tools", "linux64", "${LIB}trace.so");
-        }
+        const tracingEnvironmentDir = path.join(config.dbLocation, "temp", "tracingEnvironment");
+        fs.mkdirSync(tracingEnvironmentDir, { recursive: true });
+        const startTracingJson = path.join(tracingEnvironmentDir, "start-tracing.json");
+        fs.writeFileSync(startTracingJson, JSON.stringify(startTracingEnv));
+        const result = await (0, tracer_config_1.getCombinedTracerConfig)(config);
+        t.notDeepEqual(result, undefined);
+        const expectedEnv = startTracingEnv;
         if (process.platform === "win32") {
             expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/win64/runner.exe");
         }
@@ -327,7 +94,6 @@ function getTestConfig(tmpDir) {
             expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/linux64/runner");
         }
         t.deepEqual(result, {
-            spec: path.join(tmpDir, "compound-spec"),
             env: expectedEnv,
         });
     });

lib/trap-caching.test.js

@@ -33,6 +33,7 @@ const ava_1 = __importDefault(require("ava"));
 const sinon = __importStar(require("sinon"));
 const actionsUtil = __importStar(require("./actions-util"));
 const codeql_1 = require("./codeql");
+const configUtils = __importStar(require("./config-utils"));
 const languages_1 = require("./languages");
 const testing_utils_1 = require("./testing-utils");
 const trap_caching_1 = require("./trap-caching");
@@ -94,11 +95,7 @@ const testConfigWithoutTmpDir = {
     debugMode: false,
     debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
     debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-    augmentationProperties: {
-        injectedMlQueries: false,
-        packsInputCombines: false,
-        queriesInputCombines: false,
-    },
+    augmentationProperties: configUtils.defaultAugmentationProperties,
     trapCaches: {
         javascript: "/some/cache/dir",
     },
@@ -119,11 +116,7 @@ function getTestConfigWithTempDir(tmpDir) {
         debugMode: false,
         debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
         debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-        augmentationProperties: {
-            injectedMlQueries: false,
-            packsInputCombines: false,
-            queriesInputCombines: false,
-        },
+        augmentationProperties: configUtils.defaultAugmentationProperties,
         trapCaches: {
             javascript: path.resolve(tmpDir, "jsCache"),
             ruby: path.resolve(tmpDir, "rubyCache"),

lib/util.js

@@ -337,9 +337,11 @@ exports.assertNever = assertNever;
  * knowing what version of CodeQL we're running.
  */
 function initializeEnvironment(version) {
-    core.exportVariable(String(shared_environment_1.EnvVar.VERSION), version);
+    core.exportVariable(String(shared_environment_1.EnvVar.FEATURE_MULTI_LANGUAGE), "false");
+    core.exportVariable(String(shared_environment_1.EnvVar.FEATURE_SANDWICH), "false");
     core.exportVariable(String(shared_environment_1.EnvVar.FEATURE_SARIF_COMBINE), "true");
     core.exportVariable(String(shared_environment_1.EnvVar.FEATURE_WILL_UPLOAD), "true");
+    core.exportVariable(String(shared_environment_1.EnvVar.VERSION), version);
 }
 exports.initializeEnvironment = initializeEnvironment;
 /**

lib/util.test.js

@@ -33,6 +33,7 @@ const github = __importStar(require("@actions/github"));
 const ava_1 = __importDefault(require("ava"));
 const sinon = __importStar(require("sinon"));
 const api = __importStar(require("./api-client"));
+const config_utils_1 = require("./config-utils");
 const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
@@ -241,11 +242,7 @@ for (const [packs, expectedStatus] of ML_POWERED_JS_STATUS_TESTS) {
                 debugMode: false,
                 debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
                 debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-                augmentationProperties: {
-                    injectedMlQueries: false,
-                    packsInputCombines: false,
-                    queriesInputCombines: false,
-                },
+                augmentationProperties: config_utils_1.defaultAugmentationProperties,
                 trapCaches: {},
                 trapCacheDownloadTime: 0,
             };

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.2.13",
+  "version": "2.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.2.13",
+  "version": "2.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.2.13",
+      "version": "2.3.0",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.2.13",
+  "version": "2.3.0",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

pr-checks/checks/export-file-baseline-information.yml

@@ -1,8 +1,6 @@
 name: "Export file baseline information"
 description: "Tests that file baseline information is exported when the feature is enabled"
 versions: ["nightly-latest"]
-env: 
-  CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: true # Remove when Swift is GA.
 steps:
   - uses: ./../action/init
     id: init
@@ -32,7 +30,10 @@ steps:
     shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
-      expected_baseline_languages="cpp cs go java js py rb swift"
+      expected_baseline_languages="cpp cs go java js py rb"
+      if [[ $RUNNER_OS != "Windows" ]]; then
+        expected_baseline_languages+=" swift"
+      fi
 
       for lang in ${expected_baseline_languages}; do
         rule_name="${lang}/baseline/expected-extracted-files"

pr-checks/checks/ml-powered-queries.yml

@@ -1,12 +1,5 @@
 name: "ML-powered queries"
 description: "Tests that ML-powered queries are run with the security-extended suite and that they produce alerts on a test DB"
-versions: [
-    # Latest release in 2.7.x series
-    "stable-20220120",
-    "cached",
-    "latest",
-    "nightly-latest",
-  ]
 steps:
   - uses: ./../action/init
     with:
@@ -30,7 +23,7 @@ steps:
   - name: Check sarif
     uses: ./../action/.github/actions/check-sarif
     # Running on Windows requires CodeQL CLI 2.9.0+.
-    if: "!(matrix.version == 'stable-20220120' && runner.os == 'Windows')"
+    if: "!(matrix.version == 'stable-20220401' && runner.os == 'Windows')"
     with:
       sarif-file: ${{ runner.temp }}/results/javascript.sarif
       queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
@@ -39,7 +32,7 @@ steps:
   - name: Check results
     env:
       # Running on Windows requires CodeQL CLI 2.9.0+.
-      SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220120' && runner.os == 'Windows') }}
+      SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220401' && runner.os == 'Windows') }}
     shell: bash
     run: |
       echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"

pr-checks/checks/multi-language-autodetect.yml

@@ -1,8 +1,6 @@
 name: "Multi-language repository"
 description: "An end-to-end integration test of a multi-language repository using automatic language detection"
 operatingSystems: ["ubuntu", "macos"]
-env:
-  CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: "true" # Remove when Swift is GA.
 steps:
   - uses: ./../action/init
     id: init
@@ -12,7 +10,7 @@ steps:
 
   - uses: ./../action/.github/actions/setup-swift
     with:
-      codeql-path: ${{steps.init.outputs.codeql-path}}
+      codeql-path: ${{ steps.init.outputs.codeql-path }}
 
   - name: Build code
     shell: bash
@@ -58,7 +56,7 @@ steps:
       fi
 
   - name: Check language autodetect for Ruby
-    if: "(matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
+    if: env.CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT == 'true'
     shell: bash
     run: |
       RUBY_DB=${{ fromJson(steps.analysis.outputs.db-locations).ruby }}
@@ -68,7 +66,7 @@ steps:
       fi
 
   - name: Check language autodetect for Swift
-    if: "(matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
+    if: env.CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT == 'true'
     shell: bash
     run: |
       SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}

pr-checks/checks/swift-custom-build.yml

@@ -3,7 +3,6 @@ description: "Tests creation of a Swift database using custom build"
 versions: ["latest", "cached", "nightly-latest"]
 operatingSystems: ["ubuntu", "macos"]
 env:
-  CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: "true" # Remove when Swift is GA.
   DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
 steps:
   - uses: ./../action/init

pr-checks/checks/test-local-codeql.yml

@@ -9,9 +9,13 @@ steps:
       CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
     run: |
       wget "$CODEQL_URL"
-  - uses: ./../action/init
+  - id: init
+    uses: ./../action/init
     with:
       tools: ./codeql-bundle.tar.gz
+  - uses: ./../action/.github/actions/setup-swift
+    with:
+      codeql-path: ${{ steps.init.outputs.codeql-path }}
   - name: Build code
     shell: bash
     run: ./build.sh

pr-checks/checks/unset-environment.yml

@@ -3,9 +3,13 @@ description: "An end-to-end integration test that unsets some environment variab
 operatingSystems: ["ubuntu"]
 steps:
   - uses: ./../action/init
+    id: init
     with:
       db-location: ${{ runner.temp }}/customDbLocation
       tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - uses: ./../action/.github/actions/setup-swift
+    with:
+      codeql-path: ${{ steps.init.outputs.codeql-path }}
   - name: Build code
     shell: bash
     # Disable Kotlin analysis while it's incompatible with Kotlin 1.8, until we find a

pr-checks/sync.py

@@ -1,14 +1,18 @@
 import ruamel.yaml
+from ruamel.yaml.scalarstring import FoldedScalarString
 import os
+import textwrap
 
 # The default set of CodeQL Bundle versions to use for the PR checks.
 defaultTestVersions = [
-    # The oldest supported CodeQL version: 2.6.3. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
-    "stable-20211005",
-    # The last CodeQL release in the 2.7 series: 2.7.6.
-    "stable-20220120",
-    # The last CodeQL release in the 2.8 series: 2.8.5.
+    # The oldest supported CodeQL version: 2.8.5. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
     "stable-20220401",
+    # The last CodeQL release in the 2.9 series: 2.9.4.
+    "stable-20220615",
+    # The last CodeQL release in the 2.10 series: 2.10.5.
+    "stable-20220908",
+    # The last CodeQL release in the 2.11 series: 2.11.6.
+    "stable-20221211",
     # The version of CodeQL currently in the toolcache. Typically either the latest release or the one before.
     "cached",
     # The latest release of CodeQL.
@@ -18,22 +22,6 @@ defaultTestVersions = [
 ]
 
 
-def isCompatibleWithLatestImages(version):
-    if version in ["cached", "latest", "nightly-latest"]:
-        return True
-    date = version.split("-")[1]
-    # The first version of the CodeQL CLI compatible with `ubuntu-22.04` and `windows-2022` is
-    # 2.8.2. This appears in CodeQL Bundle version codeql-bundle-20220224.
-    return date >= "20220224"
-
-
-def operatingSystemsForVersion(version):
-    if isCompatibleWithLatestImages(version):
-        return ["ubuntu-latest", "macos-latest", "windows-latest"]
-    else:
-        return ["ubuntu-20.04", "macos-latest", "windows-2019"]
-
-
 header = """# Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
 #     pip install ruamel.yaml && python3 sync.py
@@ -53,6 +41,7 @@ def writeHeader(checkStream):
 
 yaml = ruamel.yaml.YAML()
 yaml.Representer = NonAliasingRTRepresenter
+
 allJobs = {}
 for file in os.listdir('checks'):
     with open(f"checks/{file}", 'r') as checkStream:
@@ -60,7 +49,7 @@ for file in os.listdir('checks'):
 
     matrix = []
     for version in checkSpecification.get('versions', defaultTestVersions):
-        runnerImages = operatingSystemsForVersion(version)
+        runnerImages = ["ubuntu-latest", "macos-latest", "windows-latest"]
         if checkSpecification.get('operatingSystems', None):
             runnerImages = [image for image in runnerImages for operatingSystem in checkSpecification['operatingSystems']
                             if image.startswith(operatingSystem)]
@@ -83,19 +72,26 @@ for file in os.listdir('checks'):
             'with': {
                 'version': '${{ matrix.version }}'
             }
-        }
+        },
+        # We don't support Swift on Windows or prior versions of the CLI.
+        {
+            'name': 'Set environment variable for Swift enablement',
+            # Ensure that this is serialized as a folded (`>`) string to preserve the readability
+            # of the generated workflow.
+            'if': FoldedScalarString(textwrap.dedent('''
+                runner.os != 'Windows' && (
+                    matrix.version == '20220908' ||
+                    matrix.version == '20221211' ||
+                    matrix.version == 'cached' ||
+                    matrix.version == 'latest' ||
+                    matrix.version == 'nightly-latest'
+                )
+            ''').strip()),
+            'shell': 'bash',
+            'run': 'echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV'
+        },
     ]
 
-    if any(not isCompatibleWithLatestImages(m['version']) for m in matrix):
-        steps.append({
-            'name': 'Set up Go',
-            'if': "matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'",
-            'uses': 'actions/setup-go@v4',
-            'with': {
-                'go-version': '^1.13.1'
-            }
-        })
-
     steps.extend(checkSpecification['steps'])
 
     checkJob = {

queries/.cache/data/17/bd/17bd99d2be870a62a10c01563195dedb396d1073

@@ -0,0 +1,30 @@
+ #      Precompiled CodeQL query
+---
+format:
+- 202210190
+creator: "2.12.0"
+name: "binary-planting.ql"
+dbscheme: "4d00210ca570d55c4833af11d3372b774dbc63f2"
+stages:
+- cached: "eab2ee2a0540ade3989ca6057981f91dca87e8dd"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "e3d73e04276e1e7d870422c3d0b20a77b26134bd"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "4d38c88bc217c78abc64ea4bde9d82e4fb9dceb5"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "f5fe3c8ecd3c4f7f23db589fc5beedd3b98350c8"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "6b91c5ace67fc41b3fc7b66fbe4f1656e5021299"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "e12de1ddade327e68a2446986356414403060359"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "27e1a12ac46e3b189b87c28330e49073e43901d6"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+results:
+  nodes:
+    resultArranger: "1\"nd\"ei12"
+  edges:
+    resultArranger: "2\"pred\"ei12\"succ\"ei12"
+  '#select':
+    resultArranger: "40ei12\"source\"ei12\"sink\"ei120s"
+inputsDigest: "17bd99d2be870a62a10c01563195dedb396d1073"

queries/.cache/data/18/0d/180d77cb5041c05f39bbe8ae402fd801e1bed99d

@@ -0,0 +1,30 @@
+ #      Precompiled CodeQL query
+---
+format:
+- 202210190
+creator: "2.12.0"
+name: "binary-planting.ql"
+dbscheme: "4d00210ca570d55c4833af11d3372b774dbc63f2"
+stages:
+- cached: "eab2ee2a0540ade3989ca6057981f91dca87e8dd"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "e3d73e04276e1e7d870422c3d0b20a77b26134bd"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "4d38c88bc217c78abc64ea4bde9d82e4fb9dceb5"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "f5fe3c8ecd3c4f7f23db589fc5beedd3b98350c8"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "6b91c5ace67fc41b3fc7b66fbe4f1656e5021299"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "e12de1ddade327e68a2446986356414403060359"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+- cached: "ed12e9ba01052a2f5f25e424440b0348fb968160"
+  debugInfo: "fecaa121855b37cb5060daceb1adc2e02056f801"
+results:
+  nodes:
+    resultArranger: "1\"nd\"ei12"
+  edges:
+    resultArranger: "2\"pred\"ei12\"succ\"ei12"
+  '#select':
+    resultArranger: "40ei12\"source\"ei12\"sink\"ei120s"
+inputsDigest: "180d77cb5041c05f39bbe8ae402fd801e1bed99d"

src/analysis-paths.test.ts

@@ -3,6 +3,7 @@ import * as path from "path";
 import test from "ava";
 
 import * as analysisPaths from "./analysis-paths";
+import { defaultAugmentationProperties } from "./config-utils";
 import { setupTests } from "./testing-utils";
 import * as util from "./util";
 
@@ -24,11 +25,7 @@ test("emptyPaths", async (t) => {
       debugMode: false,
       debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
       debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-      augmentationProperties: {
-        injectedMlQueries: false,
-        packsInputCombines: false,
-        queriesInputCombines: false,
-      },
+      augmentationProperties: defaultAugmentationProperties,
       trapCaches: {},
       trapCacheDownloadTime: 0,
     };
@@ -55,11 +52,7 @@ test("nonEmptyPaths", async (t) => {
       debugMode: false,
       debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
       debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-      augmentationProperties: {
-        injectedMlQueries: false,
-        packsInputCombines: false,
-        queriesInputCombines: false,
-      },
+      augmentationProperties: defaultAugmentationProperties,
       trapCaches: {},
       trapCacheDownloadTime: 0,
     };
@@ -89,11 +82,7 @@ test("exclude temp dir", async (t) => {
     debugMode: false,
     debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
     debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-    augmentationProperties: {
-      injectedMlQueries: false,
-      packsInputCombines: false,
-      queriesInputCombines: false,
-    },
+    augmentationProperties: defaultAugmentationProperties,
     trapCaches: {},
     trapCacheDownloadTime: 0,
   };

src/analyze-action.ts

@@ -16,7 +16,7 @@ import {
 } from "./analyze";
 import { getApiDetails, getGitHubVersion } from "./api-client";
 import { runAutobuild } from "./autobuild";
-import { enrichEnvironment, getCodeQL } from "./codeql";
+import { getCodeQL } from "./codeql";
 import { Config, getConfig } from "./config-utils";
 import { uploadDatabases } from "./database-upload";
 import { Features } from "./feature-flags";
@@ -207,8 +207,6 @@ async function run() {
       );
     }
 
-    await enrichEnvironment(await getCodeQL(config.codeQLCmd));
-
     const apiDetails = getApiDetails();
     const outputDir = actionsUtil.getRequiredInput("output");
     const threads = util.getThreadsFlag(

src/analyze.test.ts

@@ -13,7 +13,11 @@ import {
   QueriesStatusReport,
 } from "./analyze";
 import { CodeQL, setCodeQL } from "./codeql";
-import { Config, QueriesWithSearchPath } from "./config-utils";
+import {
+  Config,
+  QueriesWithSearchPath,
+  defaultAugmentationProperties,
+} from "./config-utils";
 import { Feature } from "./feature-flags";
 import { Language } from "./languages";
 import { getRunnerLogger } from "./logging";
@@ -111,11 +115,7 @@ test("status report fields and search path setting", async (t) => {
         debugMode: false,
         debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
         debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-        augmentationProperties: {
-          injectedMlQueries: false,
-          packsInputCombines: false,
-          queriesInputCombines: false,
-        },
+        augmentationProperties: defaultAugmentationProperties,
         trapCaches: {},
         trapCacheDownloadTime: 0,
       };
@@ -258,11 +258,7 @@ function createBaseConfig(tmpDir: string): Config {
     debugMode: false,
     debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
     debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
-    augmentationProperties: {
-      injectedMlQueries: false,
-      packsInputCombines: false,
-      queriesInputCombines: false,
-    },
+    augmentationProperties: defaultAugmentationProperties,
     trapCaches: {},
     trapCacheDownloadTime: 0,
   };

src/analyze.ts

@@ -8,12 +8,11 @@ import * as yaml from "js-yaml";
 
 import { DatabaseCreationTimings } from "./actions-util";
 import * as analysisPaths from "./analysis-paths";
-import { CodeQL, CODEQL_VERSION_NEW_TRACING, getCodeQL } from "./codeql";
+import { CodeQL, getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { FeatureEnablement } from "./feature-flags";
 import { isScannedLanguage, Language } from "./languages";
 import { Logger } from "./logging";
-import * as sharedEnv from "./shared-environment";
 import { endTracingForCluster } from "./tracer-config";
 import * as util from "./util";
 
@@ -493,19 +492,13 @@ export async function runFinalize(
     logger
   );
 
-  const codeql = await getCodeQL(config.codeQLCmd);
   // WARNING: This does not _really_ end tracing, as the tracer will restore its
   // critical environment variables and it'll still be active for all processes
   // launched from this build step.
   // However, it will stop tracing for all steps past the codeql-action/analyze
   // step.
-  if (await util.codeQlVersionAbove(codeql, CODEQL_VERSION_NEW_TRACING)) {
-    // Delete variables as specified by the end-tracing script
-    await endTracingForCluster(config);
-  } else {
-    // Delete the tracer config env var to avoid tracing ourselves
-    delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
-  }
+  // Delete variables as specified by the end-tracing script
+  await endTracingForCluster(config);
   return timings;
 }
 

src/codeql.test.ts

@@ -69,6 +69,7 @@ test.beforeEach(() => {
     debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
     debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
     augmentationProperties: {
+      threatModelsInputCombines: false,
       injectedMlQueries: false,
       packsInputCombines: false,
       queriesInputCombines: false,
@@ -682,6 +683,7 @@ test("databaseInitCluster() without injected codescanning config", async (t) =>
       ...stubConfig,
       tempDir,
       augmentationProperties: {
+        threatModelsInputCombines: false,
         injectedMlQueries: false,
         queriesInputCombines: false,
         packsInputCombines: false,
@@ -762,6 +764,7 @@ test(
     injectedMlQueries: false,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
   },
   {},
   {}
@@ -774,6 +777,7 @@ test(
     injectedMlQueries: true,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
   },
   {},
   {
@@ -788,6 +792,7 @@ test(
     injectedMlQueries: true,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
   },
   {
     originalUserInput: {
@@ -811,6 +816,7 @@ test(
     injectedMlQueries: true,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
   },
   {
     originalUserInput: {
@@ -833,6 +839,7 @@ test(
     queriesInputCombines: false,
     packsInputCombines: false,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
   },
   {},
   {
@@ -848,6 +855,7 @@ test(
     queriesInputCombines: false,
     packsInputCombines: true,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
   },
   {
     originalUserInput: {
@@ -871,6 +879,7 @@ test(
     queriesInputCombines: false,
     packsInputCombines: false,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
   },
   {
     originalUserInput: {
@@ -892,6 +901,7 @@ test(
     queriesInputCombines: false,
     packsInputCombines: false,
     packsInput: ["xxx", "yyy"],
+    threatModelsInputCombines: false,
   },
   {
     originalUserInput: {
@@ -913,6 +923,7 @@ test(
     injectedMlQueries: false,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
   },
   {},
@@ -935,6 +946,7 @@ test(
     injectedMlQueries: false,
     queriesInputCombines: false,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
   },
   {
@@ -961,6 +973,7 @@ test(
     injectedMlQueries: false,
     queriesInputCombines: true,
     packsInputCombines: false,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
   },
   {
@@ -990,6 +1003,7 @@ test(
     injectedMlQueries: false,
     queriesInputCombines: true,
     packsInputCombines: true,
+    threatModelsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
   },
   {},
@@ -1012,6 +1026,7 @@ test(
     injectedMlQueries: false,
     queriesInputCombines: true,
     packsInputCombines: true,
+    threatModelsInputCombines: false,
     queriesInput: [],
     packsInput: [],
   },
@@ -1024,6 +1039,71 @@ test(
   {}
 );
 
+test(
+  "threat model from config",
+  injectedConfigMacro,
+  {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    threatModelsInputCombines: false,
+    queriesInput: [],
+    packsInput: [],
+  },
+  {
+    originalUserInput: {
+      "threat-models": ["a", "b"],
+    },
+  },
+  {
+    "threat-models": ["a", "b"],
+  }
+);
+
+test(
+  "threat model from input overrides config",
+  injectedConfigMacro,
+  {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    threatModelsInputCombines: false,
+    threatModelsInput: ["a", "b"],
+    queriesInput: [],
+    packsInput: [],
+  },
+  {
+    originalUserInput: {
+      "threat-models": ["c", "d"],
+    },
+  },
+  {
+    "threat-models": ["a", "b"],
+  }
+);
+
+test(
+  "threat model from input combines with config",
+  injectedConfigMacro,
+  {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    threatModelsInputCombines: true,
+    threatModelsInput: ["a", "b"],
+    queriesInput: [],
+    packsInput: [],
+  },
+  {
+    originalUserInput: {
+      "threat-models": ["c", "d"],
+    },
+  },
+  {
+    "threat-models": ["c", "d", "a", "b"],
+  }
+);
+
 test("does not pass a code scanning config or qlconfig file to the CLI when CLI config passing is disabled", async (t: ExecutionContext<unknown>) => {
   await util.withTmpDir(async (tempDir) => {
     const runnerConstructorStub = stubToolRunnerConstructor();

src/codeql.ts

@@ -1,7 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import * as core from "@actions/core";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as yaml from "js-yaml";
 
@@ -18,7 +17,6 @@ import { ToolsSource } from "./init";
 import { isTracedLanguage, Language } from "./languages";
 import { Logger } from "./logging";
 import * as setupCodeql from "./setup-codeql";
-import { EnvVar } from "./shared-environment";
 import { toolrunnerErrorCatcher } from "./toolrunner-error-catcher";
 import {
   getTrapCachingExtractorConfigArgs,
@@ -77,19 +75,6 @@ export interface CodeQL {
    * Print version information about CodeQL.
    */
   printVersion(): Promise<void>;
-  /**
-   * Run 'codeql database trace-command' on 'tracer-env.js' and parse
-   * the result to get environment variables set by CodeQL.
-   */
-  getTracerEnv(databasePath: string): Promise<{ [key: string]: string }>;
-  /**
-   * Run 'codeql database init'.
-   */
-  databaseInit(
-    databasePath: string,
-    language: Language,
-    sourceRoot: string
-  ): Promise<void>;
   /**
    * Run 'codeql database init --db-cluster'.
    */
@@ -267,7 +252,7 @@ let cachedCodeQL: CodeQL | undefined = undefined;
  * The version flags below can be used to conditionally enable certain features
  * on versions newer than this.
  */
-const CODEQL_MINIMUM_VERSION = "2.6.3";
+const CODEQL_MINIMUM_VERSION = "2.8.5";
 
 /**
  * Versions of CodeQL that version-flag certain functionality in the Action.
@@ -280,23 +265,6 @@ const CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED = "2.10.4";
 export const CODEQL_VERSION_GHES_PACK_DOWNLOAD = "2.10.4";
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
 
-/**
- * This variable controls using the new style of tracing from the CodeQL
- * CLI. In particular, with versions above this we will use both indirect
- * tracing, and multi-language tracing together with database clusters.
- *
- * Note that there were bugs in both of these features that were fixed in
- * release 2.7.0 of the CodeQL CLI, therefore this flag is only enabled for
- * versions above that.
- */
-export const CODEQL_VERSION_NEW_TRACING = "2.7.0";
-
-/**
- * Versions 2.7.3+ of the CodeQL CLI support build tracing with glibc 2.34 on Linux. Versions before
- * this cannot perform build tracing when running on the Actions `ubuntu-22.04` runner image.
- */
-export const CODEQL_VERSION_TRACING_GLIBC_2_34 = "2.7.3";
-
 /**
  * Versions 2.9.0+ of the CodeQL CLI run machine learning models from a temporary directory, which
  * resolves an issue on Windows where TensorFlow models are not correctly loaded due to the path of
@@ -419,8 +387,6 @@ export function setCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {
       () => new Promise((resolve) => resolve("1.0.0"))
     ),
     printVersion: resolveFunction(partialCodeql, "printVersion"),
-    getTracerEnv: resolveFunction(partialCodeql, "getTracerEnv"),
-    databaseInit: resolveFunction(partialCodeql, "databaseInit"),
     databaseInitCluster: resolveFunction(partialCodeql, "databaseInitCluster"),
     runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),
     extractScannedLanguage: resolveFunction(
@@ -507,94 +473,6 @@ export async function getCodeQLForCmd(
     async printVersion() {
       await runTool(cmd, ["version", "--format=json"]);
     },
-    async getTracerEnv(databasePath: string) {
-      // Write tracer-env.js to a temp location.
-      // BEWARE: The name and location of this file is recognized by `codeql database
-      // trace-command` in order to enable special support for concatenable tracer
-      // configurations. Consequently the name must not be changed.
-      // (This warning can be removed once a different way to recognize the
-      // action/runner has been implemented in `codeql database trace-command`
-      // _and_ is present in the latest supported CLI release.)
-      const tracerEnvJs = path.resolve(
-        databasePath,
-        "working",
-        "tracer-env.js"
-      );
-
-      fs.mkdirSync(path.dirname(tracerEnvJs), { recursive: true });
-      fs.writeFileSync(
-        tracerEnvJs,
-        `
-        const fs = require('fs');
-        const env = {};
-        for (let entry of Object.entries(process.env)) {
-          const key = entry[0];
-          const value = entry[1];
-          if (typeof value !== 'undefined' && key !== '_' && !key.startsWith('JAVA_MAIN_CLASS_')) {
-            env[key] = value;
-          }
-        }
-        process.stdout.write(process.argv[2]);
-        fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');`
-      );
-
-      // BEWARE: The name and location of this file is recognized by `codeql database
-      // trace-command` in order to enable special support for concatenable tracer
-      // configurations. Consequently the name must not be changed.
-      // (This warning can be removed once a different way to recognize the
-      // action/runner has been implemented in `codeql database trace-command`
-      // _and_ is present in the latest supported CLI release.)
-      const envFile = path.resolve(databasePath, "working", "env.tmp");
-
-      try {
-        await runTool(cmd, [
-          "database",
-          "trace-command",
-          databasePath,
-          ...getExtraOptionsFromEnv(["database", "trace-command"]),
-          process.execPath,
-          tracerEnvJs,
-          envFile,
-        ]);
-      } catch (e) {
-        if (
-          e instanceof CommandInvocationError &&
-          e.output.includes(
-            "undefined symbol: __libc_dlopen_mode, version GLIBC_PRIVATE"
-          ) &&
-          process.platform === "linux" &&
-          !(await util.codeQlVersionAbove(
-            this,
-            CODEQL_VERSION_TRACING_GLIBC_2_34
-          ))
-        ) {
-          throw new util.UserError(
-            "The CodeQL CLI is incompatible with the version of glibc on your system. " +
-              `Please upgrade to CodeQL CLI version ${CODEQL_VERSION_TRACING_GLIBC_2_34} or ` +
-              "later. If you cannot upgrade to a newer version of the CodeQL CLI, you can " +
-              `alternatively run your workflow on another runner image such as "ubuntu-20.04" ` +
-              "that has glibc 2.33 or earlier installed."
-          );
-        } else {
-          throw e;
-        }
-      }
-      return JSON.parse(fs.readFileSync(envFile, "utf-8"));
-    },
-    async databaseInit(
-      databasePath: string,
-      language: Language,
-      sourceRoot: string
-    ) {
-      await runTool(cmd, [
-        "database",
-        "init",
-        databasePath,
-        `--language=${language}`,
-        `--source-root=${sourceRoot}`,
-        ...getExtraOptionsFromEnv(["database", "init"]),
-      ]);
-    },
     async databaseInitCluster(
       config: Config,
       sourceRoot: string,
@@ -1256,6 +1134,7 @@ async function generateCodeScanningConfig(
   if (Array.isArray(augmentedConfig.packs) && !augmentedConfig.packs.length) {
     delete augmentedConfig.packs;
   }
+
   if (config.augmentationProperties.injectedMlQueries) {
     // We need to inject the ML queries into the original user input before
     // we pass this on to the CLI, to make sure these get run.
@@ -1270,6 +1149,28 @@ async function generateCodeScanningConfig(
       augmentedConfig.packs["javascript"].push(packString);
     }
   }
+
+  // Inject the threat-models from the input
+  if (config.augmentationProperties.threatModelsInput) {
+    if (config.augmentationProperties.threatModelsInputCombines) {
+      // threat-models input combines with threat-models from the config file
+      // (if any were defined).
+      augmentedConfig["threat-models"] = (
+        augmentedConfig["threat-models"] || []
+      ).concat(config.augmentationProperties.threatModelsInput);
+    } else {
+      // threat-models input overrides threat-models from the config file
+      augmentedConfig["threat-models"] =
+        config.augmentationProperties.threatModelsInput;
+    }
+  }
+  if (
+    Array.isArray(augmentedConfig["threat-models"]) &&
+    !augmentedConfig["threat-models"].length
+  ) {
+    delete augmentedConfig["threat-models"];
+  }
+
   logger.info(
     `Writing augmented user configuration file to ${codeScanningConfigFile}`
   );
@@ -1305,17 +1206,3 @@ async function getCodeScanningConfigExportArguments(
   }
   return [];
 }
-
-/**
- * Enrich the environment variables with further flags that we cannot
- * know the value of until we know what version of CodeQL we're running.
- */
-export async function enrichEnvironment(codeql: CodeQL) {
-  if (await util.codeQlVersionAbove(codeql, CODEQL_VERSION_NEW_TRACING)) {
-    core.exportVariable(EnvVar.FEATURE_MULTI_LANGUAGE, "false");
-    core.exportVariable(EnvVar.FEATURE_SANDWICH, "false");
-  } else {
-    core.exportVariable(EnvVar.FEATURE_MULTI_LANGUAGE, "true");
-    core.exportVariable(EnvVar.FEATURE_SANDWICH, "true");
-  }
-}

src/config-utils.test.ts

@@ -105,6 +105,7 @@ test("load empty config", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       false,
       false,
       "",
@@ -126,6 +127,7 @@ test("load empty config", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         false,
         false,
         "",
@@ -176,6 +178,7 @@ test("loading config saves config", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       false,
       false,
       "",
@@ -212,6 +215,7 @@ test("load input outside of workspace", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         "../input",
         undefined,
         false,
@@ -252,6 +256,7 @@ test("load non-local input with invalid repo syntax", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         configFile,
         undefined,
         false,
@@ -293,6 +298,7 @@ test("load non-existent input", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         configFile,
         undefined,
         false,
@@ -400,6 +406,7 @@ test("load non-empty input", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       configFilePath,
       undefined,
       false,
@@ -471,6 +478,7 @@ test("Default queries are used", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       configFilePath,
       undefined,
       false,
@@ -550,6 +558,7 @@ test("Queries can be specified in config file", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       configFilePath,
       undefined,
       false,
@@ -628,6 +637,7 @@ test("Queries from config file can be overridden in workflow file", async (t) =>
       testQueries,
       undefined,
       undefined,
+      undefined,
       configFilePath,
       undefined,
       false,
@@ -704,6 +714,7 @@ test("Queries in workflow file can be used in tandem with the 'disable default q
       testQueries,
       undefined,
       undefined,
+      undefined,
       configFilePath,
       undefined,
       false,
@@ -773,6 +784,7 @@ test("Multiple queries can be specified in workflow file, no config file require
       undefined,
       undefined,
       undefined,
+      undefined,
       false,
       false,
       "",
@@ -859,6 +871,7 @@ test("Queries in workflow file can be added to the set of queries without overri
       testQueries,
       undefined,
       undefined,
+      undefined,
       configFilePath,
       undefined,
       false,
@@ -943,6 +956,7 @@ test("Invalid queries in workflow file handled correctly", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         false,
         false,
         "",
@@ -1013,6 +1027,7 @@ test("API client used when reading remote config", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       configFile,
       undefined,
       false,
@@ -1044,6 +1059,7 @@ test("Remote config handles the case where a directory is provided", async (t) =
         undefined,
         undefined,
         undefined,
+        undefined,
         repoReference,
         undefined,
         false,
@@ -1083,6 +1099,7 @@ test("Invalid format of remote config handled correctly", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         repoReference,
         undefined,
         false,
@@ -1128,6 +1145,7 @@ test("No detected languages", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         false,
         false,
         "",
@@ -1160,6 +1178,7 @@ test("Unknown languages", async (t) => {
         undefined,
         undefined,
         undefined,
+        undefined,
         false,
         false,
         "",
@@ -1215,6 +1234,7 @@ test("Config specifies packages", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       configFile,
       undefined,
       false,
@@ -1276,6 +1296,7 @@ test("Config specifies packages for multiple languages", async (t) => {
       undefined,
       undefined,
       undefined,
+      undefined,
       configFile,
       undefined,
       false,
@@ -1348,6 +1369,7 @@ function doInvalidInputTest(
           undefined,
           undefined,
           undefined,
+          undefined,
           configFile,
           undefined,
           false,
@@ -1934,6 +1956,7 @@ const mlPoweredQueriesMacro = test.macro({
         undefined,
         undefined,
         undefined,
+        undefined,
         false,
         false,
         "",
@@ -2105,12 +2128,14 @@ const calculateAugmentationMacro = test.macro({
     _title: string,
     rawPacksInput: string | undefined,
     rawQueriesInput: string | undefined,
+    rawThreatModelsInput: string | undefined,
     languages: Language[],
     expectedAugmentationProperties: configUtils.AugmentationProperties
   ) => {
     const actualAugmentationProperties = configUtils.calculateAugmentation(
       rawPacksInput,
       rawQueriesInput,
+      rawThreatModelsInput,
       languages
     );
     t.deepEqual(actualAugmentationProperties, expectedAugmentationProperties);
@@ -2123,12 +2148,15 @@ test(
   "All empty",
   undefined,
   undefined,
+  undefined,
   [Language.javascript],
   {
     queriesInputCombines: false,
     queriesInput: undefined,
     packsInputCombines: false,
     packsInput: undefined,
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
   } as configUtils.AugmentationProperties
 );
@@ -2138,12 +2166,15 @@ test(
   "With queries",
   undefined,
   " a, b , c, d",
+  undefined,
   [Language.javascript],
   {
     queriesInputCombines: false,
     queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
     packsInputCombines: false,
     packsInput: undefined,
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
   } as configUtils.AugmentationProperties
 );
@@ -2153,12 +2184,15 @@ test(
   "With queries combining",
   undefined,
   "   +   a, b , c, d ",
+  undefined,
   [Language.javascript],
   {
     queriesInputCombines: true,
     queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
     packsInputCombines: false,
     packsInput: undefined,
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
   } as configUtils.AugmentationProperties
 );
@@ -2168,12 +2202,15 @@ test(
   "With packs",
   "   codeql/a , codeql/b   , codeql/c  , codeql/d  ",
   undefined,
+  undefined,
   [Language.javascript],
   {
     queriesInputCombines: false,
     queriesInput: undefined,
     packsInputCombines: false,
     packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
     injectedMlQueries: false,
   } as configUtils.AugmentationProperties
 );
@@ -2183,12 +2220,51 @@ test(
   "With packs combining",
   "   +   codeql/a, codeql/b, codeql/c, codeql/d",
   undefined,
+  undefined,
   [Language.javascript],
   {
     queriesInputCombines: false,
     queriesInput: undefined,
     packsInputCombines: true,
     packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
+    threatModelsInputCombines: false,
+    threatModelsInput: undefined,
+    injectedMlQueries: false,
+  } as configUtils.AugmentationProperties
+);
+
+test(
+  calculateAugmentationMacro,
+  "With threat model",
+  undefined,
+  undefined,
+  "   a , b   , c  , d  ",
+  [Language.javascript],
+  {
+    queriesInputCombines: false,
+    queriesInput: undefined,
+    packsInput: undefined,
+    packsInputCombines: false,
+    threatModelsInput: ["a", "b", "c", "d"],
+    threatModelsInputCombines: false,
+    injectedMlQueries: false,
+  } as configUtils.AugmentationProperties
+);
+
+test(
+  calculateAugmentationMacro,
+  "With threat model combining",
+  undefined,
+  undefined,
+  " +  a , b   , c  , d  ",
+  [Language.javascript],
+  {
+    queriesInput: undefined,
+    queriesInputCombines: false,
+    packsInput: undefined,
+    packsInputCombines: false,
+    threatModelsInput: ["a", "b", "c", "d"],
+    threatModelsInputCombines: true,
     injectedMlQueries: false,
   } as configUtils.AugmentationProperties
 );
@@ -2199,6 +2275,7 @@ const calculateAugmentationErrorMacro = test.macro({
     _title: string,
     rawPacksInput: string | undefined,
     rawQueriesInput: string | undefined,
+    rawThreatModelsInput: string | undefined,
     languages: Language[],
     expectedError: RegExp | string
   ) => {
@@ -2207,6 +2284,7 @@ const calculateAugmentationErrorMacro = test.macro({
         configUtils.calculateAugmentation(
           rawPacksInput,
           rawQueriesInput,
+          rawThreatModelsInput,
           languages
         ),
       { message: expectedError }
@@ -2220,6 +2298,7 @@ test(
   "Plus (+) with nothing else (queries)",
   undefined,
   "   +   ",
+  undefined,
   [Language.javascript],
   /The workflow property "queries" is invalid/
 );
@@ -2229,6 +2308,7 @@ test(
   "Plus (+) with nothing else (packs)",
   "   +   ",
   undefined,
+  undefined,
   [Language.javascript],
   /The workflow property "packs" is invalid/
 );
@@ -2238,6 +2318,7 @@ test(
   "Packs input with multiple languages",
   "   +  a/b, c/d ",
   undefined,
+  undefined,
   [Language.javascript, Language.java],
   /Cannot specify a 'packs' input in a multi-language analysis/
 );
@@ -2247,6 +2328,7 @@ test(
   "Packs input with no languages",
   "   +  a/b, c/d ",
   undefined,
+  undefined,
   [],
   /No languages specified/
 );
@@ -2256,10 +2338,21 @@ test(
   "Invalid packs",
   " a-pack-without-a-scope ",
   undefined,
+  undefined,
   [Language.javascript],
   /"a-pack-without-a-scope" is not a valid pack/
 );
 
+test(
+  calculateAugmentationErrorMacro,
+  "Invalid threat-models",
+  undefined,
+  undefined,
+  "   + ",
+  [Language.javascript],
+  /A '\+' was used in the 'threat-models'/
+);
+
 test("downloadPacks-no-registries", async (t) => {
   return await util.withTmpDir(async (tmpDir) => {
     const packDownloadStub = sinon.stub();

src/config-utils.ts

@@ -63,6 +63,10 @@ export interface UserConfig {
   // Set of query filters to include and exclude extra queries based on
   // codeql query suite `include` and `exclude` properties
   "query-filters"?: QueryFilter[];
+
+  // The set of threat models to consider for this analysis. If left unset,
+  // the "standard" threat model will be used.
+  "threat-models"?: string[];
 }
 
 export type QueryFilter = ExcludeQueryFilter | IncludeQueryFilter;
@@ -241,10 +245,22 @@ export interface AugmentationProperties {
    * Whether or not the packs input combines with the packs in the config.
    */
   packsInputCombines: boolean;
+
   /**
    * The packs input from the `with` block of the action declaration
    */
   packsInput?: string[];
+
+  /**
+   * Whether or not the threat-models input combines with the threat-model in the config.
+   */
+  threatModelsInputCombines: boolean;
+
+  /**
+   * The threat-modesl input from the `with` block of the action declaration
+   */
+  threatModelsInput?: string[];
+
   /**
    * Whether we injected ML queries into this configuration.
    */
@@ -258,9 +274,11 @@ export interface AugmentationProperties {
 export const defaultAugmentationProperties: AugmentationProperties = {
   queriesInputCombines: false,
   packsInputCombines: false,
+  threatModelsInputCombines: false,
   injectedMlQueries: false,
   packsInput: undefined,
   queriesInput: undefined,
+  threatModelsInput: undefined,
 };
 export type Packs = Partial<Record<Language, string[]>>;
 
@@ -1057,6 +1075,7 @@ export async function getDefaultConfig(
   languagesInput: string | undefined,
   rawQueriesInput: string | undefined,
   rawPacksInput: string | undefined,
+  rawThreatModelsInput: string | undefined,
   dbLocation: string | undefined,
   trapCachingEnabled: boolean,
   debugMode: boolean,
@@ -1088,6 +1107,7 @@ export async function getDefaultConfig(
   const augmentationProperties = calculateAugmentation(
     rawPacksInput,
     rawQueriesInput,
+    rawThreatModelsInput,
     languages
   );
   const packs = augmentationProperties.packsInput
@@ -1164,6 +1184,7 @@ async function loadConfig(
   languagesInput: string | undefined,
   rawQueriesInput: string | undefined,
   rawPacksInput: string | undefined,
+  rawThreatModelsInput: string | undefined,
   configFile: string,
   dbLocation: string | undefined,
   trapCachingEnabled: boolean,
@@ -1230,6 +1251,7 @@ async function loadConfig(
   const augmentationProperties = calculateAugmentation(
     rawPacksInput,
     rawQueriesInput,
+    rawThreatModelsInput,
     languages
   );
   const packs = parsePacks(
@@ -1370,6 +1392,7 @@ async function loadConfig(
 export function calculateAugmentation(
   rawPacksInput: string | undefined,
   rawQueriesInput: string | undefined,
+  rawThreatModelsInput: string | undefined,
   languages: Language[]
 ): AugmentationProperties {
   const packsInputCombines = shouldCombine(rawPacksInput);
@@ -1384,12 +1407,20 @@ export function calculateAugmentation(
     queriesInputCombines
   );
 
+  const threatModelsInputCombines = shouldCombine(rawThreatModelsInput);
+  const threatModelsInput = parseThreatModelsFromInput(
+    rawThreatModelsInput,
+    threatModelsInputCombines
+  );
+
   return {
     injectedMlQueries: false, // filled in later
     packsInputCombines,
     packsInput: packsInput?.[languages[0]],
     queriesInput,
     queriesInputCombines,
+    threatModelsInputCombines,
+    threatModelsInput,
   };
 }
 
@@ -1512,6 +1543,31 @@ function parsePacksFromInput(
   };
 }
 
+function parseThreatModelsFromInput(
+  rawThreatModelsInput: string | undefined,
+  threatModelsInputCombines: boolean
+): string[] | undefined {
+  if (!rawThreatModelsInput?.trim()) {
+    return undefined;
+  }
+
+  rawThreatModelsInput = rawThreatModelsInput.trim();
+  if (threatModelsInputCombines) {
+    rawThreatModelsInput = rawThreatModelsInput.trim().substring(1).trim();
+    if (!rawThreatModelsInput) {
+      throw new Error(
+        getConfigFilePropertyError(
+          undefined,
+          "threat-models",
+          "A '+' was used in the 'threat-models' input to specify that you wished to add some packs to your CodeQL analysis. However, no threat models were specified. Please either remove the '+' or specify some threat models."
+        )
+      );
+    }
+  }
+
+  return rawThreatModelsInput.split(",").map((t) => t.trim());
+}
+
 /**
  * Validates that this package specification is syntactically correct.
  * It may not point to any real package, but after this function returns
@@ -1687,6 +1743,7 @@ export async function initConfig(
   languagesInput: string | undefined,
   queriesInput: string | undefined,
   packsInput: string | undefined,
+  threatModelsInput: string | undefined,
   registriesInput: string | undefined,
   configFile: string | undefined,
   dbLocation: string | undefined,
@@ -1712,6 +1769,7 @@ export async function initConfig(
       languagesInput,
       queriesInput,
       packsInput,
+      threatModelsInput,
       dbLocation,
       trapCachingEnabled,
       debugMode,
@@ -1731,6 +1789,7 @@ export async function initConfig(
       languagesInput,
       queriesInput,
       packsInput,
+      threatModelsInput,
       configFile,
       dbLocation,
       trapCachingEnabled,

src/debug-artifacts.ts

@@ -8,13 +8,12 @@ import del from "del";
 
 import { getRequiredInput } from "./actions-util";
 import { dbIsFinalized } from "./analyze";
-import { CODEQL_VERSION_NEW_TRACING, getCodeQL } from "./codeql";
+import { getCodeQL } from "./codeql";
 import { Config } from "./config-utils";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 import {
   bundleDb,
-  codeQlVersionAbove,
   doesDirectoryExist,
   getCodeQLDatabasePath,
   listFolder,
@@ -72,8 +71,6 @@ export async function uploadSarifDebugArtifact(
 }
 
 export async function uploadLogsDebugArtifact(config: Config) {
-  const codeql = await getCodeQL(config.codeQLCmd);
-
   let toUpload: string[] = [];
   for (const language of config.languages) {
     const databaseDirectory = getCodeQLDatabasePath(config, language);
@@ -83,36 +80,20 @@ export async function uploadLogsDebugArtifact(config: Config) {
     }
   }
 
-  if (await codeQlVersionAbove(codeql, CODEQL_VERSION_NEW_TRACING)) {
-    // Multilanguage tracing: there are additional logs in the root of the cluster
-    const multiLanguageTracingLogsDirectory = path.resolve(
-      config.dbLocation,
-      "log"
-    );
-    if (doesDirectoryExist(multiLanguageTracingLogsDirectory)) {
-      toUpload = toUpload.concat(listFolder(multiLanguageTracingLogsDirectory));
-    }
+  // Multilanguage tracing: there are additional logs in the root of the cluster
+  const multiLanguageTracingLogsDirectory = path.resolve(
+    config.dbLocation,
+    "log"
+  );
+  if (doesDirectoryExist(multiLanguageTracingLogsDirectory)) {
+    toUpload = toUpload.concat(listFolder(multiLanguageTracingLogsDirectory));
   }
+
   await uploadDebugArtifacts(
     toUpload,
     config.dbLocation,
     config.debugArtifactName
   );
-
-  // Before multi-language tracing, we wrote a compound-build-tracer.log in the temp dir
-  if (!(await codeQlVersionAbove(codeql, CODEQL_VERSION_NEW_TRACING))) {
-    const compoundBuildTracerLogDirectory = path.resolve(
-      config.tempDir,
-      "compound-build-tracer.log"
-    );
-    if (doesDirectoryExist(compoundBuildTracerLogDirectory)) {
-      await uploadDebugArtifacts(
-        [compoundBuildTracerLogDirectory],
-        config.tempDir,
-        config.debugArtifactName
-      );
-    }
-  }
 }
 
 /**