Merge pull request #2727 from github/oscarsj-patch-1

Switch auth for enterprises-release repo from ssh to codeql CI token

.github/codeql/codeql-actions-config.yml

@@ -0,0 +1,4 @@
+# Configuration for the CodeQL Actions Queries
+name: "CodeQL Actions Queries config"
+queries:
+  - uses: security-and-quality

.github/workflows/__rubocop-multi-language.yml

@@ -46,7 +46,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@2654679fe7f7c29875c669398a8ec0791b8a64a1 # v1.215.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/codeql.yml

@@ -70,7 +70,7 @@ jobs:
         echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
         echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
 
-  build:
+  analyze-javascript:
     needs: [check-codeql-versions]
     strategy:
       fail-fast: false
@@ -81,7 +81,7 @@ jobs:
 
     permissions:
       contents: read
-      security-events: write # needed to upload results
+      security-events: write
 
     steps:
     - name: Checkout
@@ -100,3 +100,27 @@ jobs:
       uses: ./analyze
       with:
         category: "/language:javascript"
+
+
+  analyze-actions:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Initialize CodeQL
+      uses: ./init
+      with:
+        languages: actions
+        config-file: ./.github/codeql/codeql-actions-config.yml
+    - name: Perform CodeQL Analysis
+      uses: ./analyze
+      with:
+        category: "/language:actions"

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -19,14 +19,14 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.7"
+          python-version: "3.13"
       - name: Checkout CodeQL Action
         uses: actions/checkout@v4
       - name: Checkout Enterprise Releases
         uses: actions/checkout@v4
         with:
           repository: github/enterprise-releases
-          ssh-key: ${{ secrets.ENTERPRISE_RELEASES_SSH_KEY }}
+          token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }}
           path: ${{ github.workspace }}/enterprise-releases/
       - name: Update Supported Enterprise Server Versions
         run: |

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## [UNRELEASED]
+
+No user facing changes.
+
+## 3.28.8 - 29 Jan 2025
+
+- Enable support for Kotlin 2.1.10 when running with CodeQL CLI v2.20.3. [#2744](https://github.com/github/codeql-action/pull/2744)
+
+## 3.28.7 - 29 Jan 2025
+
+No user facing changes.
+
 ## 3.28.6 - 27 Jan 2025
 
 - Re-enable debug artifact upload for CLI versions 2.20.3 or greater. [#2726](https://github.com/github/codeql-action/pull/2726)

lib/analyze-action.js

@@ -160,6 +160,14 @@ async function run() {
     let dbCreationTimings = undefined;
     let didUploadTrapCaches = false;
     util.initializeEnvironment(actionsUtil.getActionVersion());
+    // Unset the CODEQL_PROXY_* environment variables, as they are not needed
+    // and can cause issues with the CodeQL CLI
+    // Check for CODEQL_PROXY_HOST: and if it is empty but set, unset it
+    if (process.env.CODEQL_PROXY_HOST === "") {
+        delete process.env.CODEQL_PROXY_HOST;
+        delete process.env.CODEQL_PROXY_PORT;
+        delete process.env.CODEQL_PROXY_CA_CERTIFICATE;
+    }
     // Make inputs accessible in the `post` step, details at
     // https://github.com/github/codeql-action/issues/2553
     actionsUtil.persistInputs();

lib/init-action.js

@@ -317,6 +317,11 @@ async function run() {
         if (await features.getValue(feature_flags_1.Feature.DisableKotlinAnalysisEnabled)) {
             core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
         }
+        const kotlinLimitVar = "CODEQL_EXTRACTOR_KOTLIN_OVERRIDE_MAXIMUM_VERSION_LIMIT";
+        if ((await (0, util_1.codeQlVersionAtLeast)(codeql, "2.20.3")) &&
+            !(await (0, util_1.codeQlVersionAtLeast)(codeql, "2.20.4"))) {
+            core.exportVariable(kotlinLimitVar, "2.1.20");
+        }
         if (config.languages.includes(languages_1.Language.cpp)) {
             const envVar = "CODEQL_EXTRACTOR_CPP_TRAP_CACHING";
             if (process.env[envVar]) {

lib/start-proxy-action.js

@@ -45,7 +45,6 @@ const util = __importStar(require("./util"));
 const UPDATEJOB_PROXY = "update-job-proxy";
 const UPDATEJOB_PROXY_VERSION = "v2.0.20241023203727";
 const UPDATEJOB_PROXY_URL_PREFIX = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.18.1/";
-const PROXY_USER = "proxy_user";
 const KEY_SIZE = 2048;
 const KEY_EXPIRY_YEARS = 2;
 const CERT_SUBJECT = [
@@ -100,15 +99,17 @@ async function runWrapper() {
     core.saveState("proxy-log-file", proxyLogFilePath);
     // Get the configuration options
     const credentials = (0, start_proxy_1.getCredentials)(logger, actionsUtil.getOptionalInput("registry_secrets"), actionsUtil.getOptionalInput("registries_credentials"), actionsUtil.getOptionalInput("language"));
+    if (credentials.length === 0) {
+        logger.info("No credentials found, skipping proxy setup.");
+        return;
+    }
     logger.info(`Credentials loaded for the following registries:\n ${credentials
         .map((c) => credentialToStr(c))
         .join("\n")}`);
     const ca = generateCertificateAuthority();
-    const proxyAuth = getProxyAuth();
     const proxyConfig = {
         all_credentials: credentials,
         ca,
-        proxy_auth: proxyAuth,
     };
     // Start the Proxy
     const proxyBin = await getProxyBinaryPath();
@@ -165,17 +166,6 @@ async function startProxy(binPath, config, logFilePath, logger) {
         core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`);
     }
 }
-// getProxyAuth returns the authentication information for the proxy itself.
-function getProxyAuth() {
-    const proxy_password = actionsUtil.getOptionalInput("proxy_password");
-    if (proxy_password) {
-        return {
-            username: PROXY_USER,
-            password: proxy_password,
-        };
-    }
-    return;
-}
 async function getProxyBinaryPath() {
     const proxyFileName = process.platform === "win32" ? `${UPDATEJOB_PROXY}.exe` : UPDATEJOB_PROXY;
     const platform = process.platform === "win32"

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "3.28.6",
+  "version": "3.28.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "3.28.6",
+  "version": "3.28.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "3.28.6",
+      "version": "3.28.9",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^2.1.9",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "3.28.6",
+  "version": "3.28.9",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

pr-checks/checks/rubocop-multi-language.yml

@@ -5,7 +5,7 @@ operatingSystems: ["ubuntu"]
 versions: ["default"]
 steps:
   - name: Set up Ruby
-    uses: ruby/setup-ruby@v1
+    uses: ruby/setup-ruby@2654679fe7f7c29875c669398a8ec0791b8a64a1 # v1.215.0
     with:
       ruby-version: 2.6
   - name: Install Code Scanning integration

src/analyze-action.ts

@@ -202,6 +202,15 @@ async function run() {
   let didUploadTrapCaches = false;
   util.initializeEnvironment(actionsUtil.getActionVersion());
 
+  // Unset the CODEQL_PROXY_* environment variables, as they are not needed
+  // and can cause issues with the CodeQL CLI
+  // Check for CODEQL_PROXY_HOST: and if it is empty but set, unset it
+  if (process.env.CODEQL_PROXY_HOST === "") {
+    delete process.env.CODEQL_PROXY_HOST;
+    delete process.env.CODEQL_PROXY_PORT;
+    delete process.env.CODEQL_PROXY_CA_CERTIFICATE;
+  }
+
   // Make inputs accessible in the `post` step, details at
   // https://github.com/github/codeql-action/issues/2553
   actionsUtil.persistInputs();

src/init-action.ts

@@ -539,6 +539,15 @@ async function run() {
       core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
     }
 
+    const kotlinLimitVar =
+      "CODEQL_EXTRACTOR_KOTLIN_OVERRIDE_MAXIMUM_VERSION_LIMIT";
+    if (
+      (await codeQlVersionAtLeast(codeql, "2.20.3")) &&
+      !(await codeQlVersionAtLeast(codeql, "2.20.4"))
+    ) {
+      core.exportVariable(kotlinLimitVar, "2.1.20");
+    }
+
     if (config.languages.includes(Language.cpp)) {
       const envVar = "CODEQL_EXTRACTOR_CPP_TRAP_CACHING";
       if (process.env[envVar]) {

src/start-proxy-action.ts

@@ -14,7 +14,6 @@ const UPDATEJOB_PROXY = "update-job-proxy";
 const UPDATEJOB_PROXY_VERSION = "v2.0.20241023203727";
 const UPDATEJOB_PROXY_URL_PREFIX =
   "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.18.1/";
-const PROXY_USER = "proxy_user";
 const KEY_SIZE = 2048;
 const KEY_EXPIRY_YEARS = 2;
 
@@ -100,6 +99,12 @@ async function runWrapper() {
     actionsUtil.getOptionalInput("registries_credentials"),
     actionsUtil.getOptionalInput("language"),
   );
+
+  if (credentials.length === 0) {
+    logger.info("No credentials found, skipping proxy setup.");
+    return;
+  }
+
   logger.info(
     `Credentials loaded for the following registries:\n ${credentials
       .map((c) => credentialToStr(c))
@@ -107,12 +112,10 @@ async function runWrapper() {
   );
 
   const ca = generateCertificateAuthority();
-  const proxyAuth = getProxyAuth();
 
   const proxyConfig: ProxyConfig = {
     all_credentials: credentials,
     ca,
-    proxy_auth: proxyAuth,
   };
 
   // Start the Proxy
@@ -181,18 +184,6 @@ async function startProxy(
   }
 }
 
-// getProxyAuth returns the authentication information for the proxy itself.
-function getProxyAuth(): BasicAuthCredentials | undefined {
-  const proxy_password = actionsUtil.getOptionalInput("proxy_password");
-  if (proxy_password) {
-    return {
-      username: PROXY_USER,
-      password: proxy_password,
-    };
-  }
-  return;
-}
-
 async function getProxyBinaryPath(): Promise<string> {
   const proxyFileName =
     process.platform === "win32" ? `${UPDATEJOB_PROXY}.exe` : UPDATEJOB_PROXY;

start-proxy/action.yml

@@ -9,9 +9,6 @@ inputs:
   registries_credentials:
     description: Base64 encoded JSON configuration for the URLs and credentials of the package registries
     required: false
-  proxy_password:
-    required: false
-    description: The password of the proxy
   token:
     description: GitHub token to use for authenticating with this instance of GitHub, used to upload debug artifacts.
     default: ${{ github.token }}