initial commit of actions

github/codeql-action-v1/lib/actions-util.js

@@ -0,0 +1,517 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printDebugLogs = exports.isAnalyzingDefaultBranch = exports.getRelativeScriptPath = exports.isRunningLocalAction = exports.workflowEventName = exports.sendStatusReport = exports.createStatusReportBase = exports.getActionsStatus = exports.getRef = exports.computeAutomationID = exports.getAutomationID = exports.getAnalysisKey = exports.determineMergeBaseCommitOid = exports.getCommitOid = exports.getTemporaryDirectory = exports.getOptionalInput = exports.getRequiredInput = void 0;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const core = __importStar(require("@actions/core"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const api = __importStar(require("./api-client"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util_1 = require("./util");
+const workflow_1 = require("./workflow");
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
+/**
+ * Wrapper around core.getInput for inputs that always have a value.
+ * Also see getOptionalInput.
+ *
+ * This allows us to get stronger type checking of required/optional inputs.
+ */
+function getRequiredInput(name) {
+    return core.getInput(name, { required: true });
+}
+exports.getRequiredInput = getRequiredInput;
+/**
+ * Wrapper around core.getInput that converts empty inputs to undefined.
+ * Also see getRequiredInput.
+ *
+ * This allows us to get stronger type checking of required/optional inputs.
+ */
+const getOptionalInput = function (name) {
+    const value = core.getInput(name);
+    return value.length > 0 ? value : undefined;
+};
+exports.getOptionalInput = getOptionalInput;
+function getTemporaryDirectory() {
+    const value = process.env["CODEQL_ACTION_TEMP"];
+    return value !== undefined && value !== ""
+        ? value
+        : (0, util_1.getRequiredEnvParam)("RUNNER_TEMP");
+}
+exports.getTemporaryDirectory = getTemporaryDirectory;
+/**
+ * Gets the SHA of the commit that is currently checked out.
+ */
+const getCommitOid = async function (checkoutPath, ref = "HEAD") {
+    // Try to use git to get the current commit SHA. If that fails then
+    // log but otherwise silently fall back to using the SHA from the environment.
+    // The only time these two values will differ is during analysis of a PR when
+    // the workflow has changed the current commit to the head commit instead of
+    // the merge commit, which must mean that git is available.
+    // Even if this does go wrong, it's not a huge problem for the alerts to
+    // reported on the merge commit.
+    try {
+        let commitOid = "";
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), ["rev-parse", ref], {
+            silent: true,
+            listeners: {
+                stdout: (data) => {
+                    commitOid += data.toString();
+                },
+                stderr: (data) => {
+                    process.stderr.write(data);
+                },
+            },
+            cwd: checkoutPath,
+        }).exec();
+        return commitOid.trim();
+    }
+    catch (e) {
+        core.info("Could not determine current commit SHA using git. Continuing with data from user input or environment.");
+        core.debug(`Reason: ${e.message}`);
+        core.debug(e.stack || "NO STACK");
+        return (0, exports.getOptionalInput)("sha") || (0, util_1.getRequiredEnvParam)("GITHUB_SHA");
+    }
+};
+exports.getCommitOid = getCommitOid;
+/**
+ * If the action was triggered by a pull request, determine the commit sha of the merge base.
+ * Returns undefined if run by other triggers or the merge base cannot be determined.
+ */
+const determineMergeBaseCommitOid = async function () {
+    if (workflowEventName() !== "pull_request") {
+        return undefined;
+    }
+    const mergeSha = (0, util_1.getRequiredEnvParam)("GITHUB_SHA");
+    const checkoutPath = (0, exports.getOptionalInput)("checkout_path");
+    try {
+        let commitOid = "";
+        let baseOid = "";
+        let headOid = "";
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), ["show", "-s", "--format=raw", mergeSha], {
+            silent: true,
+            listeners: {
+                stdline: (data) => {
+                    if (data.startsWith("commit ") && commitOid === "") {
+                        commitOid = data.substring(7);
+                    }
+                    else if (data.startsWith("parent ")) {
+                        if (baseOid === "") {
+                            baseOid = data.substring(7);
+                        }
+                        else if (headOid === "") {
+                            headOid = data.substring(7);
+                        }
+                    }
+                },
+                stderr: (data) => {
+                    process.stderr.write(data);
+                },
+            },
+            cwd: checkoutPath,
+        }).exec();
+        // Let's confirm our assumptions: We had a merge commit and the parsed parent data looks correct
+        if (commitOid === mergeSha &&
+            headOid.length === 40 &&
+            baseOid.length === 40) {
+            return baseOid;
+        }
+        return undefined;
+    }
+    catch (e) {
+        core.info(`Failed to call git to determine merge base. Continuing with data from environment: ${e}`);
+        core.info(e.stack || "NO STACK");
+        return undefined;
+    }
+};
+exports.determineMergeBaseCommitOid = determineMergeBaseCommitOid;
+/**
+ * Get the analysis key parameter for the current job.
+ *
+ * This will combine the workflow path and current job name.
+ * Computing this the first time requires making requests to
+ * the github API, but after that the result will be cached.
+ */
+async function getAnalysisKey() {
+    const analysisKeyEnvVar = "CODEQL_ACTION_ANALYSIS_KEY";
+    let analysisKey = process.env[analysisKeyEnvVar];
+    if (analysisKey !== undefined) {
+        return analysisKey;
+    }
+    const workflowPath = await (0, workflow_1.getWorkflowPath)();
+    const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");
+    analysisKey = `${workflowPath}:${jobName}`;
+    core.exportVariable(analysisKeyEnvVar, analysisKey);
+    return analysisKey;
+}
+exports.getAnalysisKey = getAnalysisKey;
+async function getAutomationID() {
+    const analysis_key = await getAnalysisKey();
+    const environment = getRequiredInput("matrix");
+    return computeAutomationID(analysis_key, environment);
+}
+exports.getAutomationID = getAutomationID;
+function computeAutomationID(analysis_key, environment) {
+    let automationID = `${analysis_key}/`;
+    const matrix = (0, util_1.parseMatrixInput)(environment);
+    if (matrix !== undefined) {
+        // the id has to be deterministic so we sort the fields
+        for (const entry of Object.entries(matrix).sort()) {
+            if (typeof entry[1] === "string") {
+                automationID += `${entry[0]}:${entry[1]}/`;
+            }
+            else {
+                // In code scanning we just handle the string values,
+                // the rest get converted to the empty string
+                automationID += `${entry[0]}:/`;
+            }
+        }
+    }
+    return automationID;
+}
+exports.computeAutomationID = computeAutomationID;
+/**
+ * Get the ref currently being analyzed.
+ */
+async function getRef() {
+    // Will be in the form "refs/heads/master" on a push event
+    // or in the form "refs/pull/N/merge" on a pull_request event
+    const refInput = (0, exports.getOptionalInput)("ref");
+    const shaInput = (0, exports.getOptionalInput)("sha");
+    const checkoutPath = (0, exports.getOptionalInput)("checkout_path") ||
+        (0, exports.getOptionalInput)("source-root") ||
+        (0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE");
+    const hasRefInput = !!refInput;
+    const hasShaInput = !!shaInput;
+    // If one of 'ref' or 'sha' are provided, both are required
+    if ((hasRefInput || hasShaInput) && !(hasRefInput && hasShaInput)) {
+        throw new Error("Both 'ref' and 'sha' are required if one of them is provided.");
+    }
+    const ref = refInput || getRefFromEnv();
+    const sha = shaInput || (0, util_1.getRequiredEnvParam)("GITHUB_SHA");
+    // If the ref is a user-provided input, we have to skip logic
+    // and assume that it is really where they want to upload the results.
+    if (refInput) {
+        return refInput;
+    }
+    // For pull request refs we want to detect whether the workflow
+    // has run `git checkout HEAD^2` to analyze the 'head' ref rather
+    // than the 'merge' ref. If so, we want to convert the ref that
+    // we report back.
+    const pull_ref_regex = /refs\/pull\/(\d+)\/merge/;
+    if (!pull_ref_regex.test(ref)) {
+        return ref;
+    }
+    const head = await (0, exports.getCommitOid)(checkoutPath, "HEAD");
+    // in actions/checkout@v2+ we can check if git rev-parse HEAD == GITHUB_SHA
+    // in actions/checkout@v1 this may not be true as it checks out the repository
+    // using GITHUB_REF. There is a subtle race condition where
+    // git rev-parse GITHUB_REF != GITHUB_SHA, so we must check
+    // git rev-parse GITHUB_REF == git rev-parse HEAD instead.
+    const hasChangedRef = sha !== head &&
+        (await (0, exports.getCommitOid)(checkoutPath, ref.replace(/^refs\/pull\//, "refs/remotes/pull/"))) !== head;
+    if (hasChangedRef) {
+        const newRef = ref.replace(pull_ref_regex, "refs/pull/$1/head");
+        core.debug(`No longer on merge commit, rewriting ref from ${ref} to ${newRef}.`);
+        return newRef;
+    }
+    else {
+        return ref;
+    }
+}
+exports.getRef = getRef;
+function getRefFromEnv() {
+    // To workaround a limitation of Actions dynamic workflows not setting
+    // the GITHUB_REF in some cases, we accept also the ref within the
+    // CODE_SCANNING_REF variable. When possible, however, we prefer to use
+    // the GITHUB_REF as that is a protected variable and cannot be overwritten.
+    let refEnv;
+    try {
+        refEnv = (0, util_1.getRequiredEnvParam)("GITHUB_REF");
+    }
+    catch (e) {
+        // If the GITHUB_REF is not set, we try to rescue by getting the
+        // CODE_SCANNING_REF.
+        const maybeRef = process.env["CODE_SCANNING_REF"];
+        if (maybeRef === undefined || maybeRef.length === 0) {
+            throw e;
+        }
+        refEnv = maybeRef;
+    }
+    return refEnv;
+}
+function getActionsStatus(error, otherFailureCause) {
+    if (error || otherFailureCause) {
+        return error instanceof util_1.UserError ? "user-error" : "failure";
+    }
+    else {
+        return "success";
+    }
+}
+exports.getActionsStatus = getActionsStatus;
+/**
+ * Compose a StatusReport.
+ *
+ * @param actionName The name of the action, e.g. 'init', 'finish', 'upload-sarif'
+ * @param status The status. Must be 'success', 'failure', or 'starting'
+ * @param startedAt The time this action started executing.
+ * @param cause  Cause of failure (only supply if status is 'failure')
+ * @param exception Exception (only supply if status is 'failure')
+ */
+async function createStatusReportBase(actionName, status, actionStartedAt, cause, exception) {
+    const commitOid = (0, exports.getOptionalInput)("sha") || process.env["GITHUB_SHA"] || "";
+    const ref = await getRef();
+    const workflowRunIDStr = process.env["GITHUB_RUN_ID"];
+    let workflowRunID = -1;
+    if (workflowRunIDStr) {
+        workflowRunID = parseInt(workflowRunIDStr, 10);
+    }
+    const workflowName = process.env["GITHUB_WORKFLOW"] || "";
+    const jobName = process.env["GITHUB_JOB"] || "";
+    const analysis_key = await getAnalysisKey();
+    let workflowStartedAt = process.env[sharedEnv.CODEQL_WORKFLOW_STARTED_AT];
+    if (workflowStartedAt === undefined) {
+        workflowStartedAt = actionStartedAt.toISOString();
+        core.exportVariable(sharedEnv.CODEQL_WORKFLOW_STARTED_AT, workflowStartedAt);
+    }
+    const runnerOs = (0, util_1.getRequiredEnvParam)("RUNNER_OS");
+    const codeQlCliVersion = (0, util_1.getCachedCodeQlVersion)();
+    const actionRef = process.env["GITHUB_ACTION_REF"];
+    const testingEnvironment = process.env[sharedEnv.CODEQL_ACTION_TESTING_ENVIRONMENT] || "";
+    // re-export the testing environment variable so that it is available to subsequent steps,
+    // even if it was only set for this step
+    if (testingEnvironment !== "") {
+        core.exportVariable(sharedEnv.CODEQL_ACTION_TESTING_ENVIRONMENT, testingEnvironment);
+    }
+    const statusReport = {
+        workflow_run_id: workflowRunID,
+        workflow_name: workflowName,
+        job_name: jobName,
+        analysis_key,
+        commit_oid: commitOid,
+        ref,
+        action_name: actionName,
+        action_ref: actionRef,
+        action_oid: "unknown",
+        started_at: workflowStartedAt,
+        action_started_at: actionStartedAt.toISOString(),
+        status,
+        testing_environment: testingEnvironment,
+        runner_os: runnerOs,
+        action_version: pkg.version,
+    };
+    // Add optional parameters
+    if (cause) {
+        statusReport.cause = cause;
+    }
+    if (exception) {
+        statusReport.exception = exception;
+    }
+    if (status === "success" ||
+        status === "failure" ||
+        status === "aborted" ||
+        status === "user-error") {
+        statusReport.completed_at = new Date().toISOString();
+    }
+    const matrix = getRequiredInput("matrix");
+    if (matrix) {
+        statusReport.matrix_vars = matrix;
+    }
+    if ("RUNNER_ARCH" in process.env) {
+        // RUNNER_ARCH is available only in GHES 3.4 and later
+        // Values other than X86, X64, ARM, or ARM64 are discarded server side
+        statusReport.runner_arch = process.env["RUNNER_ARCH"];
+    }
+    if (runnerOs === "Windows" || runnerOs === "macOS") {
+        statusReport.runner_os_release = os.release();
+    }
+    if (codeQlCliVersion !== undefined) {
+        statusReport.codeql_version = codeQlCliVersion;
+    }
+    return statusReport;
+}
+exports.createStatusReportBase = createStatusReportBase;
+const GENERIC_403_MSG = "The repo on which this action is running is not opted-in to CodeQL code scanning.";
+const GENERIC_404_MSG = "Not authorized to use the CodeQL code scanning feature on this repo.";
+const OUT_OF_DATE_MSG = "CodeQL Action is out-of-date. Please upgrade to the latest version of codeql-action.";
+const INCOMPATIBLE_MSG = "CodeQL Action version is incompatible with the code scanning endpoint. Please update to a compatible version of codeql-action.";
+/**
+ * Send a status report to the code_scanning/analysis/status endpoint.
+ *
+ * Optionally checks the response from the API endpoint and sets the action
+ * as failed if the status report failed. This is only expected to be used
+ * when sending a 'starting' report.
+ *
+ * Returns whether sending the status report was successful of not.
+ */
+async function sendStatusReport(statusReport) {
+    const statusReportJSON = JSON.stringify(statusReport);
+    core.debug(`Sending status report: ${statusReportJSON}`);
+    // If in test mode we don't want to upload the results
+    if ((0, util_1.isInTestMode)()) {
+        core.debug("In test mode. Status reports are not uploaded.");
+        return true;
+    }
+    const nwo = (0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY");
+    const [owner, repo] = nwo.split("/");
+    const client = api.getApiClient();
+    try {
+        await client.request("PUT /repos/:owner/:repo/code-scanning/analysis/status", {
+            owner,
+            repo,
+            data: statusReportJSON,
+        });
+        return true;
+    }
+    catch (e) {
+        console.log(e);
+        if ((0, util_1.isHTTPError)(e)) {
+            switch (e.status) {
+                case 403:
+                    if (workflowIsTriggeredByPushEvent() && isDependabotActor()) {
+                        core.setFailed('Workflows triggered by Dependabot on the "push" event run with read-only access. ' +
+                            "Uploading Code Scanning results requires write access. " +
+                            'To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. ' +
+                            "See https://docs.github.com/en/code-security/secure-coding/configuring-code-scanning#scanning-on-push for more information on how to configure these events.");
+                    }
+                    else {
+                        core.setFailed(e.message || GENERIC_403_MSG);
+                    }
+                    return false;
+                case 404:
+                    core.setFailed(GENERIC_404_MSG);
+                    return false;
+                case 422:
+                    // schema incompatibility when reporting status
+                    // this means that this action version is no longer compatible with the API
+                    // we still want to continue as it is likely the analysis endpoint will work
+                    if ((0, util_1.getRequiredEnvParam)("GITHUB_SERVER_URL") !== util_1.GITHUB_DOTCOM_URL) {
+                        core.debug(INCOMPATIBLE_MSG);
+                    }
+                    else {
+                        core.debug(OUT_OF_DATE_MSG);
+                    }
+                    return true;
+            }
+        }
+        // something else has gone wrong and the request/response will be logged by octokit
+        // it's possible this is a transient error and we should continue scanning
+        core.error("An unexpected error occurred when sending code scanning status report.");
+        return true;
+    }
+}
+exports.sendStatusReport = sendStatusReport;
+function workflowEventName() {
+    // If the original event is dynamic CODESCANNING_EVENT_NAME will contain the right info (push/pull_request)
+    if (process.env["GITHUB_EVENT_NAME"] === "dynamic") {
+        const value = process.env["CODESCANNING_EVENT_NAME"];
+        if (value === undefined || value.length === 0) {
+            return process.env["GITHUB_EVENT_NAME"];
+        }
+        return value;
+    }
+    return process.env["GITHUB_EVENT_NAME"];
+}
+exports.workflowEventName = workflowEventName;
+// Was the workflow run triggered by a `push` event, for example as opposed to a `pull_request` event.
+function workflowIsTriggeredByPushEvent() {
+    return workflowEventName() === "push";
+}
+// Is dependabot the actor that triggered the current workflow run.
+function isDependabotActor() {
+    return process.env["GITHUB_ACTOR"] === "dependabot[bot]";
+}
+// Is the current action executing a local copy (i.e. we're running a workflow on the codeql-action repo itself)
+// as opposed to running a remote action (i.e. when another repo references us)
+function isRunningLocalAction() {
+    const relativeScriptPath = getRelativeScriptPath();
+    return (relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath));
+}
+exports.isRunningLocalAction = isRunningLocalAction;
+// Get the location where the action is running from.
+// This can be used to get the actions name or tell if we're running a local action.
+function getRelativeScriptPath() {
+    const runnerTemp = (0, util_1.getRequiredEnvParam)("RUNNER_TEMP");
+    const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
+    return path.relative(actionsDirectory, __filename);
+}
+exports.getRelativeScriptPath = getRelativeScriptPath;
+// Reads the contents of GITHUB_EVENT_PATH as a JSON object
+function getWorkflowEvent() {
+    const eventJsonFile = (0, util_1.getRequiredEnvParam)("GITHUB_EVENT_PATH");
+    try {
+        return JSON.parse(fs.readFileSync(eventJsonFile, "utf-8"));
+    }
+    catch (e) {
+        throw new Error(`Unable to read workflow event JSON from ${eventJsonFile}: ${e}`);
+    }
+}
+function removeRefsHeadsPrefix(ref) {
+    return ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref;
+}
+// Is the version of the repository we are currently analyzing from the default branch,
+// or alternatively from another branch or a pull request.
+async function isAnalyzingDefaultBranch() {
+    var _a;
+    // Get the current ref and trim and refs/heads/ prefix
+    let currentRef = await getRef();
+    currentRef = removeRefsHeadsPrefix(currentRef);
+    const event = getWorkflowEvent();
+    let defaultBranch = (_a = event === null || event === void 0 ? void 0 : event.repository) === null || _a === void 0 ? void 0 : _a.default_branch;
+    if (process.env.GITHUB_EVENT_NAME === "schedule") {
+        defaultBranch = removeRefsHeadsPrefix((0, util_1.getRequiredEnvParam)("GITHUB_REF"));
+    }
+    return currentRef === defaultBranch;
+}
+exports.isAnalyzingDefaultBranch = isAnalyzingDefaultBranch;
+async function printDebugLogs(config) {
+    for (const language of config.languages) {
+        const databaseDirectory = (0, util_1.getCodeQLDatabasePath)(config, language);
+        const logsDirectory = path.join(databaseDirectory, "log");
+        if (!(0, util_1.doesDirectoryExist)(logsDirectory)) {
+            core.info(`Directory ${logsDirectory} does not exist.`);
+            continue; // Skip this language database.
+        }
+        const walkLogFiles = (dir) => {
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            if (entries.length === 0) {
+                core.info(`No debug logs found at directory ${logsDirectory}.`);
+            }
+            for (const entry of entries) {
+                if (entry.isFile()) {
+                    const absolutePath = path.resolve(dir, entry.name);
+                    core.startGroup(`CodeQL Debug Logs - ${language} - ${entry.name} from file at path ${absolutePath}`);
+                    process.stdout.write(fs.readFileSync(absolutePath));
+                    core.endGroup();
+                }
+                else if (entry.isDirectory()) {
+                    walkLogFiles(path.resolve(dir, entry.name));
+                }
+            }
+        };
+        walkLogFiles(logsDirectory);
+    }
+}
+exports.printDebugLogs = printDebugLogs;
+//# sourceMappingURL=actions-util.js.map

github/codeql-action-v1/lib/actions-util.test.js

@@ -0,0 +1,214 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsutil = __importStar(require("./actions-util"));
+const testing_utils_1 = require("./testing-utils");
+const util_1 = require("./util");
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("getRef() throws on the empty string", async (t) => {
+    process.env["GITHUB_REF"] = "";
+    await t.throwsAsync(actionsutil.getRef);
+});
+(0, ava_1.default)("getRef() returns merge PR ref if GITHUB_SHA still checked out", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const expectedRef = "refs/pull/1/merge";
+        const currentSha = "a".repeat(40);
+        process.env["GITHUB_REF"] = expectedRef;
+        process.env["GITHUB_SHA"] = currentSha;
+        const callback = sinon.stub(actionsutil, "getCommitOid");
+        callback.withArgs("HEAD").resolves(currentSha);
+        const actualRef = await actionsutil.getRef();
+        t.deepEqual(actualRef, expectedRef);
+        callback.restore();
+    });
+});
+(0, ava_1.default)("getRef() returns merge PR ref if GITHUB_REF still checked out but sha has changed (actions checkout@v1)", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const expectedRef = "refs/pull/1/merge";
+        process.env["GITHUB_REF"] = expectedRef;
+        process.env["GITHUB_SHA"] = "b".repeat(40);
+        const sha = "a".repeat(40);
+        const callback = sinon.stub(actionsutil, "getCommitOid");
+        callback.withArgs("refs/remotes/pull/1/merge").resolves(sha);
+        callback.withArgs("HEAD").resolves(sha);
+        const actualRef = await actionsutil.getRef();
+        t.deepEqual(actualRef, expectedRef);
+        callback.restore();
+    });
+});
+(0, ava_1.default)("getRef() returns head PR ref if GITHUB_REF no longer checked out", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        process.env["GITHUB_REF"] = "refs/pull/1/merge";
+        process.env["GITHUB_SHA"] = "a".repeat(40);
+        const callback = sinon.stub(actionsutil, "getCommitOid");
+        callback.withArgs(tmpDir, "refs/pull/1/merge").resolves("a".repeat(40));
+        callback.withArgs(tmpDir, "HEAD").resolves("b".repeat(40));
+        const actualRef = await actionsutil.getRef();
+        t.deepEqual(actualRef, "refs/pull/1/head");
+        callback.restore();
+    });
+});
+(0, ava_1.default)("getRef() returns ref provided as an input and ignores current HEAD", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const getAdditionalInputStub = sinon.stub(actionsutil, "getOptionalInput");
+        getAdditionalInputStub.withArgs("ref").resolves("refs/pull/2/merge");
+        getAdditionalInputStub.withArgs("sha").resolves("b".repeat(40));
+        // These values are be ignored
+        process.env["GITHUB_REF"] = "refs/pull/1/merge";
+        process.env["GITHUB_SHA"] = "a".repeat(40);
+        const callback = sinon.stub(actionsutil, "getCommitOid");
+        callback.withArgs("refs/pull/1/merge").resolves("b".repeat(40));
+        callback.withArgs("HEAD").resolves("b".repeat(40));
+        const actualRef = await actionsutil.getRef();
+        t.deepEqual(actualRef, "refs/pull/2/merge");
+        callback.restore();
+        getAdditionalInputStub.restore();
+    });
+});
+(0, ava_1.default)("getRef() returns CODE_SCANNING_REF as a fallback for GITHUB_REF", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const expectedRef = "refs/pull/1/HEAD";
+        const currentSha = "a".repeat(40);
+        process.env["CODE_SCANNING_REF"] = expectedRef;
+        process.env["GITHUB_REF"] = "";
+        process.env["GITHUB_SHA"] = currentSha;
+        const actualRef = await actionsutil.getRef();
+        t.deepEqual(actualRef, expectedRef);
+    });
+});
+(0, ava_1.default)("getRef() returns GITHUB_REF over CODE_SCANNING_REF if both are provided", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const expectedRef = "refs/pull/1/merge";
+        const currentSha = "a".repeat(40);
+        process.env["CODE_SCANNING_REF"] = "refs/pull/1/HEAD";
+        process.env["GITHUB_REF"] = expectedRef;
+        process.env["GITHUB_SHA"] = currentSha;
+        const actualRef = await actionsutil.getRef();
+        t.deepEqual(actualRef, expectedRef);
+    });
+});
+(0, ava_1.default)("getRef() throws an error if only `ref` is provided as an input", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const getAdditionalInputStub = sinon.stub(actionsutil, "getOptionalInput");
+        getAdditionalInputStub.withArgs("ref").resolves("refs/pull/1/merge");
+        await t.throwsAsync(async () => {
+            await actionsutil.getRef();
+        }, {
+            instanceOf: Error,
+            message: "Both 'ref' and 'sha' are required if one of them is provided.",
+        });
+        getAdditionalInputStub.restore();
+    });
+});
+(0, ava_1.default)("getRef() throws an error if only `sha` is provided as an input", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        process.env["GITHUB_WORKSPACE"] = "/tmp";
+        const getAdditionalInputStub = sinon.stub(actionsutil, "getOptionalInput");
+        getAdditionalInputStub.withArgs("sha").resolves("a".repeat(40));
+        await t.throwsAsync(async () => {
+            await actionsutil.getRef();
+        }, {
+            instanceOf: Error,
+            message: "Both 'ref' and 'sha' are required if one of them is provided.",
+        });
+        getAdditionalInputStub.restore();
+    });
+});
+(0, ava_1.default)("computeAutomationID()", async (t) => {
+    let actualAutomationID = actionsutil.computeAutomationID(".github/workflows/codeql-analysis.yml:analyze", '{"language": "javascript", "os": "linux"}');
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/language:javascript/os:linux/");
+    // check the environment sorting
+    actualAutomationID = actionsutil.computeAutomationID(".github/workflows/codeql-analysis.yml:analyze", '{"os": "linux", "language": "javascript"}');
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/language:javascript/os:linux/");
+    // check that an empty environment produces the right results
+    actualAutomationID = actionsutil.computeAutomationID(".github/workflows/codeql-analysis.yml:analyze", "{}");
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
+    // check non string environment values
+    actualAutomationID = actionsutil.computeAutomationID(".github/workflows/codeql-analysis.yml:analyze", '{"number": 1, "object": {"language": "javascript"}}');
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/number:/object:/");
+    // check undefined environment
+    actualAutomationID = actionsutil.computeAutomationID(".github/workflows/codeql-analysis.yml:analyze", undefined);
+    t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
+});
+(0, ava_1.default)("initializeEnvironment", (t) => {
+    (0, util_1.initializeEnvironment)("1.2.3");
+    t.deepEqual(process.env.CODEQL_ACTION_VERSION, "1.2.3");
+});
+(0, ava_1.default)("isAnalyzingDefaultBranch()", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const envFile = path.join(tmpDir, "event.json");
+        fs.writeFileSync(envFile, JSON.stringify({
+            repository: {
+                default_branch: "main",
+            },
+        }));
+        process.env["GITHUB_EVENT_PATH"] = envFile;
+        process.env["GITHUB_REF"] = "main";
+        process.env["GITHUB_SHA"] = "1234";
+        t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), true);
+        process.env["GITHUB_REF"] = "refs/heads/main";
+        t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), true);
+        process.env["GITHUB_REF"] = "feature";
+        t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), false);
+        fs.writeFileSync(envFile, JSON.stringify({
+            schedule: "0 0 * * *",
+        }));
+        process.env["GITHUB_EVENT_NAME"] = "schedule";
+        process.env["GITHUB_REF"] = "refs/heads/main";
+        t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), true);
+        const getAdditionalInputStub = sinon.stub(actionsutil, "getOptionalInput");
+        getAdditionalInputStub
+            .withArgs("ref")
+            .resolves("refs/heads/something-else");
+        getAdditionalInputStub
+            .withArgs("sha")
+            .resolves("0000000000000000000000000000000000000000");
+        process.env["GITHUB_EVENT_NAME"] = "schedule";
+        process.env["GITHUB_REF"] = "refs/heads/main";
+        t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), false);
+        getAdditionalInputStub.restore();
+    });
+});
+(0, ava_1.default)("workflowEventName()", async (t) => {
+    process.env["GITHUB_EVENT_NAME"] = "push";
+    t.deepEqual(actionsutil.workflowEventName(), "push");
+    process.env["GITHUB_EVENT_NAME"] = "dynamic";
+    t.deepEqual(actionsutil.workflowEventName(), "dynamic");
+    process.env["CODESCANNING_EVENT_NAME"] = "push";
+    t.deepEqual(actionsutil.workflowEventName(), "push");
+});
+//# sourceMappingURL=actions-util.test.js.map

github/codeql-action-v1/lib/analysis-paths.js

@@ -0,0 +1,80 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.includeAndExcludeAnalysisPaths = exports.printPathFiltersWarning = exports.legalWindowsPathCharactersRegex = void 0;
+const path = __importStar(require("path"));
+function isInterpretedLanguage(language) {
+    return (language === "javascript" || language === "python" || language === "ruby");
+}
+// Matches a string containing only characters that are legal to include in paths on windows.
+exports.legalWindowsPathCharactersRegex = /^[^<>:"|?]*$/;
+// Builds an environment variable suitable for LGTM_INDEX_INCLUDE or LGTM_INDEX_EXCLUDE
+function buildIncludeExcludeEnvVar(paths) {
+    // Ignore anything containing a *
+    paths = paths.filter((p) => p.indexOf("*") === -1);
+    // Some characters are illegal in path names in windows
+    if (process.platform === "win32") {
+        paths = paths.filter((p) => p.match(exports.legalWindowsPathCharactersRegex));
+    }
+    return paths.join("\n");
+}
+function printPathFiltersWarning(config, logger) {
+    // Index include/exclude/filters only work in javascript/python/ruby.
+    // If any other languages are detected/configured then show a warning.
+    if ((config.paths.length !== 0 || config.pathsIgnore.length !== 0) &&
+        !config.languages.every(isInterpretedLanguage)) {
+        logger.warning('The "paths"/"paths-ignore" fields of the config only have effect for JavaScript, Python, and Ruby');
+    }
+}
+exports.printPathFiltersWarning = printPathFiltersWarning;
+function includeAndExcludeAnalysisPaths(config) {
+    // The 'LGTM_INDEX_INCLUDE' and 'LGTM_INDEX_EXCLUDE' environment variables
+    // control which files/directories are traversed when scanning.
+    // This allows including files that otherwise would not be scanned, or
+    // excluding and not traversing entire file subtrees.
+    // It does not understand globs or double-globs because that would require it to
+    // traverse the entire file tree to determine which files are matched.
+    // Any paths containing "*" are not included in these.
+    if (config.paths.length !== 0) {
+        process.env["LGTM_INDEX_INCLUDE"] = buildIncludeExcludeEnvVar(config.paths);
+    }
+    // If the temporary or tools directory is in the working directory ignore that too.
+    const tempRelativeToWorking = path.relative(process.cwd(), config.tempDir);
+    let pathsIgnore = config.pathsIgnore;
+    if (!tempRelativeToWorking.startsWith("..") &&
+        !path.isAbsolute(tempRelativeToWorking)) {
+        pathsIgnore = pathsIgnore.concat(tempRelativeToWorking);
+    }
+    if (pathsIgnore.length !== 0) {
+        process.env["LGTM_INDEX_EXCLUDE"] = buildIncludeExcludeEnvVar(pathsIgnore);
+    }
+    // The 'LGTM_INDEX_FILTERS' environment variable controls which files are
+    // extracted or ignored. It does not control which directories are traversed.
+    // This does understand the glob and double-glob syntax.
+    const filters = [];
+    filters.push(...config.paths.map((p) => `include:${p}`));
+    filters.push(...config.pathsIgnore.map((p) => `exclude:${p}`));
+    if (filters.length !== 0) {
+        process.env["LGTM_INDEX_FILTERS"] = filters.join("\n");
+    }
+}
+exports.includeAndExcludeAnalysisPaths = includeAndExcludeAnalysisPaths;
+//# sourceMappingURL=analysis-paths.js.map

github/codeql-action-v1/lib/analysis-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-paths.js","sourceRoot":"","sources":["../src/analysis-paths.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAK7B,SAAS,qBAAqB,CAAC,QAAQ;IACrC,OAAO,CACL,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAC1E,CAAC;AACJ,CAAC;AAED,6FAA6F;AAChF,QAAA,+BAA+B,GAAG,cAAc,CAAC;AAE9D,uFAAuF;AACvF,SAAS,yBAAyB,CAAC,KAAe;IAChD,iCAAiC;IACjC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnD,uDAAuD;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uCAA+B,CAAC,CAAC,CAAC;KACvE;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,uBAAuB,CACrC,MAA0B,EAC1B,MAAc;IAEd,qEAAqE;IACrE,sEAAsE;IACtE,IACE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;QAC9D,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAC9C;QACA,MAAM,CAAC,OAAO,CACZ,mGAAmG,CACpG,CAAC;KACH;AACH,CAAC;AAdD,0DAcC;AAED,SAAgB,8BAA8B,CAAC,MAA0B;IACvE,0EAA0E;IAC1E,+DAA+D;IAC/D,sEAAsE;IACtE,qDAAqD;IACrD,gFAAgF;IAChF,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC7B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KAC7E;IACD,mFAAmF;IACnF,MAAM,qBAAqB,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACrC,IACE,CAAC,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC;QACvC,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EACvC;QACA,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;KACzD;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;QAC5B,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;KAC5E;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACxD;AACH,CAAC;AAjCD,wEAiCC"}

github/codeql-action-v1/lib/analysis-paths.test.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const ava_1 = __importDefault(require("ava"));
+const analysisPaths = __importStar(require("./analysis-paths"));
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("emptyPaths", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const config = {
+            languages: [],
+            queries: {},
+            pathsIgnore: [],
+            paths: [],
+            originalUserInput: {},
+            tempDir: tmpDir,
+            codeQLCmd: "",
+            gitHubVersion: { type: util.GitHubVariant.DOTCOM },
+            dbLocation: path.resolve(tmpDir, "codeql_databases"),
+            packs: {},
+            debugMode: false,
+            debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
+            debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
+            augmentationProperties: {
+                injectedMlQueries: false,
+                packsInputCombines: false,
+                queriesInputCombines: false,
+            },
+            trapCaches: {},
+            trapCacheDownloadTime: 0,
+        };
+        analysisPaths.includeAndExcludeAnalysisPaths(config);
+        t.is(process.env["LGTM_INDEX_INCLUDE"], undefined);
+        t.is(process.env["LGTM_INDEX_EXCLUDE"], undefined);
+        t.is(process.env["LGTM_INDEX_FILTERS"], undefined);
+    });
+});
+(0, ava_1.default)("nonEmptyPaths", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        const config = {
+            languages: [],
+            queries: {},
+            paths: ["path1", "path2", "**/path3"],
+            pathsIgnore: ["path4", "path5", "path6/**"],
+            originalUserInput: {},
+            tempDir: tmpDir,
+            codeQLCmd: "",
+            gitHubVersion: { type: util.GitHubVariant.DOTCOM },
+            dbLocation: path.resolve(tmpDir, "codeql_databases"),
+            packs: {},
+            debugMode: false,
+            debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
+            debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
+            augmentationProperties: {
+                injectedMlQueries: false,
+                packsInputCombines: false,
+                queriesInputCombines: false,
+            },
+            trapCaches: {},
+            trapCacheDownloadTime: 0,
+        };
+        analysisPaths.includeAndExcludeAnalysisPaths(config);
+        t.is(process.env["LGTM_INDEX_INCLUDE"], "path1\npath2");
+        t.is(process.env["LGTM_INDEX_EXCLUDE"], "path4\npath5");
+        t.is(process.env["LGTM_INDEX_FILTERS"], "include:path1\ninclude:path2\ninclude:**/path3\nexclude:path4\nexclude:path5\nexclude:path6/**");
+    });
+});
+(0, ava_1.default)("exclude temp dir", async (t) => {
+    const tempDir = path.join(process.cwd(), "codeql-runner-temp");
+    const config = {
+        languages: [],
+        queries: {},
+        pathsIgnore: [],
+        paths: [],
+        originalUserInput: {},
+        tempDir,
+        codeQLCmd: "",
+        gitHubVersion: { type: util.GitHubVariant.DOTCOM },
+        dbLocation: path.resolve(tempDir, "codeql_databases"),
+        packs: {},
+        debugMode: false,
+        debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
+        debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
+        augmentationProperties: {
+            injectedMlQueries: false,
+            packsInputCombines: false,
+            queriesInputCombines: false,
+        },
+        trapCaches: {},
+        trapCacheDownloadTime: 0,
+    };
+    analysisPaths.includeAndExcludeAnalysisPaths(config);
+    t.is(process.env["LGTM_INDEX_INCLUDE"], undefined);
+    t.is(process.env["LGTM_INDEX_EXCLUDE"], "codeql-runner-temp");
+    t.is(process.env["LGTM_INDEX_FILTERS"], undefined);
+});
+//# sourceMappingURL=analysis-paths.test.js.map

github/codeql-action-v1/lib/analysis-paths.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AAEvB,gEAAkD;AAClD,mDAA6C;AAC7C,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;YACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACpD,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,sBAAsB,EAAE;gBACtB,iBAAiB,EAAE,KAAK;gBACxB,kBAAkB,EAAE,KAAK;gBACzB,oBAAoB,EAAE,KAAK;aAC5B;YACD,UAAU,EAAE,EAAE;YACd,qBAAqB,EAAE,CAAC;SACzB,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YACrC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3C,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;YACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC;YACpD,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,KAAK;YAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;YACnD,sBAAsB,EAAE;gBACtB,iBAAiB,EAAE,KAAK;gBACxB,kBAAkB,EAAE,KAAK;gBACzB,oBAAoB,EAAE,KAAK;aAC5B;YACD,UAAU,EAAE,EAAE;YACd,qBAAqB,EAAE,CAAC;SACzB,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CACF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACjC,gGAAgG,CACjG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,EAAE;QACT,iBAAiB,EAAE,EAAE;QACrB,OAAO;QACP,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAwB;QACxE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACrD,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,KAAK;QAChB,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;QACnD,iBAAiB,EAAE,IAAI,CAAC,2BAA2B;QACnD,sBAAsB,EAAE;YACtB,iBAAiB,EAAE,KAAK;YACxB,kBAAkB,EAAE,KAAK;YACzB,oBAAoB,EAAE,KAAK;SAC5B;QACD,UAAU,EAAE,EAAE;QACd,qBAAqB,EAAE,CAAC;KACzB,CAAC;IACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC9D,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/analyze-action-env.test.js

@@ -0,0 +1,86 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const analyze = __importStar(require("./analyze"));
+const configUtils = __importStar(require("./config-utils"));
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+// This test needs to be in its own file so that ava would run it in its own
+// nodejs process. The code being tested is in analyze-action.ts, which runs
+// immediately on load. So the file needs to be loaded during part of the test,
+// and that can happen only once per nodejs process. If multiple such tests are
+// in the same test file, ava would run them in the same nodejs process, and all
+// but the first test would fail.
+(0, ava_1.default)("analyze action with RAM & threads from environment variables", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        process.env["GITHUB_SERVER_URL"] = util.GITHUB_DOTCOM_URL;
+        process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
+        process.env["GITHUB_API_URL"] = "https://api.github.com";
+        sinon
+            .stub(actionsUtil, "createStatusReportBase")
+            .resolves({});
+        sinon.stub(actionsUtil, "sendStatusReport").resolves(true);
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        const gitHubVersion = {
+            type: util.GitHubVariant.DOTCOM,
+        };
+        sinon.stub(configUtils, "getConfig").resolves({
+            gitHubVersion,
+            languages: [],
+            packs: [],
+            trapCaches: {},
+        });
+        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
+        requiredInputStub.withArgs("token").returns("fake-token");
+        requiredInputStub.withArgs("upload-database").returns("false");
+        const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
+        optionalInputStub.withArgs("cleanup-level").returns("none");
+        optionalInputStub.withArgs("expect-error").returns("false");
+        sinon.stub(util, "getGitHubVersion").resolves(gitHubVersion);
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {});
+        // When there are no action inputs for RAM and threads, the action uses
+        // environment variables (passed down from the init action) to set RAM and
+        // threads usage.
+        process.env["CODEQL_THREADS"] = "-1";
+        process.env["CODEQL_RAM"] = "4992";
+        const runFinalizeStub = sinon.stub(analyze, "runFinalize");
+        const runQueriesStub = sinon.stub(analyze, "runQueries");
+        const analyzeAction = require("./analyze-action");
+        // When analyze-action.ts loads, it runs an async function from the top
+        // level but does not wait for it to finish. To ensure that calls to
+        // runFinalize and runQueries are correctly captured by spies, we explicitly
+        // wait for the action promise to complete before starting verification.
+        await analyzeAction.runPromise;
+        t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
+        t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=4992");
+        t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
+        t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=4992");
+    });
+});
+//# sourceMappingURL=analyze-action-env.test.js.map

github/codeql-action-v1/lib/analyze-action-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-action-env.test.js","sourceRoot":"","sources":["../src/analyze-action-env.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,4DAA8C;AAC9C,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,8DAA8D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;aAC3C,QAAQ,CAAC,EAAkC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnE,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,uEAAuE;QACvE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/analyze-action-input.test.js

@@ -0,0 +1,86 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const analyze = __importStar(require("./analyze"));
+const configUtils = __importStar(require("./config-utils"));
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+// This test needs to be in its own file so that ava would run it in its own
+// nodejs process. The code being tested is in analyze-action.ts, which runs
+// immediately on load. So the file needs to be loaded during part of the test,
+// and that can happen only once per nodejs process. If multiple such tests are
+// in the same test file, ava would run them in the same nodejs process, and all
+// but the first test would fail.
+(0, ava_1.default)("analyze action with RAM & threads from action inputs", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        process.env["GITHUB_SERVER_URL"] = util.GITHUB_DOTCOM_URL;
+        process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
+        process.env["GITHUB_API_URL"] = "https://api.github.com";
+        sinon
+            .stub(actionsUtil, "createStatusReportBase")
+            .resolves({});
+        sinon.stub(actionsUtil, "sendStatusReport").resolves(true);
+        const gitHubVersion = {
+            type: util.GitHubVariant.DOTCOM,
+        };
+        sinon.stub(configUtils, "getConfig").resolves({
+            gitHubVersion,
+            languages: [],
+            packs: [],
+            trapCaches: {},
+        });
+        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
+        requiredInputStub.withArgs("token").returns("fake-token");
+        requiredInputStub.withArgs("upload-database").returns("false");
+        const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
+        optionalInputStub.withArgs("cleanup-level").returns("none");
+        optionalInputStub.withArgs("expect-error").returns("false");
+        sinon.stub(util, "getGitHubVersion").resolves(gitHubVersion);
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {});
+        process.env["CODEQL_THREADS"] = "1";
+        process.env["CODEQL_RAM"] = "4992";
+        // Action inputs have precedence over environment variables.
+        optionalInputStub.withArgs("threads").returns("-1");
+        optionalInputStub.withArgs("ram").returns("3012");
+        const runFinalizeStub = sinon.stub(analyze, "runFinalize");
+        const runQueriesStub = sinon.stub(analyze, "runQueries");
+        const analyzeAction = require("./analyze-action");
+        // When analyze-action.ts loads, it runs an async function from the top
+        // level but does not wait for it to finish. To ensure that calls to
+        // runFinalize and runQueries are correctly captured by spies, we explicitly
+        // wait for the action promise to complete before starting verification.
+        await analyzeAction.runPromise;
+        t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
+        t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=3012");
+        t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
+        t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=3012");
+    });
+});
+//# sourceMappingURL=analyze-action-input.test.js.map

github/codeql-action-v1/lib/analyze-action-input.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-action-input.test.js","sourceRoot":"","sources":["../src/analyze-action-input.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,4DAA8C;AAC9C,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,sDAAsD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;aAC3C,QAAQ,CAAC,EAAkC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnE,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,4DAA4D;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/analyze-action-post-helper.js

@@ -0,0 +1,41 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = void 0;
+const core = __importStar(require("@actions/core"));
+const actionsUtil = __importStar(require("./actions-util"));
+const config_utils_1 = require("./config-utils");
+const logging_1 = require("./logging");
+async function run(uploadSarifDebugArtifact) {
+    const logger = (0, logging_1.getActionsLogger)();
+    const config = await (0, config_utils_1.getConfig)(actionsUtil.getTemporaryDirectory(), logger);
+    if (config === undefined) {
+        throw new Error("Config file could not be found at expected location. Did the 'init' action fail to start?");
+    }
+    // Upload Actions SARIF artifacts for debugging
+    if (config === null || config === void 0 ? void 0 : config.debugMode) {
+        core.info("Debug mode is on. Uploading available SARIF files as Actions debugging artifact...");
+        const outputDir = actionsUtil.getRequiredInput("output");
+        await uploadSarifDebugArtifact(config, outputDir);
+    }
+}
+exports.run = run;
+//# sourceMappingURL=analyze-action-post-helper.js.map

github/codeql-action-v1/lib/analyze-action-post-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-action-post-helper.js","sourceRoot":"","sources":["../src/analyze-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,iDAA2C;AAC3C,uCAA6C;AAEtC,KAAK,UAAU,GAAG,CAAC,wBAAkC;IAC1D,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAElC,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;KACH;IAED,+CAA+C;IAC/C,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,EAAE;QACrB,IAAI,CAAC,IAAI,CACP,oFAAoF,CACrF,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;KACnD;AACH,CAAC;AAlBD,kBAkBC"}

github/codeql-action-v1/lib/analyze-action-post-helper.test.js

@@ -0,0 +1,69 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const analyzeActionPostHelper = __importStar(require("./analyze-action-post-helper"));
+const configUtils = __importStar(require("./config-utils"));
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("post: analyze action with debug mode off", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env["RUNNER_TEMP"] = tmpDir;
+        const gitHubVersion = {
+            type: util.GitHubVariant.DOTCOM,
+        };
+        sinon.stub(configUtils, "getConfig").resolves({
+            debugMode: false,
+            gitHubVersion,
+            languages: [],
+            packs: [],
+        });
+        const uploadSarifSpy = sinon.spy();
+        await analyzeActionPostHelper.run(uploadSarifSpy);
+        t.assert(uploadSarifSpy.notCalled);
+    });
+});
+(0, ava_1.default)("post: analyze action with debug mode on", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env["RUNNER_TEMP"] = tmpDir;
+        const gitHubVersion = {
+            type: util.GitHubVariant.DOTCOM,
+        };
+        sinon.stub(configUtils, "getConfig").resolves({
+            debugMode: true,
+            gitHubVersion,
+            languages: [],
+            packs: [],
+        });
+        const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
+        requiredInputStub.withArgs("output").returns("fake-output-dir");
+        const uploadSarifSpy = sinon.spy();
+        await analyzeActionPostHelper.run(uploadSarifSpy);
+        t.assert(uploadSarifSpy.called);
+    });
+});
+//# sourceMappingURL=analyze-action-post-helper.test.js.map

github/codeql-action-v1/lib/analyze-action-post-helper.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-action-post-helper.test.js","sourceRoot":"","sources":["../src/analyze-action-post-helper.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,sFAAwE;AACxE,4DAA8C;AAC9C,mDAA6C;AAC7C,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,0CAA0C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3D,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;QAEpC,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,SAAS,EAAE,KAAK;YAChB,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;SACuB,CAAC,CAAC;QAEpC,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAEnC,MAAM,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElD,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1D,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;QAEpC,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,SAAS,EAAE,IAAI;YACf,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;SACuB,CAAC,CAAC;QAEpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEhE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAEnC,MAAM,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElD,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/analyze-action-post.js

@@ -0,0 +1,40 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * This file is the entry point for the `post:` hook of `analyze-action.yml`.
+ * It will run after the all steps in this job, in reverse order in relation to
+ * other `post:` hooks.
+ */
+const core = __importStar(require("@actions/core"));
+const analyzeActionPostHelper = __importStar(require("./analyze-action-post-helper"));
+const debugArtifacts = __importStar(require("./debug-artifacts"));
+async function runWrapper() {
+    try {
+        await analyzeActionPostHelper.run(debugArtifacts.uploadSarifDebugArtifact);
+    }
+    catch (error) {
+        core.setFailed(`analyze post-action step failed: ${error}`);
+        console.log(error);
+    }
+}
+void runWrapper();
+//# sourceMappingURL=analyze-action-post.js.map

github/codeql-action-v1/lib/analyze-action-post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-action-post.js","sourceRoot":"","sources":["../src/analyze-action-post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,oDAAsC;AAEtC,sFAAwE;AACxE,kEAAoD;AAEpD,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC;KAC5E;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

github/codeql-action-v1/lib/analyze-action.js

@@ -0,0 +1,246 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runPromise = exports.sendStatusReport = void 0;
+const fs = __importStar(require("fs"));
+const path_1 = __importDefault(require("path"));
+// We need to import `performance` on Node 12
+const perf_hooks_1 = require("perf_hooks");
+const core = __importStar(require("@actions/core"));
+const actionsUtil = __importStar(require("./actions-util"));
+const analyze_1 = require("./analyze");
+const api_client_1 = require("./api-client");
+const autobuild_1 = require("./autobuild");
+const codeql_1 = require("./codeql");
+const config_utils_1 = require("./config-utils");
+const database_upload_1 = require("./database-upload");
+const feature_flags_1 = require("./feature-flags");
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
+const shared_environment_1 = require("./shared-environment");
+const trap_caching_1 = require("./trap-caching");
+const upload_lib = __importStar(require("./upload-lib"));
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
+async function sendStatusReport(startedAt, config, stats, error, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger) {
+    const status = actionsUtil.getActionsStatus(error, stats === null || stats === void 0 ? void 0 : stats.analyze_failure_language);
+    const statusReportBase = await actionsUtil.createStatusReportBase("finish", status, startedAt, error === null || error === void 0 ? void 0 : error.message, error === null || error === void 0 ? void 0 : error.stack);
+    const statusReport = {
+        ...statusReportBase,
+        ...(config
+            ? {
+                ml_powered_javascript_queries: util.getMlPoweredJsQueriesStatus(config),
+            }
+            : {}),
+        ...(stats || {}),
+        ...(dbCreationTimings || {}),
+    };
+    if (config && didUploadTrapCaches) {
+        const trapCacheUploadStatusReport = {
+            ...statusReport,
+            trap_cache_upload_duration_ms: Math.round(trapCacheUploadTime || 0),
+            trap_cache_upload_size_bytes: Math.round(await (0, trap_caching_1.getTotalCacheSize)(config.trapCaches, logger)),
+        };
+        await actionsUtil.sendStatusReport(trapCacheUploadStatusReport);
+    }
+    else {
+        await actionsUtil.sendStatusReport(statusReport);
+    }
+}
+exports.sendStatusReport = sendStatusReport;
+// `expect-error` should only be set to a non-false value by the CodeQL Action PR checks.
+function hasBadExpectErrorInput() {
+    return (actionsUtil.getOptionalInput("expect-error") !== "false" &&
+        !util.isInTestMode());
+}
+/**
+ * Returns whether any TRAP files exist under the `db-go` folder,
+ * indicating whether Go extraction has extracted at least one file.
+ */
+function doesGoExtractionOutputExist(config) {
+    const golangDbDirectory = util.getCodeQLDatabasePath(config, languages_1.Language.go);
+    const trapDirectory = path_1.default.join(golangDbDirectory, "trap", languages_1.Language.go);
+    return (fs.existsSync(trapDirectory) &&
+        fs
+            .readdirSync(trapDirectory)
+            .some((fileName) => [
+            ".trap",
+            ".trap.gz",
+            ".trap.br",
+            ".trap.tar.gz",
+            ".trap.tar.br",
+            ".trap.tar",
+        ].some((ext) => fileName.endsWith(ext))));
+}
+/**
+ * We attempt to autobuild Go to preserve compatibility for users who have
+ * set up Go using a legacy scanning style CodeQL workflow, i.e. one without
+ * an autobuild step or manual build steps.
+ *
+ * - We detect whether an autobuild step is present by checking the
+ * `util.DID_AUTOBUILD_GO_ENV_VAR_NAME` environment variable, which is set
+ * when the autobuilder is invoked.
+ * - We detect whether the Go database has already been finalized in case it
+ * has been manually set in a prior Action step.
+ * - We approximate whether manual build steps are present by looking at
+ * whether any extraction output already exists for Go.
+ */
+async function runAutobuildIfLegacyGoWorkflow(config, logger) {
+    if (!config.languages.includes(languages_1.Language.go)) {
+        return;
+    }
+    if (process.env[util.DID_AUTOBUILD_GO_ENV_VAR_NAME] === "true") {
+        logger.debug("Won't run Go autobuild since it has already been run.");
+        return;
+    }
+    if ((0, analyze_1.dbIsFinalized)(config, languages_1.Language.go, logger)) {
+        logger.debug("Won't run Go autobuild since there is already a finalized database for Go.");
+        return;
+    }
+    // This captures whether a user has added manual build steps for Go
+    if (doesGoExtractionOutputExist(config)) {
+        logger.debug("Won't run Go autobuild since at least one file of Go code has already been extracted.");
+        // If the user has run the manual build step, and has set the `CODEQL_EXTRACTOR_GO_BUILD_TRACING`
+        // variable, we suggest they remove it from their workflow.
+        if ("CODEQL_EXTRACTOR_GO_BUILD_TRACING" in process.env) {
+            logger.warning(`The CODEQL_EXTRACTOR_GO_BUILD_TRACING environment variable has no effect on workflows with manual build steps, so we recommend that you remove it from your workflow.`);
+        }
+        return;
+    }
+    await (0, autobuild_1.runAutobuild)(languages_1.Language.go, config, logger);
+}
+async function run() {
+    const startedAt = new Date();
+    let uploadResult = undefined;
+    let runStats = undefined;
+    let config = undefined;
+    let trapCacheUploadTime = undefined;
+    let dbCreationTimings = undefined;
+    let didUploadTrapCaches = false;
+    util.initializeEnvironment(pkg.version);
+    await util.checkActionVersion(pkg.version);
+    const logger = (0, logging_1.getActionsLogger)();
+    try {
+        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("finish", "starting", startedAt)))) {
+            return;
+        }
+        config = await (0, config_utils_1.getConfig)(actionsUtil.getTemporaryDirectory(), logger);
+        if (config === undefined) {
+            throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
+        }
+        if (hasBadExpectErrorInput()) {
+            throw new Error("`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork.");
+        }
+        await util.enrichEnvironment(await (0, codeql_1.getCodeQL)(config.codeQLCmd));
+        const apiDetails = (0, api_client_1.getApiDetails)();
+        const outputDir = actionsUtil.getRequiredInput("output");
+        const threads = util.getThreadsFlag(actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"], logger);
+        const memory = util.getMemoryFlag(actionsUtil.getOptionalInput("ram") || process.env["CODEQL_RAM"]);
+        const repositoryNwo = (0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY"));
+        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+        const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, actionsUtil.getTemporaryDirectory(), logger);
+        await runAutobuildIfLegacyGoWorkflow(config, logger);
+        dbCreationTimings = await (0, analyze_1.runFinalize)(outputDir, threads, memory, config, logger);
+        if (actionsUtil.getRequiredInput("skip-queries") !== "true") {
+            runStats = await (0, analyze_1.runQueries)(outputDir, memory, util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), threads, actionsUtil.getOptionalInput("category"), config, logger, features);
+        }
+        if (actionsUtil.getOptionalInput("cleanup-level") !== "none") {
+            await (0, analyze_1.runCleanup)(config, actionsUtil.getOptionalInput("cleanup-level") || "brutal", logger);
+        }
+        const dbLocations = {};
+        for (const language of config.languages) {
+            dbLocations[language] = util.getCodeQLDatabasePath(config, language);
+        }
+        core.setOutput("db-locations", dbLocations);
+        if (runStats && actionsUtil.getRequiredInput("upload") === "true") {
+            uploadResult = await upload_lib.uploadFromActions(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger);
+            core.setOutput("sarif-id", uploadResult.sarifID);
+        }
+        else {
+            logger.info("Not uploading results");
+        }
+        // Possibly upload the database bundles for remote queries
+        await (0, database_upload_1.uploadDatabases)(repositoryNwo, config, apiDetails, logger);
+        // Possibly upload the TRAP caches for later re-use
+        const trapCacheUploadStartTime = perf_hooks_1.performance.now();
+        const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+        didUploadTrapCaches = await (0, trap_caching_1.uploadTrapCaches)(codeql, config, logger);
+        trapCacheUploadTime = perf_hooks_1.performance.now() - trapCacheUploadStartTime;
+        // We don't upload results in test mode, so don't wait for processing
+        if (util.isInTestMode()) {
+            core.debug("In test mode. Waiting for processing is disabled.");
+        }
+        else if (uploadResult !== undefined &&
+            actionsUtil.getRequiredInput("wait-for-processing") === "true") {
+            await upload_lib.waitForProcessing((0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), uploadResult.sarifID, (0, logging_1.getActionsLogger)());
+        }
+        // If we did not throw an error yet here, but we expect one, throw it.
+        if (actionsUtil.getOptionalInput("expect-error") === "true") {
+            core.setFailed(`expect-error input was set to true but no error was thrown.`);
+        }
+        core.exportVariable(shared_environment_1.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
+    }
+    catch (origError) {
+        const error = origError instanceof Error ? origError : new Error(String(origError));
+        if (actionsUtil.getOptionalInput("expect-error") !== "true" ||
+            hasBadExpectErrorInput()) {
+            core.setFailed(error.message);
+        }
+        if (error instanceof analyze_1.CodeQLAnalysisError) {
+            const stats = { ...error.queriesStatusReport };
+            await sendStatusReport(startedAt, config, stats, error, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger);
+        }
+        else {
+            await sendStatusReport(startedAt, config, undefined, error, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger);
+        }
+        return;
+    }
+    if (runStats && uploadResult) {
+        await sendStatusReport(startedAt, config, {
+            ...runStats,
+            ...uploadResult.statusReport,
+        }, undefined, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger);
+    }
+    else if (runStats) {
+        await sendStatusReport(startedAt, config, { ...runStats }, undefined, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger);
+    }
+    else {
+        await sendStatusReport(startedAt, config, undefined, undefined, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger);
+    }
+}
+exports.runPromise = run();
+async function runWrapper() {
+    try {
+        await exports.runPromise;
+    }
+    catch (error) {
+        core.setFailed(`analyze action failed: ${error}`);
+    }
+    await (0, util_1.checkForTimeout)();
+}
+void runWrapper();
+//# sourceMappingURL=analyze-action.js.map

github/codeql-action-v1/lib/analyze.js

@@ -0,0 +1,328 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateQueryFilters = exports.runCleanup = exports.runFinalize = exports.createQuerySuiteContents = exports.convertPackToQuerySuiteEntry = exports.runQueries = exports.dbIsFinalized = exports.createdDBForScannedLanguages = exports.CodeQLAnalysisError = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const perf_hooks_1 = require("perf_hooks"); // We need to import `performance` on Node 12
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const del_1 = __importDefault(require("del"));
+const yaml = __importStar(require("js-yaml"));
+const analysisPaths = __importStar(require("./analysis-paths"));
+const codeql_1 = require("./codeql");
+const configUtils = __importStar(require("./config-utils"));
+const languages_1 = require("./languages");
+const sharedEnv = __importStar(require("./shared-environment"));
+const tracer_config_1 = require("./tracer-config");
+const util = __importStar(require("./util"));
+class CodeQLAnalysisError extends Error {
+    constructor(queriesStatusReport, message) {
+        super(message);
+        this.name = "CodeQLAnalysisError";
+        this.queriesStatusReport = queriesStatusReport;
+    }
+}
+exports.CodeQLAnalysisError = CodeQLAnalysisError;
+async function setupPythonExtractor(logger) {
+    const codeqlPython = process.env["CODEQL_PYTHON"];
+    if (codeqlPython === undefined || codeqlPython.length === 0) {
+        // If CODEQL_PYTHON is not set, no dependencies were installed, so we don't need to do anything
+        return;
+    }
+    const scriptsFolder = path.resolve(__dirname, "../python-setup");
+    let output = "";
+    const options = {
+        listeners: {
+            stdout: (data) => {
+                output += data.toString();
+            },
+        },
+    };
+    await new toolrunner.ToolRunner(codeqlPython, [path.join(scriptsFolder, "find_site_packages.py")], options).exec();
+    logger.info(`Setting LGTM_INDEX_IMPORT_PATH=${output}`);
+    process.env["LGTM_INDEX_IMPORT_PATH"] = output;
+    output = "";
+    await new toolrunner.ToolRunner(codeqlPython, ["-c", "import sys; print(sys.version_info[0])"], options).exec();
+    logger.info(`Setting LGTM_PYTHON_SETUP_VERSION=${output}`);
+    process.env["LGTM_PYTHON_SETUP_VERSION"] = output;
+}
+async function createdDBForScannedLanguages(codeql, config, logger) {
+    // Insert the LGTM_INDEX_X env vars at this point so they are set when
+    // we extract any scanned languages.
+    analysisPaths.includeAndExcludeAnalysisPaths(config);
+    for (const language of config.languages) {
+        if ((0, languages_1.isScannedLanguage)(language) &&
+            !dbIsFinalized(config, language, logger)) {
+            logger.startGroup(`Extracting ${language}`);
+            if (language === languages_1.Language.python) {
+                await setupPythonExtractor(logger);
+            }
+            await codeql.extractScannedLanguage(config, language);
+            logger.endGroup();
+        }
+    }
+}
+exports.createdDBForScannedLanguages = createdDBForScannedLanguages;
+function dbIsFinalized(config, language, logger) {
+    const dbPath = util.getCodeQLDatabasePath(config, language);
+    try {
+        const dbInfo = yaml.load(fs.readFileSync(path.resolve(dbPath, "codeql-database.yml"), "utf8"));
+        return !("inProgress" in dbInfo);
+    }
+    catch (e) {
+        logger.warning(`Could not check whether database for ${language} was finalized. Assuming it is not.`);
+        return false;
+    }
+}
+exports.dbIsFinalized = dbIsFinalized;
+async function finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger) {
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    const extractionStart = perf_hooks_1.performance.now();
+    await createdDBForScannedLanguages(codeql, config, logger);
+    const extractionTime = perf_hooks_1.performance.now() - extractionStart;
+    const trapImportStart = perf_hooks_1.performance.now();
+    for (const language of config.languages) {
+        if (dbIsFinalized(config, language, logger)) {
+            logger.info(`There is already a finalized database for ${language} at the location where the CodeQL Action places databases, so we did not create one.`);
+        }
+        else {
+            logger.startGroup(`Finalizing ${language}`);
+            await codeql.finalizeDatabase(util.getCodeQLDatabasePath(config, language), threadsFlag, memoryFlag);
+            logger.endGroup();
+        }
+    }
+    const trapImportTime = perf_hooks_1.performance.now() - trapImportStart;
+    return {
+        scanned_language_extraction_duration_ms: Math.round(extractionTime),
+        trap_import_duration_ms: Math.round(trapImportTime),
+    };
+}
+// Runs queries and creates sarif files in the given folder
+async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag, automationDetailsId, config, logger, featureEnablement) {
+    const statusReport = {};
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    await util.logCodeScanningConfigInCli(codeql, featureEnablement, logger);
+    for (const language of config.languages) {
+        const queries = config.queries[language];
+        const queryFilters = validateQueryFilters(config.originalUserInput["query-filters"]);
+        const packsWithVersion = config.packs[language] || [];
+        try {
+            if (await util.useCodeScanningConfigInCli(codeql, featureEnablement)) {
+                // If we are using the code scanning config in the CLI,
+                // much of the work needed to generate the query suites
+                // is done in the CLI. We just need to make a single
+                // call to run all the queries for each language and
+                // another to interpret the results.
+                logger.startGroup(`Running queries for ${language}`);
+                const startTimeBuiltIn = new Date().getTime();
+                await runQueryGroup(language, "all", undefined, undefined);
+                // TODO should not be using `builtin` here. We should be using `all` instead.
+                // The status report does not support `all` yet.
+                statusReport[`analyze_builtin_queries_${language}_duration_ms`] =
+                    new Date().getTime() - startTimeBuiltIn;
+                logger.startGroup(`Interpreting results for ${language}`);
+                const startTimeInterpretResults = new Date().getTime();
+                const sarifFile = path.join(sarifFolder, `${language}.sarif`);
+                const analysisSummary = await runInterpretResults(language, undefined, sarifFile, config.debugMode);
+                statusReport[`interpret_results_${language}_duration_ms`] =
+                    new Date().getTime() - startTimeInterpretResults;
+                logger.endGroup();
+                logger.info(analysisSummary);
+            }
+            else {
+                // config was generated by the action, so must be interpreted by the action.
+                const hasBuiltinQueries = (queries === null || queries === void 0 ? void 0 : queries.builtin.length) > 0;
+                const hasCustomQueries = (queries === null || queries === void 0 ? void 0 : queries.custom.length) > 0;
+                const hasPackWithCustomQueries = packsWithVersion.length > 0;
+                if (!hasBuiltinQueries &&
+                    !hasCustomQueries &&
+                    !hasPackWithCustomQueries) {
+                    throw new Error(`Unable to analyze ${language} as no queries were selected for this language`);
+                }
+                logger.startGroup(`Running queries for ${language}`);
+                const querySuitePaths = [];
+                if (queries["builtin"].length > 0) {
+                    const startTimeBuiltIn = new Date().getTime();
+                    querySuitePaths.push((await runQueryGroup(language, "builtin", createQuerySuiteContents(queries["builtin"], queryFilters), undefined)));
+                    statusReport[`analyze_builtin_queries_${language}_duration_ms`] =
+                        new Date().getTime() - startTimeBuiltIn;
+                }
+                const startTimeCustom = new Date().getTime();
+                let ranCustom = false;
+                for (let i = 0; i < queries["custom"].length; ++i) {
+                    if (queries["custom"][i].queries.length > 0) {
+                        querySuitePaths.push((await runQueryGroup(language, `custom-${i}`, createQuerySuiteContents(queries["custom"][i].queries, queryFilters), queries["custom"][i].searchPath)));
+                        ranCustom = true;
+                    }
+                }
+                if (packsWithVersion.length > 0) {
+                    querySuitePaths.push(await runQueryPacks(language, "packs", packsWithVersion, queryFilters));
+                    ranCustom = true;
+                }
+                if (ranCustom) {
+                    statusReport[`analyze_custom_queries_${language}_duration_ms`] =
+                        new Date().getTime() - startTimeCustom;
+                }
+                logger.endGroup();
+                logger.startGroup(`Interpreting results for ${language}`);
+                const startTimeInterpretResults = new Date().getTime();
+                const sarifFile = path.join(sarifFolder, `${language}.sarif`);
+                const analysisSummary = await runInterpretResults(language, querySuitePaths, sarifFile, config.debugMode);
+                statusReport[`interpret_results_${language}_duration_ms`] =
+                    new Date().getTime() - startTimeInterpretResults;
+                logger.endGroup();
+                logger.info(analysisSummary);
+            }
+            logger.info(await runPrintLinesOfCode(language));
+        }
+        catch (e) {
+            logger.info(String(e));
+            if (e instanceof Error) {
+                logger.info(e.stack);
+            }
+            statusReport.analyze_failure_language = language;
+            throw new CodeQLAnalysisError(statusReport, `Error running analysis for ${language}: ${e}`);
+        }
+    }
+    return statusReport;
+    async function runInterpretResults(language, queries, sarifFile, enableDebugLogging) {
+        const databasePath = util.getCodeQLDatabasePath(config, language);
+        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", automationDetailsId);
+    }
+    async function runPrintLinesOfCode(language) {
+        const databasePath = util.getCodeQLDatabasePath(config, language);
+        return await codeql.databasePrintBaseline(databasePath);
+    }
+    async function runQueryGroup(language, type, querySuiteContents, searchPath) {
+        const databasePath = util.getCodeQLDatabasePath(config, language);
+        // Pass the queries to codeql using a file instead of using the command
+        // line to avoid command line length restrictions, particularly on windows.
+        const querySuitePath = querySuiteContents
+            ? `${databasePath}-queries-${type}.qls`
+            : undefined;
+        if (querySuiteContents && querySuitePath) {
+            fs.writeFileSync(querySuitePath, querySuiteContents);
+            logger.debug(`Query suite file for ${language}-${type}...\n${querySuiteContents}`);
+        }
+        await codeql.databaseRunQueries(databasePath, searchPath, querySuitePath, memoryFlag, threadsFlag);
+        logger.debug(`BQRS results produced for ${language} (queries: ${type})"`);
+        return querySuitePath;
+    }
+    async function runQueryPacks(language, type, packs, queryFilters) {
+        const databasePath = util.getCodeQLDatabasePath(config, language);
+        for (const pack of packs) {
+            logger.debug(`Running query pack for ${language}-${type}: ${pack}`);
+        }
+        // combine the list of packs into a query suite in order to run them all simultaneously.
+        const querySuite = packs.map(convertPackToQuerySuiteEntry).concat(queryFilters);
+        const querySuitePath = `${databasePath}-queries-${type}.qls`;
+        fs.writeFileSync(querySuitePath, yaml.dump(querySuite));
+        logger.debug(`BQRS results produced for ${language} (queries: ${type})"`);
+        await codeql.databaseRunQueries(databasePath, undefined, querySuitePath, memoryFlag, threadsFlag);
+        return querySuitePath;
+    }
+}
+exports.runQueries = runQueries;
+function convertPackToQuerySuiteEntry(packStr) {
+    var _a, _b, _c, _d;
+    const pack = configUtils.parsePacksSpecification(packStr);
+    return {
+        qlpack: !pack.path ? pack.name : undefined,
+        from: pack.path ? pack.name : undefined,
+        version: pack.version,
+        query: ((_a = pack.path) === null || _a === void 0 ? void 0 : _a.endsWith(".ql")) ? pack.path : undefined,
+        queries: !((_b = pack.path) === null || _b === void 0 ? void 0 : _b.endsWith(".ql")) && !((_c = pack.path) === null || _c === void 0 ? void 0 : _c.endsWith(".qls"))
+            ? pack.path
+            : undefined,
+        apply: ((_d = pack.path) === null || _d === void 0 ? void 0 : _d.endsWith(".qls")) ? pack.path : undefined,
+    };
+}
+exports.convertPackToQuerySuiteEntry = convertPackToQuerySuiteEntry;
+function createQuerySuiteContents(queries, queryFilters) {
+    return yaml.dump(queries.map((q) => ({ query: q })).concat(queryFilters));
+}
+exports.createQuerySuiteContents = createQuerySuiteContents;
+async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger) {
+    try {
+        await (0, del_1.default)(outputDir, { force: true });
+    }
+    catch (error) {
+        if ((error === null || error === void 0 ? void 0 : error.code) !== "ENOENT") {
+            throw error;
+        }
+    }
+    await fs.promises.mkdir(outputDir, { recursive: true });
+    const timings = await finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger);
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    // WARNING: This does not _really_ end tracing, as the tracer will restore its
+    // critical environment variables and it'll still be active for all processes
+    // launched from this build step.
+    // However, it will stop tracing for all steps past the codeql-action/analyze
+    // step.
+    if (await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+        // Delete variables as specified by the end-tracing script
+        await (0, tracer_config_1.endTracingForCluster)(config);
+    }
+    else {
+        // Delete the tracer config env var to avoid tracing ourselves
+        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
+    }
+    return timings;
+}
+exports.runFinalize = runFinalize;
+async function runCleanup(config, cleanupLevel, logger) {
+    logger.startGroup("Cleaning up databases");
+    for (const language of config.languages) {
+        const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+        const databasePath = util.getCodeQLDatabasePath(config, language);
+        await codeql.databaseCleanup(databasePath, cleanupLevel);
+    }
+    logger.endGroup();
+}
+exports.runCleanup = runCleanup;
+// exported for testing
+function validateQueryFilters(queryFilters) {
+    if (!queryFilters) {
+        return [];
+    }
+    if (!Array.isArray(queryFilters)) {
+        throw new Error(`Query filters must be an array of "include" or "exclude" entries. Found ${typeof queryFilters}`);
+    }
+    const errors = [];
+    for (const qf of queryFilters) {
+        const keys = Object.keys(qf);
+        if (keys.length !== 1) {
+            errors.push(`Query filter must have exactly one key: ${JSON.stringify(qf)}`);
+        }
+        if (!["exclude", "include"].includes(keys[0])) {
+            errors.push(`Only "include" or "exclude" filters are allowed:\n${JSON.stringify(qf)}`);
+        }
+    }
+    if (errors.length) {
+        throw new Error(`Invalid query filter.\n${errors.join("\n")}`);
+    }
+    return queryFilters;
+}
+exports.validateQueryFilters = validateQueryFilters;
+//# sourceMappingURL=analyze.js.map

github/codeql-action-v1/lib/analyze.test.js

@@ -0,0 +1,324 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const ava_1 = __importDefault(require("ava"));
+const yaml = __importStar(require("js-yaml"));
+const analyze_1 = require("./analyze");
+const codeql_1 = require("./codeql");
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+// Checks that the duration fields are populated for the correct language
+// and correct case of builtin or custom. Also checks the correct search
+// paths are set in the database analyze invocation.
+(0, ava_1.default)("status report fields and search path setting", async (t) => {
+    let searchPathsUsed = [];
+    return await util.withTmpDir(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const memoryFlag = "";
+        const addSnippetsFlag = "";
+        const threadsFlag = "";
+        const packs = {
+            [languages_1.Language.cpp]: ["a/b@1.0.0"],
+            [languages_1.Language.java]: ["c/d@2.0.0"],
+        };
+        for (const language of Object.values(languages_1.Language)) {
+            (0, codeql_1.setCodeQL)({
+                packDownload: async () => ({ packs: [] }),
+                databaseRunQueries: async (_db, searchPath) => {
+                    searchPathsUsed.push(searchPath);
+                },
+                databaseInterpretResults: async (_db, _queriesRun, sarifFile) => {
+                    fs.writeFileSync(sarifFile, JSON.stringify({
+                        runs: [
+                            // references a rule with the lines-of-code tag, so baseline should be injected
+                            {
+                                tool: {
+                                    extensions: [
+                                        {
+                                            rules: [
+                                                {
+                                                    properties: {
+                                                        tags: ["lines-of-code"],
+                                                    },
+                                                },
+                                            ],
+                                        },
+                                    ],
+                                },
+                                properties: {
+                                    metricResults: [
+                                        {
+                                            rule: {
+                                                index: 0,
+                                                toolComponent: {
+                                                    index: 0,
+                                                },
+                                            },
+                                            value: 123,
+                                        },
+                                    ],
+                                },
+                            },
+                            {},
+                        ],
+                    }));
+                    return "";
+                },
+                databasePrintBaseline: async () => "",
+            });
+            searchPathsUsed = [];
+            const config = {
+                languages: [language],
+                queries: {},
+                pathsIgnore: [],
+                paths: [],
+                originalUserInput: {},
+                tempDir: tmpDir,
+                codeQLCmd: "",
+                gitHubVersion: {
+                    type: util.GitHubVariant.DOTCOM,
+                },
+                dbLocation: path.resolve(tmpDir, "codeql_databases"),
+                packs,
+                debugMode: false,
+                debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
+                debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
+                augmentationProperties: {
+                    injectedMlQueries: false,
+                    packsInputCombines: false,
+                    queriesInputCombines: false,
+                },
+                trapCaches: {},
+                trapCacheDownloadTime: 0,
+            };
+            fs.mkdirSync(util.getCodeQLDatabasePath(config, language), {
+                recursive: true,
+            });
+            config.queries[language] = {
+                builtin: ["foo.ql"],
+                custom: [],
+            };
+            const builtinStatusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([]));
+            const hasPacks = language in packs;
+            const statusReportKeys = Object.keys(builtinStatusReport).sort();
+            if (hasPacks) {
+                t.deepEqual(statusReportKeys.length, 3, statusReportKeys.toString());
+                t.deepEqual(statusReportKeys[0], `analyze_builtin_queries_${language}_duration_ms`);
+                t.deepEqual(statusReportKeys[1], `analyze_custom_queries_${language}_duration_ms`);
+                t.deepEqual(statusReportKeys[2], `interpret_results_${language}_duration_ms`);
+            }
+            else {
+                t.deepEqual(statusReportKeys[0], `analyze_builtin_queries_${language}_duration_ms`);
+                t.deepEqual(statusReportKeys[1], `interpret_results_${language}_duration_ms`);
+            }
+            config.queries[language] = {
+                builtin: [],
+                custom: [
+                    {
+                        queries: ["foo.ql"],
+                        searchPath: "/1",
+                    },
+                    {
+                        queries: ["bar.ql"],
+                        searchPath: "/2",
+                    },
+                ],
+            };
+            const customStatusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([]));
+            t.deepEqual(Object.keys(customStatusReport).length, 2);
+            t.true(`analyze_custom_queries_${language}_duration_ms` in customStatusReport);
+            const expectedSearchPathsUsed = hasPacks
+                ? [undefined, undefined, "/1", "/2", undefined]
+                : [undefined, "/1", "/2"];
+            t.deepEqual(searchPathsUsed, expectedSearchPathsUsed);
+            t.true(`interpret_results_${language}_duration_ms` in customStatusReport);
+        }
+        verifyQuerySuites(tmpDir);
+    });
+    function verifyQuerySuites(tmpDir) {
+        const qlsContent = [
+            {
+                query: "foo.ql",
+            },
+        ];
+        const qlsContent2 = [
+            {
+                query: "bar.ql",
+            },
+        ];
+        for (const lang of Object.values(languages_1.Language)) {
+            t.deepEqual(readContents(`${lang}-queries-builtin.qls`), qlsContent);
+            t.deepEqual(readContents(`${lang}-queries-custom-0.qls`), qlsContent);
+            t.deepEqual(readContents(`${lang}-queries-custom-1.qls`), qlsContent2);
+        }
+        function readContents(name) {
+            const x = fs.readFileSync(path.join(tmpDir, "codeql_databases", name), "utf8");
+            console.log(x);
+            return yaml.load(fs.readFileSync(path.join(tmpDir, "codeql_databases", name), "utf8"));
+        }
+    }
+});
+(0, ava_1.default)("validateQueryFilters", (t) => {
+    t.notThrows(() => (0, analyze_1.validateQueryFilters)([]));
+    t.notThrows(() => (0, analyze_1.validateQueryFilters)(undefined));
+    t.notThrows(() => {
+        return (0, analyze_1.validateQueryFilters)([
+            {
+                exclude: {
+                    "problem.severity": "recommendation",
+                },
+            },
+            {
+                exclude: {
+                    "tags contain": ["foo", "bar"],
+                },
+            },
+            {
+                include: {
+                    "problem.severity": "something-to-think-about",
+                },
+            },
+            {
+                include: {
+                    "tags contain": ["baz", "bop"],
+                },
+            },
+        ]);
+    });
+    t.throws(() => {
+        return (0, analyze_1.validateQueryFilters)([
+            {
+                exclude: {
+                    "tags contain": ["foo", "bar"],
+                },
+                include: {
+                    "tags contain": ["baz", "bop"],
+                },
+            },
+        ]);
+    }, { message: /Query filter must have exactly one key/ });
+    t.throws(() => {
+        return (0, analyze_1.validateQueryFilters)([{ xxx: "foo" }]);
+    }, { message: /Only "include" or "exclude" filters are allowed/ });
+    t.throws(() => {
+        return (0, analyze_1.validateQueryFilters)({ exclude: "foo" });
+    }, {
+        message: /Query filters must be an array of "include" or "exclude" entries/,
+    });
+});
+const convertPackToQuerySuiteEntryMacro = ava_1.default.macro({
+    exec: (t, packSpec, suiteEntry) => t.deepEqual((0, analyze_1.convertPackToQuerySuiteEntry)(packSpec), suiteEntry),
+    title: (_providedTitle, packSpec) => `Query Suite Entry: ${packSpec}`,
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b", {
+    qlpack: "a/b",
+    from: undefined,
+    version: undefined,
+    query: undefined,
+    queries: undefined,
+    apply: undefined,
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b@~1.2.3", {
+    qlpack: "a/b",
+    from: undefined,
+    version: "~1.2.3",
+    query: undefined,
+    queries: undefined,
+    apply: undefined,
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b:my/path", {
+    qlpack: undefined,
+    from: "a/b",
+    version: undefined,
+    query: undefined,
+    queries: "my/path",
+    apply: undefined,
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b@~1.2.3:my/path", {
+    qlpack: undefined,
+    from: "a/b",
+    version: "~1.2.3",
+    query: undefined,
+    queries: "my/path",
+    apply: undefined,
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b:my/path/query.ql", {
+    qlpack: undefined,
+    from: "a/b",
+    version: undefined,
+    query: "my/path/query.ql",
+    queries: undefined,
+    apply: undefined,
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b@~1.2.3:my/path/query.ql", {
+    qlpack: undefined,
+    from: "a/b",
+    version: "~1.2.3",
+    query: "my/path/query.ql",
+    queries: undefined,
+    apply: undefined,
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b:my/path/suite.qls", {
+    qlpack: undefined,
+    from: "a/b",
+    version: undefined,
+    query: undefined,
+    queries: undefined,
+    apply: "my/path/suite.qls",
+});
+(0, ava_1.default)(convertPackToQuerySuiteEntryMacro, "a/b@~1.2.3:my/path/suite.qls", {
+    qlpack: undefined,
+    from: "a/b",
+    version: "~1.2.3",
+    query: undefined,
+    queries: undefined,
+    apply: "my/path/suite.qls",
+});
+(0, ava_1.default)("convertPackToQuerySuiteEntry Failure", (t) => {
+    t.throws(() => (0, analyze_1.convertPackToQuerySuiteEntry)("this-is-not-a-pack"));
+});
+(0, ava_1.default)("createQuerySuiteContents", (t) => {
+    const yamlResult = (0, analyze_1.createQuerySuiteContents)(["query1.ql", "query2.ql"], [
+        {
+            exclude: { "problem.severity": "recommendation" },
+        },
+        {
+            include: { "problem.severity": "recommendation" },
+        },
+    ]);
+    const expected = `- query: query1.ql
+- query: query2.ql
+- exclude:
+    problem.severity: recommendation
+- include:
+    problem.severity: recommendation
+`;
+    t.deepEqual(yamlResult, expected);
+});
+//# sourceMappingURL=analyze.test.js.map

github/codeql-action-v1/lib/api-client.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGitHubVersion = exports.getApiClientWithExternalAuth = exports.getApiClient = exports.getApiDetails = exports.DisallowedAPIVersionReason = void 0;
+const githubUtils = __importStar(require("@actions/github/lib/utils"));
+const retry = __importStar(require("@octokit/plugin-retry"));
+const console_log_level_1 = __importDefault(require("console-log-level"));
+const actions_util_1 = require("./actions-util");
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
+var DisallowedAPIVersionReason;
+(function (DisallowedAPIVersionReason) {
+    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_OLD"] = 0] = "ACTION_TOO_OLD";
+    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_NEW"] = 1] = "ACTION_TOO_NEW";
+})(DisallowedAPIVersionReason = exports.DisallowedAPIVersionReason || (exports.DisallowedAPIVersionReason = {}));
+function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
+    const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth;
+    const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
+    return new retryingOctokit(githubUtils.getOctokitOptions(auth, {
+        baseUrl: apiDetails.apiURL,
+        userAgent: `CodeQL-Action/${pkg.version}`,
+        log: (0, console_log_level_1.default)({ level: "debug" }),
+    }));
+}
+function getApiDetails() {
+    return {
+        auth: (0, actions_util_1.getRequiredInput)("token"),
+        url: (0, util_1.getRequiredEnvParam)("GITHUB_SERVER_URL"),
+        apiURL: (0, util_1.getRequiredEnvParam)("GITHUB_API_URL"),
+    };
+}
+exports.getApiDetails = getApiDetails;
+function getApiClient() {
+    return createApiClientWithDetails(getApiDetails());
+}
+exports.getApiClient = getApiClient;
+function getApiClientWithExternalAuth(apiDetails) {
+    return createApiClientWithDetails(apiDetails, { allowExternal: true });
+}
+exports.getApiClientWithExternalAuth = getApiClientWithExternalAuth;
+let cachedGitHubVersion = undefined;
+/**
+ * Report the GitHub server version. This is a wrapper around
+ * util.getGitHubVersion() that automatically supplies GitHub API details using
+ * GitHub Action inputs.
+ *
+ * @returns GitHub version
+ */
+async function getGitHubVersion() {
+    if (cachedGitHubVersion === undefined) {
+        cachedGitHubVersion = await util.getGitHubVersion(getApiDetails());
+    }
+    return cachedGitHubVersion;
+}
+exports.getGitHubVersion = getGitHubVersion;
+//# sourceMappingURL=api-client.js.map

github/codeql-action-v1/lib/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uEAAyD;AACzD,6DAA+C;AAC/C,0EAAgD;AAEhD,iDAAkD;AAClD,6CAA+B;AAC/B,iCAA4D;AAE5D,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAiBD,SAAS,0BAA0B,CACjC,UAAoC,EACpC,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,EAAE;IAE9B,MAAM,IAAI,GACR,CAAC,aAAa,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;IACpE,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,eAAe,CACxB,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAClC,OAAO,EAAE,UAAU,CAAC,MAAM;QAC1B,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;QACzC,GAAG,EAAE,IAAA,2BAAe,EAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO;QACL,IAAI,EAAE,IAAA,+BAAgB,EAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,IAAA,0BAAmB,EAAC,mBAAmB,CAAC;QAC7C,MAAM,EAAE,IAAA,0BAAmB,EAAC,gBAAgB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAND,sCAMC;AAED,SAAgB,YAAY;IAC1B,OAAO,0BAA0B,CAAC,aAAa,EAAE,CAAC,CAAC;AACrD,CAAC;AAFD,oCAEC;AAED,SAAgB,4BAA4B,CAC1C,UAAoC;IAEpC,OAAO,0BAA0B,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAJD,oEAIC;AAED,IAAI,mBAAmB,GAA8B,SAAS,CAAC;AAE/D;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB;IACpC,IAAI,mBAAmB,KAAK,SAAS,EAAE;QACrC,mBAAmB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;KACpE;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AALD,4CAKC"}

github/codeql-action-v1/lib/api-client.test.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const githubUtils = __importStar(require("@actions/github/lib/utils"));
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const api_client_1 = require("./api-client");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
+(0, testing_utils_1.setupTests)(ava_1.default);
+let pluginStub;
+let githubStub;
+ava_1.default.beforeEach(() => {
+    pluginStub = sinon.stub(githubUtils.GitHub, "plugin");
+    githubStub = sinon.stub();
+    pluginStub.returns(githubStub);
+    util.initializeEnvironment(pkg.version);
+});
+(0, ava_1.default)("getApiClient", async (t) => {
+    sinon.stub(actionsUtil, "getRequiredInput").withArgs("token").returns("xyz");
+    const requiredEnvParamStub = sinon.stub(util, "getRequiredEnvParam");
+    requiredEnvParamStub
+        .withArgs("GITHUB_SERVER_URL")
+        .returns("http://github.localhost");
+    requiredEnvParamStub
+        .withArgs("GITHUB_API_URL")
+        .returns("http://api.github.localhost");
+    (0, api_client_1.getApiClient)();
+    t.assert(githubStub.calledOnceWithExactly({
+        auth: "token xyz",
+        baseUrl: "http://api.github.localhost",
+        log: sinon.match.any,
+        userAgent: `CodeQL-Action/${pkg.version}`,
+    }));
+});
+//# sourceMappingURL=api-client.test.js.map

github/codeql-action-v1/lib/api-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.test.js","sourceRoot":"","sources":["../src/api-client.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,uEAAyD;AACzD,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,6CAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAI,UAA2B,CAAC;AAChC,IAAI,UAA2B,CAAC;AAEhC,aAAI,CAAC,UAAU,CAAC,GAAG,EAAE;IACnB,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,oBAAoB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACrE,oBAAoB;SACjB,QAAQ,CAAC,mBAAmB,CAAC;SAC7B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,oBAAoB;SACjB,QAAQ,CAAC,gBAAgB,CAAC;SAC1B,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,IAAA,yBAAY,GAAE,CAAC;IAEf,CAAC,CAAC,MAAM,CACN,UAAU,CAAC,qBAAqB,CAAC;QAC/B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,6BAA6B;QACtC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;QACpB,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;KAC1C,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/api-compatibility.json

@@ -0,0 +1 @@
+{ "maximumVersion": "3.8", "minimumVersion": "3.4" }

github/codeql-action-v1/lib/autobuild-action.js

@@ -0,0 +1,93 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const actions_util_1 = require("./actions-util");
+const api_client_1 = require("./api-client");
+const autobuild_1 = require("./autobuild");
+const configUtils = __importStar(require("./config-utils"));
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const util_1 = require("./util");
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
+async function sendCompletedStatusReport(startedAt, allLanguages, failingLanguage, cause) {
+    (0, util_1.initializeEnvironment)(pkg.version);
+    const status = (0, actions_util_1.getActionsStatus)(cause, failingLanguage);
+    const statusReportBase = await (0, actions_util_1.createStatusReportBase)("autobuild", status, startedAt, cause === null || cause === void 0 ? void 0 : cause.message, cause === null || cause === void 0 ? void 0 : cause.stack);
+    const statusReport = {
+        ...statusReportBase,
+        autobuild_languages: allLanguages.join(","),
+        autobuild_failure: failingLanguage,
+    };
+    await (0, actions_util_1.sendStatusReport)(statusReport);
+}
+async function run() {
+    const startedAt = new Date();
+    const logger = (0, logging_1.getActionsLogger)();
+    await (0, util_1.checkActionVersion)(pkg.version);
+    let currentLanguage = undefined;
+    let languages = undefined;
+    try {
+        if (!(await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)("autobuild", "starting", startedAt)))) {
+            return;
+        }
+        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
+        const config = await configUtils.getConfig((0, actions_util_1.getTemporaryDirectory)(), logger);
+        if (config === undefined) {
+            throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
+        }
+        languages = await (0, autobuild_1.determineAutobuildLanguages)(config, logger);
+        if (languages !== undefined) {
+            const workingDirectory = (0, actions_util_1.getOptionalInput)("working-directory");
+            if (workingDirectory) {
+                logger.info(`Changing autobuilder working directory to ${workingDirectory}`);
+                process.chdir(workingDirectory);
+            }
+            for (const language of languages) {
+                currentLanguage = language;
+                await (0, autobuild_1.runAutobuild)(language, config, logger);
+                if (language === languages_1.Language.go) {
+                    core.exportVariable(util_1.DID_AUTOBUILD_GO_ENV_VAR_NAME, "true");
+                }
+            }
+        }
+    }
+    catch (error) {
+        core.setFailed(`We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps.  ${error instanceof Error ? error.message : String(error)}`);
+        console.log(error);
+        await sendCompletedStatusReport(startedAt, languages !== null && languages !== void 0 ? languages : [], currentLanguage, error instanceof Error ? error : new Error(String(error)));
+        return;
+    }
+    await sendCompletedStatusReport(startedAt, languages !== null && languages !== void 0 ? languages : []);
+}
+async function runWrapper() {
+    try {
+        await run();
+    }
+    catch (error) {
+        core.setFailed(`autobuild action failed. ${error}`);
+        console.log(error);
+    }
+}
+void runWrapper();
+//# sourceMappingURL=autobuild-action.js.map

github/codeql-action-v1/lib/autobuild-action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAOwB;AACxB,6CAAgD;AAChD,2CAAwE;AACxE,4DAA8C;AAC9C,2CAAuC;AACvC,uCAA6C;AAC7C,iCAKgB;AAEhB,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AASvC,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;IAEb,IAAA,4BAAqB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAAsB,EACnD,WAAW,EACX,MAAM,EACN,SAAS,EACT,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,EACd,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,IAAA,+BAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,MAAM,IAAA,yBAAkB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,eAAe,GAAyB,SAAS,CAAC;IACtD,IAAI,SAAS,GAA2B,SAAS,CAAC;IAClD,IAAI;QACF,IACE,CAAC,CAAC,MAAM,IAAA,+BAAgB,EACtB,MAAM,IAAA,qCAAsB,EAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CACjE,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QAED,SAAS,GAAG,MAAM,IAAA,uCAA2B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE;YAC3B,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;YAC/D,IAAI,gBAAgB,EAAE;gBACpB,MAAM,CAAC,IAAI,CACT,6CAA6C,gBAAgB,EAAE,CAChE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;aACjC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;gBAChC,eAAe,GAAG,QAAQ,CAAC;gBAC3B,MAAM,IAAA,wBAAY,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,EAAE,EAAE;oBAC5B,IAAI,CAAC,cAAc,CAAC,oCAA6B,EAAE,MAAM,CAAC,CAAC;iBAC5D;aACF;SACF;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CACZ,mIACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,yBAAyB,CAC7B,SAAS,EACT,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,EACf,eAAe,EACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

github/codeql-action-v1/lib/autobuild.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAutobuild = exports.determineAutobuildLanguages = void 0;
+const codeql_1 = require("./codeql");
+const languages_1 = require("./languages");
+async function determineAutobuildLanguages(config, logger) {
+    // Attempt to find a language to autobuild
+    // We want pick the dominant language in the repo from the ones we're able to build
+    // The languages are sorted in order specified by user or by lines of code if we got
+    // them from the GitHub API, so try to build the first language on the list.
+    const autobuildLanguages = config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l));
+    if (!autobuildLanguages) {
+        logger.info("None of the languages in this project require extra build steps");
+        return undefined;
+    }
+    /**
+     * Additionally autobuild Go in the autobuild Action to ensure backwards
+     * compatibility for users performing a multi-language build within a single
+     * job.
+     *
+     * For example, consider a user with the following workflow file:
+     *
+     * ```yml
+     * - uses: github/codeql-action/init@v2
+     *   with:
+     *     languages: go, java
+     * - uses: github/codeql-action/autobuild@v2
+     * - uses: github/codeql-action/analyze@v2
+     * ```
+     *
+     * - With Go extraction disabled, we will run the Java autobuilder in the
+     *   autobuild Action, ensuring we extract both Java and Go code.
+     * - With Go extraction enabled, taking the previous behavior we'd run the Go
+     *   autobuilder, since Go is first on the list of languages. We wouldn't run
+     *   the Java autobuilder at all and so we'd only extract Go code.
+     *
+     * We therefore introduce a special case here such that we'll autobuild Go
+     * in addition to the primary non-Go traced language in the autobuild Action.
+     *
+     * This special case behavior should be removed as part of the next major
+     * version of the CodeQL Action.
+     */
+    const autobuildLanguagesWithoutGo = autobuildLanguages.filter((l) => l !== languages_1.Language.go);
+    const languages = [];
+    // First run the autobuilder for the first non-Go traced language, if one
+    // exists.
+    if (autobuildLanguagesWithoutGo[0] !== undefined) {
+        languages.push(autobuildLanguagesWithoutGo[0]);
+    }
+    // If Go is requested, run the Go autobuilder last to ensure it doesn't
+    // interfere with the other autobuilder.
+    if (autobuildLanguages.length !== autobuildLanguagesWithoutGo.length) {
+        languages.push(languages_1.Language.go);
+    }
+    logger.debug(`Will autobuild ${languages.join(" and ")}.`);
+    // In general the autobuilders for other traced languages may conflict with
+    // each other. Therefore if a user has requested more than one non-Go traced
+    // language, we ask for manual build steps.
+    // Matrixing the build would also work, but that would change the SARIF
+    // categories, potentially leading to a "stale tips" situation where alerts
+    // that should be fixed remain on a repo since they are linked to SARIF
+    // categories that are no longer updated.
+    if (autobuildLanguagesWithoutGo.length > 1) {
+        logger.warning(`We will only automatically build ${languages.join(" and ")} code. If you wish to scan ${autobuildLanguagesWithoutGo
+            .slice(1)
+            .join(" and ")}, you must replace the autobuild step of your workflow with custom build steps. ` +
+            "For more information, see " +
+            "https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-the-codeql-workflow-for-compiled-languages#adding-build-steps-for-a-compiled-language");
+    }
+    return languages;
+}
+exports.determineAutobuildLanguages = determineAutobuildLanguages;
+async function runAutobuild(language, config, logger) {
+    logger.startGroup(`Attempting to automatically build ${language} code`);
+    const codeQL = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    await codeQL.runAutobuild(language);
+    logger.endGroup();
+}
+exports.runAutobuild = runAutobuild;
+//# sourceMappingURL=autobuild.js.map

github/codeql-action-v1/lib/autobuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autobuild.js","sourceRoot":"","sources":["../src/autobuild.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AAErC,2CAAyD;AAGlD,KAAK,UAAU,2BAA2B,CAC/C,MAA0B,EAC1B,MAAc;IAEd,0CAA0C;IAC1C,mFAAmF;IACnF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,IAAA,4BAAgB,EAAC,CAAC,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,kBAAkB,EAAE;QACvB,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;KAClB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAQ,CAAC,EAAE,CACzB,CAAC;IAEF,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,yEAAyE;IACzE,UAAU;IACV,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE;QAChD,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;KAChD;IACD,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,kBAAkB,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE;QACpE,SAAS,CAAC,IAAI,CAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC;KAC7B;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;IAC3C,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,yCAAyC;IACzC,IAAI,2BAA2B,CAAC,MAAM,GAAG,CAAC,EAAE;QAC1C,MAAM,CAAC,OAAO,CACZ,oCAAoC,SAAS,CAAC,IAAI,CAChD,OAAO,CACR,8BAA8B,2BAA2B;aACvD,KAAK,CAAC,CAAC,CAAC;aACR,IAAI,CACH,OAAO,CACR,kFAAkF;YACnF,4BAA4B;YAC5B,0NAA0N,CAC7N,CAAC;KACH;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAtFD,kEAsFC;AAEM,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAA0B,EAC1B,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,qCAAqC,QAAQ,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AATD,oCASC"}

github/codeql-action-v1/lib/codeql.js

@@ -0,0 +1,995 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getExtraOptions = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.convertToSemVer = exports.getCodeQLURLVersion = exports.setupCodeQL = exports.getCodeQLActionRepository = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = exports.CODEQL_VERSION_NEW_TRACING = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CODEQL_DEFAULT_ACTION_REPOSITORY = exports.CommandInvocationError = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolcache = __importStar(require("@actions/tool-cache"));
+const fast_deep_equal_1 = __importDefault(require("fast-deep-equal"));
+const yaml = __importStar(require("js-yaml"));
+const semver = __importStar(require("semver"));
+const uuid_1 = require("uuid");
+const actions_util_1 = require("./actions-util");
+const api = __importStar(require("./api-client"));
+const defaults = __importStar(require("./defaults.json")); // Referenced from codeql-action-sync-tool!
+const error_matcher_1 = require("./error-matcher");
+const languages_1 = require("./languages");
+const toolrunner_error_catcher_1 = require("./toolrunner-error-catcher");
+const trap_caching_1 = require("./trap-caching");
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+class CommandInvocationError extends Error {
+    constructor(cmd, args, exitCode, error, output) {
+        super(`Failure invoking ${cmd} with arguments ${args}.\n
+      Exit code ${exitCode} and error was:\n
+      ${error}`);
+        this.output = output;
+    }
+}
+exports.CommandInvocationError = CommandInvocationError;
+/**
+ * Stores the CodeQL object, and is populated by `setupCodeQL` or `getCodeQL`.
+ * Can be overridden in tests using `setCodeQL`.
+ */
+let cachedCodeQL = undefined;
+const CODEQL_BUNDLE_VERSION = defaults.bundleVersion;
+exports.CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
+/**
+ * The oldest version of CodeQL that the Action will run with. This should be
+ * at least three minor versions behind the current version and must include the
+ * CLI versions shipped with each supported version of GHES.
+ *
+ * The version flags below can be used to conditionally enable certain features
+ * on versions newer than this.
+ */
+const CODEQL_MINIMUM_VERSION = "2.6.3";
+/**
+ * Versions of CodeQL that version-flag certain functionality in the Action.
+ * For convenience, please keep these in descending order. Once a version
+ * flag is older than the oldest supported version above, it may be removed.
+ */
+const CODEQL_VERSION_CUSTOM_QUERY_HELP = "2.7.1";
+const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.10.0";
+const CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED = "2.10.4";
+exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = "2.10.4";
+const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
+/**
+ * This variable controls using the new style of tracing from the CodeQL
+ * CLI. In particular, with versions above this we will use both indirect
+ * tracing, and multi-language tracing together with database clusters.
+ *
+ * Note that there were bugs in both of these features that were fixed in
+ * release 2.7.0 of the CodeQL CLI, therefore this flag is only enabled for
+ * versions above that.
+ */
+exports.CODEQL_VERSION_NEW_TRACING = "2.7.0";
+/**
+ * Versions 2.7.3+ of the CodeQL CLI support build tracing with glibc 2.34 on Linux. Versions before
+ * this cannot perform build tracing when running on the Actions `ubuntu-22.04` runner image.
+ */
+exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = "2.7.3";
+/**
+ * Versions 2.9.0+ of the CodeQL CLI run machine learning models from a temporary directory, which
+ * resolves an issue on Windows where TensorFlow models are not correctly loaded due to the path of
+ * some of their files being greater than MAX_PATH (260 characters).
+ */
+exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = "2.9.0";
+/**
+ * Previous versions had the option already, but were missing the
+ * --extractor-options-verbosity that we need.
+ */
+exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = "2.10.3";
+function getCodeQLBundleName() {
+    let platform;
+    if (process.platform === "win32") {
+        platform = "win64";
+    }
+    else if (process.platform === "linux") {
+        platform = "linux64";
+    }
+    else if (process.platform === "darwin") {
+        platform = "osx64";
+    }
+    else {
+        return "codeql-bundle.tar.gz";
+    }
+    return `codeql-bundle-${platform}.tar.gz`;
+}
+function getCodeQLActionRepository(logger) {
+    if ((0, actions_util_1.isRunningLocalAction)()) {
+        // This handles the case where the Action does not come from an Action repository,
+        // e.g. our integration tests which use the Action code from the current checkout.
+        // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
+        logger.info("The CodeQL Action is checked out locally. Using the default CodeQL Action repository.");
+        return exports.CODEQL_DEFAULT_ACTION_REPOSITORY;
+    }
+    return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY");
+}
+exports.getCodeQLActionRepository = getCodeQLActionRepository;
+async function getCodeQLBundleDownloadURL(apiDetails, variant, logger) {
+    const codeQLActionRepository = getCodeQLActionRepository(logger);
+    const potentialDownloadSources = [
+        // This GitHub instance, and this Action.
+        [apiDetails.url, codeQLActionRepository],
+        // This GitHub instance, and the canonical Action.
+        [apiDetails.url, exports.CODEQL_DEFAULT_ACTION_REPOSITORY],
+        // GitHub.com, and the canonical Action.
+        [util.GITHUB_DOTCOM_URL, exports.CODEQL_DEFAULT_ACTION_REPOSITORY],
+    ];
+    // We now filter out any duplicates.
+    // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
+    const uniqueDownloadSources = potentialDownloadSources.filter((source, index, self) => {
+        return !self.slice(0, index).some((other) => (0, fast_deep_equal_1.default)(source, other));
+    });
+    const codeQLBundleName = getCodeQLBundleName();
+    if (variant === util.GitHubVariant.GHAE) {
+        try {
+            const release = await api
+                .getApiClient()
+                .request("GET /enterprise/code-scanning/codeql-bundle/find/{tag}", {
+                tag: CODEQL_BUNDLE_VERSION,
+            });
+            const assetID = release.data.assets[codeQLBundleName];
+            if (assetID !== undefined) {
+                const download = await api
+                    .getApiClient()
+                    .request("GET /enterprise/code-scanning/codeql-bundle/download/{asset_id}", { asset_id: assetID });
+                const downloadURL = download.data.url;
+                logger.info(`Found CodeQL bundle at GitHub AE endpoint with URL ${downloadURL}.`);
+                return downloadURL;
+            }
+            else {
+                logger.info(`Attempted to fetch bundle from GitHub AE endpoint but the bundle ${codeQLBundleName} was not found in the assets ${JSON.stringify(release.data.assets)}.`);
+            }
+        }
+        catch (e) {
+            logger.info(`Attempted to fetch bundle from GitHub AE endpoint but got error ${e}.`);
+        }
+    }
+    for (const downloadSource of uniqueDownloadSources) {
+        const [apiURL, repository] = downloadSource;
+        // If we've reached the final case, short-circuit the API check since we know the bundle exists and is public.
+        if (apiURL === util.GITHUB_DOTCOM_URL &&
+            repository === exports.CODEQL_DEFAULT_ACTION_REPOSITORY) {
+            break;
+        }
+        const [repositoryOwner, repositoryName] = repository.split("/");
+        try {
+            const release = await api.getApiClient().repos.getReleaseByTag({
+                owner: repositoryOwner,
+                repo: repositoryName,
+                tag: CODEQL_BUNDLE_VERSION,
+            });
+            for (const asset of release.data.assets) {
+                if (asset.name === codeQLBundleName) {
+                    logger.info(`Found CodeQL bundle in ${downloadSource[1]} on ${downloadSource[0]} with URL ${asset.url}.`);
+                    return asset.url;
+                }
+            }
+        }
+        catch (e) {
+            logger.info(`Looked for CodeQL bundle in ${downloadSource[1]} on ${downloadSource[0]} but got error ${e}.`);
+        }
+    }
+    return `https://github.com/${exports.CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${CODEQL_BUNDLE_VERSION}/${codeQLBundleName}`;
+}
+async function getCodeQLSource(toolsInput, bypassToolcache, apiDetails, variant, logger) {
+    var _a;
+    if (toolsInput && toolsInput !== "latest" && !toolsInput.startsWith("http")) {
+        return {
+            codeqlTarPath: toolsInput,
+            sourceType: "local",
+            toolsVersion: "local",
+        };
+    }
+    const forceLatestReason = 
+    // We use the special value of 'latest' to prioritize the version in the
+    // defaults over any pinned cached version.
+    toolsInput === "latest"
+        ? '"tools: latest" was requested'
+        : // If the user hasn't requested a particular CodeQL version, then bypass
+            // the toolcache when the appropriate feature is enabled. This
+            // allows us to quickly rollback a broken bundle that has made its way
+            // into the toolcache.
+            toolsInput === undefined && bypassToolcache
+                ? "a specific version of CodeQL was not requested and the bypass toolcache feature is enabled"
+                : undefined;
+    const forceLatest = forceLatestReason !== undefined;
+    if (forceLatest) {
+        logger.debug(`Forcing the latest version of the CodeQL tools since ${forceLatestReason}.`);
+    }
+    const codeqlURL = forceLatest ? undefined : toolsInput;
+    const requestedSemVer = convertToSemVer(getCodeQLURLVersion(codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`), logger);
+    // If we find the specified version, we always use that.
+    const codeqlFolder = toolcache.find("CodeQL", requestedSemVer);
+    if (codeqlFolder) {
+        return {
+            codeqlFolder,
+            sourceType: "toolcache",
+            toolsVersion: requestedSemVer,
+        };
+    }
+    // If we don't find the requested version, in some cases we may allow a
+    // different version to save download time if the version hasn't been
+    // specified explicitly (in which case we always honor it).
+    if (!codeqlURL && !forceLatest) {
+        const codeqlVersions = toolcache.findAllVersions("CodeQL");
+        if (codeqlVersions.length === 1 && (0, util_1.isGoodVersion)(codeqlVersions[0])) {
+            const tmpCodeqlFolder = toolcache.find("CodeQL", codeqlVersions[0]);
+            if (fs.existsSync(path.join(tmpCodeqlFolder, "pinned-version"))) {
+                logger.debug(`CodeQL in cache overriding the default ${CODEQL_BUNDLE_VERSION}`);
+                return {
+                    codeqlFolder: tmpCodeqlFolder,
+                    sourceType: "toolcache",
+                    toolsVersion: codeqlVersions[0],
+                };
+            }
+        }
+    }
+    return {
+        codeqlURL: codeqlURL ||
+            (await getCodeQLBundleDownloadURL(apiDetails, variant, logger)),
+        semanticVersion: requestedSemVer,
+        sourceType: "download",
+        toolsVersion: ((_a = semver.prerelease(requestedSemVer)) === null || _a === void 0 ? void 0 : _a.join(".")) || requestedSemVer,
+    };
+}
+async function downloadCodeQL(codeqlURL, semanticVersion, apiDetails, tempDir, logger) {
+    const parsedCodeQLURL = new URL(codeqlURL);
+    const searchParams = new URLSearchParams(parsedCodeQLURL.search);
+    const headers = {
+        accept: "application/octet-stream",
+    };
+    // We only want to provide an authorization header if we are downloading
+    // from the same GitHub instance the Action is running on.
+    // This avoids leaking Enterprise tokens to dotcom.
+    // We also don't want to send an authorization header if there's already a token provided in the URL.
+    if (searchParams.has("token")) {
+        logger.debug("CodeQL tools URL contains an authorization token.");
+    }
+    else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
+        logger.debug("Providing an authorization token to download CodeQL tools.");
+        headers.authorization = `token ${apiDetails.auth}`;
+    }
+    else {
+        logger.debug("Downloading CodeQL tools without an authorization token.");
+    }
+    logger.info(`Downloading CodeQL tools from ${codeqlURL}. This may take a while.`);
+    const dest = path.join(tempDir, (0, uuid_1.v4)());
+    const finalHeaders = Object.assign({ "User-Agent": "CodeQL Action" }, headers);
+    const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, undefined, finalHeaders);
+    logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
+    const codeqlExtracted = await toolcache.extractTar(codeqlPath);
+    return await toolcache.cacheDir(codeqlExtracted, "CodeQL", semanticVersion);
+}
+/**
+ * Set up CodeQL CLI access.
+ *
+ * @param toolsInput
+ * @param apiDetails
+ * @param tempDir
+ * @param variant
+ * @param bypassToolcache
+ * @param logger
+ * @param checkVersion Whether to check that CodeQL CLI meets the minimum
+ *        version requirement. Must be set to true outside tests.
+ * @returns a { CodeQL, toolsVersion } object.
+ */
+async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, bypassToolcache, logger, checkVersion) {
+    try {
+        const source = await getCodeQLSource(toolsInput, bypassToolcache, apiDetails, variant, logger);
+        let codeqlFolder;
+        switch (source.sourceType) {
+            case "local":
+                codeqlFolder = await toolcache.extractTar(source.codeqlTarPath);
+                break;
+            case "toolcache":
+                codeqlFolder = source.codeqlFolder;
+                logger.debug(`CodeQL found in cache ${codeqlFolder}`);
+                break;
+            case "download":
+                codeqlFolder = await downloadCodeQL(source.codeqlURL, source.semanticVersion, apiDetails, tempDir, logger);
+                break;
+            default:
+                (0, util_1.assertNever)(source);
+        }
+        let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql");
+        if (process.platform === "win32") {
+            codeqlCmd += ".exe";
+        }
+        else if (process.platform !== "linux" && process.platform !== "darwin") {
+            throw new Error(`Unsupported platform: ${process.platform}`);
+        }
+        cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion);
+        return { codeql: cachedCodeQL, toolsVersion: source.toolsVersion };
+    }
+    catch (e) {
+        logger.error(e instanceof Error ? e : new Error(String(e)));
+        throw new Error("Unable to download and extract CodeQL CLI");
+    }
+}
+exports.setupCodeQL = setupCodeQL;
+function getCodeQLURLVersion(url) {
+    const match = url.match(/\/codeql-bundle-(.*)\//);
+    if (match === null || match.length < 2) {
+        throw new Error(`Malformed tools url: ${url}. Version could not be inferred`);
+    }
+    return match[1];
+}
+exports.getCodeQLURLVersion = getCodeQLURLVersion;
+function convertToSemVer(version, logger) {
+    if (!semver.valid(version)) {
+        logger.debug(`Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`);
+        version = `0.0.0-${version}`;
+    }
+    const s = semver.clean(version);
+    if (!s) {
+        throw new Error(`Bundle version ${version} is not in SemVer format.`);
+    }
+    return s;
+}
+exports.convertToSemVer = convertToSemVer;
+/**
+ * Use the CodeQL executable located at the given path.
+ */
+async function getCodeQL(cmd) {
+    if (cachedCodeQL === undefined) {
+        cachedCodeQL = await getCodeQLForCmd(cmd, true);
+    }
+    return cachedCodeQL;
+}
+exports.getCodeQL = getCodeQL;
+function resolveFunction(partialCodeql, methodName, defaultImplementation) {
+    if (typeof partialCodeql[methodName] !== "function") {
+        if (defaultImplementation !== undefined) {
+            return defaultImplementation;
+        }
+        const dummyMethod = () => {
+            throw new Error(`CodeQL ${methodName} method not correctly defined`);
+        };
+        return dummyMethod;
+    }
+    return partialCodeql[methodName];
+}
+/**
+ * Set the functionality for CodeQL methods. Only for use in tests.
+ *
+ * Accepts a partial object and any undefined methods will be implemented
+ * to immediately throw an exception indicating which method is missing.
+ */
+function setCodeQL(partialCodeql) {
+    cachedCodeQL = {
+        getPath: resolveFunction(partialCodeql, "getPath", () => "/tmp/dummy-path"),
+        getVersion: resolveFunction(partialCodeql, "getVersion", () => new Promise((resolve) => resolve("1.0.0"))),
+        printVersion: resolveFunction(partialCodeql, "printVersion"),
+        getTracerEnv: resolveFunction(partialCodeql, "getTracerEnv"),
+        databaseInit: resolveFunction(partialCodeql, "databaseInit"),
+        databaseInitCluster: resolveFunction(partialCodeql, "databaseInitCluster"),
+        runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),
+        extractScannedLanguage: resolveFunction(partialCodeql, "extractScannedLanguage"),
+        finalizeDatabase: resolveFunction(partialCodeql, "finalizeDatabase"),
+        resolveLanguages: resolveFunction(partialCodeql, "resolveLanguages"),
+        betterResolveLanguages: resolveFunction(partialCodeql, "betterResolveLanguages"),
+        resolveQueries: resolveFunction(partialCodeql, "resolveQueries"),
+        packDownload: resolveFunction(partialCodeql, "packDownload"),
+        databaseCleanup: resolveFunction(partialCodeql, "databaseCleanup"),
+        databaseBundle: resolveFunction(partialCodeql, "databaseBundle"),
+        databaseRunQueries: resolveFunction(partialCodeql, "databaseRunQueries"),
+        databaseInterpretResults: resolveFunction(partialCodeql, "databaseInterpretResults"),
+        databasePrintBaseline: resolveFunction(partialCodeql, "databasePrintBaseline"),
+        diagnosticsExport: resolveFunction(partialCodeql, "diagnosticsExport"),
+    };
+    return cachedCodeQL;
+}
+exports.setCodeQL = setCodeQL;
+/**
+ * Get the cached CodeQL object. Should only be used from tests.
+ *
+ * TODO: Work out a good way for tests to get this from the test context
+ * instead of having to have this method.
+ */
+function getCachedCodeQL() {
+    if (cachedCodeQL === undefined) {
+        // Should never happen as setCodeQL is called by testing-utils.setupTests
+        throw new Error("cachedCodeQL undefined");
+    }
+    return cachedCodeQL;
+}
+exports.getCachedCodeQL = getCachedCodeQL;
+/**
+ * Get a real, newly created CodeQL instance for testing. The instance refers to
+ * a non-existent placeholder codeql command, so tests that use this function
+ * should also stub the toolrunner.ToolRunner constructor.
+ */
+async function getCodeQLForTesting(cmd = "codeql-for-testing") {
+    return getCodeQLForCmd(cmd, false);
+}
+exports.getCodeQLForTesting = getCodeQLForTesting;
+/**
+ * Return a CodeQL object for CodeQL CLI access.
+ *
+ * @param cmd Path to CodeQL CLI
+ * @param checkVersion Whether to check that CodeQL CLI meets the minimum
+ *        version requirement. Must be set to true outside tests.
+ * @returns A new CodeQL object
+ */
+async function getCodeQLForCmd(cmd, checkVersion) {
+    const codeql = {
+        getPath() {
+            return cmd;
+        },
+        async getVersion() {
+            let result = util.getCachedCodeQlVersion();
+            if (result === undefined) {
+                result = (await runTool(cmd, ["version", "--format=terse"])).trim();
+                util.cacheCodeQlVersion(result);
+            }
+            return result;
+        },
+        async printVersion() {
+            await runTool(cmd, ["version", "--format=json"]);
+        },
+        async getTracerEnv(databasePath) {
+            // Write tracer-env.js to a temp location.
+            // BEWARE: The name and location of this file is recognized by `codeql database
+            // trace-command` in order to enable special support for concatenable tracer
+            // configurations. Consequently the name must not be changed.
+            // (This warning can be removed once a different way to recognize the
+            // action/runner has been implemented in `codeql database trace-command`
+            // _and_ is present in the latest supported CLI release.)
+            const tracerEnvJs = path.resolve(databasePath, "working", "tracer-env.js");
+            fs.mkdirSync(path.dirname(tracerEnvJs), { recursive: true });
+            fs.writeFileSync(tracerEnvJs, `
+        const fs = require('fs');
+        const env = {};
+        for (let entry of Object.entries(process.env)) {
+          const key = entry[0];
+          const value = entry[1];
+          if (typeof value !== 'undefined' && key !== '_' && !key.startsWith('JAVA_MAIN_CLASS_')) {
+            env[key] = value;
+          }
+        }
+        process.stdout.write(process.argv[2]);
+        fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');`);
+            // BEWARE: The name and location of this file is recognized by `codeql database
+            // trace-command` in order to enable special support for concatenable tracer
+            // configurations. Consequently the name must not be changed.
+            // (This warning can be removed once a different way to recognize the
+            // action/runner has been implemented in `codeql database trace-command`
+            // _and_ is present in the latest supported CLI release.)
+            const envFile = path.resolve(databasePath, "working", "env.tmp");
+            try {
+                await runTool(cmd, [
+                    "database",
+                    "trace-command",
+                    databasePath,
+                    ...getExtraOptionsFromEnv(["database", "trace-command"]),
+                    process.execPath,
+                    tracerEnvJs,
+                    envFile,
+                ]);
+            }
+            catch (e) {
+                if (e instanceof CommandInvocationError &&
+                    e.output.includes("undefined symbol: __libc_dlopen_mode, version GLIBC_PRIVATE") &&
+                    process.platform === "linux" &&
+                    !(await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_TRACING_GLIBC_2_34))) {
+                    throw new util.UserError("The CodeQL CLI is incompatible with the version of glibc on your system. " +
+                        `Please upgrade to CodeQL CLI version ${exports.CODEQL_VERSION_TRACING_GLIBC_2_34} or ` +
+                        "later. If you cannot upgrade to a newer version of the CodeQL CLI, you can " +
+                        `alternatively run your workflow on another runner image such as "ubuntu-20.04" ` +
+                        "that has glibc 2.33 or earlier installed.");
+                }
+                else {
+                    throw e;
+                }
+            }
+            return JSON.parse(fs.readFileSync(envFile, "utf-8"));
+        },
+        async databaseInit(databasePath, language, sourceRoot) {
+            await runTool(cmd, [
+                "database",
+                "init",
+                databasePath,
+                `--language=${language}`,
+                `--source-root=${sourceRoot}`,
+                ...getExtraOptionsFromEnv(["database", "init"]),
+            ]);
+        },
+        async databaseInitCluster(config, sourceRoot, processName, featureEnablement, logger) {
+            const extraArgs = config.languages.map((language) => `--language=${language}`);
+            if (config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l)).length > 0) {
+                extraArgs.push("--begin-tracing");
+                extraArgs.push(...(await (0, trap_caching_1.getTrapCachingExtractorConfigArgs)(config)));
+                extraArgs.push(`--trace-process-name=${processName}`);
+                if (
+                // There's a bug in Lua tracing for Go on Windows in versions earlier than
+                // `CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED`, so don't use Lua tracing
+                // when tracing Go on Windows on these CodeQL versions.
+                (await util.codeQlVersionAbove(this, CODEQL_VERSION_LUA_TRACER_CONFIG)) &&
+                    config.languages.includes(languages_1.Language.go) &&
+                    (0, languages_1.isTracedLanguage)(languages_1.Language.go) &&
+                    process.platform === "win32" &&
+                    !(await util.codeQlVersionAbove(this, CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED))) {
+                    extraArgs.push("--no-internal-use-lua-tracing");
+                }
+            }
+            // A config file is only generated if the CliConfigFileEnabled feature flag is enabled.
+            const configLocation = await generateCodeScanningConfig(codeql, config, featureEnablement, logger);
+            // Only pass external repository token if a config file is going to be parsed by the CLI.
+            let externalRepositoryToken;
+            if (configLocation) {
+                extraArgs.push(`--codescanning-config=${configLocation}`);
+                externalRepositoryToken = (0, actions_util_1.getOptionalInput)("external-repository-token");
+                if (externalRepositoryToken) {
+                    extraArgs.push("--external-repository-token-stdin");
+                }
+            }
+            await runTool(cmd, [
+                "database",
+                "init",
+                "--db-cluster",
+                config.dbLocation,
+                `--source-root=${sourceRoot}`,
+                ...extraArgs,
+                ...getExtraOptionsFromEnv(["database", "init"]),
+            ], { stdin: externalRepositoryToken });
+        },
+        async runAutobuild(language) {
+            const cmdName = process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh";
+            // The autobuilder for Swift is located in the experimental/ directory.
+            const possibleExperimentalDir = language === languages_1.Language.swift ? "experimental" : "";
+            const autobuildCmd = path.join(path.dirname(cmd), possibleExperimentalDir, language, "tools", cmdName);
+            // Update JAVA_TOOL_OPTIONS to contain '-Dhttp.keepAlive=false'
+            // This is because of an issue with Azure pipelines timing out connections after 4 minutes
+            // and Maven not properly handling closed connections
+            // Otherwise long build processes will timeout when pulling down Java packages
+            // https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
+            const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";
+            process.env["JAVA_TOOL_OPTIONS"] = [
+                ...javaToolOptions.split(/\s+/),
+                "-Dhttp.keepAlive=false",
+                "-Dmaven.wagon.http.pool=false",
+            ].join(" ");
+            // On macOS, System Integrity Protection (SIP) typically interferes with
+            // CodeQL build tracing of protected binaries.
+            // The usual workaround is to prefix `$CODEQL_RUNNER` to build commands:
+            // `$CODEQL_RUNNER` (not to be confused with the deprecated CodeQL Runner tool)
+            // points to a simple wrapper binary included with the CLI, and the extra layer of
+            // process indirection helps the tracer bypass SIP.
+            // The above SIP workaround is *not* needed here.
+            // At the `autobuild` step in the Actions workflow, we assume the `init` step
+            // has successfully run, and will have exported `DYLD_INSERT_LIBRARIES`
+            // into the environment of subsequent steps, to activate the tracer.
+            // When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
+            // the Actions runtime introduces its own workaround for SIP
+            // (https://github.com/actions/runner/pull/416).
+            await runTool(autobuildCmd);
+        },
+        async extractScannedLanguage(config, language) {
+            const databasePath = util.getCodeQLDatabasePath(config, language);
+            // Get extractor location
+            let extractorPath = "";
+            await new toolrunner.ToolRunner(cmd, [
+                "resolve",
+                "extractor",
+                "--format=json",
+                `--language=${language}`,
+                ...getExtraOptionsFromEnv(["resolve", "extractor"]),
+            ], {
+                silent: true,
+                listeners: {
+                    stdout: (data) => {
+                        extractorPath += data.toString();
+                    },
+                    stderr: (data) => {
+                        process.stderr.write(data);
+                    },
+                },
+            }).exec();
+            // Set trace command
+            const ext = process.platform === "win32" ? ".cmd" : ".sh";
+            const traceCommand = path.resolve(JSON.parse(extractorPath), "tools", `autobuild${ext}`);
+            // Run trace command
+            await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, [
+                "database",
+                "trace-command",
+                ...(await (0, trap_caching_1.getTrapCachingExtractorConfigArgsForLang)(config, language)),
+                ...getExtraOptionsFromEnv(["database", "trace-command"]),
+                databasePath,
+                "--",
+                traceCommand,
+            ], error_matcher_1.errorMatchers);
+        },
+        async finalizeDatabase(databasePath, threadsFlag, memoryFlag) {
+            const args = [
+                "database",
+                "finalize",
+                "--finalize-dataset",
+                threadsFlag,
+                memoryFlag,
+                ...getExtraOptionsFromEnv(["database", "finalize"]),
+                databasePath,
+            ];
+            await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, args, error_matcher_1.errorMatchers);
+        },
+        async resolveLanguages() {
+            const codeqlArgs = [
+                "resolve",
+                "languages",
+                "--format=json",
+                ...getExtraOptionsFromEnv(["resolve", "languages"]),
+            ];
+            const output = await runTool(cmd, codeqlArgs);
+            try {
+                return JSON.parse(output);
+            }
+            catch (e) {
+                throw new Error(`Unexpected output from codeql resolve languages: ${e}`);
+            }
+        },
+        async betterResolveLanguages() {
+            const codeqlArgs = [
+                "resolve",
+                "languages",
+                "--format=betterjson",
+                "--extractor-options-verbosity=4",
+                ...getExtraOptionsFromEnv(["resolve", "languages"]),
+            ];
+            const output = await runTool(cmd, codeqlArgs);
+            try {
+                return JSON.parse(output);
+            }
+            catch (e) {
+                throw new Error(`Unexpected output from codeql resolve languages with --format=betterjson: ${e}`);
+            }
+        },
+        async resolveQueries(queries, extraSearchPath) {
+            const codeqlArgs = [
+                "resolve",
+                "queries",
+                ...queries,
+                "--format=bylanguage",
+                ...getExtraOptionsFromEnv(["resolve", "queries"]),
+            ];
+            if (extraSearchPath !== undefined) {
+                codeqlArgs.push("--additional-packs", extraSearchPath);
+            }
+            const output = await runTool(cmd, codeqlArgs);
+            try {
+                return JSON.parse(output);
+            }
+            catch (e) {
+                throw new Error(`Unexpected output from codeql resolve queries: ${e}`);
+            }
+        },
+        async databaseRunQueries(databasePath, extraSearchPath, querySuitePath, memoryFlag, threadsFlag) {
+            const codeqlArgs = [
+                "database",
+                "run-queries",
+                memoryFlag,
+                threadsFlag,
+                databasePath,
+                "--min-disk-free=1024",
+                "-v",
+                ...getExtraOptionsFromEnv(["database", "run-queries"]),
+            ];
+            if (extraSearchPath !== undefined) {
+                codeqlArgs.push("--additional-packs", extraSearchPath);
+            }
+            if (querySuitePath) {
+                codeqlArgs.push(querySuitePath);
+            }
+            await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, codeqlArgs, error_matcher_1.errorMatchers);
+        },
+        async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, addSnippetsFlag, threadsFlag, verbosityFlag, automationDetailsId) {
+            const codeqlArgs = [
+                "database",
+                "interpret-results",
+                threadsFlag,
+                "--format=sarif-latest",
+                verbosityFlag,
+                `--output=${sarifFile}`,
+                addSnippetsFlag,
+                "--print-diagnostics-summary",
+                "--print-metrics-summary",
+                "--sarif-group-rules-by-pack",
+                ...getExtraOptionsFromEnv(["database", "interpret-results"]),
+            ];
+            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_CUSTOM_QUERY_HELP))
+                codeqlArgs.push("--sarif-add-query-help");
+            if (automationDetailsId !== undefined) {
+                codeqlArgs.push("--sarif-category", automationDetailsId);
+            }
+            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_FILE_BASELINE_INFORMATION)) {
+                codeqlArgs.push("--sarif-add-baseline-file-info");
+            }
+            codeqlArgs.push(databasePath);
+            if (querySuitePaths) {
+                codeqlArgs.push(...querySuitePaths);
+            }
+            // capture stdout, which contains analysis summaries
+            const returnState = await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, codeqlArgs, error_matcher_1.errorMatchers);
+            return returnState.stdout;
+        },
+        async databasePrintBaseline(databasePath) {
+            const codeqlArgs = [
+                "database",
+                "print-baseline",
+                ...getExtraOptionsFromEnv(["database", "print-baseline"]),
+                databasePath,
+            ];
+            return await runTool(cmd, codeqlArgs);
+        },
+        /**
+         * Download specified packs into the package cache. If the specified
+         * package and version already exists (e.g., from a previous analysis run),
+         * then it is not downloaded again (unless the extra option `--force` is
+         * specified).
+         *
+         * If no version is specified, then the latest version is
+         * downloaded. The check to determine what the latest version is is done
+         * each time this package is requested.
+         *
+         * Optionally, a `qlconfigFile` is included. If used, then this file
+         * is used to determine which registry each pack is downloaded from.
+         */
+        async packDownload(packs, qlconfigFile) {
+            const qlconfigArg = qlconfigFile
+                ? [`--qlconfig-file=${qlconfigFile}`]
+                : [];
+            const codeqlArgs = [
+                "pack",
+                "download",
+                ...qlconfigArg,
+                "--format=json",
+                "--resolve-query-specs",
+                ...getExtraOptionsFromEnv(["pack", "download"]),
+                ...packs,
+            ];
+            const output = await runTool(cmd, codeqlArgs);
+            try {
+                const parsedOutput = JSON.parse(output);
+                if (Array.isArray(parsedOutput.packs) &&
+                    // TODO PackDownloadOutput will not include the version if it is not specified
+                    // in the input. The version is always the latest version available.
+                    // It should be added to the output, but this requires a CLI change
+                    parsedOutput.packs.every((p) => p.name /* && p.version */)) {
+                    return parsedOutput;
+                }
+                else {
+                    throw new Error("Unexpected output from pack download");
+                }
+            }
+            catch (e) {
+                throw new Error(`Attempted to download specified packs but got an error:\n${output}\n${e}`);
+            }
+        },
+        async databaseCleanup(databasePath, cleanupLevel) {
+            const codeqlArgs = [
+                "database",
+                "cleanup",
+                databasePath,
+                `--mode=${cleanupLevel}`,
+                ...getExtraOptionsFromEnv(["database", "cleanup"]),
+            ];
+            await runTool(cmd, codeqlArgs);
+        },
+        async databaseBundle(databasePath, outputFilePath, databaseName) {
+            const args = [
+                "database",
+                "bundle",
+                databasePath,
+                `--output=${outputFilePath}`,
+                `--name=${databaseName}`,
+                ...getExtraOptionsFromEnv(["database", "bundle"]),
+            ];
+            await new toolrunner.ToolRunner(cmd, args).exec();
+        },
+        async diagnosticsExport(sarifFile, automationDetailsId) {
+            const args = [
+                "diagnostics",
+                "export",
+                "--format=sarif-latest",
+                `--output=${sarifFile}`,
+                ...getExtraOptionsFromEnv(["diagnostics", "export"]),
+            ];
+            if (automationDetailsId !== undefined) {
+                args.push("--sarif-category", automationDetailsId);
+            }
+            await new toolrunner.ToolRunner(cmd, args).exec();
+        },
+    };
+    // To ensure that status reports include the CodeQL CLI version wherever
+    // possible, we want to call getVersion(), which populates the version value
+    // used by status reporting, at the earliest opportunity. But invoking
+    // getVersion() directly here breaks tests that only pretend to create a
+    // CodeQL object. So instead we rely on the assumption that all non-test
+    // callers would set checkVersion to true, and util.codeQlVersionAbove()
+    // would call getVersion(), so the CLI version would be cached as soon as the
+    // CodeQL object is created.
+    if (checkVersion &&
+        !(await util.codeQlVersionAbove(codeql, CODEQL_MINIMUM_VERSION))) {
+        throw new Error(`Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${await codeql.getVersion()}`);
+    }
+    return codeql;
+}
+/**
+ * Gets the options for `path` of `options` as an array of extra option strings.
+ */
+function getExtraOptionsFromEnv(paths) {
+    const options = util.getExtraOptionsEnvParam();
+    return getExtraOptions(options, paths, []);
+}
+/**
+ * Gets `options` as an array of extra option strings.
+ *
+ * - throws an exception mentioning `pathInfo` if this conversion is impossible.
+ */
+function asExtraOptions(options, pathInfo) {
+    if (options === undefined) {
+        return [];
+    }
+    if (!Array.isArray(options)) {
+        const msg = `The extra options for '${pathInfo.join(".")}' ('${JSON.stringify(options)}') are not in an array.`;
+        throw new Error(msg);
+    }
+    return options.map((o) => {
+        const t = typeof o;
+        if (t !== "string" && t !== "number" && t !== "boolean") {
+            const msg = `The extra option for '${pathInfo.join(".")}' ('${JSON.stringify(o)}') is not a primitive value.`;
+            throw new Error(msg);
+        }
+        return `${o}`;
+    });
+}
+/**
+ * Gets the options for `path` of `options` as an array of extra option strings.
+ *
+ * - the special terminal step name '*' in `options` matches all path steps
+ * - throws an exception if this conversion is impossible.
+ *
+ * Exported for testing.
+ */
+function getExtraOptions(options, paths, pathInfo) {
+    const all = asExtraOptions(options === null || options === void 0 ? void 0 : options["*"], pathInfo.concat("*"));
+    const specific = paths.length === 0
+        ? asExtraOptions(options, pathInfo)
+        : getExtraOptions(options === null || options === void 0 ? void 0 : options[paths[0]], paths === null || paths === void 0 ? void 0 : paths.slice(1), pathInfo.concat(paths[0]));
+    return all.concat(specific);
+}
+exports.getExtraOptions = getExtraOptions;
+/*
+ * A constant defining the maximum number of characters we will keep from
+ * the programs stderr for logging. This serves two purposes:
+ * (1) It avoids an OOM if a program fails in a way that results it
+ *     printing many log lines.
+ * (2) It avoids us hitting the limit of how much data we can send in our
+ *     status reports on GitHub.com.
+ */
+const maxErrorSize = 20000;
+async function runTool(cmd, args = [], opts = {}) {
+    let output = "";
+    let error = "";
+    const exitCode = await new toolrunner.ToolRunner(cmd, args, {
+        listeners: {
+            stdout: (data) => {
+                output += data.toString("utf8");
+            },
+            stderr: (data) => {
+                let readStartIndex = 0;
+                // If the error is too large, then we only take the last 20,000 characters
+                if (data.length - maxErrorSize > 0) {
+                    // Eg: if we have 20,000 the start index should be 2.
+                    readStartIndex = data.length - maxErrorSize + 1;
+                }
+                error += data.toString("utf8", readStartIndex);
+            },
+        },
+        ignoreReturnCode: true,
+        ...(opts.stdin ? { input: Buffer.from(opts.stdin || "") } : {}),
+    }).exec();
+    if (exitCode !== 0)
+        throw new CommandInvocationError(cmd, args, exitCode, error, output);
+    return output;
+}
+/**
+ * If appropriate, generates a code scanning configuration that is to be used for a scan.
+ * If the configuration is not to be generated, returns undefined.
+ *
+ * @param codeql The CodeQL object to use.
+ * @param config The configuration to use.
+ * @returns the path to the generated user configuration file.
+ */
+async function generateCodeScanningConfig(codeql, config, featureEnablement, logger) {
+    var _a;
+    if (!(await util.useCodeScanningConfigInCli(codeql, featureEnablement))) {
+        return;
+    }
+    const configLocation = path.resolve(config.tempDir, "user-config.yaml");
+    // make a copy so we can modify it
+    const augmentedConfig = cloneObject(config.originalUserInput);
+    // Inject the queries from the input
+    if (config.augmentationProperties.queriesInput) {
+        if (config.augmentationProperties.queriesInputCombines) {
+            augmentedConfig.queries = (augmentedConfig.queries || []).concat(config.augmentationProperties.queriesInput);
+        }
+        else {
+            augmentedConfig.queries = config.augmentationProperties.queriesInput;
+        }
+    }
+    if (((_a = augmentedConfig.queries) === null || _a === void 0 ? void 0 : _a.length) === 0) {
+        delete augmentedConfig.queries;
+    }
+    // Inject the packs from the input
+    if (config.augmentationProperties.packsInput) {
+        if (config.augmentationProperties.packsInputCombines) {
+            // At this point, we already know that this is a single-language analysis
+            if (Array.isArray(augmentedConfig.packs)) {
+                augmentedConfig.packs = (augmentedConfig.packs || []).concat(config.augmentationProperties.packsInput);
+            }
+            else if (!augmentedConfig.packs) {
+                augmentedConfig.packs = config.augmentationProperties.packsInput;
+            }
+            else {
+                // At this point, we know there is only one language.
+                // If there were more than one language, an error would already have been thrown.
+                const language = Object.keys(augmentedConfig.packs)[0];
+                augmentedConfig.packs[language] = augmentedConfig.packs[language].concat(config.augmentationProperties.packsInput);
+            }
+        }
+        else {
+            augmentedConfig.packs = config.augmentationProperties.packsInput;
+        }
+    }
+    if (Array.isArray(augmentedConfig.packs) && !augmentedConfig.packs.length) {
+        delete augmentedConfig.packs;
+    }
+    if (config.augmentationProperties.injectedMlQueries) {
+        // We need to inject the ML queries into the original user input before
+        // we pass this on to the CLI, to make sure these get run.
+        const packString = await util.getMlPoweredJsQueriesPack(codeql);
+        if (augmentedConfig.packs === undefined)
+            augmentedConfig.packs = [];
+        if (Array.isArray(augmentedConfig.packs)) {
+            augmentedConfig.packs.push(packString);
+        }
+        else {
+            if (!augmentedConfig.packs.javascript)
+                augmentedConfig.packs["javascript"] = [];
+            augmentedConfig.packs["javascript"].push(packString);
+        }
+    }
+    logger.info(`Writing augmented user configuration file to ${configLocation}`);
+    logger.startGroup("Augmented user configuration file contents");
+    logger.info(yaml.dump(augmentedConfig));
+    logger.endGroup();
+    fs.writeFileSync(configLocation, yaml.dump(augmentedConfig));
+    return configLocation;
+}
+function cloneObject(obj) {
+    return JSON.parse(JSON.stringify(obj));
+}
+//# sourceMappingURL=codeql.js.map

github/codeql-action-v1/lib/codeql.test.js

@@ -0,0 +1,613 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stubToolRunnerConstructor = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolcache = __importStar(require("@actions/tool-cache"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const ava_1 = __importDefault(require("ava"));
+const del_1 = __importDefault(require("del"));
+const yaml = __importStar(require("js-yaml"));
+const nock_1 = __importDefault(require("nock"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const codeql = __importStar(require("./codeql"));
+const defaults = __importStar(require("./defaults.json"));
+const feature_flags_1 = require("./feature-flags");
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+(0, testing_utils_1.setupTests)(ava_1.default);
+const sampleApiDetails = {
+    auth: "token",
+    url: "https://github.com",
+    apiURL: "https://api.github.com",
+};
+const sampleGHAEApiDetails = {
+    auth: "token",
+    url: "https://example.githubenterprise.com",
+    apiURL: "https://example.githubenterprise.com/api/v3",
+};
+let stubConfig;
+ava_1.default.beforeEach(() => {
+    (0, util_1.initializeEnvironment)("1.2.3");
+    stubConfig = {
+        languages: [languages_1.Language.cpp],
+        queries: {},
+        pathsIgnore: [],
+        paths: [],
+        originalUserInput: {},
+        tempDir: "",
+        codeQLCmd: "",
+        gitHubVersion: {
+            type: util.GitHubVariant.DOTCOM,
+        },
+        dbLocation: "",
+        packs: {},
+        debugMode: false,
+        debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
+        debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
+        augmentationProperties: {
+            injectedMlQueries: false,
+            packsInputCombines: false,
+            queriesInputCombines: false,
+        },
+        trapCaches: {},
+        trapCacheDownloadTime: 0,
+    };
+});
+/**
+ * Mocks the API for downloading the bundle tagged `tagName`.
+ *
+ * @returns the download URL for the bundle. This can be passed to the tools parameter of
+ * `codeql.setupCodeQL`.
+ */
+async function mockDownloadApi({ apiDetails = sampleApiDetails, isPinned, tagName, }) {
+    var _a;
+    const platform = process.platform === "win32"
+        ? "win64"
+        : process.platform === "linux"
+            ? "linux64"
+            : "osx64";
+    const baseUrl = (_a = apiDetails === null || apiDetails === void 0 ? void 0 : apiDetails.url) !== null && _a !== void 0 ? _a : "https://example.com";
+    const relativeUrl = apiDetails
+        ? `/github/codeql-action/releases/download/${tagName}/codeql-bundle-${platform}.tar.gz`
+        : `/download/${tagName}/codeql-bundle.tar.gz`;
+    (0, nock_1.default)(baseUrl)
+        .get(relativeUrl)
+        .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle${isPinned ? "-pinned" : ""}.tar.gz`));
+    return `${baseUrl}${relativeUrl}`;
+}
+async function installIntoToolcache({ apiDetails = sampleApiDetails, isPinned, tagName, tmpDir, }) {
+    const url = await mockDownloadApi({ apiDetails, isPinned, tagName });
+    await codeql.setupCodeQL(url, apiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
+}
+(0, ava_1.default)("downloads and caches explicitly requested bundles that aren't in the toolcache", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const versions = ["20200601", "20200610"];
+        for (let i = 0; i < versions.length; i++) {
+            const version = versions[i];
+            const url = await mockDownloadApi({
+                tagName: `codeql-bundle-${version}`,
+                isPinned: false,
+            });
+            const result = await codeql.setupCodeQL(url, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
+            t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
+            t.is(result.toolsVersion, version);
+        }
+        t.is(toolcache.findAllVersions("CodeQL").length, 2);
+    });
+});
+(0, ava_1.default)("downloads an explicitly requested bundle even if a different version is cached", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        await installIntoToolcache({
+            tagName: "codeql-bundle-20200601",
+            isPinned: true,
+            tmpDir,
+        });
+        const url = await mockDownloadApi({
+            tagName: "codeql-bundle-20200610",
+        });
+        const result = await codeql.setupCodeQL(url, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
+        t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
+        t.deepEqual(result.toolsVersion, "20200610");
+    });
+});
+(0, ava_1.default)("uses a cached bundle when no tools input is given", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        await installIntoToolcache({
+            tagName: "codeql-bundle-20200601",
+            isPinned: true,
+            tmpDir,
+        });
+        const result = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
+        t.deepEqual(result.toolsVersion, "0.0.0-20200601");
+        const cachedVersions = toolcache.findAllVersions("CodeQL");
+        t.is(cachedVersions.length, 1);
+    });
+});
+(0, ava_1.default)("downloads bundle if only an unpinned version is cached", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        await installIntoToolcache({
+            tagName: "codeql-bundle-20200601",
+            isPinned: false,
+            tmpDir,
+        });
+        await mockDownloadApi({
+            tagName: defaults.bundleVersion,
+        });
+        const result = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
+        t.deepEqual(result.toolsVersion, defaults.bundleVersion.replace("codeql-bundle-", ""));
+        const cachedVersions = toolcache.findAllVersions("CodeQL");
+        t.is(cachedVersions.length, 2);
+    });
+});
+(0, ava_1.default)('downloads bundle if "latest" tools specified but not cached', async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        await installIntoToolcache({
+            tagName: "codeql-bundle-20200601",
+            isPinned: true,
+            tmpDir,
+        });
+        await mockDownloadApi({
+            tagName: defaults.bundleVersion,
+        });
+        const result = await codeql.setupCodeQL("latest", sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
+        t.deepEqual(result.toolsVersion, defaults.bundleVersion.replace("codeql-bundle-", ""));
+        const cachedVersions = toolcache.findAllVersions("CodeQL");
+        t.is(cachedVersions.length, 2);
+    });
+});
+const TOOLCACHE_BYPASS_TEST_CASES = [
+    [true, undefined, true],
+    [false, undefined, false],
+    [
+        true,
+        "https://github.com/github/codeql-action/releases/download/codeql-bundle-20200601/codeql-bundle.tar.gz",
+        false,
+    ],
+];
+for (const [isFeatureEnabled, toolsInput, shouldToolcacheBeBypassed,] of TOOLCACHE_BYPASS_TEST_CASES) {
+    (0, ava_1.default)(`download codeql bundle ${shouldToolcacheBeBypassed ? "bypasses" : "does not bypass"} toolcache when feature ${isFeatureEnabled ? "enabled" : "disabled"} and tools: ${toolsInput} passed`, async (t) => {
+        await util.withTmpDir(async (tmpDir) => {
+            (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+            await installIntoToolcache({
+                tagName: "codeql-bundle-20200601",
+                isPinned: true,
+                tmpDir,
+            });
+            await mockDownloadApi({
+                tagName: defaults.bundleVersion,
+            });
+            await codeql.setupCodeQL(toolsInput, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, isFeatureEnabled, (0, logging_1.getRunnerLogger)(true), false);
+            const cachedVersions = toolcache.findAllVersions("CodeQL");
+            t.is(cachedVersions.length, shouldToolcacheBeBypassed ? 2 : 1);
+        });
+    });
+}
+(0, ava_1.default)("download codeql bundle from github ae endpoint", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        const bundleAssetID = 10;
+        const platform = process.platform === "win32"
+            ? "win64"
+            : process.platform === "linux"
+                ? "linux64"
+                : "osx64";
+        const codeQLBundleName = `codeql-bundle-${platform}.tar.gz`;
+        (0, nock_1.default)("https://example.githubenterprise.com")
+            .get(`/api/v3/enterprise/code-scanning/codeql-bundle/find/${defaults.bundleVersion}`)
+            .reply(200, {
+            assets: { [codeQLBundleName]: bundleAssetID },
+        });
+        (0, nock_1.default)("https://example.githubenterprise.com")
+            .get(`/api/v3/enterprise/code-scanning/codeql-bundle/download/${bundleAssetID}`)
+            .reply(200, {
+            url: `https://example.githubenterprise.com/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`,
+        });
+        (0, nock_1.default)("https://example.githubenterprise.com")
+            .get(`/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`)
+            .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`));
+        // This is a workaround to mock `api.getApiDetails()` since it doesn't seem to be possible to
+        // mock this directly. The difficulty is that `getApiDetails()` is called locally in
+        // `api-client.ts`, but `sinon.stub(api, "getApiDetails")` only affects calls to
+        // `getApiDetails()` via an imported `api` module.
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("token")
+            .returns(sampleGHAEApiDetails.auth);
+        const requiredEnvParamStub = sinon.stub(util, "getRequiredEnvParam");
+        requiredEnvParamStub
+            .withArgs("GITHUB_SERVER_URL")
+            .returns(sampleGHAEApiDetails.url);
+        requiredEnvParamStub
+            .withArgs("GITHUB_API_URL")
+            .returns(sampleGHAEApiDetails.apiURL);
+        sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
+        process.env["GITHUB_ACTION_REPOSITORY"] = "github/codeql-action";
+        await codeql.setupCodeQL(undefined, sampleGHAEApiDetails, tmpDir, util.GitHubVariant.GHAE, false, (0, logging_1.getRunnerLogger)(true), false);
+        const cachedVersions = toolcache.findAllVersions("CodeQL");
+        t.is(cachedVersions.length, 1);
+    });
+});
+(0, ava_1.default)("parse codeql bundle url version", (t) => {
+    t.deepEqual(codeql.getCodeQLURLVersion("https://github.com/.../codeql-bundle-20200601/..."), "20200601");
+});
+(0, ava_1.default)("convert to semver", (t) => {
+    const tests = {
+        "20200601": "0.0.0-20200601",
+        "20200601.0": "0.0.0-20200601.0",
+        "20200601.0.0": "20200601.0.0",
+        "1.2.3": "1.2.3",
+        "1.2.3-alpha": "1.2.3-alpha",
+        "1.2.3-beta.1": "1.2.3-beta.1",
+    };
+    for (const [version, expectedVersion] of Object.entries(tests)) {
+        try {
+            const parsedVersion = codeql.convertToSemVer(version, (0, logging_1.getRunnerLogger)(true));
+            t.deepEqual(parsedVersion, expectedVersion);
+        }
+        catch (e) {
+            t.fail(e instanceof Error ? e.message : String(e));
+        }
+    }
+});
+(0, ava_1.default)("getExtraOptions works for explicit paths", (t) => {
+    t.deepEqual(codeql.getExtraOptions({}, ["foo"], []), []);
+    t.deepEqual(codeql.getExtraOptions({ foo: [42] }, ["foo"], []), ["42"]);
+    t.deepEqual(codeql.getExtraOptions({ foo: { bar: [42] } }, ["foo", "bar"], []), ["42"]);
+});
+(0, ava_1.default)("getExtraOptions works for wildcards", (t) => {
+    t.deepEqual(codeql.getExtraOptions({ "*": [42] }, ["foo"], []), ["42"]);
+});
+(0, ava_1.default)("getExtraOptions works for wildcards and explicit paths", (t) => {
+    const o1 = { "*": [42], foo: [87] };
+    t.deepEqual(codeql.getExtraOptions(o1, ["foo"], []), ["42", "87"]);
+    const o2 = { "*": [42], foo: [87] };
+    t.deepEqual(codeql.getExtraOptions(o2, ["foo", "bar"], []), ["42"]);
+    const o3 = { "*": [42], foo: { "*": [87], bar: [99] } };
+    const p = ["foo", "bar"];
+    t.deepEqual(codeql.getExtraOptions(o3, p, []), ["42", "87", "99"]);
+});
+(0, ava_1.default)("getExtraOptions throws for bad content", (t) => {
+    t.throws(() => codeql.getExtraOptions({ "*": 42 }, ["foo"], []));
+    t.throws(() => codeql.getExtraOptions({ foo: 87 }, ["foo"], []));
+    t.throws(() => codeql.getExtraOptions({ "*": [42], foo: { "*": 87, bar: [99] } }, ["foo", "bar"], []));
+});
+(0, ava_1.default)("getCodeQLActionRepository", (t) => {
+    const logger = (0, logging_1.getRunnerLogger)(true);
+    (0, util_1.initializeEnvironment)("1.2.3");
+    // isRunningLocalAction() === true
+    delete process.env["GITHUB_ACTION_REPOSITORY"];
+    process.env["RUNNER_TEMP"] = path.dirname(__dirname);
+    const repoLocalRunner = codeql.getCodeQLActionRepository(logger);
+    t.deepEqual(repoLocalRunner, "github/codeql-action");
+    // isRunningLocalAction() === false
+    sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
+    process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy";
+    const repoEnv = codeql.getCodeQLActionRepository(logger);
+    t.deepEqual(repoEnv, "xxx/yyy");
+});
+(0, ava_1.default)("databaseInterpretResults() does not set --sarif-add-query-help for 2.7.0", async (t) => {
+    const runnerConstructorStub = stubToolRunnerConstructor();
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeqlObject, "getVersion").resolves("2.7.0");
+    // safeWhich throws because of the test CodeQL object.
+    sinon.stub(safeWhich, "safeWhich").resolves("");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    t.false(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be absent, but it is present");
+});
+(0, ava_1.default)("databaseInterpretResults() sets --sarif-add-query-help for 2.7.1", async (t) => {
+    const runnerConstructorStub = stubToolRunnerConstructor();
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeqlObject, "getVersion").resolves("2.7.1");
+    // safeWhich throws because of the test CodeQL object.
+    sinon.stub(safeWhich, "safeWhich").resolves("");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    t.true(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be present, but it is absent");
+});
+(0, ava_1.default)("databaseInitCluster() without injected codescanning config", async (t) => {
+    await util.withTmpDir(async (tempDir) => {
+        const runnerConstructorStub = stubToolRunnerConstructor();
+        const codeqlObject = await codeql.getCodeQLForTesting();
+        sinon.stub(codeqlObject, "getVersion").resolves("2.8.1");
+        // safeWhich throws because of the test CodeQL object.
+        sinon.stub(safeWhich, "safeWhich").resolves("");
+        const thisStubConfig = {
+            ...stubConfig,
+            tempDir,
+            augmentationProperties: {
+                injectedMlQueries: false,
+                queriesInputCombines: false,
+                packsInputCombines: false,
+            },
+        };
+        await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const args = runnerConstructorStub.firstCall.args[1];
+        // should NOT have used an config file
+        const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
+        t.falsy(configArg, "Should have injected a codescanning config");
+    });
+});
+// Test macro for ensuring different variants of injected augmented configurations
+const injectedConfigMacro = ava_1.default.macro({
+    exec: async (t, augmentationProperties, configOverride, expectedConfig) => {
+        await util.withTmpDir(async (tempDir) => {
+            const runnerConstructorStub = stubToolRunnerConstructor();
+            const codeqlObject = await codeql.getCodeQLForTesting();
+            sinon
+                .stub(codeqlObject, "getVersion")
+                .resolves(feature_flags_1.featureConfig[feature_flags_1.Feature.CliConfigFileEnabled].minimumVersion);
+            const thisStubConfig = {
+                ...stubConfig,
+                ...configOverride,
+                tempDir,
+                augmentationProperties,
+            };
+            await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.CliConfigFileEnabled]), (0, logging_1.getRunnerLogger)(true));
+            const args = runnerConstructorStub.firstCall.args[1];
+            // should have used an config file
+            const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
+            t.truthy(configArg, "Should have injected a codescanning config");
+            const configFile = configArg.split("=")[1];
+            const augmentedConfig = yaml.load(fs.readFileSync(configFile, "utf8"));
+            t.deepEqual(augmentedConfig, expectedConfig);
+            await (0, del_1.default)(configFile, { force: true });
+        });
+    },
+    title: (providedTitle = "") => `databaseInitCluster() injected config: ${providedTitle}`,
+});
+(0, ava_1.default)("basic", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+}, {}, {});
+(0, ava_1.default)("injected ML queries", injectedConfigMacro, {
+    injectedMlQueries: true,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+}, {}, {
+    packs: ["codeql/javascript-experimental-atm-queries@~0.4.0"],
+});
+(0, ava_1.default)("injected ML queries with existing packs", injectedConfigMacro, {
+    injectedMlQueries: true,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+}, {
+    originalUserInput: {
+        packs: { javascript: ["codeql/something-else"] },
+    },
+}, {
+    packs: {
+        javascript: [
+            "codeql/something-else",
+            "codeql/javascript-experimental-atm-queries@~0.4.0",
+        ],
+    },
+});
+(0, ava_1.default)("injected ML queries with existing packs of different language", injectedConfigMacro, {
+    injectedMlQueries: true,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+}, {
+    originalUserInput: {
+        packs: { cpp: ["codeql/something-else"] },
+    },
+}, {
+    packs: {
+        cpp: ["codeql/something-else"],
+        javascript: ["codeql/javascript-experimental-atm-queries@~0.4.0"],
+    },
+});
+(0, ava_1.default)("injected packs from input", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+    packsInput: ["xxx", "yyy"],
+}, {}, {
+    packs: ["xxx", "yyy"],
+});
+(0, ava_1.default)("injected packs from input with existing packs combines", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: false,
+    packsInputCombines: true,
+    packsInput: ["xxx", "yyy"],
+}, {
+    originalUserInput: {
+        packs: {
+            cpp: ["codeql/something-else"],
+        },
+    },
+}, {
+    packs: {
+        cpp: ["codeql/something-else", "xxx", "yyy"],
+    },
+});
+(0, ava_1.default)("injected packs from input with existing packs overrides", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+    packsInput: ["xxx", "yyy"],
+}, {
+    originalUserInput: {
+        packs: {
+            cpp: ["codeql/something-else"],
+        },
+    },
+}, {
+    packs: ["xxx", "yyy"],
+});
+(0, ava_1.default)("injected packs from input with existing packs overrides and ML model inject", injectedConfigMacro, {
+    injectedMlQueries: true,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+    packsInput: ["xxx", "yyy"],
+}, {
+    originalUserInput: {
+        packs: {
+            cpp: ["codeql/something-else"],
+        },
+    },
+}, {
+    packs: ["xxx", "yyy", "codeql/javascript-experimental-atm-queries@~0.4.0"],
+});
+// similar, but with queries
+(0, ava_1.default)("injected queries from input", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
+}, {}, {
+    queries: [
+        {
+            uses: "xxx",
+        },
+        {
+            uses: "yyy",
+        },
+    ],
+});
+(0, ava_1.default)("injected queries from input overrides", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: false,
+    packsInputCombines: false,
+    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
+}, {
+    originalUserInput: {
+        queries: [{ uses: "zzz" }],
+    },
+}, {
+    queries: [
+        {
+            uses: "xxx",
+        },
+        {
+            uses: "yyy",
+        },
+    ],
+});
+(0, ava_1.default)("injected queries from input combines", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: false,
+    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
+}, {
+    originalUserInput: {
+        queries: [{ uses: "zzz" }],
+    },
+}, {
+    queries: [
+        {
+            uses: "zzz",
+        },
+        {
+            uses: "xxx",
+        },
+        {
+            uses: "yyy",
+        },
+    ],
+});
+(0, ava_1.default)("injected queries from input combines 2", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
+}, {}, {
+    queries: [
+        {
+            uses: "xxx",
+        },
+        {
+            uses: "yyy",
+        },
+    ],
+});
+(0, ava_1.default)("injected queries and packs, but empty", injectedConfigMacro, {
+    injectedMlQueries: false,
+    queriesInputCombines: true,
+    packsInputCombines: true,
+    queriesInput: [],
+    packsInput: [],
+}, {
+    originalUserInput: {
+        packs: [],
+        queries: [],
+    },
+}, {});
+(0, ava_1.default)("does not use injected config", async (t) => {
+    const origCODEQL_PASS_CONFIG_TO_CLI = process.env.CODEQL_PASS_CONFIG_TO_CLI;
+    process.env["CODEQL_PASS_CONFIG_TO_CLI"] = "false";
+    try {
+        const runnerConstructorStub = stubToolRunnerConstructor();
+        const codeqlObject = await codeql.getCodeQLForTesting();
+        sinon
+            .stub(codeqlObject, "getVersion")
+            .resolves(feature_flags_1.featureConfig[feature_flags_1.Feature.CliConfigFileEnabled].minimumVersion);
+        await codeqlObject.databaseInitCluster(stubConfig, "", undefined, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const args = runnerConstructorStub.firstCall.args[1];
+        // should have used an config file
+        const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
+        t.falsy(configArg, "Should NOT have injected a codescanning config");
+    }
+    finally {
+        process.env["CODEQL_PASS_CONFIG_TO_CLI"] = origCODEQL_PASS_CONFIG_TO_CLI;
+    }
+});
+(0, ava_1.default)("databaseInterpretResults() sets --sarif-add-baseline-file-info for 2.11.3", async (t) => {
+    const runnerConstructorStub = stubToolRunnerConstructor();
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeqlObject, "getVersion").resolves("2.11.3");
+    // safeWhich throws because of the test CodeQL object.
+    sinon.stub(safeWhich, "safeWhich").resolves("");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    t.true(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-baseline-file-info"), "--sarif-add-baseline-file-info should be present, but it is absent");
+});
+(0, ava_1.default)("databaseInterpretResults() does not set --sarif-add-baseline-file-info for 2.11.2", async (t) => {
+    const runnerConstructorStub = stubToolRunnerConstructor();
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeqlObject, "getVersion").resolves("2.11.2");
+    // safeWhich throws because of the test CodeQL object.
+    sinon.stub(safeWhich, "safeWhich").resolves("");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    t.false(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-baseline-file-info"), "--sarif-add-baseline-file-info must be absent, but it is present");
+});
+function stubToolRunnerConstructor() {
+    const runnerObjectStub = sinon.createStubInstance(toolrunner.ToolRunner);
+    runnerObjectStub.exec.resolves(0);
+    const runnerConstructorStub = sinon.stub(toolrunner, "ToolRunner");
+    runnerConstructorStub.returns(runnerObjectStub);
+    return runnerConstructorStub;
+}
+exports.stubToolRunnerConstructor = stubToolRunnerConstructor;
+//# sourceMappingURL=codeql.test.js.map

github/codeql-action-v1/lib/database-upload.js

@@ -0,0 +1,82 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uploadDatabases = void 0;
+const fs = __importStar(require("fs"));
+const actionsUtil = __importStar(require("./actions-util"));
+const api_client_1 = require("./api-client");
+const codeql_1 = require("./codeql");
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+async function uploadDatabases(repositoryNwo, config, apiDetails, logger) {
+    if (actionsUtil.getRequiredInput("upload-database") !== "true") {
+        logger.debug("Database upload disabled in workflow. Skipping upload.");
+        return;
+    }
+    // Do nothing when not running against github.com
+    if (config.gitHubVersion.type !== util.GitHubVariant.DOTCOM) {
+        logger.debug("Not running against github.com. Skipping upload.");
+        return;
+    }
+    if (!(await actionsUtil.isAnalyzingDefaultBranch())) {
+        // We only want to upload a database if we are analyzing the default branch.
+        logger.debug("Not analyzing default branch. Skipping upload.");
+        return;
+    }
+    const client = (0, api_client_1.getApiClient)();
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    for (const language of config.languages) {
+        try {
+            // Upload the database bundle.
+            // Although we are uploading arbitrary file contents to the API, it's worth
+            // noting that it's the API's job to validate that the contents is acceptable.
+            // This API method is available to anyone with write access to the repo.
+            const bundledDb = await (0, util_1.bundleDb)(config, language, codeql, language);
+            const bundledDbSize = fs.statSync(bundledDb).size;
+            const bundledDbReadStream = fs.createReadStream(bundledDb);
+            try {
+                await client.request(`POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name`, {
+                    owner: repositoryNwo.owner,
+                    repo: repositoryNwo.repo,
+                    language,
+                    name: `${language}-database`,
+                    data: bundledDbReadStream,
+                    headers: {
+                        authorization: `token ${apiDetails.auth}`,
+                        "Content-Type": "application/zip",
+                        "Content-Length": bundledDbSize,
+                    },
+                });
+                logger.debug(`Successfully uploaded database for ${language}`);
+            }
+            finally {
+                bundledDbReadStream.close();
+            }
+        }
+        catch (e) {
+            console.log(e);
+            // Log a warning but don't fail the workflow
+            logger.warning(`Failed to upload database for ${language}: ${e}`);
+        }
+    }
+}
+exports.uploadDatabases = uploadDatabases;
+//# sourceMappingURL=database-upload.js.map

github/codeql-action-v1/lib/database-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAIrC,6CAA+B;AAC/B,iCAAkC;AAE3B,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE;QAC9D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;KACR;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;QAC3D,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO;KACR;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACnD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;KACR;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI;gBACF,MAAM,MAAM,CAAC,OAAO,CAClB,wGAAwG,EACxG;oBACE,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;aAChE;oBAAS;gBACR,mBAAmB,CAAC,KAAK,EAAE,CAAC;aAC7B;SACF;QAAC,OAAO,CAAC,EAAE;YACV,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;SACnE;KACF;AACH,CAAC;AA7DD,0CA6DC"}

github/codeql-action-v1/lib/database-upload.test.js

@@ -0,0 +1,202 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const github = __importStar(require("@actions/github"));
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const apiClient = __importStar(require("./api-client"));
+const codeql_1 = require("./codeql");
+const config_utils_1 = require("./config-utils");
+const database_upload_1 = require("./database-upload");
+const languages_1 = require("./languages");
+const testing_utils_1 = require("./testing-utils");
+const util_1 = require("./util");
+(0, testing_utils_1.setupTests)(ava_1.default);
+ava_1.default.beforeEach(() => {
+    (0, util_1.initializeEnvironment)("1.2.3");
+});
+const testRepoName = { owner: "github", repo: "example" };
+const testApiDetails = {
+    auth: "1234",
+    url: "https://github.com",
+    apiURL: undefined,
+};
+function getTestConfig(tmpDir) {
+    return {
+        languages: [languages_1.Language.javascript],
+        queries: {},
+        pathsIgnore: [],
+        paths: [],
+        originalUserInput: {},
+        tempDir: tmpDir,
+        codeQLCmd: "foo",
+        gitHubVersion: { type: util_1.GitHubVariant.DOTCOM },
+        dbLocation: tmpDir,
+        packs: {},
+        debugMode: false,
+        debugArtifactName: util_1.DEFAULT_DEBUG_ARTIFACT_NAME,
+        debugDatabaseName: util_1.DEFAULT_DEBUG_DATABASE_NAME,
+        augmentationProperties: config_utils_1.defaultAugmentationProperties,
+        trapCaches: {},
+        trapCacheDownloadTime: 0,
+    };
+}
+async function mockHttpRequests(databaseUploadStatusCode) {
+    // Passing an auth token is required, so we just use a dummy value
+    const client = github.getOctokit("123");
+    const requestSpy = sinon.stub(client, "request");
+    const url = "POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name";
+    const databaseUploadSpy = requestSpy.withArgs(url);
+    if (databaseUploadStatusCode < 300) {
+        databaseUploadSpy.resolves(undefined);
+    }
+    else {
+        databaseUploadSpy.throws(new util_1.HTTPError("some error message", databaseUploadStatusCode));
+    }
+    sinon.stub(apiClient, "getApiClient").value(() => client);
+}
+(0, ava_1.default)("Abort database upload if 'upload-database' input set to false", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("upload-database")
+            .returns("false");
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        const loggedMessages = [];
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        t.assert(loggedMessages.find((v) => v.type === "debug" &&
+            v.message === "Database upload disabled in workflow. Skipping upload.") !== undefined);
+    });
+});
+(0, ava_1.default)("Abort database upload if running against GHES", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("upload-database")
+            .returns("true");
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        const config = getTestConfig(tmpDir);
+        config.gitHubVersion = { type: util_1.GitHubVariant.GHES, version: "3.0" };
+        const loggedMessages = [];
+        await (0, database_upload_1.uploadDatabases)(testRepoName, config, testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        t.assert(loggedMessages.find((v) => v.type === "debug" &&
+            v.message === "Not running against github.com. Skipping upload.") !== undefined);
+    });
+});
+(0, ava_1.default)("Abort database upload if running against GHAE", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("upload-database")
+            .returns("true");
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        const config = getTestConfig(tmpDir);
+        config.gitHubVersion = { type: util_1.GitHubVariant.GHAE };
+        const loggedMessages = [];
+        await (0, database_upload_1.uploadDatabases)(testRepoName, config, testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        t.assert(loggedMessages.find((v) => v.type === "debug" &&
+            v.message === "Not running against github.com. Skipping upload.") !== undefined);
+    });
+});
+(0, ava_1.default)("Abort database upload if not analyzing default branch", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("upload-database")
+            .returns("true");
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(false);
+        const loggedMessages = [];
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        t.assert(loggedMessages.find((v) => v.type === "debug" &&
+            v.message === "Not analyzing default branch. Skipping upload.") !== undefined);
+    });
+});
+(0, ava_1.default)("Don't crash if uploading a database fails", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("upload-database")
+            .returns("true");
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        await mockHttpRequests(500);
+        (0, codeql_1.setCodeQL)({
+            async databaseBundle(_, outputFilePath) {
+                fs.writeFileSync(outputFilePath, "");
+            },
+        });
+        const loggedMessages = [];
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        t.assert(loggedMessages.find((v) => v.type === "warning" &&
+            v.message ===
+                "Failed to upload database for javascript: Error: some error message") !== undefined);
+    });
+});
+(0, ava_1.default)("Successfully uploading a database to api.github.com", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("upload-database")
+            .returns("true");
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        await mockHttpRequests(201);
+        (0, codeql_1.setCodeQL)({
+            async databaseBundle(_, outputFilePath) {
+                fs.writeFileSync(outputFilePath, "");
+            },
+        });
+        const loggedMessages = [];
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        t.assert(loggedMessages.find((v) => v.type === "debug" &&
+            v.message === "Successfully uploaded database for javascript") !== undefined);
+    });
+});
+(0, ava_1.default)("Successfully uploading a database to uploads.github.com", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+        sinon
+            .stub(actionsUtil, "getRequiredInput")
+            .withArgs("upload-database")
+            .returns("true");
+        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
+        await mockHttpRequests(201);
+        (0, codeql_1.setCodeQL)({
+            async databaseBundle(_, outputFilePath) {
+                fs.writeFileSync(outputFilePath, "");
+            },
+        });
+        const loggedMessages = [];
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        t.assert(loggedMessages.find((v) => v.type === "debug" &&
+            v.message === "Successfully uploaded database for javascript") !== undefined);
+    });
+});
+//# sourceMappingURL=database-upload.test.js.map

github/codeql-action-v1/lib/debug-artifacts.js

@@ -0,0 +1,143 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uploadDatabaseBundleDebugArtifact = exports.uploadLogsDebugArtifact = exports.uploadSarifDebugArtifact = exports.uploadDebugArtifacts = exports.sanitizeArifactName = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const artifact = __importStar(require("@actions/artifact"));
+const core = __importStar(require("@actions/core"));
+const adm_zip_1 = __importDefault(require("adm-zip"));
+const del_1 = __importDefault(require("del"));
+const actions_util_1 = require("./actions-util");
+const analyze_1 = require("./analyze");
+const codeql_1 = require("./codeql");
+const util_1 = require("./util");
+function sanitizeArifactName(name) {
+    return name.replace(/[^a-zA-Z0-9_\\-]+/g, "");
+}
+exports.sanitizeArifactName = sanitizeArifactName;
+async function uploadDebugArtifacts(toUpload, rootDir, artifactName) {
+    if (toUpload.length === 0) {
+        return;
+    }
+    let suffix = "";
+    const matrix = (0, actions_util_1.getRequiredInput)("matrix");
+    if (matrix) {
+        try {
+            for (const [, matrixVal] of Object.entries(JSON.parse(matrix)).sort())
+                suffix += `-${matrixVal}`;
+        }
+        catch (e) {
+            core.info("Could not parse user-specified `matrix` input into JSON. The debug artifact will not be named with the user's `matrix` input.");
+        }
+    }
+    await artifact.create().uploadArtifact(sanitizeArifactName(`${artifactName}${suffix}`), toUpload.map((file) => path.normalize(file)), path.normalize(rootDir));
+}
+exports.uploadDebugArtifacts = uploadDebugArtifacts;
+async function uploadSarifDebugArtifact(config, outputDir) {
+    if (!(0, util_1.doesDirectoryExist)(outputDir)) {
+        return;
+    }
+    let toUpload = [];
+    for (const lang of config.languages) {
+        const sarifFile = path.resolve(outputDir, `${lang}.sarif`);
+        if (fs.existsSync(sarifFile)) {
+            toUpload = toUpload.concat(sarifFile);
+        }
+    }
+    await uploadDebugArtifacts(toUpload, outputDir, config.debugArtifactName);
+}
+exports.uploadSarifDebugArtifact = uploadSarifDebugArtifact;
+async function uploadLogsDebugArtifact(config) {
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    let toUpload = [];
+    for (const language of config.languages) {
+        const databaseDirectory = (0, util_1.getCodeQLDatabasePath)(config, language);
+        const logsDirectory = path.resolve(databaseDirectory, "log");
+        if ((0, util_1.doesDirectoryExist)(logsDirectory)) {
+            toUpload = toUpload.concat((0, util_1.listFolder)(logsDirectory));
+        }
+    }
+    if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+        // Multilanguage tracing: there are additional logs in the root of the cluster
+        const multiLanguageTracingLogsDirectory = path.resolve(config.dbLocation, "log");
+        if ((0, util_1.doesDirectoryExist)(multiLanguageTracingLogsDirectory)) {
+            toUpload = toUpload.concat((0, util_1.listFolder)(multiLanguageTracingLogsDirectory));
+        }
+    }
+    await uploadDebugArtifacts(toUpload, config.dbLocation, config.debugArtifactName);
+    // Before multi-language tracing, we wrote a compound-build-tracer.log in the temp dir
+    if (!(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING))) {
+        const compoundBuildTracerLogDirectory = path.resolve(config.tempDir, "compound-build-tracer.log");
+        if ((0, util_1.doesDirectoryExist)(compoundBuildTracerLogDirectory)) {
+            await uploadDebugArtifacts([compoundBuildTracerLogDirectory], config.tempDir, config.debugArtifactName);
+        }
+    }
+}
+exports.uploadLogsDebugArtifact = uploadLogsDebugArtifact;
+/**
+ * If a database has not been finalized, we cannot run the `codeql database bundle`
+ * command in the CLI because it will return an error. Instead we directly zip
+ * all files in the database folder and return the path.
+ */
+async function createPartialDatabaseBundle(config, language) {
+    const databasePath = (0, util_1.getCodeQLDatabasePath)(config, language);
+    const databaseBundlePath = path.resolve(config.dbLocation, `${config.debugDatabaseName}-${language}-partial.zip`);
+    core.info(`${config.debugDatabaseName}-${language} is not finalized. Uploading partial database bundle at ${databaseBundlePath}...`);
+    // See `bundleDb` for explanation behind deleting existing db bundle.
+    if (fs.existsSync(databaseBundlePath)) {
+        await (0, del_1.default)(databaseBundlePath, { force: true });
+    }
+    const zip = new adm_zip_1.default();
+    zip.addLocalFolder(databasePath);
+    zip.writeZip(databaseBundlePath);
+    return databaseBundlePath;
+}
+/**
+ * Runs `codeql database bundle` command and returns the path.
+ */
+async function createDatabaseBundleCli(config, language) {
+    // Otherwise run `codeql database bundle` command.
+    const databaseBundlePath = await (0, util_1.bundleDb)(config, language, await (0, codeql_1.getCodeQL)(config.codeQLCmd), `${config.debugDatabaseName}-${language}`);
+    return databaseBundlePath;
+}
+async function uploadDatabaseBundleDebugArtifact(config, logger) {
+    for (const language of config.languages) {
+        try {
+            let databaseBundlePath;
+            if (!(0, analyze_1.dbIsFinalized)(config, language, logger)) {
+                databaseBundlePath = await createPartialDatabaseBundle(config, language);
+            }
+            else {
+                databaseBundlePath = await createDatabaseBundleCli(config, language);
+            }
+            await uploadDebugArtifacts([databaseBundlePath], config.dbLocation, config.debugArtifactName);
+        }
+        catch (error) {
+            core.info(`Failed to upload database debug bundle for ${config.debugDatabaseName}-${language}: ${error}`);
+        }
+    }
+}
+exports.uploadDatabaseBundleDebugArtifact = uploadDatabaseBundleDebugArtifact;
+//# sourceMappingURL=debug-artifacts.js.map

github/codeql-action-v1/lib/debug-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-artifacts.js","sourceRoot":"","sources":["../src/debug-artifacts.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oDAAsC;AACtC,sDAA6B;AAC7B,8CAAsB;AAEtB,iDAAkD;AAClD,uCAA0C;AAC1C,qCAAiE;AAIjE,iCAMgB;AAEhB,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAFD,kDAEC;AAEM,KAAK,UAAU,oBAAoB,CACxC,QAAkB,EAClB,OAAe,EACf,YAAoB;IAEpB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACzB,OAAO;KACR;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE;QACV,IAAI;YACF,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;gBACnE,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;SAC7B;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,IAAI,CACP,+HAA+H,CAChI,CAAC;SACH;KACF;IACD,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,cAAc,CACpC,mBAAmB,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,EAC/C,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AAzBD,oDAyBC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC,IAAA,yBAAkB,EAAC,SAAS,CAAC,EAAE;QAClC,OAAO;KACR;IAED,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;YAC5B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACvC;KACF;IACD,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAhBD,4DAgBC;AAEM,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,iBAAiB,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,IAAA,yBAAkB,EAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,aAAa,CAAC,CAAC,CAAC;SACvD;KACF;IAED,IAAI,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,mCAA0B,CAAC,EAAE;QAChE,8EAA8E;QAC9E,MAAM,iCAAiC,GAAG,IAAI,CAAC,OAAO,CACpD,MAAM,CAAC,UAAU,EACjB,KAAK,CACN,CAAC;QACF,IAAI,IAAA,yBAAkB,EAAC,iCAAiC,CAAC,EAAE;YACzD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,iCAAiC,CAAC,CAAC,CAAC;SAC3E;KACF;IACD,MAAM,oBAAoB,CACxB,QAAQ,EACR,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;IAEF,sFAAsF;IACtF,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,mCAA0B,CAAC,CAAC,EAAE;QACnE,MAAM,+BAA+B,GAAG,IAAI,CAAC,OAAO,CAClD,MAAM,CAAC,OAAO,EACd,2BAA2B,CAC5B,CAAC;QACF,IAAI,IAAA,yBAAkB,EAAC,+BAA+B,CAAC,EAAE;YACvD,MAAM,oBAAoB,CACxB,CAAC,+BAA+B,CAAC,EACjC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;KACF;AACH,CAAC;AA1CD,0DA0CC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,MAAc,EACd,QAAkB;IAElB,MAAM,YAAY,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CACrC,MAAM,CAAC,UAAU,EACjB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,cAAc,CACtD,CAAC;IACF,IAAI,CAAC,IAAI,CACP,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,2DAA2D,kBAAkB,KAAK,CAC1H,CAAC;IACF,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QACrC,MAAM,IAAA,aAAG,EAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KAChD;IACD,MAAM,GAAG,GAAG,IAAI,iBAAM,EAAE,CAAC;IACzB,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAkB;IAElB,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,MAAM,IAAA,eAAQ,EACvC,MAAM,EACN,QAAQ,EACR,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,EACjC,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,EAAE,CAC1C,CAAC;IACF,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,IAAI,kBAAkB,CAAC;YACvB,IAAI,CAAC,IAAA,uBAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC5C,kBAAkB,GAAG,MAAM,2BAA2B,CACpD,MAAM,EACN,QAAQ,CACT,CAAC;aACH;iBAAM;gBACL,kBAAkB,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACtE;YACD,MAAM,oBAAoB,CACxB,CAAC,kBAAkB,CAAC,EACpB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,IAAI,CAAC,IAAI,CACP,8CAA8C,MAAM,CAAC,iBAAiB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAC/F,CAAC;SACH;KACF;AACH,CAAC;AA1BD,8EA0BC"}

github/codeql-action-v1/lib/debug-artifacts.test.js

@@ -0,0 +1,37 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const debugArtifacts = __importStar(require("./debug-artifacts"));
+(0, ava_1.default)("sanitizeArifactName", (t) => {
+    t.deepEqual(debugArtifacts.sanitizeArifactName("hello-world_"), "hello-world_");
+    t.deepEqual(debugArtifacts.sanitizeArifactName("hello`world`"), "helloworld");
+    t.deepEqual(debugArtifacts.sanitizeArifactName("hello===123"), "hello123");
+    t.deepEqual(debugArtifacts.sanitizeArifactName("*m)a&n^y%i££n+v!a:l[i]d"), "manyinvalid");
+});
+(0, ava_1.default)("uploadDebugArtifacts", async (t) => {
+    // Test that no error is thrown if artifacts list is empty.
+    await t.notThrowsAsync(debugArtifacts.uploadDebugArtifacts([], "rootDir", "artifactName"));
+});
+//# sourceMappingURL=debug-artifacts.test.js.map

github/codeql-action-v1/lib/debug-artifacts.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-artifacts.test.js","sourceRoot":"","sources":["../src/debug-artifacts.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AAEvB,kEAAoD;AAEpD,IAAA,aAAI,EAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE;IAChC,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAClD,cAAc,CACf,CAAC;IACF,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9E,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3E,CAAC,CAAC,SAAS,CACT,cAAc,CAAC,mBAAmB,CAAC,yBAAyB,CAAC,EAC7D,aAAa,CACd,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,2DAA2D;IAC3D,MAAM,CAAC,CAAC,cAAc,CACpB,cAAc,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CACnE,CAAC;AACJ,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/defaults.json

@@ -0,0 +1,6 @@
+{
+    "bundleVersion": "codeql-bundle-20230105",
+    "cliVersion": "2.12.0",
+    "priorBundleVersion": "codeql-bundle-20221211",
+    "priorCliVersion": "2.11.6"
+}

github/codeql-action-v1/lib/error-matcher.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.errorMatchers = exports.namedMatchersForTesting = void 0;
+// exported only for testing purposes
+exports.namedMatchersForTesting = {
+    /*
+    In due course it may be possible to remove the regex, if/when javascript also exits with code 32.
+    */
+    noSourceCodeFound: {
+        exitCode: 32,
+        outputRegex: new RegExp("No JavaScript or TypeScript code found\\."),
+        message: "No code found during the build. Please see:\n" +
+            "https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning#no-code-found-during-the-build",
+    },
+    fatalError: {
+        outputRegex: new RegExp("A fatal error occurred"),
+        message: "A fatal error occurred.",
+    },
+};
+// we collapse the matches into an array for use in execErrorCatcher
+exports.errorMatchers = Object.values(exports.namedMatchersForTesting);
+//# sourceMappingURL=error-matcher.js.map

github/codeql-action-v1/lib/error-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-matcher.js","sourceRoot":"","sources":["../src/error-matcher.ts"],"names":[],"mappings":";;;AAQA,qCAAqC;AACxB,QAAA,uBAAuB,GAAoC;IACtE;;MAEE;IACF,iBAAiB,EAAE;QACjB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,IAAI,MAAM,CAAC,2CAA2C,CAAC;QACpE,OAAO,EACL,+CAA+C;YAC/C,yJAAyJ;KAC5J;IACD,UAAU,EAAE;QACV,WAAW,EAAE,IAAI,MAAM,CAAC,wBAAwB,CAAC;QACjD,OAAO,EAAE,yBAAyB;KACnC;CACF,CAAC;AAEF,oEAAoE;AACvD,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,+BAAuB,CAAC,CAAC"}

github/codeql-action-v1/lib/error-matcher.test.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const error_matcher_1 = require("./error-matcher");
+/*
+NB We test the regexes for all the matchers against example log output snippets.
+*/
+(0, ava_1.default)("noSourceCodeFound matches against example javascript output", async (t) => {
+    t.assert(testErrorMatcher("noSourceCodeFound", `
+  2020-09-07T17:39:53.9050522Z [2020-09-07 17:39:53] [build] Done extracting /opt/hostedtoolcache/CodeQL/0.0.0-20200630/x64/codeql/javascript/tools/data/externs/web/ie_vml.js (3 ms)
+  2020-09-07T17:39:53.9051849Z [2020-09-07 17:39:53] [build-err] No JavaScript or TypeScript code found.
+  2020-09-07T17:39:53.9052444Z [2020-09-07 17:39:53] [build-err] No JavaScript or TypeScript code found.
+  2020-09-07T17:39:53.9251124Z [2020-09-07 17:39:53] [ERROR] Spawned process exited abnormally (code 255; tried to run: [/opt/hostedtoolcache/CodeQL/0.0.0-20200630/x64/codeql/javascript/tools/autobuild.sh])
+  `));
+});
+(0, ava_1.default)("fatalError matches against example log output", async (t) => {
+    t.assert(testErrorMatcher("fatalError", "A fatal error occurred: Could not process query metadata for test-query.ql"));
+});
+function testErrorMatcher(matcherName, logSample) {
+    if (!(matcherName in error_matcher_1.namedMatchersForTesting)) {
+        throw new Error(`Unknown matcher ${matcherName}`);
+    }
+    const regex = error_matcher_1.namedMatchersForTesting[matcherName].outputRegex;
+    if (regex === undefined) {
+        throw new Error(`Cannot test matcher ${matcherName} with null regex`);
+    }
+    return regex.test(logSample);
+}
+//# sourceMappingURL=error-matcher.test.js.map

github/codeql-action-v1/lib/error-matcher.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-matcher.test.js","sourceRoot":"","sources":["../src/error-matcher.test.ts"],"names":[],"mappings":";;;;;AAAA,8CAAuB;AAEvB,mDAA0D;AAE1D;;EAEE;AAEF,IAAA,aAAI,EAAC,6DAA6D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC9E,CAAC,CAAC,MAAM,CACN,gBAAgB,CACd,mBAAmB,EACnB;;;;;GAKH,CACE,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,+CAA+C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChE,CAAC,CAAC,MAAM,CACN,gBAAgB,CACd,YAAY,EACZ,4EAA4E,CAC7E,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,WAAmB,EAAE,SAAiB;IAC9D,IAAI,CAAC,CAAC,WAAW,IAAI,uCAAuB,CAAC,EAAE;QAC7C,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,EAAE,CAAC,CAAC;KACnD;IACD,MAAM,KAAK,GAAG,uCAAuB,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC;IAC/D,IAAI,KAAK,KAAK,SAAS,EAAE;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,WAAW,kBAAkB,CAAC,CAAC;KACvE;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC"}

github/codeql-action-v1/lib/external-queries.js

@@ -0,0 +1,67 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCheckoutURL = exports.checkoutExternalRepository = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+/**
+ * Check out repository at the given ref, and return the directory of the checkout.
+ */
+async function checkoutExternalRepository(repository, ref, apiDetails, tempDir, logger) {
+    logger.info(`Checking out ${repository}`);
+    const checkoutLocation = path.join(tempDir, repository, ref);
+    if (!checkoutLocation.startsWith(tempDir)) {
+        // this still permits locations that mess with sibling repositories in `tempDir`, but that is acceptable
+        throw new Error(`'${repository}@${ref}' is not a valid repository and reference.`);
+    }
+    if (!fs.existsSync(checkoutLocation)) {
+        const repoCloneURL = buildCheckoutURL(repository, apiDetails);
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
+            "clone",
+            repoCloneURL,
+            checkoutLocation,
+        ]).exec();
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
+            `--work-tree=${checkoutLocation}`,
+            `--git-dir=${checkoutLocation}/.git`,
+            "checkout",
+            ref,
+        ]).exec();
+    }
+    return checkoutLocation;
+}
+exports.checkoutExternalRepository = checkoutExternalRepository;
+function buildCheckoutURL(repository, apiDetails) {
+    const repoCloneURL = new URL(apiDetails.url);
+    if (apiDetails.externalRepoAuth !== undefined) {
+        repoCloneURL.username = "x-access-token";
+        repoCloneURL.password = apiDetails.externalRepoAuth;
+    }
+    if (!repoCloneURL.pathname.endsWith("/")) {
+        repoCloneURL.pathname += "/";
+    }
+    repoCloneURL.pathname += `${repository}`;
+    return repoCloneURL.toString();
+}
+exports.buildCheckoutURL = buildCheckoutURL;
+//# sourceMappingURL=external-queries.js.map

github/codeql-action-v1/lib/external-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAKpD;;GAEG;AACI,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,GAAW,EACX,UAAwC,EACxC,OAAe,EACf,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAE1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACzC,wGAAwG;QACxG,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,IAAI,GAAG,4CAA4C,CAClE,CAAC;KACH;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;QACpC,MAAM,YAAY,GAAG,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,OAAO;YACP,YAAY;YACZ,gBAAgB;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,eAAe,gBAAgB,EAAE;YACjC,aAAa,gBAAgB,OAAO;YACpC,UAAU;YACV,GAAG;SACJ,CAAC,CAAC,IAAI,EAAE,CAAC;KACX;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAlCD,gEAkCC;AAED,SAAgB,gBAAgB,CAC9B,UAAkB,EAClB,UAAwC;IAExC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,EAAE;QAC7C,YAAY,CAAC,QAAQ,GAAG,gBAAgB,CAAC;QACzC,YAAY,CAAC,QAAQ,GAAG,UAAU,CAAC,gBAAgB,CAAC;KACrD;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACxC,YAAY,CAAC,QAAQ,IAAI,GAAG,CAAC;KAC9B;IACD,YAAY,CAAC,QAAQ,IAAI,GAAG,UAAU,EAAE,CAAC;IACzC,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC;AACjC,CAAC;AAdD,4CAcC"}

github/codeql-action-v1/lib/external-queries.test.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const ava_1 = __importDefault(require("ava"));
+const externalQueries = __importStar(require("./external-queries"));
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("checkoutExternalQueries", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        // Create a test repo in a subdir of the temp dir.
+        // It should have a default branch with two commits after the initial commit, where
+        // - the first commit contains files 'a' and 'b'
+        // - the second commit contains only 'a'
+        // Place the repo in a subdir because we're going to checkout a copy in tmpDir
+        const testRepoBaseDir = path.join(tmpDir, "test-repo-dir");
+        const repoName = "some/repo";
+        const repoPath = path.join(testRepoBaseDir, repoName);
+        const repoGitDir = path.join(repoPath, ".git");
+        // Run the given git command, and return the output.
+        // Passes --git-dir and --work-tree.
+        // Any stderr output is suppressed until the command fails.
+        const runGit = async function (command) {
+            let stdout = "";
+            let stderr = "";
+            command = [
+                `--git-dir=${repoGitDir}`,
+                `--work-tree=${repoPath}`,
+                ...command,
+            ];
+            console.log(`Running: git ${command.join(" ")}`);
+            try {
+                await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), command, {
+                    silent: true,
+                    listeners: {
+                        stdout: (data) => {
+                            stdout += data.toString();
+                        },
+                        stderr: (data) => {
+                            stderr += data.toString();
+                        },
+                    },
+                }).exec();
+            }
+            catch (e) {
+                console.log(`Command failed: git ${command.join(" ")}`);
+                process.stderr.write(stderr);
+                throw e;
+            }
+            return stdout.trim();
+        };
+        fs.mkdirSync(repoPath, { recursive: true });
+        await runGit(["init", repoPath]);
+        await runGit(["config", "user.email", "test@github.com"]);
+        await runGit(["config", "user.name", "Test Test"]);
+        await runGit(["config", "commit.gpgsign", "false"]);
+        fs.writeFileSync(path.join(repoPath, "a"), "a content");
+        await runGit(["add", "a"]);
+        await runGit(["commit", "-m", "commit1"]);
+        fs.writeFileSync(path.join(repoPath, "b"), "b content");
+        await runGit(["add", "b"]);
+        await runGit(["commit", "-m", "commit1"]);
+        const commit1Sha = await runGit(["rev-parse", "HEAD"]);
+        fs.unlinkSync(path.join(repoPath, "b"));
+        await runGit(["add", "b"]);
+        await runGit(["commit", "-m", "commit2"]);
+        const commit2Sha = await runGit(["rev-parse", "HEAD"]);
+        // Checkout the first commit, which should contain 'a' and 'b'
+        t.false(fs.existsSync(path.join(tmpDir, repoName)));
+        await externalQueries.checkoutExternalRepository(repoName, commit1Sha, {
+            url: `file://${testRepoBaseDir}`,
+            externalRepoAuth: "",
+            apiURL: undefined,
+        }, tmpDir, (0, logging_1.getRunnerLogger)(true));
+        t.true(fs.existsSync(path.join(tmpDir, repoName)));
+        t.true(fs.existsSync(path.join(tmpDir, repoName, commit1Sha)));
+        t.true(fs.existsSync(path.join(tmpDir, repoName, commit1Sha, "a")));
+        t.true(fs.existsSync(path.join(tmpDir, repoName, commit1Sha, "b")));
+        // Checkout the second commit as well, which should only contain 'a'
+        t.false(fs.existsSync(path.join(tmpDir, repoName, commit2Sha)));
+        await externalQueries.checkoutExternalRepository(repoName, commit2Sha, {
+            url: `file://${testRepoBaseDir}`,
+            externalRepoAuth: "",
+            apiURL: undefined,
+        }, tmpDir, (0, logging_1.getRunnerLogger)(true));
+        t.true(fs.existsSync(path.join(tmpDir, repoName, commit2Sha)));
+        t.true(fs.existsSync(path.join(tmpDir, repoName, commit2Sha, "a")));
+        t.false(fs.existsSync(path.join(tmpDir, repoName, commit2Sha, "b")));
+    });
+});
+(0, ava_1.default)("buildCheckoutURL", (t) => {
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.com",
+        externalRepoAuth: undefined,
+        apiURL: undefined,
+    }), "https://github.com/foo/bar");
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.example.com/",
+        externalRepoAuth: undefined,
+        apiURL: undefined,
+    }), "https://github.example.com/foo/bar");
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.com",
+        externalRepoAuth: "abc",
+        apiURL: undefined,
+    }), "https://x-access-token:abc@github.com/foo/bar");
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.example.com/",
+        externalRepoAuth: "abc",
+        apiURL: undefined,
+    }), "https://x-access-token:abc@github.example.com/foo/bar");
+});
+//# sourceMappingURL=external-queries.test.js.map

github/codeql-action-v1/lib/external-queries.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AACpD,8CAAuB;AAEvB,oEAAsD;AACtD,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,kDAAkD;QAClD,mFAAmF;QACnF,gDAAgD;QAChD,wCAAwC;QACxC,8EAA8E;QAC9E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE/C,oDAAoD;QACpD,oCAAoC;QACpC,2DAA2D;QAC3D,MAAM,MAAM,GAAG,KAAK,WAAW,OAAiB;YAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG;gBACR,aAAa,UAAU,EAAE;gBACzB,eAAe,QAAQ,EAAE;gBACzB,GAAG,OAAO;aACX,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI;gBACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAChC,OAAO,EACP;oBACE,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE;wBACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;wBACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;qBACF;iBACF,CACF,CAAC,IAAI,EAAE,CAAC;aACV;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,CAAC;aACT;YACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QAEF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAE1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,8DAA8D;QAC9D,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV;YACE,GAAG,EAAE,UAAU,eAAe,EAAE;YAChC,gBAAgB,EAAE,EAAE;YACpB,MAAM,EAAE,SAAS;SAClB,EACD,MAAM,EACN,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpE,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV;YACE,GAAG,EAAE,UAAU,eAAe,EAAE;YAChC,gBAAgB,EAAE,EAAE;YACpB,MAAM,EAAE,SAAS;SAClB,EACD,MAAM,EACN,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;IAC7B,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,oBAAoB;QACzB,gBAAgB,EAAE,SAAS;QAC3B,MAAM,EAAE,SAAS;KAClB,CAAC,EACF,4BAA4B,CAC7B,CAAC;IACF,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,6BAA6B;QAClC,gBAAgB,EAAE,SAAS;QAC3B,MAAM,EAAE,SAAS;KAClB,CAAC,EACF,oCAAoC,CACrC,CAAC;IAEF,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,oBAAoB;QACzB,gBAAgB,EAAE,KAAK;QACvB,MAAM,EAAE,SAAS;KAClB,CAAC,EACF,+CAA+C,CAChD,CAAC;IACF,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,6BAA6B;QAClC,gBAAgB,EAAE,KAAK;QACvB,MAAM,EAAE,SAAS;KAClB,CAAC,EACF,uDAAuD,CACxD,CAAC;AACJ,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/feature-flags.js

@@ -0,0 +1,216 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Features = exports.FEATURE_FLAGS_FILE_NAME = exports.featureConfig = exports.Feature = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const api_client_1 = require("./api-client");
+const util = __importStar(require("./util"));
+var Feature;
+(function (Feature) {
+    Feature["BypassToolcacheEnabled"] = "bypass_toolcache_enabled";
+    Feature["BypassToolcacheKotlinSwiftEnabled"] = "bypass_toolcache_kotlin_swift_enabled";
+    Feature["CliConfigFileEnabled"] = "cli_config_file_enabled";
+    Feature["DisableKotlinAnalysisEnabled"] = "disable_kotlin_analysis_enabled";
+    Feature["MlPoweredQueriesEnabled"] = "ml_powered_queries_enabled";
+    Feature["TrapCachingEnabled"] = "trap_caching_enabled";
+    Feature["UploadFailedSarifEnabled"] = "upload_failed_sarif_enabled";
+})(Feature = exports.Feature || (exports.Feature = {}));
+exports.featureConfig = {
+    [Feature.BypassToolcacheEnabled]: {
+        envVar: "CODEQL_BYPASS_TOOLCACHE",
+        // Cannot specify a minimum version because this flag is checked before we have
+        // access to the CodeQL instance.
+        minimumVersion: undefined,
+    },
+    [Feature.BypassToolcacheKotlinSwiftEnabled]: {
+        envVar: "CODEQL_BYPASS_TOOLCACHE_KOTLIN_SWIFT",
+        // Cannot specify a minimum version because this flag is checked before we have
+        // access to the CodeQL instance.
+        minimumVersion: undefined,
+    },
+    [Feature.DisableKotlinAnalysisEnabled]: {
+        envVar: "CODEQL_DISABLE_KOTLIN_ANALYSIS",
+        minimumVersion: undefined,
+    },
+    [Feature.CliConfigFileEnabled]: {
+        envVar: "CODEQL_PASS_CONFIG_TO_CLI",
+        minimumVersion: "2.11.6",
+    },
+    [Feature.MlPoweredQueriesEnabled]: {
+        envVar: "CODEQL_ML_POWERED_QUERIES",
+        minimumVersion: "2.7.5",
+    },
+    [Feature.TrapCachingEnabled]: {
+        envVar: "CODEQL_TRAP_CACHING",
+        minimumVersion: undefined,
+    },
+    [Feature.UploadFailedSarifEnabled]: {
+        envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
+        minimumVersion: "2.11.3",
+    },
+};
+exports.FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
+/**
+ * Determines the enablement status of a number of features.
+ * If feature enablement is not able to be determined locally, a request to the
+ * GitHub API is made to determine the enablement status.
+ */
+class Features {
+    constructor(gitHubVersion, repositoryNwo, tempDir, logger) {
+        this.gitHubFeatureFlags = new GitHubFeatureFlags(gitHubVersion, repositoryNwo, path.join(tempDir, exports.FEATURE_FLAGS_FILE_NAME), logger);
+    }
+    /**
+     *
+     * @param feature The feature to check.
+     * @param codeql An optional CodeQL object. If provided, and a `minimumVersion` is specified for the
+     *        feature, the version of the CodeQL CLI will be checked against the minimum version.
+     *        If the version is less than the minimum version, the feature will be considered
+     *        disabled. If not provided, and a `minimumVersion` is specified for the feature, the
+     *        this function will throw.
+     * @returns true if the feature is enabled, false otherwise.
+     *
+     * @throws if a `minimumVersion` is specified for the feature, and `codeql` is not provided.
+     */
+    async getValue(feature, codeql) {
+        if (!codeql && exports.featureConfig[feature].minimumVersion) {
+            throw new Error(`Internal error: A minimum version is specified for feature ${feature}, but no instance of CodeQL was provided.`);
+        }
+        // Bypassing the toolcache is disabled in test mode.
+        if (feature === Feature.BypassToolcacheEnabled && util.isInTestMode()) {
+            return false;
+        }
+        const envVar = (process.env[exports.featureConfig[feature].envVar] || "").toLocaleLowerCase();
+        // Do not use this feature if user explicitly disables it via an environment variable.
+        if (envVar === "false") {
+            return false;
+        }
+        // Never use this feature if the CLI version explicitly can't support it.
+        const minimumVersion = exports.featureConfig[feature].minimumVersion;
+        if (codeql && minimumVersion) {
+            if (!(await util.codeQlVersionAbove(codeql, minimumVersion))) {
+                return false;
+            }
+        }
+        // Use this feature if user explicitly enables it via an environment variable.
+        if (envVar === "true") {
+            return true;
+        }
+        // Ask the GitHub API if the feature is enabled.
+        return await this.gitHubFeatureFlags.getValue(feature);
+    }
+}
+exports.Features = Features;
+class GitHubFeatureFlags {
+    constructor(gitHubVersion, repositoryNwo, featureFlagsFile, logger) {
+        this.gitHubVersion = gitHubVersion;
+        this.repositoryNwo = repositoryNwo;
+        this.featureFlagsFile = featureFlagsFile;
+        this.logger = logger;
+        /**/
+    }
+    async getValue(feature) {
+        const response = await this.getAllFeatures();
+        if (response === undefined) {
+            this.logger.debug(`No feature flags API response for ${feature}, considering it disabled.`);
+            return false;
+        }
+        const featureEnablement = response[feature];
+        if (featureEnablement === undefined) {
+            this.logger.debug(`Feature '${feature}' undefined in API response, considering it disabled.`);
+            return false;
+        }
+        return !!featureEnablement;
+    }
+    async getAllFeatures() {
+        // if we have an in memory cache, use that
+        if (this.cachedApiResponse !== undefined) {
+            return this.cachedApiResponse;
+        }
+        // if a previous step has written a feature flags file to disk, use that
+        const fileFlags = await this.readLocalFlags();
+        if (fileFlags !== undefined) {
+            this.cachedApiResponse = fileFlags;
+            return fileFlags;
+        }
+        // if not, request flags from the server
+        let remoteFlags = await this.loadApiResponse();
+        if (remoteFlags === undefined) {
+            remoteFlags = {};
+        }
+        // cache the response in memory
+        this.cachedApiResponse = remoteFlags;
+        // and cache them to disk so future workflow steps can use them
+        await this.writeLocalFlags(remoteFlags);
+        return remoteFlags;
+    }
+    async readLocalFlags() {
+        try {
+            if (fs.existsSync(this.featureFlagsFile)) {
+                this.logger.debug(`Loading feature flags from ${this.featureFlagsFile}`);
+                return JSON.parse(fs.readFileSync(this.featureFlagsFile, "utf8"));
+            }
+        }
+        catch (e) {
+            this.logger.warning(`Error reading cached feature flags file ${this.featureFlagsFile}: ${e}. Requesting from GitHub instead.`);
+        }
+        return undefined;
+    }
+    async writeLocalFlags(flags) {
+        try {
+            this.logger.debug(`Writing feature flags to ${this.featureFlagsFile}`);
+            fs.writeFileSync(this.featureFlagsFile, JSON.stringify(flags));
+        }
+        catch (e) {
+            this.logger.warning(`Error writing cached feature flags file ${this.featureFlagsFile}: ${e}.`);
+        }
+    }
+    async loadApiResponse() {
+        // Do nothing when not running against github.com
+        if (this.gitHubVersion.type !== util.GitHubVariant.DOTCOM) {
+            this.logger.debug("Not running against github.com. Disabling all toggleable features.");
+            return {};
+        }
+        try {
+            const response = await (0, api_client_1.getApiClient)().request("GET /repos/:owner/:repo/code-scanning/codeql-action/features", {
+                owner: this.repositoryNwo.owner,
+                repo: this.repositoryNwo.repo,
+            });
+            return response.data;
+        }
+        catch (e) {
+            if (util.isHTTPError(e) && e.status === 403) {
+                this.logger.warning("This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. " +
+                    "As a result, it will not be opted into any experimental features. " +
+                    "This could be because the Action is running on a pull request from a fork. If not, " +
+                    `please ensure the Action has the 'security-events: write' permission. Details: ${e}`);
+            }
+            else {
+                // Some features, such as `ml_powered_queries_enabled` affect the produced alerts.
+                // Considering these features disabled in the event of a transient error could
+                // therefore lead to alert churn. As a result, we crash if we cannot determine the value of
+                // the feature.
+                throw new Error(`Encountered an error while trying to determine feature enablement: ${e}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=feature-flags.js.map

github/codeql-action-v1/lib/feature-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flags.js","sourceRoot":"","sources":["../src/feature-flags.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,6CAA4C;AAI5C,6CAA+B;AAM/B,IAAY,OAQX;AARD,WAAY,OAAO;IACjB,8DAAmD,CAAA;IACnD,sFAA2E,CAAA;IAC3E,2DAAgD,CAAA;IAChD,2EAAgE,CAAA;IAChE,iEAAsD,CAAA;IACtD,sDAA2C,CAAA;IAC3C,mEAAwD,CAAA;AAC1D,CAAC,EARW,OAAO,GAAP,eAAO,KAAP,eAAO,QAQlB;AAEY,QAAA,aAAa,GAGtB;IACF,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE;QAChC,MAAM,EAAE,yBAAyB;QACjC,+EAA+E;QAC/E,iCAAiC;QACjC,cAAc,EAAE,SAAS;KAC1B;IACD,CAAC,OAAO,CAAC,iCAAiC,CAAC,EAAE;QAC3C,MAAM,EAAE,sCAAsC;QAC9C,+EAA+E;QAC/E,iCAAiC;QACjC,cAAc,EAAE,SAAS;KAC1B;IACD,CAAC,OAAO,CAAC,4BAA4B,CAAC,EAAE;QACtC,MAAM,EAAE,gCAAgC;QACxC,cAAc,EAAE,SAAS;KAC1B;IACD,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE;QAC9B,MAAM,EAAE,2BAA2B;QACnC,cAAc,EAAE,QAAQ;KACzB;IACD,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE;QACjC,MAAM,EAAE,2BAA2B;QACnC,cAAc,EAAE,OAAO;KACxB;IACD,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE;QAC5B,MAAM,EAAE,qBAAqB;QAC7B,cAAc,EAAE,SAAS;KAC1B;IACD,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE;QAClC,MAAM,EAAE,mCAAmC;QAC3C,cAAc,EAAE,QAAQ;KACzB;CACF,CAAC;AAUW,QAAA,uBAAuB,GAAG,2BAA2B,CAAC;AAEnE;;;;GAIG;AACH,MAAa,QAAQ;IAGnB,YACE,aAAiC,EACjC,aAA4B,EAC5B,OAAe,EACf,MAAc;QAEd,IAAI,CAAC,kBAAkB,GAAG,IAAI,kBAAkB,CAC9C,aAAa,EACb,aAAa,EACb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,+BAAuB,CAAC,EAC3C,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAgB,EAAE,MAAe;QAC9C,IAAI,CAAC,MAAM,IAAI,qBAAa,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;YACpD,MAAM,IAAI,KAAK,CACb,8DAA8D,OAAO,2CAA2C,CACjH,CAAC;SACH;QAED,oDAAoD;QACpD,IAAI,OAAO,KAAK,OAAO,CAAC,sBAAsB,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE;YACrE,OAAO,KAAK,CAAC;SACd;QAED,MAAM,MAAM,GAAG,CACb,OAAO,CAAC,GAAG,CAAC,qBAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CACjD,CAAC,iBAAiB,EAAE,CAAC;QAEtB,sFAAsF;QACtF,IAAI,MAAM,KAAK,OAAO,EAAE;YACtB,OAAO,KAAK,CAAC;SACd;QAED,yEAAyE;QACzE,MAAM,cAAc,GAAG,qBAAa,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;QAC7D,IAAI,MAAM,IAAI,cAAc,EAAE;YAC5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE;gBAC5D,OAAO,KAAK,CAAC;aACd;SACF;QAED,8EAA8E;QAC9E,IAAI,MAAM,KAAK,MAAM,EAAE;YACrB,OAAO,IAAI,CAAC;SACb;QACD,gDAAgD;QAChD,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC;CACF;AAjED,4BAiEC;AAED,MAAM,kBAAkB;IAGtB,YACmB,aAAiC,EACjC,aAA4B,EAC5B,gBAAwB,EACxB,MAAc;QAHd,kBAAa,GAAb,aAAa,CAAoB;QACjC,kBAAa,GAAb,aAAa,CAAe;QAC5B,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,WAAM,GAAN,MAAM,CAAQ;QAE/B,IAAI;IACN,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qCAAqC,OAAO,4BAA4B,CACzE,CAAC;YACF,OAAO,KAAK,CAAC;SACd;QACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,iBAAiB,KAAK,SAAS,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,YAAY,OAAO,uDAAuD,CAC3E,CAAC;YACF,OAAO,KAAK,CAAC;SACd;QACD,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,0CAA0C;QAC1C,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE;YACxC,OAAO,IAAI,CAAC,iBAAiB,CAAC;SAC/B;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS,EAAE;YAC3B,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;YACnC,OAAO,SAAS,CAAC;SAClB;QAED,wCAAwC;QACxC,IAAI,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/C,IAAI,WAAW,KAAK,SAAS,EAAE;YAC7B,WAAW,GAAG,EAAE,CAAC;SAClB;QAED,+BAA+B;QAC/B,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;QAErC,+DAA+D;QAC/D,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAExC,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,cAAc;QAG1B,IAAI;YACF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE;gBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8BAA8B,IAAI,CAAC,gBAAgB,EAAE,CACtD,CAAC;gBACF,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;aACnE;SACF;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,2CAA2C,IAAI,CAAC,gBAAgB,KAAK,CAAC,mCAAmC,CAC1G,CAAC;SACH;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,KAAoC;QAEpC,IAAI;YACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACvE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;SAChE;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,2CAA2C,IAAI,CAAC,gBAAgB,KAAK,CAAC,GAAG,CAC1E,CAAC;SACH;IACH,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,iDAAiD;QACjD,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;YACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oEAAoE,CACrE,CAAC;YACF,OAAO,EAAE,CAAC;SACX;QACD,IAAI;YACF,MAAM,QAAQ,GAAG,MAAM,IAAA,yBAAY,GAAE,CAAC,OAAO,CAC3C,8DAA8D,EAC9D;gBACE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK;gBAC/B,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI;aAC9B,CACF,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAAC;SACtB;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE;gBAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,gGAAgG;oBAC9F,oEAAoE;oBACpE,qFAAqF;oBACrF,kFAAkF,CAAC,EAAE,CACxF,CAAC;aACH;iBAAM;gBACL,kFAAkF;gBAClF,8EAA8E;gBAC9E,2FAA2F;gBAC3F,eAAe;gBACf,MAAM,IAAI,KAAK,CACb,sEAAsE,CAAC,EAAE,CAC1E,CAAC;aACH;SACF;IACH,CAAC;CACF"}

github/codeql-action-v1/lib/feature-flags.test.js

@@ -0,0 +1,233 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const ava_1 = __importDefault(require("ava"));
+const feature_flags_1 = require("./feature-flags");
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
+const testing_utils_1 = require("./testing-utils");
+const util_1 = require("./util");
+(0, testing_utils_1.setupTests)(ava_1.default);
+ava_1.default.beforeEach(() => {
+    (0, util_1.initializeEnvironment)("1.2.3");
+});
+const testRepositoryNwo = (0, repository_1.parseRepositoryNwo)("github/example");
+const ALL_FEATURES_DISABLED_VARIANTS = [
+    {
+        description: "GHES",
+        gitHubVersion: { type: util_1.GitHubVariant.GHES, version: "3.0.0" },
+    },
+    { description: "GHAE", gitHubVersion: { type: util_1.GitHubVariant.GHAE } },
+];
+for (const variant of ALL_FEATURES_DISABLED_VARIANTS) {
+    (0, ava_1.default)(`All features are disabled if running against ${variant.description}`, async (t) => {
+        await (0, util_1.withTmpDir)(async (tmpDir) => {
+            const loggedMessages = [];
+            const featureEnablement = setUpFeatureFlagTests(tmpDir, (0, testing_utils_1.getRecordingLogger)(loggedMessages), variant.gitHubVersion);
+            for (const feature of Object.values(feature_flags_1.Feature)) {
+                t.false(await featureEnablement.getValue(feature, includeCodeQlIfRequired(feature)));
+            }
+            t.assert(loggedMessages.find((v) => v.type === "debug" &&
+                v.message ===
+                    "Not running against github.com. Disabling all toggleable features.") !== undefined);
+        });
+    });
+}
+(0, ava_1.default)("API response missing", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        const loggedMessages = [];
+        const featureEnablement = setUpFeatureFlagTests(tmpDir, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(403, {});
+        for (const feature of Object.values(feature_flags_1.Feature)) {
+            t.assert((await featureEnablement.getValue(feature, includeCodeQlIfRequired(feature))) === false);
+        }
+        assertAllFeaturesUndefinedInApi(t, loggedMessages);
+    });
+});
+(0, ava_1.default)("Features are disabled if they're not returned in API response", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        const loggedMessages = [];
+        const featureEnablement = setUpFeatureFlagTests(tmpDir, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {});
+        for (const feature of Object.values(feature_flags_1.Feature)) {
+            t.assert((await featureEnablement.getValue(feature, includeCodeQlIfRequired(feature))) === false);
+        }
+        assertAllFeaturesUndefinedInApi(t, loggedMessages);
+    });
+});
+(0, ava_1.default)("Feature flags exception is propagated if the API request errors", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        const featureEnablement = setUpFeatureFlagTests(tmpDir);
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(500, {});
+        await t.throwsAsync(async () => featureEnablement.getValue(feature_flags_1.Feature.MlPoweredQueriesEnabled, includeCodeQlIfRequired(feature_flags_1.Feature.MlPoweredQueriesEnabled)), {
+            message: "Encountered an error while trying to determine feature enablement: Error: some error message",
+        });
+    });
+});
+for (const feature of Object.keys(feature_flags_1.featureConfig)) {
+    (0, ava_1.default)(`Only feature '${feature}' is enabled if enabled in the API response. Other features disabled`, async (t) => {
+        await (0, util_1.withTmpDir)(async (tmpDir) => {
+            const featureEnablement = setUpFeatureFlagTests(tmpDir);
+            // set all features to false except the one we're testing
+            const expectedFeatureEnablement = {};
+            for (const f of Object.keys(feature_flags_1.featureConfig)) {
+                expectedFeatureEnablement[f] = f === feature;
+            }
+            (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
+            // retrieve the values of the actual features
+            const actualFeatureEnablement = {};
+            for (const f of Object.keys(feature_flags_1.featureConfig)) {
+                actualFeatureEnablement[f] = await featureEnablement.getValue(f, includeCodeQlIfRequired(f));
+            }
+            // All features should be false except the one we're testing
+            t.deepEqual(actualFeatureEnablement, expectedFeatureEnablement);
+        });
+    });
+    (0, ava_1.default)(`Only feature '${feature}' is enabled if the associated environment variable is true. Others disabled.`, async (t) => {
+        await (0, util_1.withTmpDir)(async (tmpDir) => {
+            const featureEnablement = setUpFeatureFlagTests(tmpDir);
+            const expectedFeatureEnablement = initializeFeatures(false);
+            (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
+            // feature should be disabled initially
+            t.assert(!(await featureEnablement.getValue(feature, includeCodeQlIfRequired(feature))));
+            // set env var to true and check that the feature is now enabled
+            process.env[feature_flags_1.featureConfig[feature].envVar] = "true";
+            t.assert(await featureEnablement.getValue(feature, includeCodeQlIfRequired(feature)));
+        });
+    });
+    (0, ava_1.default)(`Feature '${feature}' is disabled if the associated environment variable is false, even if enabled in API`, async (t) => {
+        await (0, util_1.withTmpDir)(async (tmpDir) => {
+            const featureEnablement = setUpFeatureFlagTests(tmpDir);
+            const expectedFeatureEnablement = initializeFeatures(true);
+            (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
+            // feature should be enabled initially
+            t.assert(await featureEnablement.getValue(feature, includeCodeQlIfRequired(feature)));
+            // set env var to false and check that the feature is now disabled
+            process.env[feature_flags_1.featureConfig[feature].envVar] = "false";
+            t.assert(!(await featureEnablement.getValue(feature, includeCodeQlIfRequired(feature))));
+        });
+    });
+    if (feature_flags_1.featureConfig[feature].minimumVersion !== undefined) {
+        (0, ava_1.default)(`Getting feature '${feature} should throw if no codeql is provided`, async (t) => {
+            await (0, util_1.withTmpDir)(async (tmpDir) => {
+                const featureEnablement = setUpFeatureFlagTests(tmpDir);
+                const expectedFeatureEnablement = initializeFeatures(true);
+                (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
+                await t.throwsAsync(async () => featureEnablement.getValue(feature), {
+                    message: `Internal error: A minimum version is specified for feature ${feature}, but no instance of CodeQL was provided.`,
+                });
+            });
+        });
+    }
+    if (feature_flags_1.featureConfig[feature].minimumVersion !== undefined) {
+        (0, ava_1.default)(`Feature '${feature}' is disabled if the minimum CLI version is below ${feature_flags_1.featureConfig[feature].minimumVersion}`, async (t) => {
+            await (0, util_1.withTmpDir)(async (tmpDir) => {
+                const featureEnablement = setUpFeatureFlagTests(tmpDir);
+                const expectedFeatureEnablement = initializeFeatures(true);
+                (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
+                // feature should be disabled when an old CLI version is set
+                let codeql = (0, testing_utils_1.mockCodeQLVersion)("2.0.0");
+                t.assert(!(await featureEnablement.getValue(feature, codeql)));
+                // even setting the env var to true should not enable the feature if
+                // the minimum CLI version is not met
+                process.env[feature_flags_1.featureConfig[feature].envVar] = "true";
+                t.assert(!(await featureEnablement.getValue(feature, codeql)));
+                // feature should be enabled when a new CLI version is set
+                // and env var is not set
+                process.env[feature_flags_1.featureConfig[feature].envVar] = "";
+                codeql = (0, testing_utils_1.mockCodeQLVersion)(feature_flags_1.featureConfig[feature].minimumVersion);
+                t.assert(await featureEnablement.getValue(feature, codeql));
+                // set env var to false and check that the feature is now disabled
+                process.env[feature_flags_1.featureConfig[feature].envVar] = "false";
+                t.assert(!(await featureEnablement.getValue(feature, codeql)));
+            });
+        });
+    }
+}
+// If we ever run into a situation where we no longer have any features that
+// specify a minimum version, then we will have a bunch of code no longer being
+// tested. This is unlikely, and this test will fail if that happens.
+// If we do end up in that situation, then we should consider adding a synthetic
+// feature with a minimum version that is only used for tests.
+(0, ava_1.default)("At least one feature has a minimum version specified", (t) => {
+    t.assert(Object.values(feature_flags_1.featureConfig).some((f) => f.minimumVersion !== undefined), "At least one feature should have a minimum version specified");
+    // An even less likely scenario is that we no longer have any features.
+    t.assert(Object.values(feature_flags_1.featureConfig).length > 0, "There should be at least one feature");
+});
+(0, ava_1.default)("Feature flags are saved to disk", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        const featureEnablement = setUpFeatureFlagTests(tmpDir);
+        const expectedFeatureEnablement = initializeFeatures(true);
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
+        const cachedFeatureFlags = path.join(tmpDir, feature_flags_1.FEATURE_FLAGS_FILE_NAME);
+        t.false(fs.existsSync(cachedFeatureFlags), "Feature flag cached file should not exist before getting feature flags");
+        t.true(await featureEnablement.getValue(feature_flags_1.Feature.CliConfigFileEnabled, includeCodeQlIfRequired(feature_flags_1.Feature.CliConfigFileEnabled)), "Feature flag should be enabled initially");
+        t.true(fs.existsSync(cachedFeatureFlags), "Feature flag cached file should exist after getting feature flags");
+        const actualFeatureEnablement = JSON.parse(fs.readFileSync(cachedFeatureFlags, "utf8"));
+        t.deepEqual(actualFeatureEnablement, expectedFeatureEnablement);
+        // now test that we actually use the feature flag cache instead of the server
+        actualFeatureEnablement[feature_flags_1.Feature.CliConfigFileEnabled] = false;
+        fs.writeFileSync(cachedFeatureFlags, JSON.stringify(actualFeatureEnablement));
+        // delete the in memory cache so that we are forced to use the cached file
+        featureEnablement.gitHubFeatureFlags.cachedApiResponse = undefined;
+        t.false(await featureEnablement.getValue(feature_flags_1.Feature.CliConfigFileEnabled, includeCodeQlIfRequired(feature_flags_1.Feature.CliConfigFileEnabled)), "Feature flag should be enabled after reading from cached file");
+    });
+});
+(0, ava_1.default)("Environment variable can override feature flag cache", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        const featureEnablement = setUpFeatureFlagTests(tmpDir);
+        const expectedFeatureEnablement = initializeFeatures(true);
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
+        const cachedFeatureFlags = path.join(tmpDir, feature_flags_1.FEATURE_FLAGS_FILE_NAME);
+        t.true(await featureEnablement.getValue(feature_flags_1.Feature.CliConfigFileEnabled, includeCodeQlIfRequired(feature_flags_1.Feature.CliConfigFileEnabled)), "Feature flag should be enabled initially");
+        t.true(fs.existsSync(cachedFeatureFlags), "Feature flag cached file should exist after getting feature flags");
+        process.env.CODEQL_PASS_CONFIG_TO_CLI = "false";
+        t.false(await featureEnablement.getValue(feature_flags_1.Feature.CliConfigFileEnabled, includeCodeQlIfRequired(feature_flags_1.Feature.CliConfigFileEnabled)), "Feature flag should be disabled after setting env var");
+    });
+});
+function assertAllFeaturesUndefinedInApi(t, loggedMessages) {
+    for (const feature of Object.keys(feature_flags_1.featureConfig)) {
+        t.assert(loggedMessages.find((v) => v.type === "debug" &&
+            v.message.includes(feature) &&
+            v.message.includes("considering it disabled")) !== undefined);
+    }
+}
+function initializeFeatures(initialValue) {
+    return Object.keys(feature_flags_1.featureConfig).reduce((features, key) => {
+        features[key] = initialValue;
+        return features;
+    }, {});
+}
+function setUpFeatureFlagTests(tmpDir, logger = (0, logging_1.getRunnerLogger)(true), gitHubVersion = { type: util_1.GitHubVariant.DOTCOM }) {
+    (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+    return new feature_flags_1.Features(gitHubVersion, testRepositoryNwo, tmpDir, logger);
+}
+function includeCodeQlIfRequired(feature) {
+    return feature_flags_1.featureConfig[feature].minimumVersion !== undefined
+        ? (0, testing_utils_1.mockCodeQLVersion)("9.9.9")
+        : undefined;
+}
+//# sourceMappingURL=feature-flags.test.js.map

github/codeql-action-v1/lib/fingerprints.js

@@ -0,0 +1,272 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addFingerprints = exports.resolveUriToFile = exports.hash = void 0;
+const fs = __importStar(require("fs"));
+const path_1 = __importDefault(require("path"));
+const long_1 = __importDefault(require("long"));
+const tab = "\t".charCodeAt(0);
+const space = " ".charCodeAt(0);
+const lf = "\n".charCodeAt(0);
+const cr = "\r".charCodeAt(0);
+const EOF = 65535;
+const BLOCK_SIZE = 100;
+const MOD = long_1.default.fromInt(37); // L
+// Compute the starting point for the hash mod
+function computeFirstMod() {
+    let firstMod = long_1.default.ONE; // L
+    for (let i = 0; i < BLOCK_SIZE; i++) {
+        firstMod = firstMod.multiply(MOD);
+    }
+    return firstMod;
+}
+/**
+ * Hash the contents of a file
+ *
+ * The hash method computes a rolling hash for every line in the input. The hash is computed using the first
+ * BLOCK_SIZE non-space/tab characters counted from the start of the line. For the computation of the hash all
+ * line endings (i.e. \r, \n, and \r\n) are normalized to '\n'. A special value (-1) is added at the end of the
+ * file followed by enough '\0' characters to ensure that there are BLOCK_SIZE characters available for computing
+ * the hashes of the lines near the end of the file.
+ *
+ * @param callback function that is called with the line number (1-based) and hash for every line
+ * @param filepath The path to the file to hash
+ */
+async function hash(callback, filepath) {
+    // A rolling view in to the input
+    const window = Array(BLOCK_SIZE).fill(0);
+    // If the character in the window is the start of a new line
+    // then records the line number, otherwise will be -1.
+    // Indexes match up with those from the window variable.
+    const lineNumbers = Array(BLOCK_SIZE).fill(-1);
+    // The current hash value, updated as we read each character
+    let hashRaw = long_1.default.ZERO;
+    const firstMod = computeFirstMod();
+    // The current index in the window, will wrap around to zero when we reach BLOCK_SIZE
+    let index = 0;
+    // The line number of the character we are currently processing from the input
+    let lineNumber = 0;
+    // Is the next character to be read the start of a new line
+    let lineStart = true;
+    // Was the previous character a CR (carriage return)
+    let prevCR = false;
+    // A map of hashes we've seen before and how many times,
+    // so we can disambiguate identical hashes
+    const hashCounts = {};
+    // Output the current hash and line number to the callback function
+    const outputHash = function () {
+        const hashValue = hashRaw.toUnsigned().toString(16);
+        if (!hashCounts[hashValue]) {
+            hashCounts[hashValue] = 0;
+        }
+        hashCounts[hashValue]++;
+        callback(lineNumbers[index], `${hashValue}:${hashCounts[hashValue]}`);
+        lineNumbers[index] = -1;
+    };
+    // Update the current hash value and increment the index in the window
+    const updateHash = function (current) {
+        const begin = window[index];
+        window[index] = current;
+        hashRaw = MOD.multiply(hashRaw)
+            .add(long_1.default.fromInt(current))
+            .subtract(firstMod.multiply(long_1.default.fromInt(begin)));
+        index = (index + 1) % BLOCK_SIZE;
+    };
+    // First process every character in the input, updating the hash and lineNumbers
+    // as we go. Once we reach a point in the window again then we've processed
+    // BLOCK_SIZE characters and if the last character at this point in the window
+    // was the start of a line then we should output the hash for that line.
+    const processCharacter = function (current) {
+        // skip tabs, spaces, and line feeds that come directly after a carriage return
+        if (current === space || current === tab || (prevCR && current === lf)) {
+            prevCR = false;
+            return;
+        }
+        // replace CR with LF
+        if (current === cr) {
+            current = lf;
+            prevCR = true;
+        }
+        else {
+            prevCR = false;
+        }
+        if (lineNumbers[index] !== -1) {
+            outputHash();
+        }
+        if (lineStart) {
+            lineStart = false;
+            lineNumber++;
+            lineNumbers[index] = lineNumber;
+        }
+        if (current === lf) {
+            lineStart = true;
+        }
+        updateHash(current);
+    };
+    const readStream = fs.createReadStream(filepath, "utf8");
+    for await (const data of readStream) {
+        for (let i = 0; i < data.length; ++i) {
+            processCharacter(data.charCodeAt(i));
+        }
+    }
+    processCharacter(EOF);
+    // Flush the remaining lines
+    for (let i = 0; i < BLOCK_SIZE; i++) {
+        if (lineNumbers[index] !== -1) {
+            outputHash();
+        }
+        updateHash(0);
+    }
+}
+exports.hash = hash;
+// Generate a hash callback function that updates the given result in-place
+// when it receives a hash for the correct line number. Ignores hashes for other lines.
+function locationUpdateCallback(result, location, logger) {
+    var _a, _b;
+    let locationStartLine = (_b = (_a = location.physicalLocation) === null || _a === void 0 ? void 0 : _a.region) === null || _b === void 0 ? void 0 : _b.startLine;
+    if (locationStartLine === undefined) {
+        // We expect the region section to be present, but it can be absent if the
+        // alert pertains to the entire file. In this case, we compute the fingerprint
+        // using the hash of the first line of the file.
+        locationStartLine = 1;
+    }
+    return function (lineNumber, hashValue) {
+        // Ignore hashes for lines that don't concern us
+        if (locationStartLine !== lineNumber) {
+            return;
+        }
+        if (!result.partialFingerprints) {
+            result.partialFingerprints = {};
+        }
+        const existingFingerprint = result.partialFingerprints.primaryLocationLineHash;
+        // If the hash doesn't match the existing fingerprint then
+        // output a warning and don't overwrite it.
+        if (!existingFingerprint) {
+            result.partialFingerprints.primaryLocationLineHash = hashValue;
+        }
+        else if (existingFingerprint !== hashValue) {
+            logger.warning(`Calculated fingerprint of ${hashValue} for file ${location.physicalLocation.artifactLocation.uri} line ${lineNumber}, but found existing inconsistent fingerprint value ${existingFingerprint}`);
+        }
+    };
+}
+// Can we fingerprint the given location. This requires access to
+// the source file so we can hash it.
+// If possible returns a absolute file path for the source file,
+// or if not possible then returns undefined.
+function resolveUriToFile(location, artifacts, sourceRoot, logger) {
+    // This may be referencing an artifact
+    if (!location.uri && location.index !== undefined) {
+        if (typeof location.index !== "number" ||
+            location.index < 0 ||
+            location.index >= artifacts.length ||
+            typeof artifacts[location.index].location !== "object") {
+            logger.debug(`Ignoring location as index "${location.index}" is invalid`);
+            return undefined;
+        }
+        location = artifacts[location.index].location;
+    }
+    // Get the URI and decode
+    if (typeof location.uri !== "string") {
+        logger.debug(`Ignoring location as URI "${location.uri}" is invalid`);
+        return undefined;
+    }
+    let uri = decodeURIComponent(location.uri);
+    // Remove a file scheme, and abort if the scheme is anything else
+    const fileUriPrefix = "file://";
+    if (uri.startsWith(fileUriPrefix)) {
+        uri = uri.substring(fileUriPrefix.length);
+    }
+    if (uri.indexOf("://") !== -1) {
+        logger.debug(`Ignoring location URI "${uri}" as the scheme is not recognised`);
+        return undefined;
+    }
+    // Discard any absolute paths that aren't in the src root
+    const srcRootPrefix = `${sourceRoot}/`;
+    if (uri.startsWith("/") && !uri.startsWith(srcRootPrefix)) {
+        logger.debug(`Ignoring location URI "${uri}" as it is outside of the src root`);
+        return undefined;
+    }
+    // Just assume a relative path is relative to the src root.
+    // This is not necessarily true but should be a good approximation
+    // and here we likely want to err on the side of handling more cases.
+    if (!path_1.default.isAbsolute(uri)) {
+        uri = srcRootPrefix + uri;
+    }
+    // Check the file exists
+    if (!fs.existsSync(uri)) {
+        logger.debug(`Unable to compute fingerprint for non-existent file: ${uri}`);
+        return undefined;
+    }
+    if (fs.statSync(uri).isDirectory()) {
+        logger.debug(`Unable to compute fingerprint for directory: ${uri}`);
+        return undefined;
+    }
+    return uri;
+}
+exports.resolveUriToFile = resolveUriToFile;
+// Compute fingerprints for results in the given sarif file
+// and return an updated sarif file contents.
+async function addFingerprints(sarif, sourceRoot, logger) {
+    var _a, _b, _c;
+    // Gather together results for the same file and construct
+    // callbacks to accept hashes for that file and update the location
+    const callbacksByFile = {};
+    for (const run of sarif.runs || []) {
+        // We may need the list of artifacts to resolve against
+        const artifacts = run.artifacts || [];
+        for (const result of run.results || []) {
+            // Check the primary location is defined correctly and is in the src root
+            const primaryLocation = (result.locations || [])[0];
+            if (!((_a = primaryLocation === null || primaryLocation === void 0 ? void 0 : primaryLocation.physicalLocation) === null || _a === void 0 ? void 0 : _a.artifactLocation)) {
+                logger.debug(`Unable to compute fingerprint for invalid location: ${JSON.stringify(primaryLocation)}`);
+                continue;
+            }
+            if (((_c = (_b = primaryLocation === null || primaryLocation === void 0 ? void 0 : primaryLocation.physicalLocation) === null || _b === void 0 ? void 0 : _b.region) === null || _c === void 0 ? void 0 : _c.startLine) === undefined) {
+                // Locations without a line number are unlikely to be source files
+                continue;
+            }
+            const filepath = resolveUriToFile(primaryLocation.physicalLocation.artifactLocation, artifacts, sourceRoot, logger);
+            if (!filepath) {
+                continue;
+            }
+            if (!callbacksByFile[filepath]) {
+                callbacksByFile[filepath] = [];
+            }
+            callbacksByFile[filepath].push(locationUpdateCallback(result, primaryLocation, logger));
+        }
+    }
+    // Now hash each file that was found
+    for (const [filepath, callbacks] of Object.entries(callbacksByFile)) {
+        // A callback that forwards the hash to all other callbacks for that file
+        const teeCallback = function (lineNumber, hashValue) {
+            for (const c of Object.values(callbacks)) {
+                c(lineNumber, hashValue);
+            }
+        };
+        await hash(teeCallback, filepath);
+    }
+    return sarif;
+}
+exports.addFingerprints = addFingerprints;
+//# sourceMappingURL=fingerprints.js.map

github/codeql-action-v1/lib/fingerprints.test.js

@@ -0,0 +1,196 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const ava_1 = __importDefault(require("ava"));
+const fingerprints = __importStar(require("./fingerprints"));
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+async function testHash(t, input, expectedHashes) {
+    await util.withTmpDir(async (tmpDir) => {
+        const tmpFile = path.resolve(tmpDir, "testfile");
+        fs.writeFileSync(tmpFile, input);
+        let index = 0;
+        const callback = function (lineNumber, hash) {
+            t.is(lineNumber, index + 1);
+            t.is(hash, expectedHashes[index]);
+            index++;
+        };
+        await fingerprints.hash(callback, tmpFile);
+        t.is(index, input.split(/\r\n|\r|\n/).length);
+    });
+}
+(0, ava_1.default)("hash", async (t) => {
+    // Try empty file
+    await testHash(t, "", ["c129715d7a2bc9a3:1"]);
+    // Try various combinations of newline characters
+    await testHash(t, " a\nb\n  \t\tc\n d", [
+        "271789c17abda88f:1",
+        "54703d4cd895b18:1",
+        "180aee12dab6264:1",
+        "a23a3dc5e078b07b:1",
+    ]);
+    await testHash(t, " hello; \t\nworld!!!\n\n\n  \t\tGreetings\n End", [
+        "8b7cf3e952e7aeb2:1",
+        "b1ae1287ec4718d9:1",
+        "bff680108adb0fcc:1",
+        "c6805c5e1288b612:1",
+        "b86d3392aea1be30:1",
+        "e6ceba753e1a442:1",
+    ]);
+    await testHash(t, " hello; \t\nworld!!!\n\n\n  \t\tGreetings\n End\n", [
+        "e9496ae3ebfced30:1",
+        "fb7c023a8b9ccb3f:1",
+        "ce8ba1a563dcdaca:1",
+        "e20e36e16fcb0cc8:1",
+        "b3edc88f2938467e:1",
+        "c8e28b0b4002a3a0:1",
+        "c129715d7a2bc9a3:1",
+    ]);
+    await testHash(t, " hello; \t\nworld!!!\r\r\r  \t\tGreetings\r End\r", [
+        "e9496ae3ebfced30:1",
+        "fb7c023a8b9ccb3f:1",
+        "ce8ba1a563dcdaca:1",
+        "e20e36e16fcb0cc8:1",
+        "b3edc88f2938467e:1",
+        "c8e28b0b4002a3a0:1",
+        "c129715d7a2bc9a3:1",
+    ]);
+    await testHash(t, " hello; \t\r\nworld!!!\r\n\r\n\r\n  \t\tGreetings\r\n End\r\n", [
+        "e9496ae3ebfced30:1",
+        "fb7c023a8b9ccb3f:1",
+        "ce8ba1a563dcdaca:1",
+        "e20e36e16fcb0cc8:1",
+        "b3edc88f2938467e:1",
+        "c8e28b0b4002a3a0:1",
+        "c129715d7a2bc9a3:1",
+    ]);
+    await testHash(t, " hello; \t\nworld!!!\r\n\n\r  \t\tGreetings\r End\r\n", [
+        "e9496ae3ebfced30:1",
+        "fb7c023a8b9ccb3f:1",
+        "ce8ba1a563dcdaca:1",
+        "e20e36e16fcb0cc8:1",
+        "b3edc88f2938467e:1",
+        "c8e28b0b4002a3a0:1",
+        "c129715d7a2bc9a3:1",
+    ]);
+    // Try repeating line that will generate identical hashes
+    await testHash(t, "Lorem ipsum dolor sit amet.\n".repeat(10), [
+        "a7f2ff13bc495cf2:1",
+        "a7f2ff13bc495cf2:2",
+        "a7f2ff13bc495cf2:3",
+        "a7f2ff13bc495cf2:4",
+        "a7f2ff13bc495cf2:5",
+        "a7f2ff13bc495cf2:6",
+        "a7f2ff1481e87703:1",
+        "a9cf91f7bbf1862b:1",
+        "55ec222b86bcae53:1",
+        "cc97dc7b1d7d8f7b:1",
+        "c129715d7a2bc9a3:1",
+    ]);
+    await testHash(t, "x = 2\nx = 1\nprint(x)\nx = 3\nprint(x)\nx = 4\nprint(x)\n", [
+        "e54938cc54b302f1:1",
+        "bb609acbe9138d60:1",
+        "1131fd5871777f34:1",
+        "5c482a0f8b35ea28:1",
+        "54517377da7028d2:1",
+        "2c644846cb18d53e:1",
+        "f1b89f20de0d133:1",
+        "c129715d7a2bc9a3:1",
+    ]);
+});
+function testResolveUriToFile(uri, index, artifactsURIs) {
+    const location = { uri, index };
+    const artifacts = artifactsURIs.map((artifactURI) => ({
+        location: { uri: artifactURI },
+    }));
+    return fingerprints.resolveUriToFile(location, artifacts, process.cwd(), (0, logging_1.getRunnerLogger)(true));
+}
+(0, ava_1.default)("resolveUriToFile", (t) => {
+    var _a, _b;
+    // The resolveUriToFile method checks that the file exists and is in the right directory
+    // so we need to give it real files to look at. We will use this file as an example.
+    // For this to work we require the current working directory to be a parent, but this
+    // should generally always be the case so this is fine.
+    const filepath = __filename.split(path.sep).join("/");
+    const relativeFilepath = path
+        .relative(process.cwd(), __filename)
+        .split(path.sep)
+        .join("/");
+    // Absolute paths are unmodified
+    t.is(testResolveUriToFile(filepath, undefined, []), filepath);
+    t.is(testResolveUriToFile(`file://${filepath}`, undefined, []), filepath);
+    // Relative paths are made absolute
+    t.is((_a = testResolveUriToFile(relativeFilepath, undefined, [])) === null || _a === void 0 ? void 0 : _a.split(path.sep).join("/"), filepath);
+    t.is((_b = testResolveUriToFile(`file://${relativeFilepath}`, undefined, [])) === null || _b === void 0 ? void 0 : _b.split(path.sep).join("/"), filepath);
+    // Absolute paths outside the src root are discarded
+    t.is(testResolveUriToFile("/src/foo/bar.js", undefined, []), undefined);
+    t.is(testResolveUriToFile("file:///src/foo/bar.js", undefined, []), undefined);
+    // Other schemes are discarded
+    t.is(testResolveUriToFile(`https://${filepath}`, undefined, []), undefined);
+    t.is(testResolveUriToFile(`ftp://${filepath}`, undefined, []), undefined);
+    // Invalid URIs are discarded
+    t.is(testResolveUriToFile(1, undefined, []), undefined);
+    t.is(testResolveUriToFile(undefined, undefined, []), undefined);
+    // Non-existent files are discarded
+    t.is(testResolveUriToFile(`${filepath}2`, undefined, []), undefined);
+    // Index is resolved
+    t.is(testResolveUriToFile(undefined, 0, [filepath]), filepath);
+    t.is(testResolveUriToFile(undefined, 1, ["foo", filepath]), filepath);
+    // Invalid indexes are discarded
+    t.is(testResolveUriToFile(undefined, 1, [filepath]), undefined);
+    t.is(testResolveUriToFile(undefined, "0", [filepath]), undefined);
+    // Directories are discarded
+    const dirpath = __dirname;
+    t.is(testResolveUriToFile(dirpath, undefined, []), undefined);
+    t.is(testResolveUriToFile(`file://${dirpath}`, undefined, []), undefined);
+});
+(0, ava_1.default)("addFingerprints", async (t) => {
+    // Run an end-to-end test on a test file
+    const input = JSON.parse(fs
+        .readFileSync(`${__dirname}/../src/testdata/fingerprinting.input.sarif`)
+        .toString());
+    const expected = JSON.parse(fs
+        .readFileSync(`${__dirname}/../src/testdata/fingerprinting.expected.sarif`)
+        .toString());
+    // The URIs in the SARIF files resolve to files in the testdata directory
+    const sourceRoot = path.normalize(`${__dirname}/../src/testdata`);
+    t.deepEqual(await fingerprints.addFingerprints(input, sourceRoot, (0, logging_1.getRunnerLogger)(true)), expected);
+});
+(0, ava_1.default)("missingRegions", async (t) => {
+    // Run an end-to-end test on a test file
+    const input = JSON.parse(fs
+        .readFileSync(`${__dirname}/../src/testdata/fingerprinting2.input.sarif`)
+        .toString());
+    const expected = JSON.parse(fs
+        .readFileSync(`${__dirname}/../src/testdata/fingerprinting2.expected.sarif`)
+        .toString());
+    // The URIs in the SARIF files resolve to files in the testdata directory
+    const sourceRoot = path.normalize(`${__dirname}/../src/testdata`);
+    t.deepEqual(await fingerprints.addFingerprints(input, sourceRoot, (0, logging_1.getRunnerLogger)(true)), expected);
+});
+//# sourceMappingURL=fingerprints.test.js.map

github/codeql-action-v1/lib/init-action-post-helper.js

@@ -0,0 +1,112 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = exports.tryUploadSarifIfRunFailed = void 0;
+const core = __importStar(require("@actions/core"));
+const actionsUtil = __importStar(require("./actions-util"));
+const codeql_1 = require("./codeql");
+const config_utils_1 = require("./config-utils");
+const feature_flags_1 = require("./feature-flags");
+const shared_environment_1 = require("./shared-environment");
+const uploadLib = __importStar(require("./upload-lib"));
+const util_1 = require("./util");
+const workflow_1 = require("./workflow");
+function createFailedUploadFailedSarifResult(error) {
+    return {
+        upload_failed_run_error: error instanceof Error ? error.message : String(error),
+        upload_failed_run_stack_trace: error instanceof Error ? error.stack : undefined,
+    };
+}
+/**
+ * Upload a failed SARIF file if we can verify that SARIF upload is enabled and determine the SARIF
+ * category for the workflow.
+ */
+async function maybeUploadFailedSarif(config, repositoryNwo, featureEnablement, logger) {
+    var _a;
+    if (!config.codeQLCmd) {
+        return { upload_failed_run_skipped_because: "CodeQL command not found" };
+    }
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    if (!(await featureEnablement.getValue(feature_flags_1.Feature.UploadFailedSarifEnabled, codeql))) {
+        return { upload_failed_run_skipped_because: "Feature disabled" };
+    }
+    const workflow = await (0, workflow_1.getWorkflow)();
+    const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");
+    const matrix = (0, util_1.parseMatrixInput)(actionsUtil.getRequiredInput("matrix"));
+    if ((0, workflow_1.getUploadInputOrThrow)(workflow, jobName, matrix) !== "true" ||
+        (0, util_1.isInTestMode)()) {
+        return { upload_failed_run_skipped_because: "SARIF upload is disabled" };
+    }
+    const category = (0, workflow_1.getCategoryInputOrThrow)(workflow, jobName, matrix);
+    const checkoutPath = (0, workflow_1.getCheckoutPathInputOrThrow)(workflow, jobName, matrix);
+    const sarifFile = "../codeql-failed-run.sarif";
+    await codeql.diagnosticsExport(sarifFile, category);
+    core.info(`Uploading failed SARIF file ${sarifFile}`);
+    const uploadResult = await uploadLib.uploadFromActions(sarifFile, checkoutPath, category, logger);
+    await uploadLib.waitForProcessing(repositoryNwo, uploadResult.sarifID, logger, { isUnsuccessfulExecution: true });
+    return (_a = uploadResult === null || uploadResult === void 0 ? void 0 : uploadResult.statusReport) !== null && _a !== void 0 ? _a : {};
+}
+async function tryUploadSarifIfRunFailed(config, repositoryNwo, featureEnablement, logger) {
+    if (process.env[shared_environment_1.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY] !== "true") {
+        try {
+            return await maybeUploadFailedSarif(config, repositoryNwo, featureEnablement, logger);
+        }
+        catch (e) {
+            logger.debug(`Failed to upload a SARIF file for this failed CodeQL code scanning run. ${e}`);
+            return createFailedUploadFailedSarifResult(e);
+        }
+    }
+    else {
+        return {
+            upload_failed_run_skipped_because: "Analyze Action completed successfully",
+        };
+    }
+}
+exports.tryUploadSarifIfRunFailed = tryUploadSarifIfRunFailed;
+async function run(uploadDatabaseBundleDebugArtifact, uploadLogsDebugArtifact, printDebugLogs, repositoryNwo, featureEnablement, logger) {
+    const config = await (0, config_utils_1.getConfig)(actionsUtil.getTemporaryDirectory(), logger);
+    if (config === undefined) {
+        logger.warning("Debugging artifacts are unavailable since the 'init' Action failed before it could produce any.");
+        return;
+    }
+    const uploadFailedSarifResult = await tryUploadSarifIfRunFailed(config, repositoryNwo, featureEnablement, logger);
+    if (uploadFailedSarifResult.upload_failed_run_skipped_because) {
+        logger.debug("Won't upload a failed SARIF file for this CodeQL code scanning run because: " +
+            `${uploadFailedSarifResult.upload_failed_run_skipped_because}.`);
+    }
+    // Throw an error if in integration tests, we expected to upload a SARIF file for a failed run
+    // but we didn't upload anything.
+    if (process.env["CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF"] === "true" &&
+        !uploadFailedSarifResult.raw_upload_size_bytes) {
+        throw new Error("Expected to upload a failed SARIF file for this CodeQL code scanning run, " +
+            `but the result was instead ${uploadFailedSarifResult}.`);
+    }
+    // Upload appropriate Actions artifacts for debugging
+    if (config.debugMode) {
+        core.info("Debug mode is on. Uploading available database bundles and logs as Actions debugging artifacts...");
+        await uploadDatabaseBundleDebugArtifact(config, logger);
+        await uploadLogsDebugArtifact(config);
+        await printDebugLogs(config);
+    }
+    return uploadFailedSarifResult;
+}
+exports.run = run;
+//# sourceMappingURL=init-action-post-helper.js.map

github/codeql-action-v1/lib/init-action-post-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-action-post-helper.js","sourceRoot":"","sources":["../src/init-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,qCAAqC;AACrC,iDAAmD;AACnD,mDAA6D;AAG7D,6DAAuF;AACvF,wDAA0C;AAC1C,iCAA6E;AAC7E,yCAKoB;AAWpB,SAAS,mCAAmC,CAC1C,KAAc;IAEd,OAAO;QACL,uBAAuB,EACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACxD,6BAA6B,EAC3B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACnD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,aAA4B,EAC5B,iBAAoC,EACpC,MAAc;;IAEd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;QACrB,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IACE,CAAC,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAChC,uBAAO,CAAC,wBAAwB,EAChC,MAAM,CACP,CAAC,EACF;QACA,OAAO,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,CAAC;KAClE;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,GAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAA,0BAAmB,EAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,IACE,IAAA,gCAAqB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,MAAM;QAC3D,IAAA,mBAAY,GAAE,EACd;QACA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,QAAQ,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE5E,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAC/C,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,MAAM,CACP,CAAC;IACF,MAAM,SAAS,CAAC,iBAAiB,CAC/B,aAAa,EACb,YAAY,CAAC,OAAO,EACpB,MAAM,EACN,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,YAAY,mCAAI,EAAE,CAAC;AAC1C,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAA4B,EAC5B,iBAAoC,EACpC,MAAc;IAEd,IAAI,OAAO,CAAC,GAAG,CAAC,oEAA+C,CAAC,KAAK,MAAM,EAAE;QAC3E,IAAI;YACF,OAAO,MAAM,sBAAsB,CACjC,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,MAAM,CACP,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CACV,2EAA2E,CAAC,EAAE,CAC/E,CAAC;YACF,OAAO,mCAAmC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,OAAO;YACL,iCAAiC,EAC/B,uCAAuC;SAC1C,CAAC;KACH;AACH,CAAC;AA1BD,8DA0BC;AAEM,KAAK,UAAU,GAAG,CACvB,iCAA2C,EAC3C,uBAAiC,EACjC,cAAwB,EACxB,aAA4B,EAC5B,iBAAoC,EACpC,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,CAAC,OAAO,CACZ,iGAAiG,CAClG,CAAC;QACF,OAAO;KACR;IAED,MAAM,uBAAuB,GAAG,MAAM,yBAAyB,CAC7D,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,MAAM,CACP,CAAC;IACF,IAAI,uBAAuB,CAAC,iCAAiC,EAAE;QAC7D,MAAM,CAAC,KAAK,CACV,8EAA8E;YAC5E,GAAG,uBAAuB,CAAC,iCAAiC,GAAG,CAClE,CAAC;KACH;IACD,8FAA8F;IAC9F,iCAAiC;IACjC,IACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,MAAM;QAClE,CAAC,uBAAuB,CAAC,qBAAqB,EAC9C;QACA,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,8BAA8B,uBAAuB,GAAG,CAC3D,CAAC;KACH;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CACP,mGAAmG,CACpG,CAAC;QACF,MAAM,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;KAC9B;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AApDD,kBAoDC"}

github/codeql-action-v1/lib/init-action-post-helper.test.js

@@ -0,0 +1,266 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const codeql = __importStar(require("./codeql"));
+const configUtils = __importStar(require("./config-utils"));
+const feature_flags_1 = require("./feature-flags");
+const initActionPostHelper = __importStar(require("./init-action-post-helper"));
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
+const testing_utils_1 = require("./testing-utils");
+const uploadLib = __importStar(require("./upload-lib"));
+const util = __importStar(require("./util"));
+const workflow = __importStar(require("./workflow"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("post: init action with debug mode off", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
+        process.env["RUNNER_TEMP"] = tmpDir;
+        const gitHubVersion = {
+            type: util.GitHubVariant.DOTCOM,
+        };
+        sinon.stub(configUtils, "getConfig").resolves({
+            debugMode: false,
+            gitHubVersion,
+            languages: [],
+            packs: [],
+        });
+        const uploadDatabaseBundleSpy = sinon.spy();
+        const uploadLogsSpy = sinon.spy();
+        const printDebugLogsSpy = sinon.spy();
+        await initActionPostHelper.run(uploadDatabaseBundleSpy, uploadLogsSpy, printDebugLogsSpy, (0, repository_1.parseRepositoryNwo)("github/codeql-action"), (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        t.assert(uploadDatabaseBundleSpy.notCalled);
+        t.assert(uploadLogsSpy.notCalled);
+        t.assert(printDebugLogsSpy.notCalled);
+    });
+});
+(0, ava_1.default)("post: init action with debug mode on", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
+        process.env["RUNNER_TEMP"] = tmpDir;
+        const gitHubVersion = {
+            type: util.GitHubVariant.DOTCOM,
+        };
+        sinon.stub(configUtils, "getConfig").resolves({
+            debugMode: true,
+            gitHubVersion,
+            languages: [],
+            packs: [],
+        });
+        const uploadDatabaseBundleSpy = sinon.spy();
+        const uploadLogsSpy = sinon.spy();
+        const printDebugLogsSpy = sinon.spy();
+        await initActionPostHelper.run(uploadDatabaseBundleSpy, uploadLogsSpy, printDebugLogsSpy, (0, repository_1.parseRepositoryNwo)("github/codeql-action"), (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        t.assert(uploadDatabaseBundleSpy.called);
+        t.assert(uploadLogsSpy.called);
+        t.assert(printDebugLogsSpy.called);
+    });
+});
+(0, ava_1.default)("uploads failed SARIF run for typical workflow", async (t) => {
+    const actionsWorkflow = createTestWorkflow([
+        {
+            name: "Checkout repository",
+            uses: "actions/checkout@v3",
+        },
+        {
+            name: "Initialize CodeQL",
+            uses: "github/codeql-action/init@v2",
+            with: {
+                languages: "javascript",
+            },
+        },
+        {
+            name: "Perform CodeQL Analysis",
+            uses: "github/codeql-action/analyze@v2",
+            with: {
+                category: "my-category",
+            },
+        },
+    ]);
+    await testFailedSarifUpload(t, actionsWorkflow, { category: "my-category" });
+});
+(0, ava_1.default)("doesn't upload failed SARIF for workflow with upload: false", async (t) => {
+    const actionsWorkflow = createTestWorkflow([
+        {
+            name: "Checkout repository",
+            uses: "actions/checkout@v3",
+        },
+        {
+            name: "Initialize CodeQL",
+            uses: "github/codeql-action/init@v2",
+            with: {
+                languages: "javascript",
+            },
+        },
+        {
+            name: "Perform CodeQL Analysis",
+            uses: "github/codeql-action/analyze@v2",
+            with: {
+                category: "my-category",
+                upload: false,
+            },
+        },
+    ]);
+    const result = await testFailedSarifUpload(t, actionsWorkflow, {
+        expectUpload: false,
+    });
+    t.is(result.upload_failed_run_skipped_because, "SARIF upload is disabled");
+});
+(0, ava_1.default)("uploading failed SARIF run succeeds when workflow uses an input with a matrix var", async (t) => {
+    const actionsWorkflow = createTestWorkflow([
+        {
+            name: "Checkout repository",
+            uses: "actions/checkout@v3",
+        },
+        {
+            name: "Initialize CodeQL",
+            uses: "github/codeql-action/init@v2",
+            with: {
+                languages: "javascript",
+            },
+        },
+        {
+            name: "Perform CodeQL Analysis",
+            uses: "github/codeql-action/analyze@v2",
+            with: {
+                category: "/language:${{ matrix.language }}",
+            },
+        },
+    ]);
+    await testFailedSarifUpload(t, actionsWorkflow, {
+        category: "/language:csharp",
+        matrix: { language: "csharp" },
+    });
+});
+(0, ava_1.default)("uploading failed SARIF run fails when workflow uses a complex upload input", async (t) => {
+    const actionsWorkflow = createTestWorkflow([
+        {
+            name: "Checkout repository",
+            uses: "actions/checkout@v3",
+        },
+        {
+            name: "Initialize CodeQL",
+            uses: "github/codeql-action/init@v2",
+            with: {
+                languages: "javascript",
+            },
+        },
+        {
+            name: "Perform CodeQL Analysis",
+            uses: "github/codeql-action/analyze@v2",
+            with: {
+                upload: "${{ matrix.language != 'csharp' }}",
+            },
+        },
+    ]);
+    const result = await testFailedSarifUpload(t, actionsWorkflow, {
+        expectUpload: false,
+    });
+    t.is(result.upload_failed_run_error, "Could not get upload input to github/codeql-action/analyze since it contained an " +
+        "unrecognized dynamic value.");
+});
+(0, ava_1.default)("uploading failed SARIF run fails when workflow does not reference github/codeql-action", async (t) => {
+    const actionsWorkflow = createTestWorkflow([
+        {
+            name: "Checkout repository",
+            uses: "actions/checkout@v3",
+        },
+    ]);
+    const result = await testFailedSarifUpload(t, actionsWorkflow, {
+        expectUpload: false,
+    });
+    t.is(result.upload_failed_run_error, "Could not get upload input to github/codeql-action/analyze since the analyze job does not " +
+        "call github/codeql-action/analyze.");
+    t.truthy(result.upload_failed_run_stack_trace);
+});
+function createTestWorkflow(steps) {
+    return {
+        name: "CodeQL",
+        on: {
+            push: {
+                branches: ["main"],
+            },
+            pull_request: {
+                branches: ["main"],
+            },
+        },
+        jobs: {
+            analyze: {
+                name: "CodeQL Analysis",
+                "runs-on": "ubuntu-latest",
+                steps,
+            },
+        },
+    };
+}
+async function testFailedSarifUpload(t, actionsWorkflow, { category, expectUpload = true, matrix = {}, } = {}) {
+    const config = {
+        codeQLCmd: "codeql",
+        debugMode: true,
+        languages: [],
+        packs: [],
+    };
+    process.env["GITHUB_JOB"] = "analyze";
+    process.env["GITHUB_REPOSITORY"] = "github/codeql-action-fake-repository";
+    process.env["GITHUB_WORKSPACE"] =
+        "/home/runner/work/codeql-action/codeql-action";
+    sinon
+        .stub(actionsUtil, "getRequiredInput")
+        .withArgs("matrix")
+        .returns(JSON.stringify(matrix));
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeql, "getCodeQL").resolves(codeqlObject);
+    const diagnosticsExportStub = sinon.stub(codeqlObject, "diagnosticsExport");
+    sinon.stub(workflow, "getWorkflow").resolves(actionsWorkflow);
+    const uploadFromActions = sinon.stub(uploadLib, "uploadFromActions");
+    uploadFromActions.resolves({
+        sarifID: "42",
+        statusReport: { raw_upload_size_bytes: 20, zipped_upload_size_bytes: 10 },
+    });
+    const waitForProcessing = sinon.stub(uploadLib, "waitForProcessing");
+    const result = await initActionPostHelper.tryUploadSarifIfRunFailed(config, (0, repository_1.parseRepositoryNwo)("github/codeql-action"), (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.UploadFailedSarifEnabled]), (0, logging_1.getRunnerLogger)(true));
+    if (expectUpload) {
+        t.deepEqual(result, {
+            raw_upload_size_bytes: 20,
+            zipped_upload_size_bytes: 10,
+        });
+    }
+    if (expectUpload) {
+        t.true(diagnosticsExportStub.calledOnceWith(sinon.match.string, category), `Actual args were: ${diagnosticsExportStub.args}`);
+        t.true(uploadFromActions.calledOnceWith(sinon.match.string, sinon.match.string, category, sinon.match.any), `Actual args were: ${uploadFromActions.args}`);
+        t.true(waitForProcessing.calledOnceWith(sinon.match.any, "42", sinon.match.any, {
+            isUnsuccessfulExecution: true,
+        }));
+    }
+    else {
+        t.true(diagnosticsExportStub.notCalled);
+        t.true(uploadFromActions.notCalled);
+        t.true(waitForProcessing.notCalled);
+    }
+    return result;
+}
+//# sourceMappingURL=init-action-post-helper.test.js.map

github/codeql-action-v1/lib/init-action-post.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * This file is the entry point for the `post:` hook of `init-action.yml`.
+ * It will run after the all steps in this job, in reverse order in relation to
+ * other `post:` hooks.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const actions_util_1 = require("./actions-util");
+const api_client_1 = require("./api-client");
+const debugArtifacts = __importStar(require("./debug-artifacts"));
+const feature_flags_1 = require("./feature-flags");
+const initActionPostHelper = __importStar(require("./init-action-post-helper"));
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
+const util_1 = require("./util");
+async function runWrapper() {
+    const startedAt = new Date();
+    let uploadFailedSarifResult;
+    try {
+        const logger = (0, logging_1.getActionsLogger)();
+        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
+        const repositoryNwo = (0, repository_1.parseRepositoryNwo)((0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY"));
+        const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), logger);
+        uploadFailedSarifResult = await initActionPostHelper.run(debugArtifacts.uploadDatabaseBundleDebugArtifact, debugArtifacts.uploadLogsDebugArtifact, actions_util_1.printDebugLogs, repositoryNwo, features, logger);
+    }
+    catch (e) {
+        core.setFailed(e instanceof Error ? e.message : String(e));
+        console.log(e);
+        await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)("init-post", (0, actions_util_1.getActionsStatus)(e), startedAt, String(e), e instanceof Error ? e.stack : undefined));
+        return;
+    }
+    const statusReportBase = await (0, actions_util_1.createStatusReportBase)("init-post", "success", startedAt);
+    const statusReport = {
+        ...statusReportBase,
+        ...uploadFailedSarifResult,
+    };
+    await (0, actions_util_1.sendStatusReport)(statusReport);
+}
+void runWrapper();
+//# sourceMappingURL=init-action-post.js.map

github/codeql-action-v1/lib/init-action-post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-action-post.js","sourceRoot":"","sources":["../src/init-action-post.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;AAEH,oDAAsC;AAEtC,iDAOwB;AACxB,6CAAgD;AAChD,kEAAoD;AACpD,mDAA2C;AAC3C,gFAAkE;AAClE,uCAA6C;AAC7C,6CAAkD;AAClD,iCAAwE;AAMxE,KAAK,UAAU,UAAU;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,uBAES,CAAC;IACd,IAAI;QACF,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,aAAa,GAAG,IAAA,+BAAkB,EACtC,IAAA,0BAAmB,EAAC,mBAAmB,CAAC,CACzC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,aAAa,EACb,IAAA,oCAAqB,GAAE,EACvB,MAAM,CACP,CAAC;QAEF,uBAAuB,GAAG,MAAM,oBAAoB,CAAC,GAAG,CACtD,cAAc,CAAC,iCAAiC,EAChD,cAAc,CAAC,uBAAuB,EACtC,6BAAc,EACd,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;KACH;IAAC,OAAO,CAAC,EAAE;QACV,IAAI,CAAC,SAAS,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,IAAA,+BAAgB,EACpB,MAAM,IAAA,qCAAsB,EAC1B,WAAW,EACX,IAAA,+BAAgB,EAAC,CAAC,CAAC,EACnB,SAAS,EACT,MAAM,CAAC,CAAC,CAAC,EACT,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzC,CACF,CAAC;QACF,OAAO;KACR;IACD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAAsB,EACnD,WAAW,EACX,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAAyB;QACzC,GAAG,gBAAgB;QACnB,GAAG,uBAAuB;KAC3B,CAAC;IACF,MAAM,IAAA,+BAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

github/codeql-action-v1/lib/init-action.js

@@ -0,0 +1,188 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const core = __importStar(require("@actions/core"));
+const actions_util_1 = require("./actions-util");
+const api_client_1 = require("./api-client");
+const codeql_1 = require("./codeql");
+const feature_flags_1 = require("./feature-flags");
+const init_1 = require("./init");
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
+const trap_caching_1 = require("./trap-caching");
+const util_1 = require("./util");
+const workflow_1 = require("./workflow");
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
+async function sendSuccessStatusReport(startedAt, config, toolsVersion, logger) {
+    var _a;
+    const statusReportBase = await (0, actions_util_1.createStatusReportBase)("init", "success", startedAt);
+    const languages = config.languages.join(",");
+    const workflowLanguages = (0, actions_util_1.getOptionalInput)("languages");
+    const paths = (config.originalUserInput.paths || []).join(",");
+    const pathsIgnore = (config.originalUserInput["paths-ignore"] || []).join(",");
+    const disableDefaultQueries = config.originalUserInput["disable-default-queries"]
+        ? languages
+        : "";
+    const queries = [];
+    let queriesInput = (_a = (0, actions_util_1.getOptionalInput)("queries")) === null || _a === void 0 ? void 0 : _a.trim();
+    if (queriesInput === undefined || queriesInput.startsWith("+")) {
+        queries.push(...(config.originalUserInput.queries || []).map((q) => q.uses));
+    }
+    if (queriesInput !== undefined) {
+        queriesInput = queriesInput.startsWith("+")
+            ? queriesInput.slice(1)
+            : queriesInput;
+        queries.push(...queriesInput.split(","));
+    }
+    const statusReport = {
+        ...statusReportBase,
+        disable_default_queries: disableDefaultQueries,
+        languages,
+        ml_powered_javascript_queries: (0, util_1.getMlPoweredJsQueriesStatus)(config),
+        paths,
+        paths_ignore: pathsIgnore,
+        queries: queries.join(","),
+        tools_input: (0, actions_util_1.getOptionalInput)("tools") || "",
+        tools_resolved_version: toolsVersion,
+        workflow_languages: workflowLanguages || "",
+        trap_cache_languages: Object.keys(config.trapCaches).join(","),
+        trap_cache_download_size_bytes: Math.round(await (0, trap_caching_1.getTotalCacheSize)(config.trapCaches, logger)),
+        trap_cache_download_duration_ms: Math.round(config.trapCacheDownloadTime),
+    };
+    await (0, actions_util_1.sendStatusReport)(statusReport);
+}
+async function run() {
+    const startedAt = new Date();
+    const logger = (0, logging_1.getActionsLogger)();
+    (0, util_1.initializeEnvironment)(pkg.version);
+    await (0, util_1.checkActionVersion)(pkg.version);
+    let config;
+    let codeql;
+    let toolsVersion;
+    const apiDetails = {
+        auth: (0, actions_util_1.getRequiredInput)("token"),
+        externalRepoAuth: (0, actions_util_1.getOptionalInput)("external-repository-token"),
+        url: (0, util_1.getRequiredEnvParam)("GITHUB_SERVER_URL"),
+        apiURL: (0, util_1.getRequiredEnvParam)("GITHUB_API_URL"),
+    };
+    const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+    (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
+    const repositoryNwo = (0, repository_1.parseRepositoryNwo)((0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY"));
+    const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), logger);
+    try {
+        const workflowErrors = await (0, workflow_1.validateWorkflow)();
+        if (!(await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)("init", "starting", startedAt, workflowErrors)))) {
+            return;
+        }
+        const initCodeQLResult = await (0, init_1.initCodeQL)((0, actions_util_1.getOptionalInput)("tools"), apiDetails, (0, actions_util_1.getTemporaryDirectory)(), gitHubVersion.type, await (0, util_1.shouldBypassToolcache)(features, (0, actions_util_1.getOptionalInput)("tools"), (0, actions_util_1.getOptionalInput)("languages"), repositoryNwo, logger), logger);
+        codeql = initCodeQLResult.codeql;
+        toolsVersion = initCodeQLResult.toolsVersion;
+        await (0, util_1.enrichEnvironment)(codeql);
+        config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), (0, actions_util_1.getOptionalInput)("registries"), (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), await getTrapCachingEnabled(features), 
+        // Debug mode is enabled if:
+        // - The `init` Action is passed `debug: true`.
+        // - Actions step debugging is enabled (e.g. by [enabling debug logging for a rerun](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs#re-running-all-the-jobs-in-a-workflow),
+        //   or by setting the `ACTIONS_STEP_DEBUG` secret to `true`).
+        (0, actions_util_1.getOptionalInput)("debug") === "true" || core.isDebug(), (0, actions_util_1.getOptionalInput)("debug-artifact-name") || util_1.DEFAULT_DEBUG_ARTIFACT_NAME, (0, actions_util_1.getOptionalInput)("debug-database-name") || util_1.DEFAULT_DEBUG_DATABASE_NAME, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), codeql, (0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), gitHubVersion, apiDetails, features, logger);
+        if (config.languages.includes(languages_1.Language.python) &&
+            (0, actions_util_1.getRequiredInput)("setup-python-dependencies") === "true") {
+            try {
+                await (0, init_1.installPythonDeps)(codeql, logger);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                logger.warning(`${message} You can call this action with 'setup-python-dependencies: false' to disable this process`);
+            }
+        }
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        core.setFailed(message);
+        console.log(e);
+        await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)("init", "aborted", startedAt, message));
+        return;
+    }
+    try {
+        // Forward Go flags
+        const goFlags = process.env["GOFLAGS"];
+        if (goFlags) {
+            core.exportVariable("GOFLAGS", goFlags);
+            core.warning("Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.");
+        }
+        // Limit RAM and threads for extractors. When running extractors, the CodeQL CLI obeys the
+        // CODEQL_RAM and CODEQL_THREADS environment variables to decide how much RAM and how many
+        // threads it would ask extractors to use. See help text for the "--ram" and "--threads"
+        // options at https://codeql.github.com/docs/codeql-cli/manual/database-trace-command/
+        // for details.
+        core.exportVariable("CODEQL_RAM", process.env["CODEQL_RAM"] ||
+            (0, util_1.getMemoryFlagValue)((0, actions_util_1.getOptionalInput)("ram")).toString());
+        core.exportVariable("CODEQL_THREADS", (0, util_1.getThreadsFlagValue)((0, actions_util_1.getOptionalInput)("threads"), logger).toString());
+        // Disable Kotlin extractor if feature flag set
+        if (await features.getValue(feature_flags_1.Feature.DisableKotlinAnalysisEnabled)) {
+            core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
+        }
+        const sourceRoot = path.resolve((0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), (0, actions_util_1.getOptionalInput)("source-root") || "");
+        const tracerConfig = await (0, init_1.runInit)(codeql, config, sourceRoot, "Runner.Worker.exe", features, logger);
+        if (tracerConfig !== undefined) {
+            for (const [key, value] of Object.entries(tracerConfig.env)) {
+                core.exportVariable(key, value);
+            }
+            if (process.platform === "win32" &&
+                !(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING))) {
+                await (0, init_1.injectWindowsTracer)("Runner.Worker.exe", undefined, config, codeql, tracerConfig);
+            }
+        }
+        core.setOutput("codeql-path", config.codeQLCmd);
+    }
+    catch (error) {
+        core.setFailed(String(error));
+        console.log(error);
+        await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)("init", (0, actions_util_1.getActionsStatus)(error), startedAt, String(error), error instanceof Error ? error.stack : undefined));
+        return;
+    }
+    await sendSuccessStatusReport(startedAt, config, toolsVersion, logger);
+}
+async function getTrapCachingEnabled(featureEnablement) {
+    // If the workflow specified something always respect that
+    const trapCaching = (0, actions_util_1.getOptionalInput)("trap-caching");
+    if (trapCaching !== undefined)
+        return trapCaching === "true";
+    // On self-hosted runners which may have slow network access, disable TRAP caching by default
+    if (!(0, util_1.isHostedRunner)())
+        return false;
+    // On hosted runners, respect the feature flag
+    return await featureEnablement.getValue(feature_flags_1.Feature.TrapCachingEnabled);
+}
+async function runWrapper() {
+    try {
+        await run();
+    }
+    catch (error) {
+        core.setFailed(`init action failed: ${error}`);
+        console.log(error);
+    }
+    await (0, util_1.checkForTimeout)();
+}
+void runWrapper();
+//# sourceMappingURL=init-action.js.map

github/codeql-action-v1/lib/init.js

@@ -0,0 +1,222 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installPythonDeps = exports.injectWindowsTracer = exports.runInit = exports.initConfig = exports.initCodeQL = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const analysisPaths = __importStar(require("./analysis-paths"));
+const codeql_1 = require("./codeql");
+const configUtils = __importStar(require("./config-utils"));
+const tracer_config_1 = require("./tracer-config");
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+async function initCodeQL(toolsInput, apiDetails, tempDir, variant, bypassToolcache, logger) {
+    logger.startGroup("Setup CodeQL tools");
+    const { codeql, toolsVersion } = await (0, codeql_1.setupCodeQL)(toolsInput, apiDetails, tempDir, variant, bypassToolcache, logger, true);
+    await codeql.printVersion();
+    logger.endGroup();
+    return { codeql, toolsVersion };
+}
+exports.initCodeQL = initCodeQL;
+async function initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, featureEnablement, logger) {
+    logger.startGroup("Load language configuration");
+    const config = await configUtils.initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, featureEnablement, logger);
+    analysisPaths.printPathFiltersWarning(config, logger);
+    logger.endGroup();
+    return config;
+}
+exports.initConfig = initConfig;
+async function runInit(codeql, config, sourceRoot, processName, featureEnablement, logger) {
+    fs.mkdirSync(config.dbLocation, { recursive: true });
+    try {
+        if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+            // Init a database cluster
+            await codeql.databaseInitCluster(config, sourceRoot, processName, featureEnablement, logger);
+        }
+        else {
+            for (const language of config.languages) {
+                // Init language database
+                await codeql.databaseInit(util.getCodeQLDatabasePath(config, language), language, sourceRoot);
+            }
+        }
+    }
+    catch (e) {
+        throw processError(e);
+    }
+    return await (0, tracer_config_1.getCombinedTracerConfig)(config, codeql);
+}
+exports.runInit = runInit;
+/**
+ * Possibly convert this error into a UserError in order to avoid
+ * counting this error towards our internal error budget.
+ *
+ * @param e The error to possibly convert to a UserError.
+ *
+ * @returns A UserError if the error is a known error that can be
+ *         attributed to the user, otherwise the original error.
+ */
+function processError(e) {
+    var _a, _b, _c, _d;
+    if (!(e instanceof Error)) {
+        return e;
+    }
+    if (
+    // Init action called twice
+    ((_a = e.message) === null || _a === void 0 ? void 0 : _a.includes("Refusing to create databases")) &&
+        ((_b = e.message) === null || _b === void 0 ? void 0 : _b.includes("exists and is not an empty directory."))) {
+        return new util.UserError(`Is the "init" action called twice in the same job? ${e.message}`);
+    }
+    if (
+    // Version of CodeQL CLI is incompatible with this version of the CodeQL Action
+    ((_c = e.message) === null || _c === void 0 ? void 0 : _c.includes("is not compatible with this CodeQL CLI")) ||
+        (
+        // Expected source location for database creation does not exist
+        (_d = e.message) === null || _d === void 0 ? void 0 : _d.includes("Invalid source root"))) {
+        return new util.UserError(e.message);
+    }
+    return e;
+}
+// Runs a powershell script to inject the tracer into a parent process
+// so it can tracer future processes, hopefully including the build process.
+// If processName is given then injects into the nearest parent process with
+// this name, otherwise uses the processLevel-th parent if defined, otherwise
+// defaults to the 3rd parent as a rough guess.
+async function injectWindowsTracer(processName, processLevel, config, codeql, tracerConfig) {
+    let script;
+    if (processName !== undefined) {
+        script = `
+      Param(
+          [Parameter(Position=0)]
+          [String]
+          $tracer
+      )
+
+      $id = $PID
+      while ($true) {
+        $p = Get-CimInstance -Class Win32_Process -Filter "ProcessId = $id"
+        Write-Host "Found process: $p"
+        if ($p -eq $null) {
+          throw "Could not determine ${processName} process"
+        }
+        if ($p[0].Name -eq "${processName}") {
+          Break
+        } else {
+          $id = $p[0].ParentProcessId
+        }
+      }
+      Write-Host "Final process: $p"
+
+      Invoke-Expression "&$tracer --inject=$id"`;
+    }
+    else {
+        // If the level is not defined then guess at the 3rd parent process.
+        // This won't be correct in every setting but it should be enough in most settings,
+        // and overestimating is likely better in this situation so we definitely trace
+        // what we want, though this does run the risk of interfering with future CI jobs.
+        // Note that the default of 3 doesn't work on github actions, so we include a
+        // special case in the script that checks for Runner.Worker.exe so we can still work
+        // on actions if the runner is invoked there.
+        processLevel = processLevel || 3;
+        script = `
+      Param(
+          [Parameter(Position=0)]
+          [String]
+          $tracer
+      )
+
+      $id = $PID
+      for ($i = 0; $i -le ${processLevel}; $i++) {
+        $p = Get-CimInstance -Class Win32_Process -Filter "ProcessId = $id"
+        Write-Host "Parent process \${i}: $p"
+        if ($p -eq $null) {
+          throw "Process tree ended before reaching required level"
+        }
+        # Special case just in case the runner is used on actions
+        if ($p[0].Name -eq "Runner.Worker.exe") {
+          Write-Host "Found Runner.Worker.exe process which means we are running on GitHub Actions"
+          Write-Host "Aborting search early and using process: $p"
+          Break
+        } elseif ($p[0].Name -eq "Agent.Worker.exe") {
+          Write-Host "Found Agent.Worker.exe process which means we are running on Azure Pipelines"
+          Write-Host "Aborting search early and using process: $p"
+          Break
+        } else {
+          $id = $p[0].ParentProcessId
+        }
+      }
+      Write-Host "Final process: $p"
+
+      Invoke-Expression "&$tracer --inject=$id"`;
+    }
+    const injectTracerPath = path.join(config.tempDir, "inject-tracer.ps1");
+    fs.writeFileSync(injectTracerPath, script);
+    await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [
+        "-ExecutionPolicy",
+        "Bypass",
+        "-file",
+        injectTracerPath,
+        path.resolve(path.dirname(codeql.getPath()), "tools", "win64", "tracer.exe"),
+    ], { env: { ODASA_TRACER_CONFIGURATION: tracerConfig.spec } }).exec();
+}
+exports.injectWindowsTracer = injectWindowsTracer;
+async function installPythonDeps(codeql, logger) {
+    logger.startGroup("Setup Python dependencies");
+    const scriptsFolder = path.resolve(__dirname, "../python-setup");
+    try {
+        if (process.platform === "win32") {
+            await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [
+                path.join(scriptsFolder, "install_tools.ps1"),
+            ]).exec();
+        }
+        else {
+            await new toolrunner.ToolRunner(path.join(scriptsFolder, "install_tools.sh")).exec();
+        }
+        const script = "auto_install_packages.py";
+        if (process.platform === "win32") {
+            await new toolrunner.ToolRunner(await safeWhich.safeWhich("py"), [
+                "-3",
+                "-B",
+                path.join(scriptsFolder, script),
+                path.dirname(codeql.getPath()),
+            ]).exec();
+        }
+        else {
+            await new toolrunner.ToolRunner(await safeWhich.safeWhich("python3"), [
+                "-B",
+                path.join(scriptsFolder, script),
+                path.dirname(codeql.getPath()),
+            ]).exec();
+        }
+    }
+    catch (e) {
+        logger.endGroup();
+        logger.warning(`An error occurred while trying to automatically install Python dependencies: ${e}\n` +
+            "Please make sure any necessary dependencies are installed before calling the codeql-action/analyze " +
+            "step, and add a 'setup-python-dependencies: false' argument to this step to disable our automatic " +
+            "dependency installation and avoid this warning.");
+        return;
+    }
+    logger.endGroup();
+}
+exports.installPythonDeps = installPythonDeps;
+//# sourceMappingURL=init.js.map

github/codeql-action-v1/lib/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAEpD,gEAAkD;AAElD,qCAA2E;AAC3E,4DAA8C;AAI9C,mDAAwE;AACxE,6CAA+B;AAC/B,iCAA4C;AAErC,KAAK,UAAU,UAAU,CAC9B,UAA8B,EAC9B,UAA4B,EAC5B,OAAe,EACf,OAA2B,EAC3B,eAAwB,EACxB,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAA,oBAAW,EAChD,UAAU,EACV,UAAU,EACV,OAAO,EACP,OAAO,EACP,eAAe,EACf,MAAM,EACN,IAAI,CACL,CAAC;IACF,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC;AArBD,gCAqBC;AAEM,KAAK,UAAU,UAAU,CAC9B,cAAkC,EAClC,YAAgC,EAChC,UAA8B,EAC9B,eAAmC,EACnC,UAA8B,EAC9B,UAA8B,EAC9B,kBAA2B,EAC3B,SAAkB,EAClB,iBAAyB,EACzB,iBAAyB,EACzB,UAAyB,EACzB,OAAe,EACf,MAAc,EACd,aAAqB,EACrB,aAAiC,EACjC,UAAoC,EACpC,iBAAoC,EACpC,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,cAAc,EACd,YAAY,EACZ,UAAU,EACV,eAAe,EACf,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,OAAO,EACP,MAAM,EACN,aAAa,EACb,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,MAAM,CACP,CAAC;IACF,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AA5CD,gCA4CC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B,EAC1B,UAAkB,EAClB,WAA+B,EAC/B,iBAAoC,EACpC,MAAc;IAEd,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErD,IAAI;QACF,IAAI,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,mCAA0B,CAAC,EAAE;YAChE,0BAA0B;YAC1B,MAAM,MAAM,CAAC,mBAAmB,CAC9B,MAAM,EACN,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,MAAM,CACP,CAAC;SACH;aAAM;YACL,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;gBACvC,yBAAyB;gBACzB,MAAM,MAAM,CAAC,YAAY,CACvB,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC5C,QAAQ,EACR,UAAU,CACX,CAAC;aACH;SACF;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;KACvB;IACD,OAAO,MAAM,IAAA,uCAAuB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAlCD,0BAkCC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,CAAM;;IAC1B,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,EAAE;QACzB,OAAO,CAAC,CAAC;KACV;IAED;IACE,2BAA2B;IAC3B,CAAA,MAAA,CAAC,CAAC,OAAO,0CAAE,QAAQ,CAAC,8BAA8B,CAAC;SACnD,MAAA,CAAC,CAAC,OAAO,0CAAE,QAAQ,CAAC,uCAAuC,CAAC,CAAA,EAC5D;QACA,OAAO,IAAI,IAAI,CAAC,SAAS,CACvB,sDAAsD,CAAC,CAAC,OAAO,EAAE,CAClE,CAAC;KACH;IAED;IACE,+EAA+E;IAC/E,CAAA,MAAA,CAAC,CAAC,OAAO,0CAAE,QAAQ,CAAC,wCAAwC,CAAC;;QAC7D,gEAAgE;QAChE,MAAA,CAAC,CAAC,OAAO,0CAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAA,EAC1C;QACA,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;KACtC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+CAA+C;AACxC,KAAK,UAAU,mBAAmB,CACvC,WAA+B,EAC/B,YAAgC,EAChC,MAA0B,EAC1B,MAAc,EACd,YAA0B;IAE1B,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,KAAK,SAAS,EAAE;QAC7B,MAAM,GAAG;;;;;;;;;;;;uCAY0B,WAAW;;8BAEpB,WAAW;;;;;;;;gDAQO,CAAC;KAC9C;SAAM;QACL,oEAAoE;QACpE,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,6EAA6E;QAC7E,oFAAoF;QACpF,6CAA6C;QAC7C,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG;;;;;;;;4BAQe,YAAY;;;;;;;;;;;;;;;;;;;;;gDAqBQ,CAAC;KAC9C;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxE,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EACvC;QACE,kBAAkB;QAClB,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,IAAI,CAAC,OAAO,CACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAC9B,OAAO,EACP,OAAO,EACP,YAAY,CACb;KACF,EACD,EAAE,GAAG,EAAE,EAAE,0BAA0B,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AA5FD,kDA4FC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEjE,IAAI;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;YAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC;aAC9C,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;aAAM;YACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAC7C,CAAC,IAAI,EAAE,CAAC;SACV;QACD,MAAM,MAAM,GAAG,0BAA0B,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;YAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBAC/D,IAAI;gBACJ,IAAI;gBACJ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;aAAM;YACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;gBACpE,IAAI;gBACJ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,CACZ,gFAAgF,CAAC,IAAI;YACnF,qGAAqG;YACrG,oGAAoG;YACpG,iDAAiD,CACpD,CAAC;QACF,OAAO;KACR;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AAzCD,8CAyCC"}

github/codeql-action-v1/lib/languages.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isScannedLanguage = exports.isTracedLanguage = exports.parseLanguage = exports.resolveAlias = exports.KOTLIN_SWIFT_BYPASS = exports.LANGUAGE_ALIASES = exports.Language = void 0;
+// All the languages supported by CodeQL
+var Language;
+(function (Language) {
+    Language["csharp"] = "csharp";
+    Language["cpp"] = "cpp";
+    Language["go"] = "go";
+    Language["java"] = "java";
+    Language["javascript"] = "javascript";
+    Language["python"] = "python";
+    Language["ruby"] = "ruby";
+    Language["swift"] = "swift";
+})(Language = exports.Language || (exports.Language = {}));
+// Additional names for languages
+exports.LANGUAGE_ALIASES = {
+    c: Language.cpp,
+    "c++": Language.cpp,
+    "c#": Language.csharp,
+    kotlin: Language.java,
+    typescript: Language.javascript,
+};
+exports.KOTLIN_SWIFT_BYPASS = ["kotlin", "swift"];
+function resolveAlias(lang) {
+    return exports.LANGUAGE_ALIASES[lang] || lang;
+}
+exports.resolveAlias = resolveAlias;
+/**
+ * Translate from user input or GitHub's API names for languages to CodeQL's
+ * names for languages. This does not translate a language alias to the actual
+ * language used by CodeQL.
+ *
+ * @param language The language to translate.
+ * @returns A language supported by CodeQL, an alias for a language, or
+ * `undefined` if the input language cannot be parsed into a langauge supported
+ * by CodeQL.
+ */
+function parseLanguage(language) {
+    // Normalise to lower case
+    language = language.trim().toLowerCase();
+    // See if it's an exact match
+    if (language in Language) {
+        return language;
+    }
+    // Check language aliases, but return the original language name,
+    // the alias will be resolved later.
+    if (language in exports.LANGUAGE_ALIASES) {
+        return language;
+    }
+    return undefined;
+}
+exports.parseLanguage = parseLanguage;
+function isTracedLanguage(language) {
+    return [
+        Language.cpp,
+        Language.csharp,
+        Language.go,
+        Language.java,
+        Language.swift,
+    ].includes(language);
+}
+exports.isTracedLanguage = isTracedLanguage;
+function isScannedLanguage(language) {
+    return !isTracedLanguage(language);
+}
+exports.isScannedLanguage = isScannedLanguage;
+//# sourceMappingURL=languages.js.map

github/codeql-action-v1/lib/languages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"languages.js","sourceRoot":"","sources":["../src/languages.ts"],"names":[],"mappings":";;;AAAA,wCAAwC;AACxC,IAAY,QASX;AATD,WAAY,QAAQ;IAClB,6BAAiB,CAAA;IACjB,uBAAW,CAAA;IACX,qBAAS,CAAA;IACT,yBAAa,CAAA;IACb,qCAAyB,CAAA;IACzB,6BAAiB,CAAA;IACjB,yBAAa,CAAA;IACb,2BAAe,CAAA;AACjB,CAAC,EATW,QAAQ,GAAR,gBAAQ,KAAR,gBAAQ,QASnB;AAED,iCAAiC;AACpB,QAAA,gBAAgB,GAAiC;IAC5D,CAAC,EAAE,QAAQ,CAAC,GAAG;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG;IACnB,IAAI,EAAE,QAAQ,CAAC,MAAM;IACrB,MAAM,EAAE,QAAQ,CAAC,IAAI;IACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAChC,CAAC;AAIW,QAAA,mBAAmB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEvD,SAAgB,YAAY,CAAC,IAAqB;IAChD,OAAO,wBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC;AAFD,oCAEC;AAED;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,QAAgB;IAC5C,0BAA0B;IAC1B,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzC,6BAA6B;IAC7B,IAAI,QAAQ,IAAI,QAAQ,EAAE;QACxB,OAAO,QAAoB,CAAC;KAC7B;IAED,iEAAiE;IACjE,oCAAoC;IACpC,IAAI,QAAQ,IAAI,wBAAgB,EAAE;QAChC,OAAO,QAAQ,CAAC;KACjB;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAhBD,sCAgBC;AAED,SAAgB,gBAAgB,CAAC,QAAkB;IACjD,OAAO;QACL,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,EAAE;QACX,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,KAAK;KACf,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC;AARD,4CAQC;AAED,SAAgB,iBAAiB,CAAC,QAAkB;IAClD,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAFD,8CAEC"}

github/codeql-action-v1/lib/languages.test.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const languages_1 = require("./languages");
+const testing_utils_1 = require("./testing-utils");
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("parseLanguage", async (t) => {
+    // Exact matches
+    t.deepEqual((0, languages_1.parseLanguage)("csharp"), languages_1.Language.csharp);
+    t.deepEqual((0, languages_1.parseLanguage)("cpp"), languages_1.Language.cpp);
+    t.deepEqual((0, languages_1.parseLanguage)("go"), languages_1.Language.go);
+    t.deepEqual((0, languages_1.parseLanguage)("java"), languages_1.Language.java);
+    t.deepEqual((0, languages_1.parseLanguage)("javascript"), languages_1.Language.javascript);
+    t.deepEqual((0, languages_1.parseLanguage)("python"), languages_1.Language.python);
+    // Aliases
+    t.deepEqual((0, languages_1.parseLanguage)("c"), "c");
+    t.deepEqual((0, languages_1.parseLanguage)("c++"), "c++");
+    t.deepEqual((0, languages_1.parseLanguage)("c#"), "c#");
+    t.deepEqual((0, languages_1.parseLanguage)("kotlin"), "kotlin");
+    t.deepEqual((0, languages_1.parseLanguage)("typescript"), "typescript");
+    // spaces and case-insensitivity
+    t.deepEqual((0, languages_1.parseLanguage)("  \t\nCsHaRp\t\t"), languages_1.Language.csharp);
+    t.deepEqual((0, languages_1.parseLanguage)("  \t\nkOtLin\t\t"), "kotlin");
+    // Not matches
+    t.deepEqual((0, languages_1.parseLanguage)("foo"), undefined);
+    t.deepEqual((0, languages_1.parseLanguage)(" "), undefined);
+    t.deepEqual((0, languages_1.parseLanguage)(""), undefined);
+});
+(0, ava_1.default)("isTracedLanguage", async (t) => {
+    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.cpp));
+    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.csharp));
+    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.go));
+    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.java));
+    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.swift));
+    t.false((0, languages_1.isTracedLanguage)(languages_1.Language.javascript));
+    t.false((0, languages_1.isTracedLanguage)(languages_1.Language.python));
+    t.false((0, languages_1.isTracedLanguage)(languages_1.Language.ruby));
+});
+(0, ava_1.default)("isScannedLanguage", async (t) => {
+    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.cpp));
+    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.csharp));
+    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.go));
+    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.java));
+    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.swift));
+    t.true((0, languages_1.isScannedLanguage)(languages_1.Language.javascript));
+    t.true((0, languages_1.isScannedLanguage)(languages_1.Language.python));
+    t.true((0, languages_1.isScannedLanguage)(languages_1.Language.ruby));
+});
+//# sourceMappingURL=languages.test.js.map

github/codeql-action-v1/lib/languages.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"languages.test.js","sourceRoot":"","sources":["../src/languages.test.ts"],"names":[],"mappings":";;;;;AAAA,8CAAuB;AAEvB,2CAKqB;AACrB,mDAA6C;AAE7C,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,gBAAgB;IAChB,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,QAAQ,CAAC,EAAE,oBAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,KAAK,CAAC,EAAE,oBAAQ,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,IAAI,CAAC,EAAE,oBAAQ,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,MAAM,CAAC,EAAE,oBAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,YAAY,CAAC,EAAE,oBAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,QAAQ,CAAC,EAAE,oBAAQ,CAAC,MAAM,CAAC,CAAC;IAEtD,UAAU;IACV,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;IAEvD,gCAAgC;IAChC,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,kBAAkB,CAAC,EAAE,oBAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAEzD,cAAc;IACd,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEzC,CAAC,CAAC,KAAK,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,KAAK,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,KAAK,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpC,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3C,CAAC,CAAC,IAAI,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC"}

github/codeql-action-v1/lib/logging.js

@@ -0,0 +1,40 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRunnerLogger = exports.getActionsLogger = void 0;
+const core = __importStar(require("@actions/core"));
+function getActionsLogger() {
+    return core;
+}
+exports.getActionsLogger = getActionsLogger;
+function getRunnerLogger(debugMode) {
+    return {
+        debug: debugMode ? console.debug : () => undefined,
+        info: console.info,
+        warning: console.warn,
+        error: console.error,
+        isDebug: () => debugMode,
+        startGroup: () => undefined,
+        endGroup: () => undefined,
+    };
+}
+exports.getRunnerLogger = getRunnerLogger;
+//# sourceMappingURL=logging.js.map

github/codeql-action-v1/lib/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AActC,SAAgB,gBAAgB;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAFD,4CAEC;AAED,SAAgB,eAAe,CAAC,SAAkB;IAChD,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,SAAS;QAClD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;QAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAVD,0CAUC"}

github/codeql-action-v1/lib/repository.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRepositoryNwo = void 0;
+function parseRepositoryNwo(input) {
+    const parts = input.split("/");
+    if (parts.length !== 2) {
+        throw new Error(`"${input}" is not a valid repository name`);
+    }
+    return {
+        owner: parts[0],
+        repo: parts[1],
+    };
+}
+exports.parseRepositoryNwo = parseRepositoryNwo;
+//# sourceMappingURL=repository.js.map

github/codeql-action-v1/lib/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../src/repository.ts"],"names":[],"mappings":";;;AAMA,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QACtB,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kCAAkC,CAAC,CAAC;KAC9D;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACf,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;KACf,CAAC;AACJ,CAAC;AATD,gDASC"}

github/codeql-action-v1/lib/shared-environment.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ODASA_TRACER_CONFIGURATION = exports.CODEQL_WORKFLOW_STARTED_AT = exports.CODEQL_ACTION_TEST_MODE = exports.CODEQL_ACTION_TESTING_ENVIRONMENT = exports.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY = void 0;
+/**
+ * This environment variable is set to true when the `analyze` Action
+ * completes successfully.
+ */
+exports.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY = "CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY";
+exports.CODEQL_ACTION_TESTING_ENVIRONMENT = "CODEQL_ACTION_TESTING_ENVIRONMENT";
+/** Used to disable uploading SARIF results or status reports to the GitHub API */
+exports.CODEQL_ACTION_TEST_MODE = "CODEQL_ACTION_TEST_MODE";
+/**
+ * The time at which the first action (normally init) started executing.
+ * If a workflow invokes a different action without first invoking the init
+ * action (i.e. the upload action is being used by a third-party integrator)
+ * then this variable will be assigned the start time of the action invoked
+ * rather that the init action.
+ */
+exports.CODEQL_WORKFLOW_STARTED_AT = "CODEQL_WORKFLOW_STARTED_AT";
+exports.ODASA_TRACER_CONFIGURATION = "ODASA_TRACER_CONFIGURATION";
+//# sourceMappingURL=shared-environment.js.map

github/codeql-action-v1/lib/shared-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-environment.js","sourceRoot":"","sources":["../src/shared-environment.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACU,QAAA,+CAA+C,GAC1D,iDAAiD,CAAC;AAEvC,QAAA,iCAAiC,GAC5C,mCAAmC,CAAC;AAEtC,kFAAkF;AACrE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAE1D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC"}

github/codeql-action-v1/lib/testdata/testFile3.js

@@ -0,0 +1,6 @@
+"use strict";
+var a;
+var b;
+var c;
+var d;
+//# sourceMappingURL=testFile3.js.map

github/codeql-action-v1/lib/testdata/testFile3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testFile3.js","sourceRoot":"","sources":["../../src/testdata/testFile3.ts"],"names":[],"mappings":";AAAA,IAAI,CAAC,CAAC;AACN,IAAI,CAAC,CAAC;AACN,IAAI,CAAC,CAAC;AACN,IAAI,CAAC,CAAC"}

github/codeql-action-v1/lib/testing-utils.js

@@ -0,0 +1,190 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFeatures = exports.mockCodeQLVersion = exports.mockLanguagesInRepo = exports.mockFeatureFlagApiEndpoint = exports.getRecordingLogger = exports.setupActionsVars = exports.setupTests = void 0;
+const github = __importStar(require("@actions/github"));
+const nock = __importStar(require("nock"));
+const sinon = __importStar(require("sinon"));
+const apiClient = __importStar(require("./api-client"));
+const CodeQL = __importStar(require("./codeql"));
+const util_1 = require("./util");
+function wrapOutput(context) {
+    // Function signature taken from Socket.write.
+    // Note there are two overloads:
+    // write(buffer: Uint8Array | string, cb?: (err?: Error) => void): boolean;
+    // write(str: Uint8Array | string, encoding?: string, cb?: (err?: Error) => void): boolean;
+    return (chunk, encoding, cb) => {
+        // Work out which method overload we are in
+        if (cb === undefined && typeof encoding === "function") {
+            cb = encoding;
+            encoding = undefined;
+        }
+        // Record the output
+        if (typeof chunk === "string") {
+            context.testOutput += chunk;
+        }
+        else {
+            context.testOutput += new TextDecoder(encoding || "utf-8").decode(chunk);
+        }
+        // Satisfy contract by calling callback when done
+        if (cb !== undefined && typeof cb === "function") {
+            cb();
+        }
+        return true;
+    };
+}
+function setupTests(test) {
+    const typedTest = test;
+    typedTest.beforeEach((t) => {
+        // Set an empty CodeQL object so that all method calls will fail
+        // unless the test explicitly sets one up.
+        CodeQL.setCodeQL({});
+        // Replace stdout and stderr so we can record output during tests
+        t.context.testOutput = "";
+        const processStdoutWrite = process.stdout.write.bind(process.stdout);
+        t.context.stdoutWrite = processStdoutWrite;
+        process.stdout.write = wrapOutput(t.context);
+        const processStderrWrite = process.stderr.write.bind(process.stderr);
+        t.context.stderrWrite = processStderrWrite;
+        process.stderr.write = wrapOutput(t.context);
+        // Workaround an issue in tests where the case insensitivity of the `$PATH`
+        // environment variable on Windows isn't preserved, i.e. `process.env.PATH`
+        // is not the same as `process.env.Path`.
+        const pathKeys = Object.keys(process.env).filter((k) => k.toLowerCase() === "path");
+        if (pathKeys.length > 0) {
+            process.env.PATH = process.env[pathKeys[0]];
+        }
+        // Many tests modify environment variables. Take a copy now so that
+        // we reset them after the test to keep tests independent of each other.
+        // process.env only has strings fields, so a shallow copy is fine.
+        t.context.env = {};
+        Object.assign(t.context.env, process.env);
+    });
+    typedTest.afterEach.always((t) => {
+        // Restore stdout and stderr
+        // The captured output is only replayed if the test failed
+        process.stdout.write = t.context.stdoutWrite;
+        process.stderr.write = t.context.stderrWrite;
+        if (!t.passed) {
+            process.stdout.write(t.context.testOutput);
+        }
+        // Undo any modifications made by nock
+        nock.cleanAll();
+        // Undo any modifications made by sinon
+        sinon.restore();
+        // Undo any modifications to the env
+        process.env = t.context.env;
+    });
+}
+exports.setupTests = setupTests;
+// Sets environment variables that make using some libraries designed for
+// use only on actions safe to use outside of actions.
+function setupActionsVars(tempDir, toolsDir) {
+    process.env["RUNNER_TEMP"] = tempDir;
+    process.env["RUNNER_TOOL_CACHE"] = toolsDir;
+    process.env["GITHUB_WORKSPACE"] = tempDir;
+}
+exports.setupActionsVars = setupActionsVars;
+function getRecordingLogger(messages) {
+    return {
+        debug: (message) => {
+            messages.push({ type: "debug", message });
+            console.debug(message);
+        },
+        info: (message) => {
+            messages.push({ type: "info", message });
+            console.info(message);
+        },
+        warning: (message) => {
+            messages.push({ type: "warning", message });
+            console.warn(message);
+        },
+        error: (message) => {
+            messages.push({ type: "error", message });
+            console.error(message);
+        },
+        isDebug: () => true,
+        startGroup: () => undefined,
+        endGroup: () => undefined,
+    };
+}
+exports.getRecordingLogger = getRecordingLogger;
+/** Mock the HTTP request to the feature flags enablement API endpoint. */
+function mockFeatureFlagApiEndpoint(responseStatusCode, response) {
+    // Passing an auth token is required, so we just use a dummy value
+    const client = github.getOctokit("123");
+    const requestSpy = sinon.stub(client, "request");
+    const optInSpy = requestSpy.withArgs("GET /repos/:owner/:repo/code-scanning/codeql-action/features");
+    if (responseStatusCode < 300) {
+        optInSpy.resolves({
+            status: responseStatusCode,
+            data: response,
+            headers: {},
+            url: "GET /repos/:owner/:repo/code-scanning/codeql-action/features",
+        });
+    }
+    else {
+        optInSpy.throws(new util_1.HTTPError("some error message", responseStatusCode));
+    }
+    sinon.stub(apiClient, "getApiClient").value(() => client);
+}
+exports.mockFeatureFlagApiEndpoint = mockFeatureFlagApiEndpoint;
+function mockLanguagesInRepo(languages) {
+    const mockClient = sinon.stub(apiClient, "getApiClient");
+    const listLanguages = sinon.stub().resolves({
+        status: 200,
+        data: languages.reduce((acc, lang) => {
+            acc[lang] = 1;
+            return acc;
+        }, {}),
+        headers: {},
+        url: "GET /repos/:owner/:repo/languages",
+    });
+    mockClient.returns({
+        repos: {
+            listLanguages,
+        },
+    });
+    return listLanguages;
+}
+exports.mockLanguagesInRepo = mockLanguagesInRepo;
+function mockCodeQLVersion(version) {
+    return {
+        async getVersion() {
+            return version;
+        },
+    };
+}
+exports.mockCodeQLVersion = mockCodeQLVersion;
+/**
+ * Create a feature enablement instance with the specified set of enabled features.
+ *
+ * This should be only used within tests.
+ */
+function createFeatures(enabledFeatures) {
+    return {
+        getValue: async (feature) => {
+            return enabledFeatures.includes(feature);
+        },
+    };
+}
+exports.createFeatures = createFeatures;
+//# sourceMappingURL=testing-utils.js.map

github/codeql-action-v1/lib/testing-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing-utils.js","sourceRoot":"","sources":["../src/testing-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,wDAA0C;AAE1C,2CAA6B;AAC7B,6CAA+B;AAE/B,wDAA0C;AAC1C,iDAAmC;AAGnC,iCAAmC;AASnC,SAAS,UAAU,CAAC,OAAoB;IACtC,8CAA8C;IAC9C,gCAAgC;IAChC,2EAA2E;IAC3E,2FAA2F;IAC3F,OAAO,CACL,KAA0B,EAC1B,QAAiB,EACjB,EAA0B,EACjB,EAAE;QACX,2CAA2C;QAC3C,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE;YACtD,EAAE,GAAG,QAAQ,CAAC;YACd,QAAQ,GAAG,SAAS,CAAC;SACtB;QAED,oBAAoB;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YAC7B,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;SAC7B;aAAM;YACL,OAAO,CAAC,UAAU,IAAI,IAAI,WAAW,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC1E;QAED,iDAAiD;QACjD,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE;YAChD,EAAE,EAAE,CAAC;SACN;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,UAAU,CAAC,IAAiB;IAC1C,MAAM,SAAS,GAAG,IAA2B,CAAC;IAE9C,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,gEAAgE;QAChE,0CAA0C;QAC1C,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAErB,iEAAiE;QACjE,CAAC,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAC1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAQ,CAAC;QACpD,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAQ,CAAC;QAEpD,2EAA2E;QAC3E,2EAA2E;QAC3E,yCAAyC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAClC,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;YACvB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;SAC7C;QAED,mEAAmE;QACnE,wEAAwE;QACxE,kEAAkE;QAClE,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,4BAA4B;QAC5B,0DAA0D;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SAC5C;QAED,sCAAsC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEhB,uCAAuC;QACvC,KAAK,CAAC,OAAO,EAAE,CAAC;QAEhB,oCAAoC;QACpC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AApDD,gCAoDC;AAED,yEAAyE;AACzE,sDAAsD;AACtD,SAAgB,gBAAgB,CAAC,OAAe,EAAE,QAAgB;IAChE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,QAAQ,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC;AAC5C,CAAC;AAJD,4CAIC;AAOD,SAAgB,kBAAkB,CAAC,QAAyB;IAC1D,OAAO;QACL,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE;YACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE;YACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,CAAC,OAAuB,EAAE,EAAE;YACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,EAAE,CAAC,OAAuB,EAAE,EAAE;YACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;QACnB,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;QAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAtBD,gDAsBC;AAED,0EAA0E;AAC1E,SAAgB,0BAA0B,CACxC,kBAA0B,EAC1B,QAAyC;IAEzC,kEAAkE;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAClC,8DAA8D,CAC/D,CAAC;IACF,IAAI,kBAAkB,GAAG,GAAG,EAAE;QAC5B,QAAQ,CAAC,QAAQ,CAAC;YAChB,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE;YACX,GAAG,EAAE,8DAA8D;SACpE,CAAC,CAAC;KACJ;SAAM;QACL,QAAQ,CAAC,MAAM,CAAC,IAAI,gBAAS,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC,CAAC;KAC1E;IAED,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;AAC5D,CAAC;AAxBD,gEAwBC;AAED,SAAgB,mBAAmB,CAAC,SAAmB;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC;QACN,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,mCAAmC;KACzC,CAAC,CAAC;IAEH,UAAU,CAAC,OAAO,CAAC;QACjB,KAAK,EAAE;YACL,aAAa;SACd;KACK,CAAC,CAAC;IACV,OAAO,aAAa,CAAC;AACvB,CAAC;AAlBD,kDAkBC;AAED,SAAgB,iBAAiB,CAAC,OAAO;IACvC,OAAO;QACL,KAAK,CAAC,UAAU;YACd,OAAO,OAAO,CAAC;QACjB,CAAC;KACe,CAAC;AACrB,CAAC;AAND,8CAMC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,eAA0B;IACvD,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1B,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAND,wCAMC"}

github/codeql-action-v1/lib/toolrunner-error-catcher.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toolrunnerErrorCatcher = void 0;
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+/**
+ * Wrapper for toolrunner.Toolrunner which checks for specific return code and/or regex matches in console output.
+ * Output will be streamed to the live console as well as captured for subsequent processing.
+ * Returns promise with return code
+ *
+ * @param     commandLine        command to execute
+ * @param     args               optional arguments for tool. Escaping is handled by the lib.
+ * @param     matchers           defines specific codes and/or regexes that should lead to return of a custom error
+ * @param     options            optional exec options.  See ExecOptions
+ * @returns   ReturnState        exit code and stdout output, if applicable
+ */
+async function toolrunnerErrorCatcher(commandLine, args, matchers, options) {
+    var _a, _b;
+    let stdout = "";
+    let stderr = "";
+    const listeners = {
+        stdout: (data) => {
+            var _a;
+            stdout += data.toString();
+            if (((_a = options === null || options === void 0 ? void 0 : options.listeners) === null || _a === void 0 ? void 0 : _a.stdout) !== undefined) {
+                options.listeners.stdout(data);
+            }
+        },
+        stderr: (data) => {
+            var _a;
+            stderr += data.toString();
+            if (((_a = options === null || options === void 0 ? void 0 : options.listeners) === null || _a === void 0 ? void 0 : _a.stderr) !== undefined) {
+                options.listeners.stderr(data);
+            }
+        },
+    };
+    // we capture the original return code or error so that if no match is found we can duplicate the behavior
+    let exitCode;
+    try {
+        exitCode = await new toolrunner.ToolRunner(await safeWhich.safeWhich(commandLine), args, {
+            ...options,
+            listeners,
+            ignoreReturnCode: true, // so we can check for specific codes using the matchers
+        }).exec();
+        // if there is a zero return code then we do not apply the matchers
+        if (exitCode === 0)
+            return { exitCode, stdout };
+        if (matchers) {
+            for (const matcher of matchers) {
+                if (matcher.exitCode === exitCode ||
+                    ((_a = matcher.outputRegex) === null || _a === void 0 ? void 0 : _a.test(stderr)) ||
+                    ((_b = matcher.outputRegex) === null || _b === void 0 ? void 0 : _b.test(stdout))) {
+                    throw new Error(matcher.message);
+                }
+            }
+        }
+        // only if we were instructed to ignore the return code do we ever return it non-zero
+        if (options === null || options === void 0 ? void 0 : options.ignoreReturnCode) {
+            return { exitCode, stdout };
+        }
+        else {
+            throw new Error(`The process '${commandLine}' failed with exit code ${exitCode}`);
+        }
+    }
+    catch (e) {
+        const error = e instanceof Error ? e : new Error(String(e));
+        throw error;
+    }
+}
+exports.toolrunnerErrorCatcher = toolrunnerErrorCatcher;
+//# sourceMappingURL=toolrunner-error-catcher.js.map

github/codeql-action-v1/lib/toolrunner-error-catcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolrunner-error-catcher.js","sourceRoot":"","sources":["../src/toolrunner-error-catcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AACA,yEAA2D;AAC3D,kEAAoD;AASpD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,IAAe,EACf,QAAyB,EACzB,OAAwB;;IAExB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;;YACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,MAAM,MAAK,SAAS,EAAE;gBAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;;YACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,0CAAE,MAAM,MAAK,SAAS,EAAE;gBAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChC;QACH,CAAC;KACF,CAAC;IAEF,0GAA0G;IAC1G,IAAI,QAAgB,CAAC;IACrB,IAAI;QACF,QAAQ,GAAG,MAAM,IAAI,UAAU,CAAC,UAAU,CACxC,MAAM,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EACtC,IAAI,EACJ;YACE,GAAG,OAAO;YACV,SAAS;YACT,gBAAgB,EAAE,IAAI,EAAE,wDAAwD;SACjF,CACF,CAAC,IAAI,EAAE,CAAC;QAET,mEAAmE;QACnE,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAEhD,IAAI,QAAQ,EAAE;YACZ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;gBAC9B,IACE,OAAO,CAAC,QAAQ,KAAK,QAAQ;qBAC7B,MAAA,OAAO,CAAC,WAAW,0CAAE,IAAI,CAAC,MAAM,CAAC,CAAA;qBACjC,MAAA,OAAO,CAAC,WAAW,0CAAE,IAAI,CAAC,MAAM,CAAC,CAAA,EACjC;oBACA,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;iBAClC;aACF;SACF;QAED,qFAAqF;QACrF,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,EAAE;YAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;SAC7B;aAAM;YACL,MAAM,IAAI,KAAK,CACb,gBAAgB,WAAW,2BAA2B,QAAQ,EAAE,CACjE,CAAC;SACH;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,CAAC;KACb;AACH,CAAC;AAhED,wDAgEC"}

github/codeql-action-v1/lib/toolrunner-error-catcher.test.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const exec = __importStar(require("@actions/exec"));
+const ava_1 = __importDefault(require("ava"));
+const testing_utils_1 = require("./testing-utils");
+const toolrunner_error_catcher_1 = require("./toolrunner-error-catcher");
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("matchers are never applied if non-error exit", async (t) => {
+    const testArgs = buildDummyArgs("foo bar\\nblort qux", "foo bar\\nblort qux", "", 0);
+    const matchers = [
+        { exitCode: 123, outputRegex: new RegExp("foo bar"), message: "error!!!" },
+    ];
+    t.deepEqual(await exec.exec("node", testArgs), 0);
+    const returnState = await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, matchers);
+    t.deepEqual(returnState.exitCode, 0);
+});
+(0, ava_1.default)("regex matchers are applied to stdout for non-zero exit code", async (t) => {
+    const testArgs = buildDummyArgs("foo bar\\nblort qux", "", "", 1);
+    const matchers = [
+        { exitCode: 123, outputRegex: new RegExp("foo bar"), message: "🦄" },
+    ];
+    await t.throwsAsync(exec.exec("node", testArgs), {
+        instanceOf: Error,
+        message: /failed with exit code 1/,
+    });
+    await t.throwsAsync((0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, matchers), {
+        instanceOf: Error,
+        message: "🦄",
+    });
+});
+(0, ava_1.default)("regex matchers are applied to stderr for non-zero exit code", async (t) => {
+    const testArgs = buildDummyArgs("non matching string", "foo bar\\nblort qux", "", 1);
+    const matchers = [
+        { exitCode: 123, outputRegex: new RegExp("foo bar"), message: "🦄" },
+    ];
+    await t.throwsAsync(exec.exec("node", testArgs), {
+        instanceOf: Error,
+        message: /failed with exit code 1/,
+    });
+    await t.throwsAsync((0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, matchers), {
+        instanceOf: Error,
+        message: "🦄",
+    });
+});
+(0, ava_1.default)("matcher returns correct error message when multiple matchers defined", async (t) => {
+    const testArgs = buildDummyArgs("non matching string", "foo bar\\nblort qux", "", 1);
+    const matchers = [
+        { exitCode: 456, outputRegex: new RegExp("lorem ipsum"), message: "😩" },
+        { exitCode: 123, outputRegex: new RegExp("foo bar"), message: "🦄" },
+        { exitCode: 789, outputRegex: new RegExp("blah blah"), message: "🤦‍♂️" },
+    ];
+    await t.throwsAsync(exec.exec("node", testArgs), {
+        instanceOf: Error,
+        message: /failed with exit code 1/,
+    });
+    await t.throwsAsync((0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, matchers), {
+        instanceOf: Error,
+        message: "🦄",
+    });
+});
+(0, ava_1.default)("matcher returns first match to regex when multiple matches", async (t) => {
+    const testArgs = buildDummyArgs("non matching string", "foo bar\\nblort qux", "", 1);
+    const matchers = [
+        { exitCode: 123, outputRegex: new RegExp("foo bar"), message: "🦄" },
+        { exitCode: 789, outputRegex: new RegExp("blah blah"), message: "🤦‍♂️" },
+        { exitCode: 987, outputRegex: new RegExp("foo bar"), message: "🚫" },
+    ];
+    await t.throwsAsync(exec.exec("node", testArgs), {
+        instanceOf: Error,
+        message: /failed with exit code 1/,
+    });
+    await t.throwsAsync((0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, matchers), {
+        instanceOf: Error,
+        message: "🦄",
+    });
+});
+(0, ava_1.default)("exit code matchers are applied", async (t) => {
+    const testArgs = buildDummyArgs("non matching string", "foo bar\\nblort qux", "", 123);
+    const matchers = [
+        {
+            exitCode: 123,
+            outputRegex: new RegExp("this will not match"),
+            message: "🦄",
+        },
+    ];
+    await t.throwsAsync(exec.exec("node", testArgs), {
+        instanceOf: Error,
+        message: /failed with exit code 123/,
+    });
+    await t.throwsAsync((0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, matchers), {
+        instanceOf: Error,
+        message: "🦄",
+    });
+});
+(0, ava_1.default)("execErrorCatcher respects the ignoreReturnValue option", async (t) => {
+    const testArgs = buildDummyArgs("standard output", "error output", "", 199);
+    await t.throwsAsync((0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, [], { ignoreReturnCode: false }), { instanceOf: Error });
+    const returnState = await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, [], {
+        ignoreReturnCode: true,
+    });
+    t.deepEqual(returnState.exitCode, 199);
+});
+(0, ava_1.default)("execErrorCatcher preserves behavior of provided listeners", async (t) => {
+    const stdoutExpected = "standard output";
+    const stderrExpected = "error output";
+    let stdoutActual = "";
+    let stderrActual = "";
+    const listeners = {
+        stdout: (data) => {
+            stdoutActual += data.toString();
+        },
+        stderr: (data) => {
+            stderrActual += data.toString();
+        },
+    };
+    const testArgs = buildDummyArgs(stdoutExpected, stderrExpected, "", 0);
+    const returnState = await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)("node", testArgs, [], {
+        listeners,
+    });
+    t.deepEqual(returnState.exitCode, 0);
+    t.deepEqual(stdoutActual, `${stdoutExpected}\n`);
+    t.deepEqual(stderrActual, `${stderrExpected}\n`);
+});
+function buildDummyArgs(stdoutContents, stderrContents, desiredErrorMessage, desiredExitCode) {
+    let command = "";
+    if (stdoutContents)
+        command += `console.log("${stdoutContents}");`;
+    if (stderrContents)
+        command += `console.error("${stderrContents}");`;
+    if (command.length === 0)
+        throw new Error("Must provide contents for either stdout or stderr");
+    if (desiredErrorMessage)
+        command += `throw new Error("${desiredErrorMessage}");`;
+    if (desiredExitCode)
+        command += `process.exitCode = ${desiredExitCode};`;
+    return ["-e", command];
+}
+//# sourceMappingURL=toolrunner-error-catcher.test.js.map

github/codeql-action-v1/lib/tracer-config.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCombinedTracerConfig = exports.concatTracerConfigs = exports.getTracerConfigForLanguage = exports.getTracerConfigForCluster = exports.endTracingForCluster = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const codeql_1 = require("./codeql");
+const languages_1 = require("./languages");
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+const CRITICAL_TRACER_VARS = new Set([
+    "SEMMLE_PRELOAD_libtrace",
+    "SEMMLE_RUNNER",
+    "SEMMLE_COPY_EXECUTABLES_ROOT",
+    "SEMMLE_DEPTRACE_SOCKET",
+    "SEMMLE_JAVA_TOOL_OPTIONS",
+]);
+async function endTracingForCluster(config) {
+    // If there are no traced languages, we don't need to do anything.
+    if (!config.languages.some((l) => (0, languages_1.isTracedLanguage)(l)))
+        return;
+    const envVariablesFile = path.resolve(config.dbLocation, "temp/tracingEnvironment/end-tracing.json");
+    if (!fs.existsSync(envVariablesFile)) {
+        throw new Error(`Environment file for ending tracing not found: ${envVariablesFile}`);
+    }
+    try {
+        const endTracingEnvVariables = JSON.parse(fs.readFileSync(envVariablesFile, "utf8"));
+        for (const [key, value] of Object.entries(endTracingEnvVariables)) {
+            if (value !== null) {
+                process.env[key] = value;
+            }
+            else {
+                delete process.env[key];
+            }
+        }
+    }
+    catch (e) {
+        throw new Error(`Failed to parse file containing end tracing environment variables: ${e}`);
+    }
+}
+exports.endTracingForCluster = endTracingForCluster;
+async function getTracerConfigForCluster(config) {
+    const tracingEnvVariables = JSON.parse(fs.readFileSync(path.resolve(config.dbLocation, "temp/tracingEnvironment/start-tracing.json"), "utf8"));
+    return {
+        spec: tracingEnvVariables["ODASA_TRACER_CONFIGURATION"],
+        env: tracingEnvVariables,
+    };
+}
+exports.getTracerConfigForCluster = getTracerConfigForCluster;
+async function getTracerConfigForLanguage(codeql, config, language) {
+    const env = await codeql.getTracerEnv(util.getCodeQLDatabasePath(config, language));
+    const spec = env["ODASA_TRACER_CONFIGURATION"];
+    const info = { spec, env: {} };
+    // Extract critical tracer variables from the environment
+    for (const entry of Object.entries(env)) {
+        const key = entry[0];
+        const value = entry[1];
+        // skip ODASA_TRACER_CONFIGURATION as it is handled separately
+        if (key === "ODASA_TRACER_CONFIGURATION") {
+            continue;
+        }
+        // skip undefined values
+        if (typeof value === "undefined") {
+            continue;
+        }
+        // Keep variables that do not exist in current environment. In addition always keep
+        // critical and CODEQL_ variables
+        if (typeof process.env[key] === "undefined" ||
+            CRITICAL_TRACER_VARS.has(key) ||
+            key.startsWith("CODEQL_")) {
+            info.env[key] = value;
+        }
+    }
+    return info;
+}
+exports.getTracerConfigForLanguage = getTracerConfigForLanguage;
+function concatTracerConfigs(tracerConfigs, config, writeBothEnvironments = false) {
+    // A tracer config is a map containing additional environment variables and a tracer 'spec' file.
+    // A tracer 'spec' file has the following format [log_file, number_of_blocks, blocks_text]
+    // Merge the environments
+    const env = {};
+    let copyExecutables = false;
+    let envSize = 0;
+    for (const v of Object.values(tracerConfigs)) {
+        for (const e of Object.entries(v.env)) {
+            const name = e[0];
+            const value = e[1];
+            // skip SEMMLE_COPY_EXECUTABLES_ROOT as it is handled separately
+            if (name === "SEMMLE_COPY_EXECUTABLES_ROOT") {
+                copyExecutables = true;
+            }
+            else if (name in env) {
+                if (env[name] !== value) {
+                    throw Error(`Incompatible values in environment parameter ${name}: ${env[name]} and ${value}`);
+                }
+            }
+            else {
+                env[name] = value;
+                envSize += 1;
+            }
+        }
+    }
+    // Concatenate spec files into a new spec file
+    const languages = Object.keys(tracerConfigs);
+    const cppIndex = languages.indexOf("cpp");
+    // Make sure cpp is the last language, if it's present since it must be concatenated last
+    if (cppIndex !== -1) {
+        const lastLang = languages[languages.length - 1];
+        languages[languages.length - 1] = languages[cppIndex];
+        languages[cppIndex] = lastLang;
+    }
+    const totalLines = [];
+    let totalCount = 0;
+    for (const lang of languages) {
+        const lines = fs
+            .readFileSync(tracerConfigs[lang].spec, "utf8")
+            .split(/\r?\n/);
+        const count = parseInt(lines[1], 10);
+        totalCount += count;
+        totalLines.push(...lines.slice(2));
+    }
+    const newLogFilePath = path.resolve(config.tempDir, "compound-build-tracer.log");
+    const spec = path.resolve(config.tempDir, "compound-spec");
+    const compoundTempFolder = path.resolve(config.tempDir, "compound-temp");
+    const newSpecContent = [
+        newLogFilePath,
+        totalCount.toString(10),
+        ...totalLines,
+    ];
+    if (copyExecutables) {
+        env["SEMMLE_COPY_EXECUTABLES_ROOT"] = compoundTempFolder;
+        envSize += 1;
+    }
+    fs.writeFileSync(spec, newSpecContent.join("\n"));
+    if (writeBothEnvironments || process.platform !== "win32") {
+        // Prepare the content of the compound environment file on Unix
+        let buffer = Buffer.alloc(4);
+        buffer.writeInt32LE(envSize, 0);
+        for (const e of Object.entries(env)) {
+            const key = e[0];
+            const value = e[1];
+            const lineBuffer = Buffer.from(`${key}=${value}\0`, "utf8");
+            const sizeBuffer = Buffer.alloc(4);
+            sizeBuffer.writeInt32LE(lineBuffer.length, 0);
+            buffer = Buffer.concat([buffer, sizeBuffer, lineBuffer]);
+        }
+        // Write the compound environment for Unix
+        const envPath = `${spec}.environment`;
+        fs.writeFileSync(envPath, buffer);
+    }
+    if (writeBothEnvironments || process.platform === "win32") {
+        // Prepare the content of the compound environment file on Windows
+        let bufferWindows = Buffer.alloc(0);
+        let length = 0;
+        for (const e of Object.entries(env)) {
+            const key = e[0];
+            const value = e[1];
+            const string = `${key}=${value}\0`;
+            length += string.length;
+            const lineBuffer = Buffer.from(string, "utf16le");
+            bufferWindows = Buffer.concat([bufferWindows, lineBuffer]);
+        }
+        const sizeBuffer = Buffer.alloc(4);
+        sizeBuffer.writeInt32LE(length + 1, 0); // Add one for trailing null character marking end
+        const trailingNull = Buffer.from(`\0`, "utf16le");
+        bufferWindows = Buffer.concat([sizeBuffer, bufferWindows, trailingNull]);
+        // Write the compound environment for Windows
+        const envPathWindows = `${spec}.win32env`;
+        fs.writeFileSync(envPathWindows, bufferWindows);
+    }
+    return { env, spec };
+}
+exports.concatTracerConfigs = concatTracerConfigs;
+async function getCombinedTracerConfig(config, codeql) {
+    // Abort if there are no traced languages as there's nothing to do
+    const tracedLanguages = config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l));
+    if (tracedLanguages.length === 0) {
+        return undefined;
+    }
+    let mainTracerConfig;
+    if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+        mainTracerConfig = await getTracerConfigForCluster(config);
+    }
+    else {
+        // Get all the tracer configs and combine them together
+        const tracedLanguageConfigs = {};
+        for (const language of tracedLanguages) {
+            tracedLanguageConfigs[language] = await getTracerConfigForLanguage(codeql, config, language);
+        }
+        mainTracerConfig = concatTracerConfigs(tracedLanguageConfigs, config);
+        // Add a couple more variables
+        mainTracerConfig.env["ODASA_TRACER_CONFIGURATION"] = mainTracerConfig.spec;
+        const codeQLDir = path.dirname(codeql.getPath());
+        if (process.platform === "darwin") {
+            mainTracerConfig.env["DYLD_INSERT_LIBRARIES"] = path.join(codeQLDir, "tools", "osx64", "libtrace.dylib");
+        }
+        else if (process.platform !== "win32") {
+            mainTracerConfig.env["LD_PRELOAD"] = path.join(codeQLDir, "tools", "linux64", "${LIB}trace.so");
+        }
+    }
+    // On macos it's necessary to prefix the build command with the runner executable
+    // on order to trace when System Integrity Protection is enabled.
+    // The executable also exists and works for other platforms so we output this env
+    // var with a path to the runner regardless so it's always available.
+    const runnerExeName = process.platform === "win32" ? "runner.exe" : "runner";
+    mainTracerConfig.env["CODEQL_RUNNER"] = path.join(mainTracerConfig.env["CODEQL_DIST"], "tools", mainTracerConfig.env["CODEQL_PLATFORM"], runnerExeName);
+    return mainTracerConfig;
+}
+exports.getCombinedTracerConfig = getCombinedTracerConfig;
+//# sourceMappingURL=tracer-config.js.map

github/codeql-action-v1/lib/tracer-config.test.js

@@ -0,0 +1,331 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const ava_1 = __importDefault(require("ava"));
+const codeql_1 = require("./codeql");
+const configUtils = __importStar(require("./config-utils"));
+const languages_1 = require("./languages");
+const testing_utils_1 = require("./testing-utils");
+const tracer_config_1 = require("./tracer-config");
+const util = __importStar(require("./util"));
+(0, testing_utils_1.setupTests)(ava_1.default);
+function getTestConfig(tmpDir) {
+    return {
+        languages: [languages_1.Language.java],
+        queries: {},
+        pathsIgnore: [],
+        paths: [],
+        originalUserInput: {},
+        tempDir: tmpDir,
+        codeQLCmd: "",
+        gitHubVersion: { type: util.GitHubVariant.DOTCOM },
+        dbLocation: path.resolve(tmpDir, "codeql_databases"),
+        packs: {},
+        debugMode: false,
+        debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
+        debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
+        augmentationProperties: configUtils.defaultAugmentationProperties,
+        trapCaches: {},
+        trapCacheDownloadTime: 0,
+    };
+}
+// A very minimal setup
+(0, ava_1.default)("getTracerConfigForLanguage - minimal setup", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: "abc",
+                    foo: "bar",
+                };
+            },
+        });
+        const result = await (0, tracer_config_1.getTracerConfigForLanguage)(codeQL, config, languages_1.Language.javascript);
+        t.deepEqual(result, { spec: "abc", env: { foo: "bar" } });
+    });
+});
+// Existing vars should not be overwritten, unless they are critical or prefixed with CODEQL_
+(0, ava_1.default)("getTracerConfigForLanguage - existing / critical vars", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        // Set up some variables in the environment
+        process.env["foo"] = "abc";
+        process.env["SEMMLE_PRELOAD_libtrace"] = "abc";
+        process.env["SEMMLE_RUNNER"] = "abc";
+        process.env["SEMMLE_COPY_EXECUTABLES_ROOT"] = "abc";
+        process.env["SEMMLE_DEPTRACE_SOCKET"] = "abc";
+        process.env["SEMMLE_JAVA_TOOL_OPTIONS"] = "abc";
+        process.env["CODEQL_VAR"] = "abc";
+        // Now CodeQL returns all these variables, and one more, with different values
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: "abc",
+                    foo: "bar",
+                    baz: "qux",
+                    SEMMLE_PRELOAD_libtrace: "SEMMLE_PRELOAD_libtrace",
+                    SEMMLE_RUNNER: "SEMMLE_RUNNER",
+                    SEMMLE_COPY_EXECUTABLES_ROOT: "SEMMLE_COPY_EXECUTABLES_ROOT",
+                    SEMMLE_DEPTRACE_SOCKET: "SEMMLE_DEPTRACE_SOCKET",
+                    SEMMLE_JAVA_TOOL_OPTIONS: "SEMMLE_JAVA_TOOL_OPTIONS",
+                    CODEQL_VAR: "CODEQL_VAR",
+                };
+            },
+        });
+        const result = await (0, tracer_config_1.getTracerConfigForLanguage)(codeQL, config, languages_1.Language.javascript);
+        t.deepEqual(result, {
+            spec: "abc",
+            env: {
+                // Should contain all variables except 'foo', because that already existed in the
+                // environment with a different value, and is not deemed a "critical" variable.
+                baz: "qux",
+                SEMMLE_PRELOAD_libtrace: "SEMMLE_PRELOAD_libtrace",
+                SEMMLE_RUNNER: "SEMMLE_RUNNER",
+                SEMMLE_COPY_EXECUTABLES_ROOT: "SEMMLE_COPY_EXECUTABLES_ROOT",
+                SEMMLE_DEPTRACE_SOCKET: "SEMMLE_DEPTRACE_SOCKET",
+                SEMMLE_JAVA_TOOL_OPTIONS: "SEMMLE_JAVA_TOOL_OPTIONS",
+                CODEQL_VAR: "CODEQL_VAR",
+            },
+        });
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - minimal configs correctly combined", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec1 = path.join(tmpDir, "spec1");
+        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
+        const tc1 = {
+            spec: spec1,
+            env: {
+                a: "a",
+                b: "b",
+            },
+        };
+        const spec2 = path.join(tmpDir, "spec2");
+        fs.writeFileSync(spec2, "foo.log\n1\nghi");
+        const tc2 = {
+            spec: spec2,
+            env: {
+                c: "c",
+            },
+        };
+        const result = (0, tracer_config_1.concatTracerConfigs)({ javascript: tc1, python: tc2 }, config);
+        t.deepEqual(result, {
+            spec: path.join(tmpDir, "compound-spec"),
+            env: {
+                a: "a",
+                b: "b",
+                c: "c",
+            },
+        });
+        t.true(fs.existsSync(result.spec));
+        t.deepEqual(fs.readFileSync(result.spec, "utf8"), `${path.join(tmpDir, "compound-build-tracer.log")}\n3\nabc\ndef\nghi`);
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - conflicting env vars", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec = path.join(tmpDir, "spec");
+        fs.writeFileSync(spec, "foo.log\n0");
+        // Ok if env vars have the same name and the same value
+        t.deepEqual((0, tracer_config_1.concatTracerConfigs)({
+            javascript: { spec, env: { a: "a", b: "b" } },
+            python: { spec, env: { b: "b", c: "c" } },
+        }, config).env, {
+            a: "a",
+            b: "b",
+            c: "c",
+        });
+        // Throws if env vars have same name but different values
+        const e = t.throws(() => (0, tracer_config_1.concatTracerConfigs)({
+            javascript: { spec, env: { a: "a", b: "b" } },
+            python: { spec, env: { b: "c" } },
+        }, config));
+        // If e is undefined, then the previous assertion will fail.
+        if (e !== undefined) {
+            t.deepEqual(e.message, "Incompatible values in environment parameter b: b and c");
+        }
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - cpp spec lines come last if present", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec1 = path.join(tmpDir, "spec1");
+        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
+        const tc1 = {
+            spec: spec1,
+            env: {
+                a: "a",
+                b: "b",
+            },
+        };
+        const spec2 = path.join(tmpDir, "spec2");
+        fs.writeFileSync(spec2, "foo.log\n1\nghi");
+        const tc2 = {
+            spec: spec2,
+            env: {
+                c: "c",
+            },
+        };
+        const result = (0, tracer_config_1.concatTracerConfigs)({ cpp: tc1, python: tc2 }, config);
+        t.deepEqual(result, {
+            spec: path.join(tmpDir, "compound-spec"),
+            env: {
+                a: "a",
+                b: "b",
+                c: "c",
+            },
+        });
+        t.true(fs.existsSync(result.spec));
+        t.deepEqual(fs.readFileSync(result.spec, "utf8"), `${path.join(tmpDir, "compound-build-tracer.log")}\n3\nghi\nabc\ndef`);
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - SEMMLE_COPY_EXECUTABLES_ROOT is updated to point to compound spec", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec = path.join(tmpDir, "spec");
+        fs.writeFileSync(spec, "foo.log\n0");
+        const result = (0, tracer_config_1.concatTracerConfigs)({
+            javascript: { spec, env: { a: "a", b: "b" } },
+            python: { spec, env: { SEMMLE_COPY_EXECUTABLES_ROOT: "foo" } },
+        }, config);
+        t.deepEqual(result.env, {
+            a: "a",
+            b: "b",
+            SEMMLE_COPY_EXECUTABLES_ROOT: path.join(tmpDir, "compound-temp"),
+        });
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - compound environment file is created correctly", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec1 = path.join(tmpDir, "spec1");
+        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
+        const tc1 = {
+            spec: spec1,
+            env: {
+                a: "a",
+            },
+        };
+        const spec2 = path.join(tmpDir, "spec2");
+        fs.writeFileSync(spec2, "foo.log\n1\nghi");
+        const tc2 = {
+            spec: spec2,
+            env: {
+                foo: "bar_baz",
+            },
+        };
+        const result = (0, tracer_config_1.concatTracerConfigs)({ javascript: tc1, python: tc2 }, config, true);
+        // Check binary contents for the Unix file
+        const envPath = `${result.spec}.environment`;
+        t.true(fs.existsSync(envPath));
+        const buffer = fs.readFileSync(envPath);
+        t.deepEqual(buffer.length, 28);
+        t.deepEqual(buffer.readInt32LE(0), 2); // number of env vars
+        t.deepEqual(buffer.readInt32LE(4), 4); // length of env var definition
+        t.deepEqual(buffer.toString("utf8", 8, 12), "a=a\0"); // [key]=[value]\0
+        t.deepEqual(buffer.readInt32LE(12), 12); // length of env var definition
+        t.deepEqual(buffer.toString("utf8", 16, 28), "foo=bar_baz\0"); // [key]=[value]\0
+        // Check binary contents for the Windows file
+        const envPathWindows = `${result.spec}.win32env`;
+        t.true(fs.existsSync(envPathWindows));
+        const bufferWindows = fs.readFileSync(envPathWindows);
+        t.deepEqual(bufferWindows.length, 38);
+        t.deepEqual(bufferWindows.readInt32LE(0), 4 + 12 + 1); // number of tchars to represent the environment
+        t.deepEqual(bufferWindows.toString("utf16le", 4, 12), "a=a\0"); // [key]=[value]\0
+        t.deepEqual(bufferWindows.toString("utf16le", 12, 36), "foo=bar_baz\0"); // [key]=[value]\0
+        t.deepEqual(bufferWindows.toString("utf16le", 36, 38), "\0"); // trailing null character
+    });
+});
+(0, ava_1.default)("getCombinedTracerConfig - return undefined when no languages are traced languages", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        // No traced languages
+        config.languages = [languages_1.Language.javascript, languages_1.Language.python];
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: "abc",
+                    CODEQL_DIST: "/",
+                    foo: "bar",
+                };
+            },
+        });
+        t.deepEqual(await (0, tracer_config_1.getCombinedTracerConfig)(config, codeQL), undefined);
+    });
+});
+(0, ava_1.default)("getCombinedTracerConfig - valid spec file", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec = path.join(tmpDir, "spec");
+        fs.writeFileSync(spec, "foo.log\n2\nabc\ndef");
+        const bundlePath = path.join(tmpDir, "bundle");
+        const codeqlPlatform = process.platform === "win32"
+            ? "win64"
+            : process.platform === "darwin"
+                ? "osx64"
+                : "linux64";
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: spec,
+                    CODEQL_DIST: bundlePath,
+                    CODEQL_PLATFORM: codeqlPlatform,
+                    foo: "bar",
+                };
+            },
+        });
+        const result = await (0, tracer_config_1.getCombinedTracerConfig)(config, codeQL);
+        t.notDeepEqual(result, undefined);
+        const expectedEnv = {
+            foo: "bar",
+            CODEQL_DIST: bundlePath,
+            CODEQL_PLATFORM: codeqlPlatform,
+            ODASA_TRACER_CONFIGURATION: result.spec,
+        };
+        if (process.platform === "darwin") {
+            expectedEnv["DYLD_INSERT_LIBRARIES"] = path.join(path.dirname(codeQL.getPath()), "tools", "osx64", "libtrace.dylib");
+        }
+        else if (process.platform !== "win32") {
+            expectedEnv["LD_PRELOAD"] = path.join(path.dirname(codeQL.getPath()), "tools", "linux64", "${LIB}trace.so");
+        }
+        if (process.platform === "win32") {
+            expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/win64/runner.exe");
+        }
+        else if (process.platform === "darwin") {
+            expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/osx64/runner");
+        }
+        else {
+            expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/linux64/runner");
+        }
+        t.deepEqual(result, {
+            spec: path.join(tmpDir, "compound-spec"),
+            env: expectedEnv,
+        });
+    });
+});
+//# sourceMappingURL=tracer-config.test.js.map

github/codeql-action-v1/lib/trap-caching.js

@@ -0,0 +1,196 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTotalCacheSize = exports.getLanguagesSupportingCaching = exports.uploadTrapCaches = exports.downloadTrapCaches = exports.getTrapCachingExtractorConfigArgsForLang = exports.getTrapCachingExtractorConfigArgs = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const cache = __importStar(require("@actions/cache"));
+const actionsUtil = __importStar(require("./actions-util"));
+const codeql_1 = require("./codeql");
+const util_1 = require("./util");
+// This constant should be bumped if we make a breaking change
+// to how the CodeQL Action stores or retrieves the TRAP cache,
+// and will invalidate previous caches. We don't need to bump
+// this for CLI/extractor changes, since the CLI version also
+// goes into the cache key.
+const CACHE_VERSION = 1;
+// This constant sets the size of each TRAP cache in megabytes.
+const CACHE_SIZE_MB = 1024;
+// This constant sets the minimum size in megabytes of a TRAP
+// cache for us to consider it worth uploading.
+const MINIMUM_CACHE_MB_TO_UPLOAD = 10;
+// The maximum number of milliseconds to wait for TRAP cache
+// uploads or downloads to complete before continuing. Note
+// this timeout is per operation, so will be run as many
+// times as there are languages with TRAP caching enabled.
+const MAX_CACHE_OPERATION_MS = 120000; // Two minutes
+async function getTrapCachingExtractorConfigArgs(config) {
+    const result = [];
+    for (const language of config.languages)
+        result.push(await getTrapCachingExtractorConfigArgsForLang(config, language));
+    return result.flat();
+}
+exports.getTrapCachingExtractorConfigArgs = getTrapCachingExtractorConfigArgs;
+async function getTrapCachingExtractorConfigArgsForLang(config, language) {
+    const cacheDir = config.trapCaches[language];
+    if (cacheDir === undefined)
+        return [];
+    const write = await actionsUtil.isAnalyzingDefaultBranch();
+    return [
+        `-O=${language}.trap.cache.dir=${cacheDir}`,
+        `-O=${language}.trap.cache.bound=${CACHE_SIZE_MB}`,
+        `-O=${language}.trap.cache.write=${write}`,
+    ];
+}
+exports.getTrapCachingExtractorConfigArgsForLang = getTrapCachingExtractorConfigArgsForLang;
+/**
+ * Download TRAP caches from the Actions cache.
+ * @param codeql The CodeQL instance to use.
+ * @param languages The languages being analyzed.
+ * @param logger A logger to record some informational messages to.
+ * @returns A partial map from languages to TRAP cache paths on disk, with
+ * languages for which we shouldn't use TRAP caching omitted.
+ */
+async function downloadTrapCaches(codeql, languages, logger) {
+    var _a, _b;
+    const result = {};
+    const languagesSupportingCaching = await getLanguagesSupportingCaching(codeql, languages, logger);
+    logger.info(`Found ${languagesSupportingCaching.length} languages that support TRAP caching`);
+    if (languagesSupportingCaching.length === 0)
+        return result;
+    const cachesDir = path.join(actionsUtil.getTemporaryDirectory(), "trapCaches");
+    for (const language of languagesSupportingCaching) {
+        const cacheDir = path.join(cachesDir, language);
+        fs.mkdirSync(cacheDir, { recursive: true });
+        result[language] = cacheDir;
+    }
+    if (await actionsUtil.isAnalyzingDefaultBranch()) {
+        logger.info("Analyzing default branch. Skipping downloading of TRAP caches.");
+        return result;
+    }
+    let baseSha = "unknown";
+    const eventPath = process.env.GITHUB_EVENT_PATH;
+    if (actionsUtil.workflowEventName() === "pull_request" &&
+        eventPath !== undefined) {
+        const event = JSON.parse(fs.readFileSync(path.resolve(eventPath), "utf-8"));
+        baseSha = ((_b = (_a = event.pull_request) === null || _a === void 0 ? void 0 : _a.base) === null || _b === void 0 ? void 0 : _b.sha) || baseSha;
+    }
+    for (const language of languages) {
+        const cacheDir = result[language];
+        if (cacheDir === undefined)
+            continue;
+        // The SHA from the base of the PR is the most similar commit we might have a cache for
+        const preferredKey = await cacheKey(codeql, language, baseSha);
+        logger.info(`Looking in Actions cache for TRAP cache with key ${preferredKey}`);
+        const found = await (0, util_1.withTimeout)(MAX_CACHE_OPERATION_MS, cache.restoreCache([cacheDir], preferredKey, [
+            // Fall back to any cache with the right key prefix
+            await cachePrefix(codeql, language),
+        ]), () => {
+            logger.info(`Timed out downloading cache for ${language}, will continue without it`);
+        });
+        if (found === undefined) {
+            // We didn't find a TRAP cache in the Actions cache, so the directory on disk is
+            // still just an empty directory. There's no reason to tell the extractor to use it,
+            // so let's unset the entry in the map so we don't set any extractor options.
+            logger.info(`No TRAP cache found in Actions cache for ${language}`);
+            delete result[language];
+        }
+    }
+    return result;
+}
+exports.downloadTrapCaches = downloadTrapCaches;
+/**
+ * Possibly upload TRAP caches to the Actions cache.
+ * @param codeql The CodeQL instance to use.
+ * @param config The configuration for this workflow.
+ * @param logger A logger to record some informational messages to.
+ * @returns Whether the TRAP caches were uploaded.
+ */
+async function uploadTrapCaches(codeql, config, logger) {
+    if (!(await actionsUtil.isAnalyzingDefaultBranch()))
+        return false; // Only upload caches from the default branch
+    for (const language of config.languages) {
+        const cacheDir = config.trapCaches[language];
+        if (cacheDir === undefined)
+            continue;
+        const trapFolderSize = await (0, util_1.tryGetFolderBytes)(cacheDir, logger);
+        if (trapFolderSize === undefined) {
+            logger.info(`Skipping upload of TRAP cache for ${language} as we couldn't determine its size`);
+            continue;
+        }
+        if (trapFolderSize < MINIMUM_CACHE_MB_TO_UPLOAD * 1048576) {
+            logger.info(`Skipping upload of TRAP cache for ${language} as it is too small`);
+            continue;
+        }
+        const key = await cacheKey(codeql, language, process.env.GITHUB_SHA || "unknown");
+        logger.info(`Uploading TRAP cache to Actions cache with key ${key}`);
+        await (0, util_1.withTimeout)(MAX_CACHE_OPERATION_MS, cache.saveCache([cacheDir], key), () => {
+            logger.info(`Timed out waiting for TRAP cache for ${language} to upload, will continue without uploading`);
+        });
+    }
+    return true;
+}
+exports.uploadTrapCaches = uploadTrapCaches;
+async function getLanguagesSupportingCaching(codeql, languages, logger) {
+    var _a, _b, _c, _d;
+    const result = [];
+    if (!(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES)))
+        return result;
+    const resolveResult = await codeql.betterResolveLanguages();
+    outer: for (const lang of languages) {
+        const extractorsForLanguage = resolveResult.extractors[lang];
+        if (extractorsForLanguage === undefined) {
+            logger.info(`${lang} does not support TRAP caching (couldn't find an extractor)`);
+            continue;
+        }
+        if (extractorsForLanguage.length !== 1) {
+            logger.info(`${lang} does not support TRAP caching (found multiple extractors)`);
+            continue;
+        }
+        const extractor = extractorsForLanguage[0];
+        const trapCacheOptions = (_d = (_c = (_b = (_a = extractor.extractor_options) === null || _a === void 0 ? void 0 : _a.trap) === null || _b === void 0 ? void 0 : _b.properties) === null || _c === void 0 ? void 0 : _c.cache) === null || _d === void 0 ? void 0 : _d.properties;
+        if (trapCacheOptions === undefined) {
+            logger.info(`${lang} does not support TRAP caching (missing option group)`);
+            continue;
+        }
+        for (const requiredOpt of ["dir", "bound", "write"]) {
+            if (!(requiredOpt in trapCacheOptions)) {
+                logger.info(`${lang} does not support TRAP caching (missing ${requiredOpt} option)`);
+                continue outer;
+            }
+        }
+        result.push(lang);
+    }
+    return result;
+}
+exports.getLanguagesSupportingCaching = getLanguagesSupportingCaching;
+async function getTotalCacheSize(trapCaches, logger) {
+    const sizes = await Promise.all(Object.values(trapCaches).map((cacheDir) => (0, util_1.tryGetFolderBytes)(cacheDir, logger)));
+    return sizes.map((a) => a || 0).reduce((a, b) => a + b, 0);
+}
+exports.getTotalCacheSize = getTotalCacheSize;
+async function cacheKey(codeql, language, baseSha) {
+    return `${await cachePrefix(codeql, language)}${baseSha}`;
+}
+async function cachePrefix(codeql, language) {
+    return `codeql-trap-${CACHE_VERSION}-${await codeql.getVersion()}-${language}-`;
+}
+//# sourceMappingURL=trap-caching.js.map