Merge branch 'main' into robertbrignull/external-token-option

src/tracer-config.test.ts

@@ -302,6 +302,7 @@ test("getCombinedTracerConfig - return undefined when no languages are traced la
       async getTracerEnv() {
         return {
           ODASA_TRACER_CONFIGURATION: "abc",
+          CODEQL_DIST: "/",
           foo: "bar",
         };
       },
@@ -318,21 +319,35 @@ test("getCombinedTracerConfig - valid spec file", async (t) => {
     const spec = path.join(tmpDir, "spec");
     fs.writeFileSync(spec, "foo.log\n2\nabc\ndef");
 
+    const bundlePath = path.join(tmpDir, "bundle");
+    const codeqlPlatform =
+      process.platform === "win32"
+        ? "win64"
+        : process.platform === "darwin"
+        ? "osx64"
+        : "linux64";
+
     const codeQL = setCodeQL({
       async getTracerEnv() {
         return {
           ODASA_TRACER_CONFIGURATION: spec,
+          CODEQL_DIST: bundlePath,
+          CODEQL_PLATFORM: codeqlPlatform,
           foo: "bar",
         };
       },
     });
 
     const result = await getCombinedTracerConfig(config, codeQL);
+    t.notDeepEqual(result, undefined);
 
     const expectedEnv = {
       foo: "bar",
+      CODEQL_DIST: bundlePath,
+      CODEQL_PLATFORM: codeqlPlatform,
       ODASA_TRACER_CONFIGURATION: result!.spec,
     };
+
     if (process.platform === "darwin") {
       expectedEnv["DYLD_INSERT_LIBRARIES"] = path.join(
         path.dirname(codeQL.getPath()),
@@ -349,6 +364,23 @@ test("getCombinedTracerConfig - valid spec file", async (t) => {
       );
     }
 
+    if (process.platform === "win32") {
+      expectedEnv["CODEQL_RUNNER"] = path.join(
+        bundlePath,
+        "tools/win64/runner.exe"
+      );
+    } else if (process.platform === "darwin") {
+      expectedEnv["CODEQL_RUNNER"] = path.join(
+        bundlePath,
+        "tools/osx64/runner"
+      );
+    } else {
+      expectedEnv["CODEQL_RUNNER"] = path.join(
+        bundlePath,
+        "tools/linux64/runner"
+      );
+    }
+
     t.deepEqual(result, {
       spec: path.join(tmpDir, "compound-spec"),
       env: expectedEnv,

src/tracer-config.ts

@@ -185,5 +185,17 @@ export async function getCombinedTracerConfig(
     );
   }
 
+  // On macos it's necessary to prefix the build command with the runner exectuable
+  // on order to trace when System Integrity Protection is enabled.
+  // The exectuable also exists and works for other platforms so we output this env
+  // var with a path to the runner regardless so it's always available.
+  const runnerExeName = process.platform === "win32" ? "runner.exe" : "runner";
+  mainTracerConfig.env["CODEQL_RUNNER"] = path.join(
+    mainTracerConfig.env["CODEQL_DIST"],
+    "tools",
+    mainTracerConfig.env["CODEQL_PLATFORM"],
+    runnerExeName
+  );
+
   return mainTracerConfig;
 }

src/upload-lib.test.ts

@@ -73,8 +73,8 @@ test("validate correct payload used per version", async (t) => {
       version,
       "actions"
     );
-    t.truthy(payload.base_ref);
-    t.truthy(payload.base_sha);
+    t.deepEqual(payload.base_ref, "refs/heads/master");
+    t.deepEqual(payload.base_sha, "f95f852bd8fca8fcc58a9a2d6c842781e32a215e");
   }
 
   for (const version of oldVersions) {

src/upload-lib.ts

@@ -258,7 +258,7 @@ export function buildPayload(
         const githubEvent = JSON.parse(
           fs.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8")
         );
-        payloadObj.base_ref = `refs/heads/$githubEvent.pull_request.base.ref`;
+        payloadObj.base_ref = `refs/heads/${githubEvent.pull_request.base.ref}`;
         payloadObj.base_sha = githubEvent.pull_request.base.sha;
       }
     }