Move extraQueryExclusions out of AugmentationProperties

src/codeql.ts

@@ -13,7 +13,7 @@ import {
 } from "./actions-util";
 import * as api from "./api-client";
 import { CliError, wrapCliConfigurationError } from "./cli-errors";
-import { type Config } from "./config-utils";
+import { appendExtraQueryExclusions, type Config } from "./config-utils";
 import { DocUrl } from "./doc-url";
 import { EnvVar } from "./environment";
 import {
@@ -1149,11 +1149,11 @@ async function runCli(
 }
 
 /**
- * Generates a code scanning configuration that is to be used for a scan.
+ * Writes the code scanning configuration that is to be used by the CLI.
  *
  * @param codeql The CodeQL object to use.
- * @param config The configuration to use.
- * @returns the path to the generated user configuration file.
+ * @param config The CodeQL Action state to use.
+ * @returns The path to the generated user configuration file.
  */
 async function writeCodeScanningConfigFile(
   config: Config,
@@ -1161,14 +1161,24 @@ async function writeCodeScanningConfigFile(
 ): Promise<string> {
   const codeScanningConfigFile = getGeneratedCodeScanningConfigPath(config);
 
+  // Apply the `extraQueryExclusions` from the CodeQL Action state to the CLI configuration.
+  // We do this here at the latest possible point before passing the CLI configuration on to
+  // the CLI so that the `extraQueryExclusions` appear after all user-configured `query-filters`.
+  // See the comment in `applyExtraQueryExclusions` for more information, as well as
+  // https://github.com/github/codeql-action/pull/2938
+  const augmentedConfig = appendExtraQueryExclusions(
+    config.extraQueryExclusions,
+    config.computedConfig,
+  );
+
   logger.info(
     `Writing augmented user configuration file to ${codeScanningConfigFile}`,
   );
   logger.startGroup("Augmented user configuration file contents");
-  logger.info(yaml.dump(config.computedConfig));
+  logger.info(yaml.dump(augmentedConfig));
   logger.endGroup();
 
-  fs.writeFileSync(codeScanningConfigFile, yaml.dump(config.computedConfig));
+  fs.writeFileSync(codeScanningConfigFile, yaml.dump(augmentedConfig));
   return codeScanningConfigFile;
 }
 

src/config-utils.test.ts

@@ -348,6 +348,7 @@ test("load non-empty input", async (t) => {
       trapCaches: {},
       trapCacheDownloadTime: 0,
       dependencyCachingEnabled: CachingKind.None,
+      extraQueryExclusions: [],
       overlayDatabaseMode: OverlayDatabaseMode.None,
       useOverlayDatabaseCaching: false,
     };

src/config-utils.ts

@@ -170,6 +170,11 @@ export interface Config {
   /** A value indicating how dependency caching should be used. */
   dependencyCachingEnabled: CachingKind;
 
+  /**
+   * Extra query exclusions to append to the config.
+   */
+  extraQueryExclusions: ExcludeQueryFilter[];
+
   /**
    * The overlay database mode to use.
    */
@@ -218,11 +223,6 @@ export interface AugmentationProperties {
    * The packs input from the `with` block of the action declaration
    */
   packsInput?: string[];
-
-  /**
-   * Extra query exclusions to append to the config.
-   */
-  extraQueryExclusions: ExcludeQueryFilter[];
 }
 
 /**
@@ -234,7 +234,6 @@ export const defaultAugmentationProperties: AugmentationProperties = {
   packsInputCombines: false,
   packsInput: undefined,
   queriesInput: undefined,
-  extraQueryExclusions: [],
 };
 export type Packs = Partial<Record<Language, string[]>>;
 
@@ -595,6 +594,7 @@ export async function getDefaultConfig({
     trapCaches,
     trapCacheDownloadTime,
     dependencyCachingEnabled: getCachingKind(dependencyCachingEnabled),
+    extraQueryExclusions: [],
     overlayDatabaseMode: OverlayDatabaseMode.None,
     useOverlayDatabaseCaching: false,
   };
@@ -683,7 +683,6 @@ export async function calculateAugmentation(
     packsInput: packsInput?.[languages[0]],
     queriesInput,
     queriesInputCombines,
-    extraQueryExclusions: [],
   };
 }
 
@@ -1145,10 +1144,7 @@ export async function initConfig(inputs: InitConfigInputs): Promise<Config> {
       logger,
     ))
   ) {
-    if (config.computedConfig["query-filters"] === undefined) {
-      config.computedConfig["query-filters"] = [];
-    }
-    config.computedConfig["query-filters"].push({
+    config.extraQueryExclusions.push({
       exclude: { tags: "exclude-from-incremental" },
     });
   }
@@ -1478,17 +1474,41 @@ export function generateCodeScanningConfig(
     delete augmentedConfig.packs;
   }
 
+  return augmentedConfig;
+}
+
+/**
+ * Appends `extraQueryExclusions` to `cliConfig`'s `query-filters`.
+ *
+ * @param extraQueryExclusions The extra query exclusions to append to the `query-filters`.
+ * @param cliConfig The CodeQL CLI configuration to extend.
+ * @returns Returns `cliConfig` if there are no extra query exclusions
+ *          or a copy of `cliConfig` where the extra query exclusions
+ *          have been appended to `query-filters`.
+ */
+export function appendExtraQueryExclusions(
+  extraQueryExclusions: ExcludeQueryFilter[],
+  cliConfig: UserConfig,
+): UserConfig {
+  if (extraQueryExclusions.length === 0) {
+    return cliConfig;
+  }
+
+  // make a copy so we can modify it
+  const augmentedConfig = cloneObject(cliConfig);
+
   augmentedConfig["query-filters"] = [
     // Ordering matters. If the first filter is an inclusion, it implicitly
     // excludes all queries that are not included. If it is an exclusion,
     // it implicitly includes all queries that are not excluded. So user
     // filters (if any) should always be first to preserve intent.
     ...(augmentedConfig["query-filters"] || []),
-    ...augmentationProperties.extraQueryExclusions,
+    ...extraQueryExclusions,
   ];
   if (augmentedConfig["query-filters"]?.length === 0) {
     delete augmentedConfig["query-filters"];
   }
+
   return augmentedConfig;
 }
 

src/testing-utils.ts

@@ -373,11 +373,11 @@ export function createTestConfig(overrides: Partial<Config>): Config {
       augmentationProperties: {
         packsInputCombines: false,
         queriesInputCombines: false,
-        extraQueryExclusions: [],
       } satisfies AugmentationProperties,
       trapCaches: {},
       trapCacheDownloadTime: 0,
       dependencyCachingEnabled: CachingKind.None,
+      extraQueryExclusions: [],
       overlayDatabaseMode: OverlayDatabaseMode.None,
       useOverlayDatabaseCaching: false,
     } satisfies Config,