Merge branch 'master' into validate_sarif

src/analysis-paths.ts

@@ -12,7 +12,7 @@ export function includeAndExcludeAnalysisPaths(config: configUtils.Config, langu
     }
 
     function isInterpretedLanguage(language): boolean {
-        return language === 'javascript' && language === 'python';
+        return language === 'javascript' || language === 'python';
     }
 
     // Index include/exclude only work in javascript and python

src/config-utils.test.ts

@@ -18,7 +18,7 @@ function setInput(name: string, value: string | undefined) {
 
 test("load empty config", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     setInput('config-file', undefined);
@@ -31,7 +31,7 @@ test("load empty config", async t => {
 
 test("loading config saves config", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     const configFile = configUtils.getConfigFile();
@@ -50,7 +50,7 @@ test("loading config saves config", async t => {
 
 test("load input outside of workspace", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     setInput('config-file', '../input');
@@ -66,7 +66,7 @@ test("load input outside of workspace", async t => {
 
 test("load non-existent input", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     t.false(fs.existsSync(path.join(tmpDir, 'input')));
@@ -83,7 +83,7 @@ test("load non-existent input", async t => {
 
 test("load non-empty input", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     // Just create a generic config object with non-default values for all fields
@@ -122,138 +122,102 @@ test("load non-empty input", async t => {
   });
 });
 
-test("load partially invalid input", async t => {
-  return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
-    process.env['GITHUB_WORKSPACE'] = tmpDir;
+function doInvalidInputTest(
+  testName: string,
+  inputFileContents: string,
+  expectedErrorMessageGenerator: (configFile: string) => string) {
 
-    // The valid parts of this config should be parsed correctly.
-    // The invalid parts should be ignored and left as the default values.
-    const inputFileContents = `
-      name:
-        - foo: bar
-      disable-default-queries: 42
-      queries:
-        - name: foo/bar
-          uses: foo/bar@dev
-      paths-ignore:
-        - a
-        - b
-      paths:
-        - c/d`;
-
-    // And the config we expect it to parse to
-    const expectedConfig = new configUtils.Config();
-    expectedConfig.externalQueries = [new configUtils.ExternalQuery('foo/bar', 'dev')];
-    expectedConfig.pathsIgnore = ['a', 'b'];
-    expectedConfig.paths = ['c/d'];
-
-    fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
-    setInput('config-file', 'input');
-
-    const actualConfig = await configUtils.loadConfig();
-
-    // Should exactly equal the object we constructed earlier
-    t.deepEqual(actualConfig, expectedConfig);
-  });
-});
-
-test("load invalid input - top level entries", async t => {
-  return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
-    process.env['GITHUB_WORKSPACE'] = tmpDir;
-
-    // Replace the arrays with strings or numbers.
-    // The invalid parts should be ignored and left as the default values.
-    const inputFileContents = `
-      name: my config
-      disable-default-queries: true
-      queries: foo
-      paths-ignore: bar
-      paths: 123`;
-
-    // And the config we expect it to parse to
-    const expectedConfig = new configUtils.Config();
-    expectedConfig.name = 'my config';
-    expectedConfig.disableDefaultQueries = true;
-
-    fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
-    setInput('config-file', 'input');
-
-    const actualConfig = await configUtils.loadConfig();
-
-    // Should exactly equal the object we constructed earlier
-    t.deepEqual(actualConfig, expectedConfig);
-  });
-});
-
-test("load invalid input - queries field type", async t => {
-  return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
-    process.env['GITHUB_WORKSPACE'] = tmpDir;
-
-    // Invalid contents of the "queries" array.
-    // The invalid parts should be ignored and left as the default values.
-    const inputFileContents = `
-      name: my config
-      disable-default-queries: true
-      queries:
-        - name: foo
-          uses:
-            - hello: world
-        - name: bar
-          uses: github/bar@master`;
-
-    // And the config we expect it to parse to
-    const expectedConfig = new configUtils.Config();
-    expectedConfig.name = 'my config';
-    expectedConfig.disableDefaultQueries = true;
-    expectedConfig.externalQueries.push(new configUtils.ExternalQuery("github/bar", "master"));
-
-    fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
-    setInput('config-file', 'input');
-
-    const actualConfig = await configUtils.loadConfig();
-
-    // Should exactly equal the object we constructed earlier
-    t.deepEqual(actualConfig, expectedConfig);
-  });
-});
-
-// Various "uses" fields, and the errors they should produce
-const testInputs = {
-  "''": configUtils.getQueryUsesBlank(),
-  "foo/bar": configUtils.getQueryUsesIncorrect("foo/bar"),
-  "foo/bar@v1@v2": configUtils.getQueryUsesIncorrect("foo/bar@v1@v2"),
-  "foo@master": configUtils.getQueryUsesIncorrect("foo@master"),
-  "https://github.com/foo/bar@master": configUtils.getQueryUsesIncorrect("https://github.com/foo/bar@master"),
-  "./foo": configUtils.getLocalPathDoesNotExist("foo"),
-  "./..": configUtils.getLocalPathOutsideOfRepository(".."),
-};
-
-for (const [input, result] of Object.entries(testInputs)) {
-  test("load invalid input - queries uses \"" + input + "\"", async t => {
+  test("load invalid input - " + testName, async t => {
     return await util.withTmpDir(async tmpDir => {
-      process.env['RUNNER_WORKSPACE'] = tmpDir;
+      process.env['RUNNER_TEMP'] = tmpDir;
       process.env['GITHUB_WORKSPACE'] = tmpDir;
 
-      // Invalid contents of a "queries.uses" field.
-      // Should fail with the expected error message
-      const inputFileContents = `
-        name: my config
-        queries:
-          - name: foo
-            uses: ` + input;
-
-      fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
+      const inputFile = path.join(tmpDir, 'input');
+      fs.writeFileSync(inputFile, inputFileContents, 'utf8');
       setInput('config-file', 'input');
 
       try {
         await configUtils.loadConfig();
         throw new Error('loadConfig did not throw error');
       } catch (err) {
-        t.deepEqual(err, new Error(result));
+        t.deepEqual(err, new Error(expectedErrorMessageGenerator(inputFile)));
       }
     });
   });
 }
+
+doInvalidInputTest(
+  'name invalid type',
+  `
+  name:
+    - foo: bar`,
+  configUtils.getNameInvalid);
+
+doInvalidInputTest(
+  'disable-default-queries invalid type',
+  `disable-default-queries: 42`,
+  configUtils.getDisableDefaultQueriesInvalid);
+
+doInvalidInputTest(
+  'queries invalid type',
+  `queries: foo`,
+  configUtils.getQueriesInvalid);
+
+doInvalidInputTest(
+  'paths-ignore invalid type',
+  `paths-ignore: bar`,
+  configUtils.getPathsIgnoreInvalid);
+
+doInvalidInputTest(
+  'paths invalid type',
+  `paths: 17`,
+  configUtils.getPathsInvalid);
+
+doInvalidInputTest(
+  'queries uses invalid type',
+  `
+  queries:
+  - uses:
+      - hello: world`,
+  configUtils.getQueryUsesInvalid);
+
+function doInvalidQueryUsesTest(
+  input: string,
+  expectedErrorMessageGenerator: (configFile: string) => string) {
+
+  // Invalid contents of a "queries.uses" field.
+  // Should fail with the expected error message
+  const inputFileContents = `
+    name: my config
+    queries:
+      - name: foo
+        uses: ` + input;
+
+  doInvalidInputTest(
+    "queries uses \"" + input + "\"",
+    inputFileContents,
+    expectedErrorMessageGenerator);
+}
+
+// Various "uses" fields, and the errors they should produce
+doInvalidQueryUsesTest(
+  "''",
+  c => configUtils.getQueryUsesInvalid(c, undefined));
+doInvalidQueryUsesTest(
+  "foo/bar",
+  c => configUtils.getQueryUsesInvalid(c, "foo/bar"));
+doInvalidQueryUsesTest(
+  "foo/bar@v1@v2",
+  c => configUtils.getQueryUsesInvalid(c, "foo/bar@v1@v2"));
+doInvalidQueryUsesTest(
+  "foo@master",
+  c => configUtils.getQueryUsesInvalid(c, "foo@master"));
+doInvalidQueryUsesTest(
+  "https://github.com/foo/bar@master",
+  c => configUtils.getQueryUsesInvalid(c, "https://github.com/foo/bar@master"));
+doInvalidQueryUsesTest(
+  "./foo",
+  c => configUtils.getLocalPathDoesNotExist(c, "foo"));
+doInvalidQueryUsesTest(
+  "./..",
+  c => configUtils.getLocalPathOutsideOfRepository(c, ".."));

src/config-utils.ts

@@ -6,6 +6,13 @@ import * as path from 'path';
 
 import * as util from './util';
 
+const NAME_PROPERTY = 'name';
+const DISPLAY_DEFAULT_QUERIES_PROPERTY = 'disable-default-queries';
+const QUERIES_PROPERTY = 'queries';
+const QUERIES_USES_PROPERTY = 'uses';
+const PATHS_IGNORE_PROPERTY = 'paths-ignore';
+const PATHS_PROPERTY = 'paths';
+
 export class ExternalQuery {
     public repository: string;
     public ref: string;
@@ -31,12 +38,12 @@ export class Config {
     public pathsIgnore: string[] = [];
     public paths: string[] = [];
 
-    public addQuery(queryUses: string) {
+    public addQuery(configFile: string, queryUses: string) {
         // The logic for parsing the string is based on what actions does for
         // parsing the 'uses' actions in the workflow file
         queryUses = queryUses.trim();
         if (queryUses === "") {
-            throw new Error(getQueryUsesBlank());
+            throw new Error(getQueryUsesInvalid(configFile));
         }
 
         // Check for the local path case before we start trying to parse the repository name
@@ -49,12 +56,12 @@ export class Config {
 
             // Check the file exists
             if (!fs.existsSync(absoluteQueryPath)) {
-                throw new Error(getLocalPathDoesNotExist(localQueryPath));
+                throw new Error(getLocalPathDoesNotExist(configFile, localQueryPath));
             }
 
             // Check the local path doesn't jump outside the repo using '..' or symlinks
             if (!(fs.realpathSync(absoluteQueryPath) + path.sep).startsWith(workspacePath + path.sep)) {
-                throw new Error(getLocalPathOutsideOfRepository(localQueryPath));
+                throw new Error(getLocalPathOutsideOfRepository(configFile, localQueryPath));
             }
 
             this.additionalQueries.push(absoluteQueryPath);
@@ -68,13 +75,13 @@ export class Config {
                 this.additionalSuites.push(suite);
                 return;
             } else {
-                throw new Error(getQueryUsesIncorrect(queryUses));
+                throw new Error(getQueryUsesInvalid(configFile, queryUses));
             }
         }
 
         let tok = queryUses.split('@');
         if (tok.length !== 2) {
-            throw new Error(getQueryUsesIncorrect(queryUses));
+            throw new Error(getQueryUsesInvalid(configFile, queryUses));
         }
 
         const ref = tok[1];
@@ -83,7 +90,7 @@ export class Config {
         // The second token is the repo
         // The rest is a path, if there is more than one token combine them to form the full path
         if (tok.length < 2) {
-            throw new Error(getQueryUsesIncorrect(queryUses));
+            throw new Error(getQueryUsesInvalid(configFile, queryUses));
         }
         if (tok.length > 3) {
             tok = [tok[0], tok[1], tok.slice(2).join('/')];
@@ -91,7 +98,7 @@ export class Config {
 
         // Check none of the parts of the repository name are empty
         if (tok[0].trim() === '' || tok[1].trim() === '') {
-            throw new Error(getQueryUsesIncorrect(queryUses));
+            throw new Error(getQueryUsesInvalid(configFile, queryUses));
         }
 
         let external = new ExternalQuery(tok[0] + '/' + tok[1], ref);
@@ -102,24 +109,47 @@ export class Config {
     }
 }
 
-export function getQueryUsesBlank(): string {
-    return '"uses" value for queries cannot be blank';
+export function getNameInvalid(configFile: string): string {
+    return getConfigFilePropertyError(configFile, NAME_PROPERTY, 'must be a non-empty string');
 }
 
-export function getQueryUsesIncorrect(queryUses: string): string {
-    return '"uses" value for queries must be a built-in suite (' + builtinSuites.join(' or ') +
-        '), a relative path, or of the form owner/repo@ref\n' +
-        'Found: ' + queryUses;
+export function getDisableDefaultQueriesInvalid(configFile: string): string {
+    return getConfigFilePropertyError(configFile, DISPLAY_DEFAULT_QUERIES_PROPERTY, 'must be a boolean');
 }
 
-export function getLocalPathOutsideOfRepository(localPath: string): string {
-    return 'Unable to use queries from local path "' + localPath +
-        '" as it is outside of the repository';
+export function getQueriesInvalid(configFile: string): string {
+    return getConfigFilePropertyError(configFile, QUERIES_PROPERTY, 'must be an array');
 }
 
-export function getLocalPathDoesNotExist(localPath: string): string {
-    return 'Unable to use queries from local path "' + localPath +
-        '" as the path does not exist in the repository';
+export function getQueryUsesInvalid(configFile: string, queryUses?: string): string {
+    return getConfigFilePropertyError(
+        configFile,
+        QUERIES_PROPERTY + '.' + QUERIES_USES_PROPERTY,
+        'must be a built-in suite (' + builtinSuites.join(' or ') +
+            '), a relative path, or be of the form "owner/repo[/path]@ref"' +
+            (queryUses !== undefined ? '\n Found: ' + queryUses : ''));
+}
+
+export function getPathsIgnoreInvalid(configFile: string): string {
+    return getConfigFilePropertyError(configFile, PATHS_IGNORE_PROPERTY, 'must be an array of non-empty strings');
+}
+
+export function getPathsInvalid(configFile: string): string {
+    return getConfigFilePropertyError(configFile, PATHS_PROPERTY, 'must be an array of non-empty strings');
+}
+
+export function getLocalPathOutsideOfRepository(configFile: string, localPath: string): string {
+    return getConfigFilePropertyError(
+        configFile,
+        QUERIES_PROPERTY + '.' + QUERIES_USES_PROPERTY,
+        'is invalid as the local path "' + localPath + '" is outside of the repository');
+}
+
+export function getLocalPathDoesNotExist(configFile: string, localPath: string): string {
+    return getConfigFilePropertyError(
+        configFile,
+        QUERIES_PROPERTY + '.' + QUERIES_USES_PROPERTY,
+        'is invalid as the local path "' + localPath + '" does not exist in the repository');
 }
 
 export function getConfigFileOutsideWorkspaceErrorMessage(configFile: string): string {
@@ -130,6 +160,10 @@ export function getConfigFileDoesNotExistErrorMessage(configFile: string): strin
     return 'The configuration file "' + configFile + '" does not exist';
 }
 
+function getConfigFilePropertyError(configFile: string, property: string, error: string): string {
+    return 'The configuration file "' + configFile + '" is invalid: property "' + property + '" ' + error;
+}
+
 function initConfig(): Config {
     let configFile = core.getInput('config-file');
 
@@ -157,38 +191,56 @@ function initConfig(): Config {
 
     const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
 
-    if (parsedYAML.name && typeof parsedYAML.name === "string") {
-        config.name = parsedYAML.name;
+    if (NAME_PROPERTY in parsedYAML) {
+        if (typeof parsedYAML[NAME_PROPERTY] !== "string") {
+            throw new Error(getNameInvalid(configFile));
+        }
+        if (parsedYAML[NAME_PROPERTY].length === 0) {
+            throw new Error(getNameInvalid(configFile));
+        }
+        config.name = parsedYAML[NAME_PROPERTY];
     }
 
-    if (parsedYAML['disable-default-queries'] && typeof parsedYAML['disable-default-queries'] === "boolean") {
-        config.disableDefaultQueries = parsedYAML['disable-default-queries'];
+    if (DISPLAY_DEFAULT_QUERIES_PROPERTY in parsedYAML) {
+        if (typeof parsedYAML[DISPLAY_DEFAULT_QUERIES_PROPERTY] !== "boolean") {
+            throw new Error(getDisableDefaultQueriesInvalid(configFile));
+        }
+        config.disableDefaultQueries = parsedYAML[DISPLAY_DEFAULT_QUERIES_PROPERTY];
     }
 
-    const queries = parsedYAML.queries;
-    if (queries && queries instanceof Array) {
-        queries.forEach(query => {
-            if (typeof query.uses === "string") {
-                config.addQuery(query.uses);
+    if (QUERIES_PROPERTY in parsedYAML) {
+        if (!(parsedYAML[QUERIES_PROPERTY] instanceof Array)) {
+            throw new Error(getQueriesInvalid(configFile));
+        }
+        parsedYAML[QUERIES_PROPERTY].forEach(query => {
+            if (!(QUERIES_USES_PROPERTY in query) || typeof query[QUERIES_USES_PROPERTY] !== "string") {
+                throw new Error(getQueryUsesInvalid(configFile));
             }
+            config.addQuery(configFile, query[QUERIES_USES_PROPERTY]);
         });
     }
 
-    const pathsIgnore = parsedYAML['paths-ignore'];
-    if (pathsIgnore && pathsIgnore instanceof Array) {
-        pathsIgnore.forEach(path => {
-            if (typeof path === "string") {
-                config.pathsIgnore.push(path);
+    if (PATHS_IGNORE_PROPERTY in parsedYAML) {
+        if (!(parsedYAML[PATHS_IGNORE_PROPERTY] instanceof Array)) {
+            throw new Error(getPathsIgnoreInvalid(configFile));
+        }
+        parsedYAML[PATHS_IGNORE_PROPERTY].forEach(path => {
+            if (typeof path !== "string" || path === '') {
+                throw new Error(getPathsIgnoreInvalid(configFile));
             }
+            config.pathsIgnore.push(path);
         });
     }
 
-    const paths = parsedYAML.paths;
-    if (paths && paths instanceof Array) {
-        paths.forEach(path => {
-            if (typeof path === "string") {
-                config.paths.push(path);
+    if (PATHS_PROPERTY in parsedYAML) {
+        if (!(parsedYAML[PATHS_PROPERTY] instanceof Array)) {
+            throw new Error(getPathsInvalid(configFile));
+        }
+        parsedYAML[PATHS_PROPERTY].forEach(path => {
+            if (typeof path !== "string" || path === '') {
+                throw new Error(getPathsInvalid(configFile));
             }
+            config.paths.push(path);
         });
     }
 
@@ -196,7 +248,7 @@ function initConfig(): Config {
 }
 
 function getConfigFolder(): string {
-    return util.getRequiredEnvParam('RUNNER_WORKSPACE');
+    return util.getRequiredEnvParam('RUNNER_TEMP');
 }
 
 export function getConfigFile(): string {

src/external-queries.test.ts

@@ -13,7 +13,7 @@ test("checkoutExternalQueries", async t => {
     ];
 
     await util.withTmpDir(async tmpDir => {
-        process.env["RUNNER_WORKSPACE"] = tmpDir;
+        process.env["RUNNER_TEMP"] = tmpDir;
         await externalQueries.checkoutExternalQueries(config);
 
         // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in master

src/external-queries.ts

@@ -7,7 +7,7 @@ import * as configUtils from './config-utils';
 import * as util from './util';
 
 export async function checkoutExternalQueries(config: configUtils.Config) {
-  const folder = util.getRequiredEnvParam('RUNNER_WORKSPACE');
+  const folder = util.getRequiredEnvParam('RUNNER_TEMP');
 
   for (const externalQuery of config.externalQueries) {
     core.info('Checking out ' + externalQuery.repository);

src/finalize-db.ts

@@ -11,6 +11,27 @@ import * as sharedEnv from './shared-environment';
 import * as upload_lib from './upload-lib';
 import * as util from './util';
 
+/**
+ * A list of queries from https://github.com/github/codeql that
+ * we don't want to run. Disabling them here is a quicker alternative to
+ * disabling them in the code scanning query suites. Queries should also
+ * be disabled in the suites, and removed from this list here once the
+ * bundle is updated to make those suite changes live.
+ *
+ * Format is a map from language to an array of path suffixes of .ql files.
+ */
+const DISABLED_BUILTIN_QUERIES: {[language: string]: string[]} = {
+  'csharp': [
+    'ql/src/Security Features/CWE-937/VulnerablePackage.ql',
+    'ql/src/Security Features/CWE-451/MissingXFrameOptions.ql',
+  ]
+};
+
+function queryIsDisabled(language, query): boolean {
+  return (DISABLED_BUILTIN_QUERIES[language] || [])
+    .some(disabledQuery => query.endsWith(disabledQuery));
+}
+
 function getMemoryFlag(): string {
   let memoryToUseMegaBytes: number;
   const memoryToUseString = core.getInput("ram");
@@ -125,7 +146,7 @@ async function resolveQueryLanguages(codeqlCmd: string, config: configUtils.Conf
       if (res[language] === undefined) {
         res[language] = [];
       }
-      res[language].push(...Object.keys(<any>queries));
+      res[language].push(...Object.keys(queries).filter(q => !queryIsDisabled(language, q)));
     }
   }
 
@@ -136,7 +157,7 @@ async function resolveQueryLanguages(codeqlCmd: string, config: configUtils.Conf
       if (res[language] === undefined) {
         res[language] = [];
       }
-      res[language].push(...Object.keys(<any>queries));
+      res[language].push(...Object.keys(queries));
     }
 
     const noDeclaredLanguage = resolveQueriesOutputObject.noDeclaredLanguage;
@@ -218,7 +239,7 @@ async function run() {
 
     if ('true' === core.getInput('upload')) {
       if (!await upload_lib.upload(sarifFolder)) {
-        await util.reportActionFailed('failed', 'upload');
+        await util.reportActionFailed('finish', 'upload');
         return;
       }
     }

src/setup-tracer.ts

@@ -108,13 +108,14 @@ function concatTracerConfigs(configs: { [lang: string]: TracerConfig }): TracerC
         totalLines.push(...lines.slice(2));
     }
 
-    const newLogFilePath = path.resolve(util.workspaceFolder(), 'compound-build-tracer.log');
-    const spec = path.resolve(util.workspaceFolder(), 'compound-spec');
-    const tempFolder = path.resolve(util.workspaceFolder(), 'compound-temp');
+    const tempFolder = util.getRequiredEnvParam('RUNNER_TEMP');
+    const newLogFilePath = path.resolve(tempFolder, 'compound-build-tracer.log');
+    const spec = path.resolve(tempFolder, 'compound-spec');
+    const compoundTempFolder = path.resolve(tempFolder, 'compound-temp');
     const newSpecContent = [newLogFilePath, totalCount.toString(10), ...totalLines];
 
     if (copyExecutables) {
-        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = tempFolder;
+        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = compoundTempFolder;
         envSize += 1;
     }
 
@@ -181,7 +182,7 @@ async function run() {
         const codeqlRam = process.env['CODEQL_RAM'] || '6500';
         core.exportVariable('CODEQL_RAM', codeqlRam);
 
-        const databaseFolder = path.resolve(util.workspaceFolder(), 'codeql_databases');
+        const databaseFolder = path.resolve(util.getRequiredEnvParam('RUNNER_TEMP'), 'codeql_databases');
         await io.mkdirP(databaseFolder);
 
         let tracedLanguages: { [key: string]: TracerConfig } = {};
@@ -238,8 +239,8 @@ async function run() {
         await util.reportActionFailed('init', error.message, error.stack);
         return;
     }
-    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
     await util.reportActionSucceeded('init');
+    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
 }
 
 run().catch(e => {

src/upload-lib.ts

@@ -155,75 +155,70 @@ export function validateSarifFileSchema(sarifFilePath: string): boolean {
 // Returns true iff the upload occurred and succeeded
 async function uploadFiles(sarifFiles: string[]): Promise<boolean> {
     core.startGroup("Uploading results");
-    let succeeded = false;
-    try {
-        core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
+    core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
 
-        const sentinelEnvVar = "CODEQL_UPLOAD_SARIF";
-        if (process.env[sentinelEnvVar]) {
-            core.error("Aborting upload: only one run of the codeql/analyze or codeql/upload-sarif actions is allowed per job");
-            return false;
-        }
-        core.exportVariable(sentinelEnvVar, sentinelEnvVar);
-
-        // Validate that the files we were asked to upload are all valid SARIF files
-        for (const file of sarifFiles) {
-            if (!validateSarifFileSchema(file)) {
-                return false;
-            }
-        }
-
-        const commitOid = await util.getCommitOid();
-        const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
-        const ref = util.getRef();
-        const analysisKey = await util.getAnalysisKey();
-        const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
-        const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
-
-        let sarifPayload = combineSarifFiles(sarifFiles);
-        sarifPayload = fingerprints.addFingerprints(sarifPayload);
-
-        const zipped_sarif = zlib.gzipSync(sarifPayload).toString('base64');
-        let checkoutPath = core.getInput('checkout_path');
-        let checkoutURI = fileUrl(checkoutPath);
-        const workflowRunID = parseInt(workflowRunIDStr, 10);
-
-        if (Number.isNaN(workflowRunID)) {
-            core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
-            return false;
-        }
-
-        let matrix: string | undefined = core.getInput('matrix');
-        if (matrix === "null" || matrix === "") {
-            matrix = undefined;
-        }
-
-        const toolNames = util.getToolNames(sarifPayload);
-
-        const payload = JSON.stringify({
-            "commit_oid": commitOid,
-            "ref": ref,
-            "analysis_key": analysisKey,
-            "analysis_name": analysisName,
-            "sarif": zipped_sarif,
-            "workflow_run_id": workflowRunID,
-            "checkout_uri": checkoutURI,
-            "environment": matrix,
-            "started_at": startedAt,
-            "tool_names": toolNames,
-        });
-
-        // Log some useful debug info about the info
-        core.debug("Raw upload size: " + sarifPayload.length + " bytes");
-        core.debug("Base64 zipped upload size: " + zipped_sarif.length + " bytes");
-        core.debug("Number of results in upload: " + countResultsInSarif(sarifPayload));
-
-        // Make the upload
-        succeeded = await uploadPayload(payload);
-
-    } catch (error) {
-        core.setFailed(error.message);
+    const sentinelEnvVar = "CODEQL_UPLOAD_SARIF";
+    if (process.env[sentinelEnvVar]) {
+        core.error("Aborting upload: only one run of the codeql/analyze or codeql/upload-sarif actions is allowed per job");
+        return false;
     }
+    core.exportVariable(sentinelEnvVar, sentinelEnvVar);
+
+    // Validate that the files we were asked to upload are all valid SARIF files
+    for (const file of sarifFiles) {
+        if (!validateSarifFileSchema(file)) {
+            return false;
+        }
+    }
+
+    const commitOid = await util.getCommitOid();
+    const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
+    const ref = util.getRef();
+    const analysisKey = await util.getAnalysisKey();
+    const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
+    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
+
+    let sarifPayload = combineSarifFiles(sarifFiles);
+    sarifPayload = fingerprints.addFingerprints(sarifPayload);
+
+    const zipped_sarif = zlib.gzipSync(sarifPayload).toString('base64');
+    let checkoutPath = core.getInput('checkout_path');
+    let checkoutURI = fileUrl(checkoutPath);
+    const workflowRunID = parseInt(workflowRunIDStr, 10);
+
+    if (Number.isNaN(workflowRunID)) {
+        core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
+        return false;
+    }
+
+    let matrix: string | undefined = core.getInput('matrix');
+    if (matrix === "null" || matrix === "") {
+        matrix = undefined;
+    }
+
+    const toolNames = util.getToolNames(sarifPayload);
+
+    const payload = JSON.stringify({
+        "commit_oid": commitOid,
+        "ref": ref,
+        "analysis_key": analysisKey,
+        "analysis_name": analysisName,
+        "sarif": zipped_sarif,
+        "workflow_run_id": workflowRunID,
+        "checkout_uri": checkoutURI,
+        "environment": matrix,
+        "started_at": startedAt,
+        "tool_names": toolNames,
+    });
+
+    // Log some useful debug info about the info
+    core.debug("Raw upload size: " + sarifPayload.length + " bytes");
+    core.debug("Base64 zipped upload size: " + zipped_sarif.length + " bytes");
+    core.debug("Number of results in upload: " + countResultsInSarif(sarifPayload));
+
+    // Make the upload
+    const succeeded = await uploadPayload(payload);
+
     core.endGroup();
 
     return succeeded;

src/util.ts

@@ -35,17 +35,6 @@ export function should_abort(actionName: string, requireInitActionHasRun: boolea
     return false;
 }
 
-/**
- * Resolve the path to the workspace folder.
- */
-export function workspaceFolder(): string {
-    let workspaceFolder = process.env['RUNNER_WORKSPACE'];
-    if (!workspaceFolder)
-        workspaceFolder = path.resolve('..');
-
-    return workspaceFolder;
-}
-
 /**
  * Get an environment parameter, but throw an error if it is not set.
  */