Merge pull request #319 from github/simon-engledew/lint-workspace

Validate the codeql-action workspace for common errors

.eslintrc.json

@@ -29,6 +29,8 @@
         "no-async-foreach/no-async-foreach": "error",
         "no-console": "off",
         "no-sequences": "error",
+        "no-shadow": "off",
+        "@typescript-eslint/no-shadow": ["error"],
         "one-var": ["error", "never"]
     },
     "overrides": [{
@@ -47,9 +49,7 @@
             "@typescript-eslint/prefer-regexp-exec": "off",
             "@typescript-eslint/require-await": "off",
             "@typescript-eslint/restrict-template-expressions": "off",
-            "func-style": "off",
-            "github/no-then": "off",
-            "no-shadow": "off"
+            "func-style": "off"
         }
     }]
 }

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
   - name: Contact GitHub Support
-    url: https://support.github.com/contact?subject=Code+Scanning+Beta+Support&tags=code-scanning-support
-    about: Contact Support about code scanning
+    url: https://support.github.com/request
+    about: Contact Support 

.github/update-release-branch.py

@@ -123,8 +123,8 @@ def get_pr_for_commit(repo, commit):
   if prs.totalCount > 0:
     # In the case that there are multiple PRs, return the earliest one
     prs = list(prs)
-    sorted(prs, key=lambda pr: int(pr.number))
-    return prs[0]
+    sorted_prs = sorted(prs, key=lambda pr: int(pr.number))
+    return sorted_prs[0]
   else:
     return None
 

.github/workflows/codeql.yml

@@ -15,7 +15,11 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - uses: ./init
+      id: init
       with:
         languages: javascript
         config-file: ./.github/codeql/codeql-config.yml
+    # confirm steps.init.outputs.codeql-path points to the codeql binary
+    - name: Print CodeQL Version
+      run: ${{steps.init.outputs.codeql-path}} version --format=json
     - uses: ./analyze

.github/workflows/integration-testing.yml

@@ -98,6 +98,37 @@ jobs:
       env:
         TEST_MODE: true
 
+  go-custom-tracing:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      CODEQL_EXTRACTOR_GO_BUILD_TRACING: "on"
+
+    steps:
+    - uses: actions/setup-go@v2
+      if: ${{ matrix.os ==  'macos-latest' }}
+      with:
+        go-version: '^1.13.1'
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+    - uses: ./../action/init
+      with:
+        languages: go
+    - name: Build code
+      shell: bash
+      run: go build main.go
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
   multi-language-repo_rubocop:
     runs-on: ubuntu-latest
 
@@ -435,6 +466,8 @@ jobs:
   runner-upload-sarif:
     runs-on: ubuntu-latest
 
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.base.repo.id == github.event.pull_request.head.repo.id }}
+
     steps:
     - uses: actions/checkout@v2
 

.github/workflows/python-deps-linux.yml

@@ -1,63 +0,0 @@
-name: Test Python Package Installation on Linux
-
-on:
-  push:
-    branches: [main, v1]
-  pull_request:
-
-jobs:
-
-  test-setup-python-scripts:
-    runs-on: ubuntu-latest
-    strategy:
-        fail-fast: false
-        matrix:
-          include:
-            - test_dir: python-setup/tests/pipenv/requests-2
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
-            - test_dir: python-setup/tests/pipenv/requests-3
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
-
-            - test_dir: python-setup/tests/poetry/requests-2
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
-            - test_dir: python-setup/tests/poetry/requests-3
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
-
-            - test_dir: python-setup/tests/requirements/requests-2
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
-            - test_dir: python-setup/tests/requirements/requests-3
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
-
-            - test_dir: python-setup/tests/setup_py/requests-2
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
-            - test_dir: python-setup/tests/setup_py/requests-3
-              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
-
-            # This one shouldn't fail, but also won't install packages
-            - test_dir: python-setup/tests/requirements/non-standard-location
-              test_script: test -z $LGTM_INDEX_IMPORT_PATH
-
-    steps:
-    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@v2
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: python
-
-    - name: Test Auto Package Installation
-      run: |
-        set -x
-        $GITHUB_WORKSPACE/python-setup/install_tools.sh
-        echo -e '\n\n\n\n\n' && sleep 0.5
-        cd $GITHUB_WORKSPACE/${{ matrix.test_dir }}
-        find /opt/hostedtoolcache/CodeQL -path "*x64/codeql" -exec $GITHUB_WORKSPACE/python-setup/auto_install_packages.py {} \;
-    - name: Setup for extractor
-      run: |
-        echo $CODEQL_PYTHON
-        # only run if $CODEQL_PYTHON is set
-        test ! -z $CODEQL_PYTHON && $GITHUB_WORKSPACE/python-setup/tests/from_python_exe.py $CODEQL_PYTHON || /bin/true
-    - name: Verify packages installed
-      run: |
-        ${{ matrix.test_script }}

.github/workflows/python-deps-windows.yml

@@ -1,61 +0,0 @@
-name: Test Python Package Installation on Windows
-
-
-on:
-  push:
-    branches: [main, v1]
-  pull_request:
-
-jobs:
-
-  test-setup-python-scripts:
-    runs-on: windows-latest
-    strategy:
-        fail-fast: false
-        matrix:
-          include:
-            - test_dir: python-setup/tests/pipenv/requests-2
-              python_version: 2
-            - test_dir: python-setup/tests/pipenv/requests-3
-              python_version: 3
-
-            - test_dir: python-setup/tests/poetry/requests-2
-              python_version: 2
-            - test_dir: python-setup/tests/poetry/requests-3
-              python_version: 3
-
-            - test_dir: python-setup/tests/requirements/requests-2
-              python_version: 2
-            - test_dir: python-setup/tests/requirements/requests-3
-              python_version: 3
-
-            - test_dir: python-setup/tests/setup_py/requests-2
-              python_version: 2
-            - test_dir: python-setup/tests/setup_py/requests-3
-              python_version: 3
-
-    steps:
-    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@v2
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: python
-
-    - name: Test Auto Package Installation
-      run: |
-        $cmd = $Env:GITHUB_WORKSPACE + "\\python-setup\\install_tools.ps1"
-        powershell -File $cmd
-
-        cd $Env:GITHUB_WORKSPACE\\${{ matrix.test_dir }}
-        py -3 $Env:GITHUB_WORKSPACE\\python-setup\\auto_install_packages.py C:\\hostedtoolcache\\windows\\CodeQL\\0.0.0-20200826\\x64\\codeql
-    - name: Setup for extractor
-      run: |
-        echo $Env:CODEQL_PYTHON
-
-        py -3 $Env:GITHUB_WORKSPACE\\python-setup\\tests\\from_python_exe.py $Env:CODEQL_PYTHON 
-    - name: Verify packages installed
-      run: |
-        $cmd = $Env:GITHUB_WORKSPACE + "\\python-setup\\tests\\check_requests_123.ps1"
-        powershell -File $cmd ${{ matrix.python_version }}

.github/workflows/python-deps.yml

@@ -0,0 +1,133 @@
+name: Test Python Package Installation on Linux and Mac
+
+on:
+  push:
+    branches: [main, v1]
+  pull_request:
+
+jobs:
+
+  test-setup-python-scripts:
+    runs-on: ${{ matrix.os }}
+    strategy:
+        fail-fast: false
+        matrix:
+          os: [ubuntu-latest, macos-latest]
+          include:
+            - test_dir: python-setup/tests/pipenv/requests-2
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
+            - test_dir: python-setup/tests/pipenv/requests-3
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
+
+            - test_dir: python-setup/tests/poetry/requests-2
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
+            - test_dir: python-setup/tests/poetry/requests-3
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
+
+            - test_dir: python-setup/tests/requirements/requests-2
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
+            - test_dir: python-setup/tests/requirements/requests-3
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
+
+            - test_dir: python-setup/tests/setup_py/requests-2
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 2
+            - test_dir: python-setup/tests/setup_py/requests-3
+              test_script: $GITHUB_WORKSPACE/python-setup/tests/check_requests_123.sh 3
+
+            # This one shouldn't fail, but also won't install packages
+            - test_dir: python-setup/tests/requirements/non-standard-location
+              test_script: test -z $LGTM_INDEX_IMPORT_PATH
+
+    steps:
+    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+    - uses: actions/checkout@v2
+
+    - name: Initialize CodeQL
+      uses: ./init
+      id: init
+      with:
+        tools: latest
+        languages: python
+        setup-python-dependencies: false
+
+    - name: Test Auto Package Installation
+      run: |
+        set -x
+        $GITHUB_WORKSPACE/python-setup/install_tools.sh
+
+        cd $GITHUB_WORKSPACE/${{ matrix.test_dir }}
+
+        case ${{ matrix.os }} in
+            ubuntu-latest*)     basePath="/opt";;
+            macos-latest*)    basePath="/Users/runner";;
+        esac
+        echo ${basePath}
+
+        $GITHUB_WORKSPACE/python-setup/auto_install_packages.py "$(dirname ${{steps.init.outputs.codeql-path}})"
+    - name: Setup for extractor
+      run: |
+        echo $CODEQL_PYTHON
+        # only run if $CODEQL_PYTHON is set
+        if [ ! -z $CODEQL_PYTHON ]; then
+            $GITHUB_WORKSPACE/python-setup/tests/from_python_exe.py $CODEQL_PYTHON;
+        fi
+    - name: Verify packages installed
+      run: |
+        ${{ matrix.test_script }}
+
+  test-setup-python-scripts-windows:
+    runs-on: windows-latest
+    strategy:
+        fail-fast: false
+        matrix:
+          include:
+            - test_dir: python-setup/tests/pipenv/requests-2
+              python_version: 2
+            - test_dir: python-setup/tests/pipenv/requests-3
+              python_version: 3
+
+            - test_dir: python-setup/tests/poetry/requests-2
+              python_version: 2
+            - test_dir: python-setup/tests/poetry/requests-3
+              python_version: 3
+
+            - test_dir: python-setup/tests/requirements/requests-2
+              python_version: 2
+            - test_dir: python-setup/tests/requirements/requests-3
+              python_version: 3
+
+            - test_dir: python-setup/tests/setup_py/requests-2
+              python_version: 2
+            - test_dir: python-setup/tests/setup_py/requests-3
+              python_version: 3
+
+    steps:
+    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+    - uses: actions/checkout@v2
+
+    - name: Initialize CodeQL
+      uses: ./init
+      with:
+        tools: latest
+        languages: python
+        setup-python-dependencies: false
+
+    - name: Test Auto Package Installation
+      run: |
+        $cmd = $Env:GITHUB_WORKSPACE + "\\python-setup\\install_tools.ps1"
+        powershell -File $cmd
+
+        cd $Env:GITHUB_WORKSPACE\\${{ matrix.test_dir }}
+        $DefaultsPath = Join-Path (Join-Path $Env:GITHUB_WORKSPACE "src") "defaults.json"
+        $CodeQLBundleName = (Get-Content -Raw -Path $DefaultsPath | ConvertFrom-Json).bundleVersion
+        $CodeQLVersion = "0.0.0-" + $CodeQLBundleName.split("-")[-1]
+        py -3 $Env:GITHUB_WORKSPACE\\python-setup\\auto_install_packages.py C:\\hostedtoolcache\\windows\\CodeQL\\$CodeQLVersion\\x64\\codeql
+    - name: Setup for extractor
+      run: |
+        echo $Env:CODEQL_PYTHON
+
+        py -3 $Env:GITHUB_WORKSPACE\\python-setup\\tests\\from_python_exe.py $Env:CODEQL_PYTHON
+    - name: Verify packages installed
+      run: |
+        $cmd = $Env:GITHUB_WORKSPACE + "\\python-setup\\tests\\check_requests_123.ps1"
+        powershell -File $cmd ${{ matrix.python_version }}

.github/workflows/release-runner.yml

@@ -0,0 +1,54 @@
+name: Release runner
+
+on:
+  workflow_dispatch:
+    inputs:
+      bundle-tag:
+        description: 'Tag of the bundle release (e.g., "codeql-bundle-20200826")'
+        required: false
+
+jobs:
+  release-runner:
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_TAG: "${{ github.event.inputs.bundle-tag }}"
+
+    strategy:
+      matrix:
+        extension: ["linux", "macos", "win.exe"]
+
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Build runner
+        run: |
+          cd runner
+          npm install
+          npm run build-runner
+
+      - uses: actions/upload-artifact@v2
+        with:
+          name: codeql-runner-${{matrix.extension}}
+          path: runner/dist/codeql-runner-${{matrix.extension}}
+
+      - name: Resolve Upload URL for the release
+        if: ${{ github.event.inputs.bundle-tag != null }}
+        id: save_url
+        run: |
+          UPLOAD_URL=$(curl -sS \
+                "https://api.github.com/repos/${GITHUB_REPOSITORY}/releases/tags/${RELEASE_TAG}" \
+                -H "Accept: application/json" \
+                -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" | jq .upload_url | sed s/\"//g)
+          echo ${UPLOAD_URL}
+          echo "::set-output name=upload_url::${UPLOAD_URL}"
+
+      - name: Upload Platform Package
+        if: ${{ github.event.inputs.bundle-tag != null }}
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ steps.save_url.outputs.upload_url }}
+          asset_path: runner/dist/codeql-runner-${{matrix.extension}}
+          asset_name: codeql-runner-${{matrix.extension}}
+          asset_content_type: application/octet-stream

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -0,0 +1,43 @@
+name: Update Supported Enterprise Server Versions
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+
+jobs:
+  update-supported-enterprise-server-versions:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Setup Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.7"
+      - name: Checkout CodeQL Action
+        uses: actions/checkout@v2
+      - name: Checkout Enterprise Releases
+        uses: actions/checkout@v2
+        with:
+          repository: github/enterprise-releases
+          ssh-key: ${{ secrets.ENTERPRISE_RELEASES_SSH_KEY }}
+          path: ${{ github.workspace }}/enterprise-releases/
+      - name: Update Supported Enterprise Server Versions
+        run: |
+          cd ./.github/workflows/update-supported-enterprise-server-versions/
+          python3 -m pip install pipenv
+          pipenv install
+          pipenv run ./update.py
+          rm --recursive "$ENTERPRISE_RELEASES_PATH"
+          npm run build
+        env:
+          ENTERPRISE_RELEASES_PATH: ${{ github.workspace }}/enterprise-releases/
+      - name: Commit Changes
+        uses: peter-evans/create-pull-request@c7f493a8000b8aeb17a1332e326ba76b57cb83eb # v3.4.1
+        with:
+          commit-message: Update supported GitHub Enterprise Server versions.
+          title: Update supported GitHub Enterprise Server versions.
+          body: ""
+          author: GitHub <noreply@github.com>
+          branch: update-supported-enterprise-server-versions
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update-supported-enterprise-server-versions/Pipfile

@@ -0,0 +1,9 @@
+[[source]]
+name = "pypi"
+url = "https://pypi.org/simple"
+verify_ssl = true
+
+[dev-packages]
+
+[packages]
+semver = "*"

.github/workflows/update-supported-enterprise-server-versions/Pipfile.lock

@@ -0,0 +1,27 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "e3ba923dcb4888e05de5448c18a732bf40197e80fabfa051a61c01b22c504879"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "semver": {
+            "hashes": [
+                "sha256:ced8b23dceb22134307c1b8abfa523da14198793d9787ac838e70e29e77458d4",
+                "sha256:fa0fe2722ee1c3f57eac478820c3a5ae2f624af8264cbdf9000c980ff7f75e3f"
+            ],
+            "index": "pypi",
+            "version": "==2.13.0"
+        }
+    },
+    "develop": {}
+}

.github/workflows/update-supported-enterprise-server-versions/update.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+import datetime
+import json
+import os
+import pathlib
+
+import semver
+
+_API_COMPATIBILITY_PATH = pathlib.Path(__file__).absolute().parents[3] / "src" / "api-compatibility.json"
+_ENTERPRISE_RELEASES_PATH = pathlib.Path(os.environ["ENTERPRISE_RELEASES_PATH"])
+_RELEASE_FILE_PATH = _ENTERPRISE_RELEASES_PATH / "releases.json"
+_FIRST_SUPPORTED_RELEASE = semver.VersionInfo.parse("2.22.0") # Versions older than this did not include Code Scanning.
+
+def main():
+	api_compatibility_data = json.loads(_API_COMPATIBILITY_PATH.read_text())
+
+	releases = json.loads(_RELEASE_FILE_PATH.read_text())
+	oldest_supported_release = None
+	newest_supported_release = semver.VersionInfo.parse(api_compatibility_data["maximumVersion"] + ".0")
+
+	for release_version_string, release_data in releases.items():
+		release_version = semver.VersionInfo.parse(release_version_string + ".0")
+		if release_version < _FIRST_SUPPORTED_RELEASE:
+			continue
+
+		if release_version > newest_supported_release:
+			feature_freeze_date = datetime.date.fromisoformat(release_data["feature_freeze"])
+			if feature_freeze_date < datetime.date.today() + datetime.timedelta(weeks=2):
+				newest_supported_release = release_version
+
+		if oldest_supported_release is None or release_version < oldest_supported_release:
+			end_of_life_date = datetime.date.fromisoformat(release_data["end"])
+			if end_of_life_date > datetime.date.today():
+				oldest_supported_release = release_version
+
+	api_compatibility_data = {
+		"minimumVersion": f"{oldest_supported_release.major}.{oldest_supported_release.minor}",
+		"maximumVersion": f"{newest_supported_release.major}.{newest_supported_release.minor}",
+	}
+	_API_COMPATIBILITY_PATH.write_text(json.dumps(api_compatibility_data, sort_keys=True) + "\n")
+
+if __name__ == "__main__":
+	main()

CONTRIBUTING.md

@@ -36,6 +36,7 @@ It is possible to run this action locally via [act](https://github.com/nektos/ac
 
   ```bash
   CODEQL_LOCAL_RUN=true
+  GITHUB_SERVER_URL=https://github.com
 
   # Optional, for better logging
   GITHUB_JOB=<ANY_JOB_NAME>

README.md

@@ -23,14 +23,14 @@ on:
   pull_request:
   schedule:
     #        ┌───────────── minute (0 - 59)
-    #        │ ┌───────────── hour (0 - 23)
-    #        │ │ ┌───────────── day of the month (1 - 31)
-    #        │ │ │ ┌───────────── month (1 - 12 or JAN-DEC)
-    #        │ │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
-    #        │ │ │ │ │
-    #        │ │ │ │ │
-    #        │ │ │ │ │
-    #        * * * * *
+    #        │  ┌───────────── hour (0 - 23)
+    #        │  │ ┌───────────── day of the month (1 - 31)
+    #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+    #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        *  * * * *
     - cron: '30 1 * * 0'
 
 jobs:
@@ -41,17 +41,6 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
-        with:
-          # Must fetch at least the immediate parents so that if this is
-          # a pull request then we can checkout the head of the pull request.
-          # Only include this option if you are running this workflow on pull requests.
-          fetch-depth: 2
-
-      # If this run was triggered by a pull request event then checkout
-      # the head of the pull request instead of the merge commit.
-      # Only include this step if you are running this workflow on pull requests.
-      - run: git checkout HEAD^2
-        if: ${{ github.event_name == 'pull_request' }}
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL

analyze/action.yml

@@ -24,7 +24,7 @@ inputs:
     description: The number of threads to be used by CodeQL.
     required: false
   checkout_path:
-    description: "The path at which the analyzed repository was checked out. Used to relativeize any absolute paths in the uploaded SARIF file."
+    description: "The path at which the analyzed repository was checked out. Used to relativize any absolute paths in the uploaded SARIF file."
     required: false
     default: ${{ github.workspace }}
   token:

init/action.yml

@@ -1,5 +1,5 @@
 name: 'CodeQL: Init'
-description: 'Setup the CodeQL tracer'
+description: 'Set up CodeQL'
 author: 'GitHub'
 inputs:
   tools:
@@ -23,6 +23,9 @@ inputs:
     description: Try to auto-install your python dependencies
     required: true
     default: 'true'
+outputs:
+  codeql-path:
+    description: The path of the CodeQL binary used for analysis
 runs:
   using: 'node12'
   main: '../lib/init-action.js'

lib/actions-util.js

@@ -7,8 +7,12 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
-const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const yaml = __importStar(require("js-yaml"));
 const api = __importStar(require("./api-client"));
 const sharedEnv = __importStar(require("./shared-environment"));
 const util_1 = require("./util");
@@ -58,6 +62,9 @@ function prepareLocalRunEnvironment() {
     if (!process.env.GITHUB_JOB) {
         core.exportVariable("GITHUB_JOB", "UNKNOWN-JOB");
     }
+    if (!process.env.CODEQL_ACTION_ANALYSIS_KEY) {
+        core.exportVariable("CODEQL_ACTION_ANALYSIS_KEY", `LOCAL-RUN:${process.env.GITHUB_JOB}`);
+    }
 }
 exports.prepareLocalRunEnvironment = prepareLocalRunEnvironment;
 /**
@@ -73,7 +80,7 @@ exports.getCommitOid = async function () {
     // reported on the merge commit.
     try {
         let commitOid = "";
-        await new toolrunnner.ToolRunner("git", ["rev-parse", "HEAD"], {
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), ["rev-parse", "HEAD"], {
             silent: true,
             listeners: {
                 stdout: (data) => {
@@ -91,10 +98,163 @@ exports.getCommitOid = async function () {
         return getRequiredEnvParam("GITHUB_SHA");
     }
 };
+function isObject(o) {
+    return o !== null && typeof o === "object";
+}
+var MissingTriggers;
+(function (MissingTriggers) {
+    MissingTriggers[MissingTriggers["None"] = 0] = "None";
+    MissingTriggers[MissingTriggers["Push"] = 1] = "Push";
+    MissingTriggers[MissingTriggers["PullRequest"] = 2] = "PullRequest";
+})(MissingTriggers || (MissingTriggers = {}));
+function toCodedErrors(errors) {
+    return Object.entries(errors).reduce((acc, [key, value]) => {
+        acc[key] = { message: value, code: key };
+        return acc;
+    }, {});
+}
+exports.WorkflowErrors = toCodedErrors({
+    MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
+    MissingHooks: `Please specify on.push and on.pull_request hooks so that Code Scanning can compare pull requests against the state of the base branch.`,
+    MissingPullRequestHook: `Please specify an on.pull_request hook so that Code Scanning is run against pull requests.`,
+    MissingPushHook: `Please specify an on.push hook so that Code Scanning can compare pull requests against the state of the base branch.`,
+    PathsSpecified: `Using on.push.paths can prevent Code Scanning annotating new alerts in your pull requests.`,
+    PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
+    CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
+});
+function validateWorkflow(doc) {
+    var _a, _b, _c, _d, _e;
+    const errors = [];
+    // .jobs[key].steps[].run
+    for (const job of Object.values(((_a = doc) === null || _a === void 0 ? void 0 : _a.jobs) || {})) {
+        for (const step of ((_b = job) === null || _b === void 0 ? void 0 : _b.steps) || []) {
+            // this was advice that we used to give in the README
+            // we actually want to run the analysis on the merge commit
+            // to produce results that are more inline with expectations
+            // (i.e: this is what will happen if you merge this PR)
+            // and avoid some race conditions
+            if (((_c = step) === null || _c === void 0 ? void 0 : _c.run) === "git checkout HEAD^2") {
+                errors.push(exports.WorkflowErrors.CheckoutWrongHead);
+            }
+        }
+    }
+    let missing = MissingTriggers.None;
+    if (doc.on === undefined) {
+        missing = MissingTriggers.Push | MissingTriggers.PullRequest;
+    }
+    else if (typeof doc.on === "string") {
+        switch (doc.on) {
+            case "push":
+                missing = MissingTriggers.PullRequest;
+                break;
+            case "pull_request":
+                missing = MissingTriggers.Push;
+                break;
+            default:
+                missing = MissingTriggers.Push | MissingTriggers.PullRequest;
+                break;
+        }
+    }
+    else if (Array.isArray(doc.on)) {
+        if (!doc.on.includes("push")) {
+            missing = missing | MissingTriggers.Push;
+        }
+        if (!doc.on.includes("pull_request")) {
+            missing = missing | MissingTriggers.PullRequest;
+        }
+    }
+    else if (isObject(doc.on)) {
+        if (!Object.prototype.hasOwnProperty.call(doc.on, "pull_request")) {
+            missing = missing | MissingTriggers.PullRequest;
+        }
+        if (!Object.prototype.hasOwnProperty.call(doc.on, "push")) {
+            missing = missing | MissingTriggers.Push;
+        }
+        else {
+            const paths = (_d = doc.on.push) === null || _d === void 0 ? void 0 : _d.paths;
+            // if you specify paths or paths-ignore you can end up with commits that have no baseline
+            // if they didn't change any files
+            // currently we cannot go back through the history and find the most recent baseline
+            if (Array.isArray(paths) && paths.length > 0) {
+                errors.push(exports.WorkflowErrors.PathsSpecified);
+            }
+            const pathsIgnore = (_e = doc.on.push) === null || _e === void 0 ? void 0 : _e["paths-ignore"];
+            if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
+                errors.push(exports.WorkflowErrors.PathsIgnoreSpecified);
+            }
+        }
+        if (doc.on.push) {
+            const push = doc.on.push.branches || [];
+            if (doc.on.pull_request) {
+                const pull_request = doc.on.pull_request.branches || [];
+                const difference = pull_request.filter((value) => !push.includes(value));
+                if (difference.length > 0) {
+                    // there are branches in pull_request that may not have a baseline
+                    // because we are not building them on push
+                    errors.push(exports.WorkflowErrors.MismatchedBranches);
+                }
+            }
+            else if (push.length > 0) {
+                // push is set up to run on a subset of branches
+                // and you could open a PR against a branch with no baseline
+                errors.push(exports.WorkflowErrors.MismatchedBranches);
+            }
+        }
+    }
+    switch (missing) {
+        case MissingTriggers.PullRequest | MissingTriggers.Push:
+            errors.push(exports.WorkflowErrors.MissingHooks);
+            break;
+        case MissingTriggers.PullRequest:
+            errors.push(exports.WorkflowErrors.MissingPullRequestHook);
+            break;
+        case MissingTriggers.Push:
+            errors.push(exports.WorkflowErrors.MissingPushHook);
+            break;
+    }
+    return errors;
+}
+exports.validateWorkflow = validateWorkflow;
+async function getWorkflowErrors() {
+    const workflow = await getWorkflow();
+    if (workflow === undefined) {
+        return [];
+    }
+    return validateWorkflow(workflow);
+}
+exports.getWorkflowErrors = getWorkflowErrors;
+function formatWorkflowErrors(errors) {
+    const issuesWere = errors.length === 1 ? "issue was" : "issues were";
+    const errorsList = errors.map((e) => e.message).join(" ");
+    return `${errors.length} ${issuesWere} detected with this workflow: ${errorsList}`;
+}
+exports.formatWorkflowErrors = formatWorkflowErrors;
+function formatWorkflowCause(errors) {
+    if (errors.length === 0) {
+        return undefined;
+    }
+    return errors.map((e) => e.code).join(",");
+}
+exports.formatWorkflowCause = formatWorkflowCause;
+async function getWorkflow() {
+    const relativePath = await getWorkflowPath();
+    const absolutePath = path.join(getRequiredEnvParam("GITHUB_WORKSPACE"), relativePath);
+    try {
+        return yaml.safeLoad(fs.readFileSync(absolutePath, "utf-8"));
+    }
+    catch (e) {
+        core.warning(`Could not read workflow: ${e.toString()}`);
+        return undefined;
+    }
+}
+exports.getWorkflow = getWorkflow;
 /**
  * Get the path of the currently executing workflow.
  */
 async function getWorkflowPath() {
+    if (util_1.isLocalRun()) {
+        return getRequiredEnvParam("WORKFLOW_PATH");
+    }
     const repo_nwo = getRequiredEnvParam("GITHUB_REPOSITORY").split("/");
     const owner = repo_nwo[0];
     const repo = repo_nwo[1];
@@ -187,6 +347,11 @@ async function createStatusReportBase(actionName, status, actionStartedAt, cause
         workflowStartedAt = actionStartedAt.toISOString();
         core.exportVariable(sharedEnv.CODEQL_WORKFLOW_STARTED_AT, workflowStartedAt);
     }
+    // If running locally then the GITHUB_ACTION_REF cannot be trusted as it may be for the previous action
+    // See https://github.com/actions/runner/issues/803
+    const actionRef = isRunningLocalAction()
+        ? undefined
+        : process.env["GITHUB_ACTION_REF"];
     const statusReport = {
         workflow_run_id: workflowRunID,
         workflow_name: workflowName,
@@ -195,6 +360,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, cause
         commit_oid: commitOid,
         ref,
         action_name: actionName,
+        action_ref: actionRef,
         action_oid: "unknown",
         started_at: workflowStartedAt,
         action_started_at: actionStartedAt.toISOString(),
@@ -217,6 +383,10 @@ async function createStatusReportBase(actionName, status, actionStartedAt, cause
     return statusReport;
 }
 exports.createStatusReportBase = createStatusReportBase;
+function isHTTPError(arg) {
+    var _a;
+    return ((_a = arg) === null || _a === void 0 ? void 0 : _a.status) !== undefined && Number.isInteger(arg.status);
+}
 /**
  * Send a status report to the code_scanning/analysis/status endpoint.
  *
@@ -226,11 +396,7 @@ exports.createStatusReportBase = createStatusReportBase;
  *
  * Returns whether sending the status report was successful of not.
  */
-async function sendStatusReport(statusReport, ignoreFailures) {
-    if (getRequiredEnvParam("GITHUB_SERVER_URL") !== util_1.GITHUB_DOTCOM_URL) {
-        core.debug("Not sending status report to GitHub Enterprise");
-        return true;
-    }
+async function sendStatusReport(statusReport) {
     if (util_1.isLocalRun()) {
         core.debug("Not sending status report because this is a local run");
         return true;
@@ -240,28 +406,56 @@ async function sendStatusReport(statusReport, ignoreFailures) {
     const nwo = getRequiredEnvParam("GITHUB_REPOSITORY");
     const [owner, repo] = nwo.split("/");
     const client = api.getActionsApiClient();
-    const statusResponse = await client.request("PUT /repos/:owner/:repo/code-scanning/analysis/status", {
-        owner,
-        repo,
-        data: statusReportJSON,
-    });
-    if (!ignoreFailures) {
-        // If the status report request fails with a 403 or a 404, then this is a deliberate
-        // message from the endpoint that the SARIF upload can be expected to fail too,
-        // so the action should fail to avoid wasting actions minutes.
-        //
-        // Other failure responses (or lack thereof) could be transitory and should not
-        // cause the action to fail.
-        if (statusResponse.status === 403) {
-            core.setFailed("The repo on which this action is running is not opted-in to CodeQL code scanning.");
-            return false;
-        }
-        if (statusResponse.status === 404) {
-            core.setFailed("Not authorized to used the CodeQL code scanning feature on this repo.");
-            return false;
-        }
+    try {
+        await client.request("PUT /repos/:owner/:repo/code-scanning/analysis/status", {
+            owner,
+            repo,
+            data: statusReportJSON,
+        });
+        return true;
+    }
+    catch (e) {
+        if (isHTTPError(e)) {
+            switch (e.status) {
+                case 403:
+                    core.setFailed("The repo on which this action is running is not opted-in to CodeQL code scanning.");
+                    return false;
+                case 404:
+                    core.setFailed("Not authorized to used the CodeQL code scanning feature on this repo.");
+                    return false;
+                case 422:
+                    // schema incompatibility when reporting status
+                    // this means that this action version is no longer compatible with the API
+                    // we still want to continue as it is likely the analysis endpoint will work
+                    if (getRequiredEnvParam("GITHUB_SERVER_URL") !== util_1.GITHUB_DOTCOM_URL) {
+                        core.warning("CodeQL Action version is incompatible with the code scanning endpoint. Please update to a compatible version of codeql-action.");
+                    }
+                    else {
+                        core.warning("CodeQL Action is out-of-date. Please upgrade to the latest version of codeql-action.");
+                    }
+                    return true;
+            }
+        }
+        // something else has gone wrong and the request/response will be logged by octokit
+        // it's possible this is a transient error and we should continue scanning
+        core.error("An unexpected error occured when sending code scanning status report.");
+        return true;
     }
-    return true;
 }
 exports.sendStatusReport = sendStatusReport;
+// Is the current action executing a local copy (i.e. we're running a workflow on the codeql-action repo itself)
+// as opposed to running a remote action (i.e. when another repo references us)
+function isRunningLocalAction() {
+    const relativeScriptPath = getRelativeScriptPath();
+    return (relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath));
+}
+exports.isRunningLocalAction = isRunningLocalAction;
+// Get the location where the action is running from.
+// This can be used to get the actions name or tell if we're running a local action.
+function getRelativeScriptPath() {
+    const runnerTemp = getRequiredEnvParam("RUNNER_TEMP");
+    const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
+    return path.relative(actionsDirectory, __filename);
+}
+exports.getRelativeScriptPath = getRelativeScriptPath;
 //# sourceMappingURL=actions-util.js.map

lib/actions-util.test.js

@@ -35,21 +35,152 @@ ava_1.default("getRef() returns head PR ref if GITHUB_SHA not currently checked
     const actualRef = await actionsutil.getRef();
     t.deepEqual(actualRef, "refs/pull/1/head");
 });
+ava_1.default("getAnalysisKey() when a local run", async (t) => {
+    process.env.CODEQL_LOCAL_RUN = "true";
+    process.env.CODEQL_ACTION_ANALYSIS_KEY = "";
+    process.env.GITHUB_JOB = "";
+    actionsutil.prepareLocalRunEnvironment();
+    const actualAnalysisKey = await actionsutil.getAnalysisKey();
+    t.deepEqual(actualAnalysisKey, "LOCAL-RUN:UNKNOWN-JOB");
+});
 ava_1.default("prepareEnvironment() when a local run", (t) => {
-    const origLocalRun = process.env.CODEQL_LOCAL_RUN;
     process.env.CODEQL_LOCAL_RUN = "false";
     process.env.GITHUB_JOB = "YYY";
+    process.env.CODEQL_ACTION_ANALYSIS_KEY = "TEST";
     actionsutil.prepareLocalRunEnvironment();
     // unchanged
     t.deepEqual(process.env.GITHUB_JOB, "YYY");
+    t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "TEST");
     process.env.CODEQL_LOCAL_RUN = "true";
     actionsutil.prepareLocalRunEnvironment();
     // unchanged
     t.deepEqual(process.env.GITHUB_JOB, "YYY");
+    t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "TEST");
+    process.env.CODEQL_ACTION_ANALYSIS_KEY = "";
+    actionsutil.prepareLocalRunEnvironment();
+    // updated
+    t.deepEqual(process.env.GITHUB_JOB, "YYY");
+    t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "LOCAL-RUN:YYY");
     process.env.GITHUB_JOB = "";
+    process.env.CODEQL_ACTION_ANALYSIS_KEY = "";
     actionsutil.prepareLocalRunEnvironment();
     // updated
     t.deepEqual(process.env.GITHUB_JOB, "UNKNOWN-JOB");
-    process.env.CODEQL_LOCAL_RUN = origLocalRun;
+    t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "LOCAL-RUN:UNKNOWN-JOB");
+});
+ava_1.default("validateWorkflow() when on is missing", (t) => {
+    const errors = actionsutil.validateWorkflow({});
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+});
+ava_1.default("validateWorkflow() when on.push is missing", (t) => {
+    const errors = actionsutil.validateWorkflow({ on: {} });
+    console.log(errors);
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+});
+ava_1.default("validateWorkflow() when on.push is an array missing pull_request", (t) => {
+    const errors = actionsutil.validateWorkflow({ on: ["push"] });
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPullRequestHook]);
+});
+ava_1.default("validateWorkflow() when on.push is an array missing push", (t) => {
+    const errors = actionsutil.validateWorkflow({ on: ["pull_request"] });
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPushHook]);
+});
+ava_1.default("validateWorkflow() when on.push is valid", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: ["push", "pull_request"],
+    });
+    t.deepEqual(errors.length, 0);
+});
+ava_1.default("validateWorkflow() when on.push is a valid superset", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: ["push", "pull_request", "schedule"],
+    });
+    t.deepEqual(errors.length, 0);
+});
+ava_1.default("validateWorkflow() when on.push should not have a path", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: {
+            push: { branches: ["main"], paths: ["test/*"] },
+            pull_request: { branches: ["main"] },
+        },
+    });
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.PathsSpecified]);
+});
+ava_1.default("validateWorkflow() when on.push is a correct object", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
+    });
+    t.deepEqual(errors.length, 0);
+});
+ava_1.default("validateWorkflow() when on.push is correct with empty objects", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: { push: undefined, pull_request: undefined },
+    });
+    console.log(errors);
+    t.deepEqual(errors.length, 0);
+});
+ava_1.default("validateWorkflow() when on.push is mismatched", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["feature"] },
+        },
+    });
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+});
+ava_1.default("validateWorkflow() when on.push is not mismatched", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: {
+            push: { branches: ["main", "feature"] },
+            pull_request: { branches: ["main"] },
+        },
+    });
+    t.deepEqual(errors.length, 0);
+});
+ava_1.default("validateWorkflow() when on.push is mismatched for pull_request", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["main", "feature"] },
+        },
+    });
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+});
+ava_1.default("validateWorkflow() when on.pull_request for every branch but push specifies branches", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: {
+            push: { branches: ["main"] },
+            pull_request: null,
+        },
+    });
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+});
+ava_1.default("validateWorkflow() when HEAD^2 is checked out", (t) => {
+    const errors = actionsutil.validateWorkflow({
+        on: ["push", "pull_request"],
+        jobs: { test: { steps: [{ run: "git checkout HEAD^2" }] } },
+    });
+    t.deepEqual(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]);
+});
+ava_1.default("formatWorkflowErrors() when there is one error", (t) => {
+    const message = actionsutil.formatWorkflowErrors([
+        actionsutil.WorkflowErrors.CheckoutWrongHead,
+    ]);
+    t.true(message.startsWith("1 issue was detected with this workflow:"));
+});
+ava_1.default("formatWorkflowErrors() when there are multiple errors", (t) => {
+    const message = actionsutil.formatWorkflowErrors([
+        actionsutil.WorkflowErrors.CheckoutWrongHead,
+        actionsutil.WorkflowErrors.PathsSpecified,
+    ]);
+    t.true(message.startsWith("2 issues were detected with this workflow:"));
+});
+ava_1.default("formatWorkflowCause()", (t) => {
+    const message = actionsutil.formatWorkflowCause([
+        actionsutil.WorkflowErrors.CheckoutWrongHead,
+        actionsutil.WorkflowErrors.PathsSpecified,
+    ]);
+    t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
+    t.deepEqual(actionsutil.formatWorkflowCause([]), undefined);
 });
 //# sourceMappingURL=actions-util.test.js.map

lib/analyze-action.js

@@ -31,7 +31,7 @@ async function run() {
     let stats = undefined;
     try {
         actionsUtil.prepareLocalRunEnvironment();
-        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("finish", "starting", startedAt), true))) {
+        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("finish", "starting", startedAt)))) {
             return;
         }
         const logger = logging_1.getActionsLogger();
@@ -39,18 +39,31 @@ async function run() {
         if (config === undefined) {
             throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
         }
-        stats = await analyze_1.runAnalyze(repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), actionsUtil.getRequiredInput("token"), actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"), actionsUtil.getRequiredInput("upload") === "true", "actions", actionsUtil.getRequiredInput("output"), util.getMemoryFlag(actionsUtil.getOptionalInput("ram")), util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), util.getThreadsFlag(actionsUtil.getOptionalInput("threads"), logger), config, logger);
+        const apiDetails = {
+            auth: actionsUtil.getRequiredInput("token"),
+            url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
+        };
+        stats = await analyze_1.runAnalyze(repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), apiDetails, actionsUtil.getRequiredInput("upload") === "true", "actions", actionsUtil.getRequiredInput("output"), util.getMemoryFlag(actionsUtil.getOptionalInput("ram")), util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), util.getThreadsFlag(actionsUtil.getOptionalInput("threads"), logger), config, logger);
     }
     catch (error) {
         core.setFailed(error.message);
         console.log(error);
+        if (error instanceof analyze_1.CodeQLAnalysisError) {
+            stats = { ...error.queriesStatusReport };
+        }
         await sendStatusReport(startedAt, stats, error);
         return;
     }
     await sendStatusReport(startedAt, stats);
 }
-run().catch((e) => {
-    core.setFailed(`analyze action failed: ${e}`);
-    console.log(e);
-});
+async function runWrapper() {
+    try {
+        await run();
+    }
+    catch (error) {
+        core.setFailed(`analyze action failed: ${error}`);
+        console.log(error);
+    }
+}
+void runWrapper();
 //# sourceMappingURL=analyze-action.js.map

lib/analyze-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-action.js","sourceRoot":"","sources":["../src/analyze-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAA6D;AAC7D,iDAA2C;AAC3C,uCAA6C;AAC7C,6CAAkD;AAClD,6CAA+B;AAM/B,KAAK,UAAU,gBAAgB,CAC7B,SAAe,EACf,KAAuC,EACvC,KAAa;;IAEb,MAAM,MAAM,GACV,OAAA,KAAK,0CAAE,wBAAwB,MAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,QAAQ,EACR,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAAuB;QACvC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAqC,SAAS,CAAC;IACxD,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,QAAQ,EACR,UAAU,EACV,SAAS,CACV,EACD,IAAI,CACL,CAAC,EACF;YACA,OAAO;SACR;QACD,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,wBAAS,CAC5B,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,KAAK,GAAG,MAAM,oBAAU,CACtB,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,MAAM,EACjD,SAAS,EACT,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACvD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,EACrE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EACpE,MAAM,EACN,MAAM,CACP,CAAC;KACH;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO;KACR;IAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IAChB,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analyze-action.js","sourceRoot":"","sources":["../src/analyze-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAImB;AACnB,iDAA2C;AAC3C,uCAA6C;AAC7C,6CAAkD;AAClD,6CAA+B;AAM/B,KAAK,UAAU,gBAAgB,CAC7B,SAAe,EACf,KAAuC,EACvC,KAAa;;IAEb,MAAM,MAAM,GACV,OAAA,KAAK,0CAAE,wBAAwB,MAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,QAAQ,EACR,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAAuB;QACvC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAqC,SAAS,CAAC;IACxD,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,QAAQ,EACR,UAAU,EACV,SAAS,CACV,CACF,CAAC,EACF;YACA,OAAO;SACR;QACD,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,wBAAS,CAC5B,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QACF,KAAK,GAAG,MAAM,oBAAU,CACtB,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,UAAU,EACV,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,MAAM,EACjD,SAAS,EACT,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACvD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,EACrE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EACpE,MAAM,EACN,MAAM,CACP,CAAC;KACH;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,IAAI,KAAK,YAAY,6BAAmB,EAAE;YACxC,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;SAC1C;QAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO;KACR;IAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/analyze.js

@@ -9,13 +9,21 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const analysisPaths = __importStar(require("./analysis-paths"));
 const codeql_1 = require("./codeql");
 const languages_1 = require("./languages");
 const sharedEnv = __importStar(require("./shared-environment"));
 const upload_lib = __importStar(require("./upload-lib"));
 const util = __importStar(require("./util"));
+class CodeQLAnalysisError extends Error {
+    constructor(queriesStatusReport, message) {
+        super(message);
+        this.name = "CodeQLAnalysisError";
+        this.queriesStatusReport = queriesStatusReport;
+    }
+}
+exports.CodeQLAnalysisError = CodeQLAnalysisError;
 async function setupPythonExtractor(logger) {
     const codeqlPython = process.env["CODEQL_PYTHON"];
     if (codeqlPython === undefined || codeqlPython.length === 0) {
@@ -30,14 +38,14 @@ async function setupPythonExtractor(logger) {
             },
         },
     };
-    await new toolrunnner.ToolRunner(codeqlPython, [
+    await new toolrunner.ToolRunner(codeqlPython, [
         "-c",
         "import os; import pip; print(os.path.dirname(os.path.dirname(pip.__file__)))",
     ], options).exec();
     logger.info(`Setting LGTM_INDEX_IMPORT_PATH=${output}`);
     process.env["LGTM_INDEX_IMPORT_PATH"] = output;
     output = "";
-    await new toolrunnner.ToolRunner(codeqlPython, ["-c", "import sys; print(sys.version_info[0])"], options).exec();
+    await new toolrunner.ToolRunner(codeqlPython, ["-c", "import sys; print(sys.version_info[0])"], options).exec();
     logger.info(`Setting LGTM_PYTHON_SETUP_VERSION=${output}`);
     process.env["LGTM_PYTHON_SETUP_VERSION"] = output;
 }
@@ -57,12 +65,12 @@ async function createdDBForScannedLanguages(config, logger) {
         }
     }
 }
-async function finalizeDatabaseCreation(config, logger) {
+async function finalizeDatabaseCreation(config, threadsFlag, logger) {
     await createdDBForScannedLanguages(config, logger);
     const codeql = codeql_1.getCodeQL(config.codeQLCmd);
     for (const language of config.languages) {
         logger.startGroup(`Finalizing ${language}`);
-        await codeql.finalizeDatabase(util.getCodeQLDatabasePath(config.tempDir, language));
+        await codeql.finalizeDatabase(util.getCodeQLDatabasePath(config.tempDir, language), threadsFlag);
         logger.endGroup();
     }
 }
@@ -101,28 +109,27 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
             }
         }
         catch (e) {
-            logger.error(`Error running analysis for ${language}: ${e}`);
             logger.info(e);
             statusReport.analyze_failure_language = language;
-            return statusReport;
+            throw new CodeQLAnalysisError(statusReport, `Error running analysis for ${language}: ${e}`);
         }
     }
     return statusReport;
 }
 exports.runQueries = runQueries;
-async function runAnalyze(repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, githubAuth, githubUrl, doUpload, mode, outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger) {
+async function runAnalyze(repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, doUpload, mode, outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger) {
     // Delete the tracer config env var to avoid tracing ourselves
     delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
     fs.mkdirSync(outputDir, { recursive: true });
     logger.info("Finalizing database creation");
-    await finalizeDatabaseCreation(config, logger);
+    await finalizeDatabaseCreation(config, threadsFlag, logger);
     logger.info("Analyzing database");
     const queriesStats = await runQueries(outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger);
     if (!doUpload) {
         logger.info("Not uploading results");
         return { ...queriesStats };
     }
-    const uploadStats = await upload_lib.upload(outputDir, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, githubAuth, githubUrl, mode, logger);
+    const uploadStats = await upload_lib.upload(outputDir, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger);
     return { ...queriesStats, ...uploadStats };
 }
 exports.runAnalyze = runAnalyze;

lib/analyze.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,0EAA4D;AAE5D,gEAAkD;AAClD,qCAAqC;AAErC,2CAA0D;AAG1D,gEAAkD;AAClD,yDAA2C;AAC3C,6CAA+B;AAmC/B,KAAK,UAAU,oBAAoB,CAAC,MAAc;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3D,+FAA+F;QAC/F,OAAO;KACR;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG;QACd,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;SACF;KACF,CAAC;IAEF,MAAM,IAAI,WAAW,CAAC,UAAU,CAC9B,YAAY,EACZ;QACE,IAAI;QACJ,8EAA8E;KAC/E,EACD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC;IAE/C,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,IAAI,WAAW,CAAC,UAAU,CAC9B,YAAY,EACZ,CAAC,IAAI,EAAE,wCAAwC,CAAC,EAChD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAA0B,EAC1B,MAAc;IAEd,sEAAsE;IACtE,oCAAoC;IACpC,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI,6BAAiB,CAAC,QAAQ,CAAC,EAAE;YAC/B,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;YAE5C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,MAAM,EAAE;gBAChC,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;aACpC;YAED,MAAM,MAAM,CAAC,sBAAsB,CACjC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,CACT,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,CAAC;SACnB;KACF;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAA0B,EAC1B,MAAc;IAEd,MAAM,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,gBAAgB,CAC3B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CACrD,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,CAAC;KACnB;AACH,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;YAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,gDAAgD,CAC9E,CAAC;SACH;QAED,IAAI;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACxC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBAEvC,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAC7C,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;oBACF,uEAAuE;oBACvE,2EAA2E;oBAC3E,MAAM,cAAc,GAAG,GAAG,YAAY,YAAY,IAAI,MAAM,CAAC;oBAC7D,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;yBACrC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;yBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACrD,MAAM,CAAC,KAAK,CACV,wBAAwB,QAAQ,QAAQ,kBAAkB,EAAE,CAC7D,CAAC;oBAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,IAAI,IAAI,QAAQ,CAAC,CAAC;oBAEtE,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,MAAM,CAAC,eAAe,CAC1B,YAAY,EACZ,SAAS,EACT,cAAc,EACd,UAAU,EACV,eAAe,EACf,WAAW,CACZ,CAAC;oBAEF,MAAM,CAAC,KAAK,CACV,8BAA8B,QAAQ,gBAAgB,SAAS,GAAG,CACnE,CAAC;oBACF,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAElB,yBAAyB;oBACzB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBACrC,YAAY,CAAC,WAAW,IAAI,YAAY,QAAQ,cAAc,CAAC;wBAC7D,OAAO,GAAG,SAAS,CAAC;iBACvB;aACF;SACF;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,YAAY,CAAC,wBAAwB,GAAG,QAAQ,CAAC;YACjD,OAAO,YAAY,CAAC;SACrB;KACF;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAxED,gCAwEC;AAEM,KAAK,UAAU,UAAU,CAC9B,aAA4B,EAC5B,SAAiB,EACjB,GAAW,EACX,WAA+B,EAC/B,YAAgC,EAChC,aAAiC,EACjC,YAAoB,EACpB,WAA+B,EAC/B,UAAkB,EAClB,SAAiB,EACjB,QAAiB,EACjB,IAAe,EACf,SAAiB,EACjB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,8DAA8D;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAEzD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC5C,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/C,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,SAAS,EACT,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;KAC5B;IAED,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CACzC,SAAS,EACT,aAAa,EACb,SAAS,EACT,GAAG,EACH,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,UAAU,EACV,SAAS,EACT,IAAI,EACJ,MAAM,CACP,CAAC;IAEF,OAAO,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,EAAE,CAAC;AAC7C,CAAC;AA5DD,gCA4DC"}
+{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAE3D,gEAAkD;AAElD,qCAAqC;AAErC,2CAA0D;AAG1D,gEAAkD;AAClD,yDAA2C;AAC3C,6CAA+B;AAE/B,MAAa,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,mBAAwC,EAAE,OAAe;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;CACF;AATD,kDASC;AAmCD,KAAK,UAAU,oBAAoB,CAAC,MAAc;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3D,+FAA+F;QAC/F,OAAO;KACR;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG;QACd,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;SACF;KACF,CAAC;IAEF,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,YAAY,EACZ;QACE,IAAI;QACJ,8EAA8E;KAC/E,EACD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC;IAE/C,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,YAAY,EACZ,CAAC,IAAI,EAAE,wCAAwC,CAAC,EAChD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAA0B,EAC1B,MAAc;IAEd,sEAAsE;IACtE,oCAAoC;IACpC,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI,6BAAiB,CAAC,QAAQ,CAAC,EAAE;YAC/B,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;YAE5C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,MAAM,EAAE;gBAChC,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;aACpC;YAED,MAAM,MAAM,CAAC,sBAAsB,CACjC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,CACT,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,CAAC;SACnB;KACF;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,gBAAgB,CAC3B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,WAAW,CACZ,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,CAAC;KACnB;AACH,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;YAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,gDAAgD,CAC9E,CAAC;SACH;QAED,IAAI;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACxC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBAEvC,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAC7C,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;oBACF,uEAAuE;oBACvE,2EAA2E;oBAC3E,MAAM,cAAc,GAAG,GAAG,YAAY,YAAY,IAAI,MAAM,CAAC;oBAC7D,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;yBACrC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;yBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACrD,MAAM,CAAC,KAAK,CACV,wBAAwB,QAAQ,QAAQ,kBAAkB,EAAE,CAC7D,CAAC;oBAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,IAAI,IAAI,QAAQ,CAAC,CAAC;oBAEtE,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,MAAM,CAAC,eAAe,CAC1B,YAAY,EACZ,SAAS,EACT,cAAc,EACd,UAAU,EACV,eAAe,EACf,WAAW,CACZ,CAAC;oBAEF,MAAM,CAAC,KAAK,CACV,8BAA8B,QAAQ,gBAAgB,SAAS,GAAG,CACnE,CAAC;oBACF,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAElB,yBAAyB;oBACzB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBACrC,YAAY,CAAC,WAAW,IAAI,YAAY,QAAQ,cAAc,CAAC;wBAC7D,OAAO,GAAG,SAAS,CAAC;iBACvB;aACF;SACF;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,YAAY,CAAC,wBAAwB,GAAG,QAAQ,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,8BAA8B,QAAQ,KAAK,CAAC,EAAE,CAC/C,CAAC;SACH;KACF;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AA1ED,gCA0EC;AAEM,KAAK,UAAU,UAAU,CAC9B,aAA4B,EAC5B,SAAiB,EACjB,GAAW,EACX,WAA+B,EAC/B,YAAgC,EAChC,aAAiC,EACjC,YAAoB,EACpB,WAA+B,EAC/B,UAA4B,EAC5B,QAAiB,EACjB,IAAe,EACf,SAAiB,EACjB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,8DAA8D;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAEzD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC5C,MAAM,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAE5D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,SAAS,EACT,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;KAC5B;IAED,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CACzC,SAAS,EACT,aAAa,EACb,SAAS,EACT,GAAG,EACH,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;IAEF,OAAO,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,EAAE,CAAC;AAC7C,CAAC;AA1DD,gCA0DC"}

lib/api-client.js

@@ -11,18 +11,55 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path = __importStar(require("path"));
+const core_1 = require("@actions/core");
 const githubUtils = __importStar(require("@actions/github/lib/utils"));
 const retry = __importStar(require("@octokit/plugin-retry"));
 const console_log_level_1 = __importDefault(require("console-log-level"));
+const semver = __importStar(require("semver"));
 const actions_util_1 = require("./actions-util");
+const apiCompatibility = __importStar(require("./api-compatibility.json"));
+const logging_1 = require("./logging");
 const util_1 = require("./util");
-exports.getApiClient = function (githubAuth, githubUrl, allowLocalRun = false) {
+var DisallowedAPIVersionReason;
+(function (DisallowedAPIVersionReason) {
+    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_OLD"] = 0] = "ACTION_TOO_OLD";
+    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_NEW"] = 1] = "ACTION_TOO_NEW";
+})(DisallowedAPIVersionReason = exports.DisallowedAPIVersionReason || (exports.DisallowedAPIVersionReason = {}));
+const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+const CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR = "CODEQL_ACTION_WARNED_ABOUT_VERSION";
+let hasBeenWarnedAboutVersion = false;
+exports.getApiClient = function (apiDetails, mode, logger, allowLocalRun = false, possibleFailureExpected = false) {
     if (util_1.isLocalRun() && !allowLocalRun) {
         throw new Error("Invalid API call in local run");
     }
-    const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
-    return new retryingOctokit(githubUtils.getOctokitOptions(githubAuth, {
-        baseUrl: getApiUrl(githubUrl),
+    const customOctokit = githubUtils.GitHub.plugin(retry.retry, (octokit, _) => {
+        octokit.hook.after("request", (response, __) => {
+            if (response.status < 400 && !possibleFailureExpected) {
+                if (hasBeenWarnedAboutVersion) {
+                    return;
+                }
+            }
+            if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined ||
+                process.env[CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR] === undefined) {
+                return;
+            }
+            const installedVersion = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER];
+            const disallowedAPIVersionReason = apiVersionInRange(installedVersion, apiCompatibility.minimumVersion, apiCompatibility.maximumVersion);
+            const toolName = mode === "actions" ? "Action" : "Runner";
+            if (disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_OLD) {
+                logger.warning(`The CodeQL ${toolName} version you are using is too old to be compatible with GitHub Enterprise ${installedVersion}. If you experience issues, please upgrade to a more recent version of the CodeQL ${toolName}.`);
+            }
+            if (disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_NEW) {
+                logger.warning(`GitHub Enterprise ${installedVersion} is too old to be compatible with this version of the CodeQL ${toolName}. If you experience issues, please upgrade to a more recent version of GitHub Enterprise or use an older version of the CodeQL ${toolName}.`);
+            }
+            hasBeenWarnedAboutVersion = true;
+            if (mode === "actions") {
+                core_1.exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
+            }
+        });
+    });
+    return new customOctokit(githubUtils.getOctokitOptions(apiDetails.auth, {
+        baseUrl: getApiUrl(apiDetails.url),
         userAgent: "CodeQL Action",
         log: console_log_level_1.default({ level: "debug" }),
     }));
@@ -39,10 +76,24 @@ function getApiUrl(githubUrl) {
     return url.toString();
 }
 // Temporary function to aid in the transition to running on and off of github actions.
-// Once all code has been coverted this function should be removed or made canonical
+// Once all code has been converted this function should be removed or made canonical
 // and called only from the action entrypoints.
 function getActionsApiClient(allowLocalRun = false) {
-    return exports.getApiClient(actions_util_1.getRequiredInput("token"), actions_util_1.getRequiredEnvParam("GITHUB_SERVER_URL"), allowLocalRun);
+    const apiDetails = {
+        auth: actions_util_1.getRequiredInput("token"),
+        url: actions_util_1.getRequiredEnvParam("GITHUB_SERVER_URL"),
+    };
+    return exports.getApiClient(apiDetails, "actions", logging_1.getActionsLogger(), allowLocalRun);
 }
 exports.getActionsApiClient = getActionsApiClient;
+function apiVersionInRange(version, minimumVersion, maximumVersion) {
+    if (!semver.satisfies(version, `>=${minimumVersion}`)) {
+        return DisallowedAPIVersionReason.ACTION_TOO_NEW;
+    }
+    if (!semver.satisfies(version, `<=${maximumVersion}`)) {
+        return DisallowedAPIVersionReason.ACTION_TOO_OLD;
+    }
+    return undefined;
+}
+exports.apiVersionInRange = apiVersionInRange;
 //# sourceMappingURL=api-client.js.map

lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6B;AAE7B,uEAAyD;AACzD,6DAA+C;AAC/C,0EAAgD;AAEhD,iDAAuE;AACvE,iCAAoC;AAEvB,QAAA,YAAY,GAAG,UAC1B,UAAkB,EAClB,SAAiB,EACjB,aAAa,GAAG,KAAK;IAErB,IAAI,iBAAU,EAAE,IAAI,CAAC,aAAa,EAAE;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;KAClD;IACD,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,eAAe,CACxB,WAAW,CAAC,iBAAiB,CAAC,UAAU,EAAE;QACxC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;QAC7B,SAAS,EAAE,eAAe;QAC1B,GAAG,EAAE,2BAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,kDAAkD;IAClD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,uFAAuF;AACvF,oFAAoF;AACpF,+CAA+C;AAC/C,SAAgB,mBAAmB,CAAC,aAAa,GAAG,KAAK;IACvD,OAAO,oBAAY,CACjB,+BAAgB,CAAC,OAAO,CAAC,EACzB,kCAAmB,CAAC,mBAAmB,CAAC,EACxC,aAAa,CACd,CAAC;AACJ,CAAC;AAND,kDAMC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6B;AAE7B,wCAA+C;AAC/C,uEAAyD;AACzD,6DAA+C;AAE/C,0EAAgD;AAChD,+CAAiC;AAEjC,iDAAuE;AACvE,2EAA6D;AAC7D,uCAAqD;AACrD,iCAA0C;AAE1C,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAOD,MAAM,gCAAgC,GAAG,6BAA6B,CAAC;AACvE,MAAM,0CAA0C,GAC9C,oCAAoC,CAAC;AACvC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEzB,QAAA,YAAY,GAAG,UAC1B,UAA4B,EAC5B,IAAU,EACV,MAAc,EACd,aAAa,GAAG,KAAK,EACrB,uBAAuB,GAAG,KAAK;IAE/B,IAAI,iBAAU,EAAE,IAAI,CAAC,aAAa,EAAE;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;KAClD;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QAC1E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,QAA8B,EAAE,EAAE,EAAE,EAAE;YACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,uBAAuB,EAAE;gBACrD,IAAI,yBAAyB,EAAE;oBAC7B,OAAO;iBACR;aACF;YACD,IACE,QAAQ,CAAC,OAAO,CAAC,gCAAgC,CAAC,KAAK,SAAS;gBAChE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,SAAS,EACrE;gBACA,OAAO;aACR;YACD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CACvC,gCAAgC,CACvB,CAAC;YACZ,MAAM,0BAA0B,GAAG,iBAAiB,CAClD,gBAAgB,EAChB,gBAAgB,CAAC,cAAc,EAC/B,gBAAgB,CAAC,cAAc,CAChC,CAAC;YAEF,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE1D,IACE,0BAA0B,KAAK,0BAA0B,CAAC,cAAc,EACxE;gBACA,MAAM,CAAC,OAAO,CACZ,cAAc,QAAQ,6EAA6E,gBAAgB,qFAAqF,QAAQ,GAAG,CACpN,CAAC;aACH;YACD,IACE,0BAA0B,KAAK,0BAA0B,CAAC,cAAc,EACxE;gBACA,MAAM,CAAC,OAAO,CACZ,qBAAqB,gBAAgB,gEAAgE,QAAQ,kIAAkI,QAAQ,GAAG,CAC3P,CAAC;aACH;YACD,yBAAyB,GAAG,IAAI,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,EAAE;gBACtB,qBAAc,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;aAClE;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,aAAa,CACtB,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE;QAC7C,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,eAAe;QAC1B,GAAG,EAAE,2BAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,kDAAkD;IAClD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,uFAAuF;AACvF,qFAAqF;AACrF,+CAA+C;AAC/C,SAAgB,mBAAmB,CAAC,aAAa,GAAG,KAAK;IACvD,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,+BAAgB,CAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,kCAAmB,CAAC,mBAAmB,CAAC;KAC9C,CAAC;IAEF,OAAO,oBAAY,CAAC,UAAU,EAAE,SAAS,EAAE,0BAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AAChF,CAAC;AAPD,kDAOC;AAED,SAAgB,iBAAiB,CAC/B,OAAe,EACf,cAAsB,EACtB,cAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,cAAc,EAAE,CAAC,EAAE;QACrD,OAAO,0BAA0B,CAAC,cAAc,CAAC;KAClD;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,cAAc,EAAE,CAAC,EAAE;QACrD,OAAO,0BAA0B,CAAC,cAAc,CAAC;KAClD;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAZD,8CAYC"}

lib/api-client.test.js

@@ -0,0 +1,17 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const api_client_1 = require("./api-client");
+ava_1.default("allowed API versions", async (t) => {
+    t.is(api_client_1.apiVersionInRange("1.33.0", "1.33", "2.0"), undefined);
+    t.is(api_client_1.apiVersionInRange("1.33.1", "1.33", "2.0"), undefined);
+    t.is(api_client_1.apiVersionInRange("1.34.0", "1.33", "2.0"), undefined);
+    t.is(api_client_1.apiVersionInRange("2.0.0", "1.33", "2.0"), undefined);
+    t.is(api_client_1.apiVersionInRange("2.0.1", "1.33", "2.0"), undefined);
+    t.is(api_client_1.apiVersionInRange("1.32.0", "1.33", "2.0"), api_client_1.DisallowedAPIVersionReason.ACTION_TOO_NEW);
+    t.is(api_client_1.apiVersionInRange("2.1.0", "1.33", "2.0"), api_client_1.DisallowedAPIVersionReason.ACTION_TOO_OLD);
+});
+//# sourceMappingURL=api-client.test.js.map

lib/api-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.test.js","sourceRoot":"","sources":["../src/api-client.test.ts"],"names":[],"mappings":";;;;;AAAA,8CAAuB;AAEvB,6CAA6E;AAE7E,aAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,EAAE,CACF,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAC1C,uCAA0B,CAAC,cAAc,CAC1C,CAAC;IACF,CAAC,CAAC,EAAE,CACF,8BAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EACzC,uCAA0B,CAAC,cAAc,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC"}

lib/api-compatibility.json

@@ -0,0 +1 @@
+{ "maximumVersion": "3.0", "minimumVersion": "2.22" }

lib/autobuild-action.js

@@ -31,7 +31,7 @@ async function run() {
     let language = undefined;
     try {
         actionsUtil.prepareLocalRunEnvironment();
-        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("autobuild", "starting", startedAt), true))) {
+        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("autobuild", "starting", startedAt)))) {
             return;
         }
         const config = await config_utils.getConfig(actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), logger);
@@ -51,8 +51,14 @@ async function run() {
     }
     await sendCompletedStatusReport(startedAt, language ? [language] : []);
 }
-run().catch((e) => {
-    core.setFailed(`autobuild action failed.  ${e}`);
-    console.log(e);
-});
+async function runWrapper() {
+    try {
+        await run();
+    }
+    catch (error) {
+        core.setFailed(`autobuild action failed. ${error}`);
+        console.log(error);
+    }
+}
+void runWrapper();
 //# sourceMappingURL=autobuild-action.js.map

lib/autobuild-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,2CAAuE;AACvE,6DAA+C;AAE/C,uCAA6C;AAS7C,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;;IAEb,MAAM,MAAM,GACV,eAAe,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,WAAW,EACX,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAyB,SAAS,CAAC;IAC/C,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,WAAW,EACX,UAAU,EACV,SAAS,CACV,EACD,IAAI,CACL,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CACzC,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,QAAQ,GAAG,sCAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE;YAC1B,MAAM,wBAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SAC9C;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CACZ,mIAAmI,KAAK,CAAC,OAAO,EAAE,CACnJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,yBAAyB,CAC7B,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAC1B,QAAQ,EACR,KAAK,CACN,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IAChB,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,2CAAuE;AACvE,6DAA+C;AAE/C,uCAA6C;AAS7C,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;;IAEb,MAAM,MAAM,GACV,eAAe,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,WAAW,EACX,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,QAAQ,GAAyB,SAAS,CAAC;IAC/C,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,WAAW,EACX,UAAU,EACV,SAAS,CACV,CACF,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CACzC,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,QAAQ,GAAG,sCAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE;YAC1B,MAAM,wBAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;SAC9C;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CACZ,mIAAmI,KAAK,CAAC,OAAO,EAAE,CACnJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,yBAAyB,CAC7B,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAC1B,QAAQ,EACR,KAAK,CACN,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/codeql.js

@@ -11,7 +11,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const stream = __importStar(require("stream"));
 const globalutil = __importStar(require("util"));
-const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const http = __importStar(require("@actions/http-client"));
 const toolcache = __importStar(require("@actions/tool-cache"));
 const semver = __importStar(require("semver"));
@@ -45,32 +45,32 @@ function getCodeQLBundleName() {
     }
     return `codeql-bundle-${platform}.tar.gz`;
 }
-function getCodeQLActionRepository(mode) {
+function getCodeQLActionRepository(mode, logger) {
     if (mode !== "actions") {
         return CODEQL_DEFAULT_ACTION_REPOSITORY;
     }
-    // Actions do not know their own repository name,
-    // so we currently use this hack to find the name based on where our files are.
-    // This can be removed once the change to the runner in https://github.com/actions/runner/pull/585 is deployed.
-    const runnerTemp = actions_util_1.getRequiredEnvParam("RUNNER_TEMP");
-    const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
-    const relativeScriptPath = path.relative(actionsDirectory, __filename);
-    // This handles the case where the Action does not come from an Action repository,
-    // e.g. our integration tests which use the Action code from the current checkout.
-    if (relativeScriptPath.startsWith("..") ||
-        path.isAbsolute(relativeScriptPath)) {
+    if (process.env["GITHUB_ACTION_REPOSITORY"] !== undefined) {
+        return process.env["GITHUB_ACTION_REPOSITORY"];
+    }
+    // The Actions Runner used with GitHub Enterprise Server 2.22 did not set the GITHUB_ACTION_REPOSITORY variable.
+    // This fallback logic can be removed after the end-of-support for 2.22 on 2021-09-23.
+    if (actions_util_1.isRunningLocalAction()) {
+        // This handles the case where the Action does not come from an Action repository,
+        // e.g. our integration tests which use the Action code from the current checkout.
+        logger.info("The CodeQL Action is checked out locally. Using the default CodeQL Action repository.");
         return CODEQL_DEFAULT_ACTION_REPOSITORY;
     }
-    const relativeScriptPathParts = relativeScriptPath.split(path.sep);
+    logger.info("GITHUB_ACTION_REPOSITORY environment variable was not set. Falling back to legacy method of finding the GitHub Action.");
+    const relativeScriptPathParts = actions_util_1.getRelativeScriptPath().split(path.sep);
     return `${relativeScriptPathParts[0]}/${relativeScriptPathParts[1]}`;
 }
-async function getCodeQLBundleDownloadURL(githubAuth, githubUrl, mode, logger) {
-    const codeQLActionRepository = getCodeQLActionRepository(mode);
+async function getCodeQLBundleDownloadURL(apiDetails, mode, logger) {
+    const codeQLActionRepository = getCodeQLActionRepository(mode, logger);
     const potentialDownloadSources = [
         // This GitHub instance, and this Action.
-        [githubUrl, codeQLActionRepository],
+        [apiDetails.url, codeQLActionRepository],
         // This GitHub instance, and the canonical Action.
-        [githubUrl, CODEQL_DEFAULT_ACTION_REPOSITORY],
+        [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY],
         // GitHub.com, and the canonical Action.
         [util.GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY],
     ];
@@ -88,7 +88,7 @@ async function getCodeQLBundleDownloadURL(githubAuth, githubUrl, mode, logger) {
         const [repositoryOwner, repositoryName] = repository.split("/");
         try {
             const release = await api
-                .getApiClient(githubAuth, githubUrl)
+                .getApiClient(apiDetails, mode, logger, false, true)
                 .repos.getReleaseByTag({
                 owner: repositoryOwner,
                 repo: repositoryName,
@@ -122,7 +122,7 @@ async function toolcacheDownloadTool(url, headers, tempDir, logger) {
     await pipeline(response.message, fs.createWriteStream(dest));
     return dest;
 }
-async function setupCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir, mode, logger) {
+async function setupCodeQL(codeqlURL, apiDetails, tempDir, toolsDir, mode, logger) {
     // Setting these two env vars makes the toolcache code safe to use outside,
     // of actions but this is obviously not a great thing we're doing and it would
     // be better to write our own implementation to use outside of actions.
@@ -135,9 +135,10 @@ async function setupCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir,
         if (forceLatest) {
             codeqlURL = undefined;
         }
-        const codeqlURLVersion = getCodeQLURLVersion(codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`, logger);
+        const codeqlURLVersion = getCodeQLURLVersion(codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`);
+        const codeqlURLSemVer = convertToSemVer(codeqlURLVersion, logger);
         // If we find the specified version, we always use that.
-        let codeqlFolder = toolcache.find("CodeQL", codeqlURLVersion);
+        let codeqlFolder = toolcache.find("CodeQL", codeqlURLSemVer);
         // If we don't find the requested version, in some cases we may allow a
         // different version to save download time if the version hasn't been
         // specified explicitly (in which case we always honor it).
@@ -156,15 +157,15 @@ async function setupCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir,
         }
         else {
             if (!codeqlURL) {
-                codeqlURL = await getCodeQLBundleDownloadURL(githubAuth, githubUrl, mode, logger);
+                codeqlURL = await getCodeQLBundleDownloadURL(apiDetails, mode, logger);
             }
             const headers = { accept: "application/octet-stream" };
             // We only want to provide an authorization header if we are downloading
             // from the same GitHub instance the Action is running on.
             // This avoids leaking Enterprise tokens to dotcom.
-            if (codeqlURL.startsWith(`${githubUrl}/`)) {
+            if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
                 logger.debug("Downloading CodeQL bundle with token.");
-                headers.authorization = `token ${githubAuth}`;
+                headers.authorization = `token ${apiDetails.auth}`;
             }
             else {
                 logger.debug("Downloading CodeQL bundle without token.");
@@ -173,7 +174,7 @@ async function setupCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir,
             const codeqlPath = await toolcacheDownloadTool(codeqlURL, headers, tempDir, logger);
             logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
             const codeqlExtracted = await toolcache.extractTar(codeqlPath);
-            codeqlFolder = await toolcache.cacheDir(codeqlExtracted, "CodeQL", codeqlURLVersion);
+            codeqlFolder = await toolcache.cacheDir(codeqlExtracted, "CodeQL", codeqlURLSemVer);
         }
         let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql");
         if (process.platform === "win32") {
@@ -183,7 +184,7 @@ async function setupCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir,
             throw new Error(`Unsupported platform: ${process.platform}`);
         }
         cachedCodeQL = getCodeQLForCmd(codeqlCmd);
-        return cachedCodeQL;
+        return { codeql: cachedCodeQL, toolsVersion: codeqlURLVersion };
     }
     catch (e) {
         logger.error(e);
@@ -191,23 +192,26 @@ async function setupCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir,
     }
 }
 exports.setupCodeQL = setupCodeQL;
-function getCodeQLURLVersion(url, logger) {
+function getCodeQLURLVersion(url) {
     const match = url.match(/\/codeql-bundle-(.*)\//);
     if (match === null || match.length < 2) {
         throw new Error(`Malformed tools url: ${url}. Version could not be inferred`);
     }
-    let version = match[1];
+    return match[1];
+}
+exports.getCodeQLURLVersion = getCodeQLURLVersion;
+function convertToSemVer(version, logger) {
     if (!semver.valid(version)) {
         logger.debug(`Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`);
         version = `0.0.0-${version}`;
     }
     const s = semver.clean(version);
     if (!s) {
-        throw new Error(`Malformed tools url ${url}. Version should be in SemVer format but have ${version} instead`);
+        throw new Error(`Bundle version ${version} is not in SemVer format.`);
     }
     return s;
 }
-exports.getCodeQLURLVersion = getCodeQLURLVersion;
+exports.convertToSemVer = convertToSemVer;
 /**
  * Use the CodeQL executable located at the given path.
  */
@@ -271,10 +275,7 @@ function getCodeQLForCmd(cmd) {
             return cmd;
         },
         async printVersion() {
-            await new toolrunnner.ToolRunner(cmd, [
-                "version",
-                "--format=json",
-            ]).exec();
+            await new toolrunner.ToolRunner(cmd, ["version", "--format=json"]).exec();
         },
         async getTracerEnv(databasePath) {
             // Write tracer-env.js to a temp location.
@@ -293,7 +294,7 @@ function getCodeQLForCmd(cmd) {
         process.stdout.write(process.argv[2]);
         fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');`);
             const envFile = path.resolve(databasePath, "working", "env.tmp");
-            await new toolrunnner.ToolRunner(cmd, [
+            await new toolrunner.ToolRunner(cmd, [
                 "database",
                 "trace-command",
                 databasePath,
@@ -305,7 +306,7 @@ function getCodeQLForCmd(cmd) {
             return JSON.parse(fs.readFileSync(envFile, "utf-8"));
         },
         async databaseInit(databasePath, language, sourceRoot) {
-            await new toolrunnner.ToolRunner(cmd, [
+            await new toolrunner.ToolRunner(cmd, [
                 "database",
                 "init",
                 databasePath,
@@ -328,12 +329,12 @@ function getCodeQLForCmd(cmd) {
                 "-Dhttp.keepAlive=false",
                 "-Dmaven.wagon.http.pool=false",
             ].join(" ");
-            await new toolrunnner.ToolRunner(autobuildCmd).exec();
+            await new toolrunner.ToolRunner(autobuildCmd).exec();
         },
         async extractScannedLanguage(databasePath, language) {
             // Get extractor location
             let extractorPath = "";
-            await new toolrunnner.ToolRunner(cmd, [
+            await new toolrunner.ToolRunner(cmd, [
                 "resolve",
                 "extractor",
                 "--format=json",
@@ -363,10 +364,11 @@ function getCodeQLForCmd(cmd) {
                 traceCommand,
             ], error_matcher_1.errorMatchers);
         },
-        async finalizeDatabase(databasePath) {
+        async finalizeDatabase(databasePath, threadsFlag) {
             await toolrunner_error_catcher_1.toolrunnerErrorCatcher(cmd, [
                 "database",
                 "finalize",
+                threadsFlag,
                 ...getExtraOptionsFromEnv(["database", "finalize"]),
                 databasePath,
             ], error_matcher_1.errorMatchers);
@@ -383,7 +385,7 @@ function getCodeQLForCmd(cmd) {
                 codeqlArgs.push("--search-path", extraSearchPath);
             }
             let output = "";
-            await new toolrunnner.ToolRunner(cmd, codeqlArgs, {
+            await new toolrunner.ToolRunner(cmd, codeqlArgs, {
                 listeners: {
                     stdout: (data) => {
                         output += data.toString();
@@ -393,13 +395,15 @@ function getCodeQLForCmd(cmd) {
             return JSON.parse(output);
         },
         async databaseAnalyze(databasePath, sarifFile, querySuite, memoryFlag, addSnippetsFlag, threadsFlag) {
-            await new toolrunnner.ToolRunner(cmd, [
+            await new toolrunner.ToolRunner(cmd, [
                 "database",
                 "analyze",
                 memoryFlag,
                 threadsFlag,
                 databasePath,
+                "--min-disk-free=1024",
                 "--format=sarif-latest",
+                "--sarif-multicause-markdown",
                 `--output=${sarifFile}`,
                 addSnippetsFlag,
                 ...getExtraOptionsFromEnv(["database", "analyze"]),
@@ -411,9 +415,31 @@ function getCodeQLForCmd(cmd) {
 /**
  * Gets the options for `path` of `options` as an array of extra option strings.
  */
-function getExtraOptionsFromEnv(path) {
+function getExtraOptionsFromEnv(paths) {
     const options = util.getExtraOptionsEnvParam();
-    return getExtraOptions(options, path, []);
+    return getExtraOptions(options, paths, []);
+}
+/**
+ * Gets `options` as an array of extra option strings.
+ *
+ * - throws an exception mentioning `pathInfo` if this conversion is impossible.
+ */
+function asExtraOptions(options, pathInfo) {
+    if (options === undefined) {
+        return [];
+    }
+    if (!Array.isArray(options)) {
+        const msg = `The extra options for '${pathInfo.join(".")}' ('${JSON.stringify(options)}') are not in an array.`;
+        throw new Error(msg);
+    }
+    return options.map((o) => {
+        const t = typeof o;
+        if (t !== "string" && t !== "number" && t !== "boolean") {
+            const msg = `The extra option for '${pathInfo.join(".")}' ('${JSON.stringify(o)}') is not a primitive value.`;
+            throw new Error(msg);
+        }
+        return `${o}`;
+    });
 }
 /**
  * Gets the options for `path` of `options` as an array of extra option strings.
@@ -423,34 +449,12 @@ function getExtraOptionsFromEnv(path) {
  *
  * Exported for testing.
  */
-function getExtraOptions(options, path, pathInfo) {
+function getExtraOptions(options, paths, pathInfo) {
     var _a, _b, _c;
-    /**
-     * Gets `options` as an array of extra option strings.
-     *
-     * - throws an exception mentioning `pathInfo` if this conversion is impossible.
-     */
-    function asExtraOptions(options, pathInfo) {
-        if (options === undefined) {
-            return [];
-        }
-        if (!Array.isArray(options)) {
-            const msg = `The extra options for '${pathInfo.join(".")}' ('${JSON.stringify(options)}') are not in an array.`;
-            throw new Error(msg);
-        }
-        return options.map((o) => {
-            const t = typeof o;
-            if (t !== "string" && t !== "number" && t !== "boolean") {
-                const msg = `The extra option for '${pathInfo.join(".")}' ('${JSON.stringify(o)}') is not a primitive value.`;
-                throw new Error(msg);
-            }
-            return `${o}`;
-        });
-    }
     const all = asExtraOptions((_a = options) === null || _a === void 0 ? void 0 : _a["*"], pathInfo.concat("*"));
-    const specific = path.length === 0
+    const specific = paths.length === 0
         ? asExtraOptions(options, pathInfo)
-        : getExtraOptions((_b = options) === null || _b === void 0 ? void 0 : _b[path[0]], (_c = path) === null || _c === void 0 ? void 0 : _c.slice(1), pathInfo.concat(path[0]));
+        : getExtraOptions((_b = options) === null || _b === void 0 ? void 0 : _b[paths[0]], (_c = paths) === null || _c === void 0 ? void 0 : _c.slice(1), pathInfo.concat(paths[0]));
     return all.concat(specific);
 }
 exports.getExtraOptions = getExtraOptions;

lib/codeql.test.js

@@ -20,6 +20,10 @@ const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
 testing_utils_1.setupTests(ava_1.default);
+const sampleApiDetails = {
+    auth: "token",
+    url: "https://github.com",
+};
 ava_1.default("download codeql bundle cache", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         const versions = ["20200601", "20200610"];
@@ -28,7 +32,7 @@ ava_1.default("download codeql bundle cache", async (t) => {
             nock_1.default("https://example.com")
                 .get(`/download/codeql-bundle-${version}/codeql-bundle.tar.gz`)
                 .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
-            await codeql.setupCodeQL(`https://example.com/download/codeql-bundle-${version}/codeql-bundle.tar.gz`, "token", "https://github.example.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+            await codeql.setupCodeQL(`https://example.com/download/codeql-bundle-${version}/codeql-bundle.tar.gz`, sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
             t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
         }
         const cachedVersions = toolcache.findAllVersions("CodeQL");
@@ -40,12 +44,12 @@ ava_1.default("download codeql bundle cache explicitly requested with pinned dif
         nock_1.default("https://example.com")
             .get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`));
-        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
         nock_1.default("https://example.com")
             .get(`/download/codeql-bundle-20200610/codeql-bundle.tar.gz`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
-        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200610/codeql-bundle.tar.gz", "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200610/codeql-bundle.tar.gz", sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
     });
 });
@@ -54,9 +58,9 @@ ava_1.default("don't download codeql bundle cache with pinned different version
         nock_1.default("https://example.com")
             .get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`));
-        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
-        await codeql.setupCodeQL(undefined, "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 1);
     });
@@ -66,7 +70,7 @@ ava_1.default("download codeql bundle cache with different version cached (not p
         nock_1.default("https://example.com")
             .get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
-        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
         const platform = process.platform === "win32"
             ? "win64"
@@ -76,7 +80,7 @@ ava_1.default("download codeql bundle cache with different version cached (not p
         nock_1.default("https://github.com")
             .get(`/github/codeql-action/releases/download/${defaults.bundleVersion}/codeql-bundle-${platform}.tar.gz`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
-        await codeql.setupCodeQL(undefined, "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 2);
     });
@@ -86,7 +90,7 @@ ava_1.default('download codeql bundle cache with pinned different version cached
         nock_1.default("https://example.com")
             .get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`));
-        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL("https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz", sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
         const platform = process.platform === "win32"
             ? "win64"
@@ -96,12 +100,15 @@ ava_1.default('download codeql bundle cache with pinned different version cached
         nock_1.default("https://github.com")
             .get(`/github/codeql-action/releases/download/${defaults.bundleVersion}/codeql-bundle-${platform}.tar.gz`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle.tar.gz`));
-        await codeql.setupCodeQL("latest", "token", "https://github.com", tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
+        await codeql.setupCodeQL("latest", sampleApiDetails, tmpDir, tmpDir, "runner", logging_1.getRunnerLogger(true));
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 2);
     });
 });
 ava_1.default("parse codeql bundle url version", (t) => {
+    t.deepEqual(codeql.getCodeQLURLVersion("https://github.com/.../codeql-bundle-20200601/..."), "20200601");
+});
+ava_1.default("convert to semver", (t) => {
     const tests = {
         "20200601": "0.0.0-20200601",
         "20200601.0": "0.0.0-20200601.0",
@@ -111,9 +118,8 @@ ava_1.default("parse codeql bundle url version", (t) => {
         "1.2.3-beta.1": "1.2.3-beta.1",
     };
     for (const [version, expectedVersion] of Object.entries(tests)) {
-        const url = `https://github.com/.../codeql-bundle-${version}/...`;
         try {
-            const parsedVersion = codeql.getCodeQLURLVersion(url, logging_1.getRunnerLogger(true));
+            const parsedVersion = codeql.convertToSemVer(version, logging_1.getRunnerLogger(true));
             t.deepEqual(parsedVersion, expectedVersion);
         }
         catch (e) {

lib/config-utils.js

@@ -99,8 +99,8 @@ const builtinSuites = ["security-extended", "security-and-quality"];
  * Throws an error if suiteName is not a valid builtin suite.
  */
 async function addBuiltinSuiteQueries(languages, codeQL, resultMap, suiteName, configFile) {
-    const suite = builtinSuites.find((suite) => suite === suiteName);
-    if (!suite) {
+    const found = builtinSuites.find((suite) => suite === suiteName);
+    if (!found) {
         throw new Error(getQueryUsesInvalid(configFile, suiteName));
     }
     const suites = languages.map((l) => `${l}-${suiteName}.qls`);
@@ -190,39 +190,39 @@ const filterPatternCharactersRegex = /.*[?+[\]!].*/;
 // to make it valid, or if not possible then throws an error.
 function validateAndSanitisePath(originalPath, propertyName, configFile, logger) {
     // Take a copy so we don't modify the original path, so we can still construct error messages
-    let path = originalPath;
+    let newPath = originalPath;
     // All paths are relative to the src root, so strip off leading slashes.
-    while (path.charAt(0) === "/") {
-        path = path.substring(1);
+    while (newPath.charAt(0) === "/") {
+        newPath = newPath.substring(1);
     }
     // Trailing ** are redundant, so strip them off
-    if (path.endsWith("/**")) {
-        path = path.substring(0, path.length - 2);
+    if (newPath.endsWith("/**")) {
+        newPath = newPath.substring(0, newPath.length - 2);
     }
     // An empty path is not allowed as it's meaningless
-    if (path === "") {
+    if (newPath === "") {
         throw new Error(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" is not an invalid path. ` +
             `It is not necessary to include it, and it is not allowed to exclude it.`));
     }
     // Check for illegal uses of **
-    if (path.match(pathStarsRegex)) {
+    if (newPath.match(pathStarsRegex)) {
         throw new Error(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" contains an invalid "**" wildcard. ` +
-            `They must be immediately preceeded and followed by a slash as in "/**/", or come at the start or end.`));
+            `They must be immediately preceded and followed by a slash as in "/**/", or come at the start or end.`));
     }
     // Check for other regex characters that we don't support.
     // Output a warning so the user knows, but otherwise continue normally.
-    if (path.match(filterPatternCharactersRegex)) {
+    if (newPath.match(filterPatternCharactersRegex)) {
         logger.warning(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" contains an unsupported character. ` +
             `The filter pattern characters ?, +, [, ], ! are not supported and will be matched literally.`));
     }
     // Ban any uses of backslash for now.
     // This may not play nicely with project layouts.
     // This restriction can be lifted later if we determine they are ok.
-    if (path.indexOf("\\") !== -1) {
+    if (newPath.indexOf("\\") !== -1) {
         throw new Error(getConfigFilePropertyError(configFile, propertyName, `"${originalPath}" contains an "\\" character. These are not allowed in filters. ` +
             `If running on windows we recommend using "/" instead for path filters.`));
     }
-    return path;
+    return newPath;
 }
 exports.validateAndSanitisePath = validateAndSanitisePath;
 // An undefined configFile in some of these functions indicates that
@@ -301,10 +301,10 @@ exports.getUnknownLanguagesError = getUnknownLanguagesError;
 /**
  * Gets the set of languages in the current repository
  */
-async function getLanguagesInRepo(repository, githubAuth, githubUrl, logger) {
+async function getLanguagesInRepo(repository, apiDetails, mode, logger) {
     logger.debug(`GitHub repo ${repository.owner} ${repository.repo}`);
     const response = await api
-        .getApiClient(githubAuth, githubUrl, true)
+        .getApiClient(apiDetails, mode, logger, true)
         .repos.listLanguages({
         owner: repository.owner,
         repo: repository.repo,
@@ -333,7 +333,7 @@ async function getLanguagesInRepo(repository, githubAuth, githubUrl, logger) {
  * If no languages could be detected from either the workflow or the repository
  * then throw an error.
  */
-async function getLanguages(languagesInput, repository, githubAuth, githubUrl, logger) {
+async function getLanguages(languagesInput, repository, apiDetails, mode, logger) {
     // Obtain from action input 'languages' if set
     let languages = (languagesInput || "")
         .split(",")
@@ -342,7 +342,7 @@ async function getLanguages(languagesInput, repository, githubAuth, githubUrl, l
     logger.info(`Languages from configuration: ${JSON.stringify(languages)}`);
     if (languages.length === 0) {
         // Obtain languages as all languages in the repo that can be analysed
-        languages = await getLanguagesInRepo(repository, githubAuth, githubUrl, logger);
+        languages = await getLanguagesInRepo(repository, apiDetails, mode, logger);
         logger.info(`Automatically detected languages: ${JSON.stringify(languages)}`);
     }
     // If the languages parameter was not given and no languages were
@@ -388,12 +388,12 @@ function shouldAddConfigFileQueries(queriesInput) {
 /**
  * Get the default config for when the user has not supplied one.
  */
-async function getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger) {
-    const languages = await getLanguages(languagesInput, repository, githubAuth, githubUrl, logger);
+async function getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
+    const languages = await getLanguages(languagesInput, repository, apiDetails, mode, logger);
     const queries = {};
     await addDefaultQueries(codeQL, languages, queries);
     if (queriesInput) {
-        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, githubUrl, logger);
+        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, apiDetails.url, logger);
     }
     return {
         languages,
@@ -410,7 +410,7 @@ exports.getDefaultConfig = getDefaultConfig;
 /**
  * Load the config from the given file.
  */
-async function loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger) {
+async function loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
     let parsedYAML;
     if (isLocal(configFile)) {
         // Treat the config file as relative to the workspace
@@ -418,7 +418,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
         parsedYAML = getLocalConfig(configFile, checkoutPath);
     }
     else {
-        parsedYAML = await getRemoteConfig(configFile, githubAuth, githubUrl);
+        parsedYAML = await getRemoteConfig(configFile, apiDetails, mode, logger);
     }
     // Validate that the 'name' property is syntactically correct,
     // even though we don't use the value yet.
@@ -430,7 +430,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
             throw new Error(getNameInvalid(configFile));
         }
     }
-    const languages = await getLanguages(languagesInput, repository, githubAuth, githubUrl, logger);
+    const languages = await getLanguages(languagesInput, repository, apiDetails, mode, logger);
     const queries = {};
     const pathsIgnore = [];
     const paths = [];
@@ -449,7 +449,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
     // unless they're prefixed with "+", in which case they supplement those
     // in the config file.
     if (queriesInput) {
-        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, githubUrl, logger);
+        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, apiDetails.url, logger);
     }
     if (shouldAddConfigFileQueries(queriesInput) &&
         QUERIES_PROPERTY in parsedYAML) {
@@ -461,29 +461,29 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
                 typeof query[QUERIES_USES_PROPERTY] !== "string") {
                 throw new Error(getQueryUsesInvalid(configFile));
             }
-            await parseQueryUses(languages, codeQL, queries, query[QUERIES_USES_PROPERTY], tempDir, checkoutPath, githubUrl, logger, configFile);
+            await parseQueryUses(languages, codeQL, queries, query[QUERIES_USES_PROPERTY], tempDir, checkoutPath, apiDetails.url, logger, configFile);
         }
     }
     if (PATHS_IGNORE_PROPERTY in parsedYAML) {
         if (!(parsedYAML[PATHS_IGNORE_PROPERTY] instanceof Array)) {
             throw new Error(getPathsIgnoreInvalid(configFile));
         }
-        for (const path of parsedYAML[PATHS_IGNORE_PROPERTY]) {
-            if (typeof path !== "string" || path === "") {
+        for (const ignorePath of parsedYAML[PATHS_IGNORE_PROPERTY]) {
+            if (typeof ignorePath !== "string" || ignorePath === "") {
                 throw new Error(getPathsIgnoreInvalid(configFile));
             }
-            pathsIgnore.push(validateAndSanitisePath(path, PATHS_IGNORE_PROPERTY, configFile, logger));
+            pathsIgnore.push(validateAndSanitisePath(ignorePath, PATHS_IGNORE_PROPERTY, configFile, logger));
         }
     }
     if (PATHS_PROPERTY in parsedYAML) {
         if (!(parsedYAML[PATHS_PROPERTY] instanceof Array)) {
             throw new Error(getPathsInvalid(configFile));
         }
-        for (const path of parsedYAML[PATHS_PROPERTY]) {
-            if (typeof path !== "string" || path === "") {
+        for (const includePath of parsedYAML[PATHS_PROPERTY]) {
+            if (typeof includePath !== "string" || includePath === "") {
                 throw new Error(getPathsInvalid(configFile));
             }
-            paths.push(validateAndSanitisePath(path, PATHS_PROPERTY, configFile, logger));
+            paths.push(validateAndSanitisePath(includePath, PATHS_PROPERTY, configFile, logger));
         }
     }
     // The list of queries should not be empty for any language. If it is then
@@ -513,15 +513,15 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
  * This will parse the config from the user input if present, or generate
  * a default config. The parsed config is then stored to a known location.
  */
-async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger) {
+async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
     let config;
     // If no config file was provided create an empty one
     if (!configFile) {
         logger.debug("No configuration file was provided");
-        config = await getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger);
+        config = await getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger);
     }
     else {
-        config = await loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger);
+        config = await loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger);
     }
     // Save the config so we can easily access it again in the future
     await saveConfig(config, logger);
@@ -546,7 +546,7 @@ function getLocalConfig(configFile, checkoutPath) {
     }
     return yaml.safeLoad(fs.readFileSync(configFile, "utf8"));
 }
-async function getRemoteConfig(configFile, githubAuth, githubUrl) {
+async function getRemoteConfig(configFile, apiDetails, mode, logger) {
     // retrieve the various parts of the config location, and ensure they're present
     const format = new RegExp("(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)");
     const pieces = format.exec(configFile);
@@ -555,7 +555,7 @@ async function getRemoteConfig(configFile, githubAuth, githubUrl) {
         throw new Error(getConfigFileRepoFormatInvalidMessage(configFile));
     }
     const response = await api
-        .getApiClient(githubAuth, githubUrl, true)
+        .getApiClient(apiDetails, mode, logger, true)
         .repos.getContent({
         owner: pieces.groups.owner,
         repo: pieces.groups.repo,

lib/config-utils.test.js

@@ -23,6 +23,10 @@ const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
 testing_utils_1.setupTests(ava_1.default);
+const sampleApiDetails = {
+    auth: "token",
+    url: "https://github.example.com",
+};
 // Returns the filepath of the newly-created file
 function createConfigFile(inputFileContents, tmpDir) {
     const configFilePath = path.join(tmpDir, "input");
@@ -66,8 +70,8 @@ ava_1.default("load empty config", async (t) => {
                 };
             },
         });
-        const config = await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logger);
-        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logger));
+        const config = await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logger);
+        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logger));
     });
 });
 ava_1.default("loading config saves config", async (t) => {
@@ -86,7 +90,7 @@ ava_1.default("loading config saves config", async (t) => {
         t.false(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // Sanity check that getConfig returns undefined before we have called initConfig
         t.deepEqual(await configUtils.getConfig(tmpDir, logger), undefined);
-        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logger);
+        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logger);
         // The saved config file should now exist
         t.true(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // And that same newly-initialised config should now be returned by getConfig
@@ -97,7 +101,7 @@ ava_1.default("loading config saves config", async (t) => {
 ava_1.default("load input outside of workspace", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         try {
-            await configUtils.initConfig(undefined, undefined, "../input", { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, "../input", { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -110,7 +114,7 @@ ava_1.default("load non-local input with invalid repo syntax", async (t) => {
         // no filename given, just a repo
         const configFile = "octo-org/codeql-config@main";
         try {
-            await configUtils.initConfig(undefined, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -124,7 +128,7 @@ ava_1.default("load non-existent input", async (t) => {
         const configFile = "input";
         t.false(fs.existsSync(path.join(tmpDir, configFile)));
         try {
-            await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -184,7 +188,7 @@ ava_1.default("load non-empty input", async (t) => {
         };
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        const actualConfig = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        const actualConfig = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         // Should exactly equal the object we constructed earlier
         t.deepEqual(actualConfig, expectedConfig);
     });
@@ -213,14 +217,14 @@ ava_1.default("Default queries are used", async (t) => {
         });
         // The important point of this config is that it doesn't specify
         // the disable-default-queries field.
-        // Any other details are hopefully irrelevant for this tetst.
+        // Any other details are hopefully irrelevant for this test.
         const inputFileContents = `
       paths:
         - foo`;
         fs.mkdirSync(path.join(tmpDir, "foo"));
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         // Check resolve queries was called correctly
         t.deepEqual(resolveQueriesArgs.length, 1);
         t.deepEqual(resolveQueriesArgs[0].queries, [
@@ -263,7 +267,7 @@ ava_1.default("Queries can be specified in config file", async (t) => {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries
         // and once for `./foo` from the config file.
@@ -285,7 +289,7 @@ ava_1.default("Queries from config file can be overridden in workflow file", asy
         - uses: ./foo`;
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
         // This config item should take precedence over the config file but shouldn't affect the default queries.
-        const queries = "./override";
+        const testQueries = "./override";
         fs.mkdirSync(path.join(tmpDir, "foo"));
         fs.mkdirSync(path.join(tmpDir, "override"));
         const resolveQueriesArgs = [];
@@ -296,7 +300,7 @@ ava_1.default("Queries from config file can be overridden in workflow file", asy
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, queries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries and once for `./override`,
         // but won't be called for './foo' from the config file.
@@ -318,7 +322,7 @@ ava_1.default("Queries in workflow file can be used in tandem with the 'disable
       name: my config
       disable-default-queries: true`;
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        const queries = "./workflow-query";
+        const testQueries = "./workflow-query";
         fs.mkdirSync(path.join(tmpDir, "workflow-query"));
         const resolveQueriesArgs = [];
         const codeQL = codeql_1.setCodeQL({
@@ -328,7 +332,7 @@ ava_1.default("Queries in workflow file can be used in tandem with the 'disable
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, queries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for `./workflow-query`,
         // but won't be called for the default one since that was disabled
@@ -345,7 +349,7 @@ ava_1.default("Multiple queries can be specified in workflow file, no config fil
     return await util.withTmpDir(async (tmpDir) => {
         fs.mkdirSync(path.join(tmpDir, "override1"));
         fs.mkdirSync(path.join(tmpDir, "override2"));
-        const queries = "./override1,./override2";
+        const testQueries = "./override1,./override2";
         const resolveQueriesArgs = [];
         const codeQL = codeql_1.setCodeQL({
             async resolveQueries(queries, extraSearchPath) {
@@ -354,7 +358,7 @@ ava_1.default("Multiple queries can be specified in workflow file, no config fil
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, queries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly:
         // It'll be called once for the default queries,
         // and then once for each of the two queries from the workflow
@@ -381,7 +385,7 @@ ava_1.default("Queries in workflow file can be added to the set of queries witho
         - uses: ./foo`;
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
         // These queries shouldn't override anything, because the value is prefixed with "+"
-        const queries = "+./additional1,./additional2";
+        const testQueries = "+./additional1,./additional2";
         fs.mkdirSync(path.join(tmpDir, "foo"));
         fs.mkdirSync(path.join(tmpDir, "additional1"));
         fs.mkdirSync(path.join(tmpDir, "additional2"));
@@ -393,7 +397,7 @@ ava_1.default("Queries in workflow file can be added to the set of queries witho
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, queries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries,
         // once for each of additional1 and additional2,
@@ -432,7 +436,7 @@ ava_1.default("Invalid queries in workflow file handled correctly", async (t) =>
             },
         });
         try {
-            await configUtils.initConfig(languages, queries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(languages, queries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             t.fail("initConfig did not throw error");
         }
         catch (err) {
@@ -475,7 +479,7 @@ ava_1.default("API client used when reading remote config", async (t) => {
         fs.mkdirSync(path.join(tmpDir, "foo/bar/dev"), { recursive: true });
         const configFile = "octo-org/codeql-config/config.yaml@main";
         const languages = "javascript";
-        await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+        await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
         t.assert(spyGetContents.called);
     });
 });
@@ -485,7 +489,7 @@ ava_1.default("Remote config handles the case where a directory is provided", as
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -501,7 +505,7 @@ ava_1.default("Invalid format of remote config handled correctly", async (t) =>
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -513,7 +517,7 @@ ava_1.default("No detected languages", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         mockListLanguages([]);
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -525,7 +529,7 @@ ava_1.default("Unknown languages", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         const languages = "ruby,english";
         try {
-            await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -550,7 +554,7 @@ function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGen
             const inputFile = path.join(tmpDir, configFile);
             fs.writeFileSync(inputFile, inputFileContents, "utf8");
             try {
-                await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, "token", "https://github.example.com", logging_1.getRunnerLogger(true));
+                await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
                 throw new Error("initConfig did not throw error");
             }
             catch (err) {
@@ -604,11 +608,11 @@ ava_1.default("path validations", (t) => {
     // Dummy values to pass to validateAndSanitisePath
     const propertyName = "paths";
     const configFile = "./.github/codeql/config.yml";
-    for (const path of validPaths) {
-        t.truthy(configUtils.validateAndSanitisePath(path, propertyName, configFile, logging_1.getRunnerLogger(true)));
+    for (const validPath of validPaths) {
+        t.truthy(configUtils.validateAndSanitisePath(validPath, propertyName, configFile, logging_1.getRunnerLogger(true)));
     }
-    for (const path of invalidPaths) {
-        t.throws(() => configUtils.validateAndSanitisePath(path, propertyName, configFile, logging_1.getRunnerLogger(true)));
+    for (const invalidPath of invalidPaths) {
+        t.throws(() => configUtils.validateAndSanitisePath(invalidPath, propertyName, configFile, logging_1.getRunnerLogger(true)));
     }
 });
 ava_1.default("path sanitisation", (t) => {

lib/defaults.json

@@ -1,3 +1,3 @@
 {
-    "bundleVersion": "codeql-bundle-20201008"
+    "bundleVersion": "codeql-bundle-20201106"
 }

lib/external-queries.js

@@ -9,7 +9,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 /**
  * Check out repository at the given ref, and return the directory of the checkout.
  */
@@ -22,12 +23,12 @@ async function checkoutExternalRepository(repository, ref, githubUrl, tempDir, l
     }
     if (!fs.existsSync(checkoutLocation)) {
         const repoURL = `${githubUrl}/${repository}`;
-        await new toolrunnner.ToolRunner("git", [
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
             "clone",
             repoURL,
             checkoutLocation,
         ]).exec();
-        await new toolrunnner.ToolRunner("git", [
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
             `--work-tree=${checkoutLocation}`,
             `--git-dir=${checkoutLocation}/.git`,
             "checkout",

lib/external-queries.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,0EAA4D;AAI5D;;GAEG;AACI,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,OAAe,EACf,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAE1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACzC,wGAAwG;QACxG,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,IAAI,GAAG,4CAA4C,CAClE,CAAC;KACH;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;QACpC,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE;YACtC,OAAO;YACP,OAAO;YACP,gBAAgB;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE;YACtC,eAAe,gBAAgB,EAAE;YACjC,aAAa,gBAAgB,OAAO;YACpC,UAAU;YACV,GAAG;SACJ,CAAC,CAAC,IAAI,EAAE,CAAC;KACX;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAlCD,gEAkCC"}
+{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAIpD;;GAEG;AACI,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,OAAe,EACf,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAE1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACzC,wGAAwG;QACxG,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,IAAI,GAAG,4CAA4C,CAClE,CAAC;KACH;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;QACpC,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,OAAO;YACP,OAAO;YACP,gBAAgB;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,eAAe,gBAAgB,EAAE;YACjC,aAAa,gBAAgB,OAAO;YACpC,UAAU;YACV,GAAG;SACJ,CAAC,CAAC,IAAI,EAAE,CAAC;KACX;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAlCD,gEAkCC"}

lib/external-queries.test.js

@@ -12,7 +12,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 const ava_1 = __importDefault(require("ava"));
 const externalQueries = __importStar(require("./external-queries"));
 const logging_1 = require("./logging");
@@ -43,7 +44,7 @@ ava_1.default("checkoutExternalQueries", async (t) => {
             ];
             console.log(`Running: git ${command.join(" ")}`);
             try {
-                await new toolrunnner.ToolRunner("git", command, {
+                await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), command, {
                     silent: true,
                     listeners: {
                         stdout: (data) => {
@@ -66,6 +67,7 @@ ava_1.default("checkoutExternalQueries", async (t) => {
         await runGit(["init", repoPath]);
         await runGit(["config", "user.email", "test@github.com"]);
         await runGit(["config", "user.name", "Test Test"]);
+        await runGit(["config", "commit.gpgsign", "false"]);
         fs.writeFileSync(path.join(repoPath, "a"), "a content");
         await runGit(["add", "a"]);
         await runGit(["commit", "-m", "commit1"]);

lib/external-queries.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,0EAA4D;AAC5D,8CAAuB;AAEvB,oEAAsD;AACtD,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,kDAAkD;QAClD,mFAAmF;QACnF,gDAAgD;QAChD,wCAAwC;QACxC,8EAA8E;QAC9E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE/C,oDAAoD;QACpD,oCAAoC;QACpC,2DAA2D;QAC3D,MAAM,MAAM,GAAG,KAAK,WAAW,OAAiB;YAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG;gBACR,aAAa,UAAU,EAAE;gBACzB,eAAe,QAAQ,EAAE;gBACzB,GAAG,OAAO;aACX,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI;gBACF,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE;oBAC/C,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE;wBACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;wBACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;qBACF;iBACF,CAAC,CAAC,IAAI,EAAE,CAAC;aACX;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,CAAC;aACT;YACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QAEF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QAEnD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAE1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,8DAA8D;QAC9D,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,UAAU,eAAe,EAAE,EAC3B,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpE,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,UAAU,eAAe,EAAE,EAC3B,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AACpD,8CAAuB;AAEvB,oEAAsD;AACtD,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,kDAAkD;QAClD,mFAAmF;QACnF,gDAAgD;QAChD,wCAAwC;QACxC,8EAA8E;QAC9E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE/C,oDAAoD;QACpD,oCAAoC;QACpC,2DAA2D;QAC3D,MAAM,MAAM,GAAG,KAAK,WAAW,OAAiB;YAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG;gBACR,aAAa,UAAU,EAAE;gBACzB,eAAe,QAAQ,EAAE;gBACzB,GAAG,OAAO;aACX,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI;gBACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAChC,OAAO,EACP;oBACE,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE;wBACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;wBACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;qBACF;iBACF,CACF,CAAC,IAAI,EAAE,CAAC;aACV;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,CAAC;aACT;YACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QAEF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAE1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,8DAA8D;QAC9D,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,UAAU,eAAe,EAAE,EAC3B,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpE,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,UAAU,eAAe,EAAE,EAC3B,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/fingerprints.js

@@ -46,7 +46,7 @@ function hash(callback, input) {
     // Indexes match up with those from the window variable.
     const lineNumbers = Array(BLOCK_SIZE).fill(-1);
     // The current hash value, updated as we read each character
-    let hash = long_1.default.ZERO;
+    let hashRaw = long_1.default.ZERO;
     const firstMod = computeFirstMod();
     // The current index in the window, will wrap around to zero when we reach BLOCK_SIZE
     let index = 0;
@@ -61,7 +61,7 @@ function hash(callback, input) {
     const hashCounts = {};
     // Output the current hash and line number to the callback function
     const outputHash = function () {
-        const hashValue = hash.toUnsigned().toString(16);
+        const hashValue = hashRaw.toUnsigned().toString(16);
         if (!hashCounts[hashValue]) {
             hashCounts[hashValue] = 0;
         }
@@ -73,7 +73,7 @@ function hash(callback, input) {
     const updateHash = function (current) {
         const begin = window[index];
         window[index] = current;
-        hash = MOD.multiply(hash)
+        hashRaw = MOD.multiply(hashRaw)
             .add(long_1.default.fromInt(current))
             .subtract(firstMod.multiply(long_1.default.fromInt(begin)));
         index = (index + 1) % BLOCK_SIZE;
@@ -120,7 +120,7 @@ function hash(callback, input) {
 }
 exports.hash = hash;
 // Generate a hash callback function that updates the given result in-place
-// when it recieves a hash for the correct line number. Ignores hashes for other lines.
+// when it receives a hash for the correct line number. Ignores hashes for other lines.
 function locationUpdateCallback(result, location, logger) {
     var _a, _b;
     let locationStartLine = (_b = (_a = location.physicalLocation) === null || _a === void 0 ? void 0 : _a.region) === null || _b === void 0 ? void 0 : _b.startLine;
@@ -130,7 +130,7 @@ function locationUpdateCallback(result, location, logger) {
         // using the hash of the first line of the file.
         locationStartLine = 1;
     }
-    return function (lineNumber, hash) {
+    return function (lineNumber, hashValue) {
         // Ignore hashes for lines that don't concern us
         if (locationStartLine !== lineNumber) {
             return;
@@ -142,10 +142,10 @@ function locationUpdateCallback(result, location, logger) {
         // If the hash doesn't match the existing fingerprint then
         // output a warning and don't overwrite it.
         if (!existingFingerprint) {
-            result.partialFingerprints.primaryLocationLineHash = hash;
+            result.partialFingerprints.primaryLocationLineHash = hashValue;
         }
-        else if (existingFingerprint !== hash) {
-            logger.warning(`Calculated fingerprint of ${hash} for file ${location.physicalLocation.artifactLocation.uri} line ${lineNumber}, but found existing inconsistent fingerprint value ${existingFingerprint}`);
+        else if (existingFingerprint !== hashValue) {
+            logger.warning(`Calculated fingerprint of ${hashValue} for file ${location.physicalLocation.artifactLocation.uri} line ${lineNumber}, but found existing inconsistent fingerprint value ${existingFingerprint}`);
         }
     };
 }
@@ -231,9 +231,9 @@ function addFingerprints(sarifContents, checkoutPath, logger) {
     // Now hash each file that was found
     for (const [filepath, callbacks] of Object.entries(callbacksByFile)) {
         // A callback that forwards the hash to all other callbacks for that file
-        const teeCallback = function (lineNumber, hash) {
+        const teeCallback = function (lineNumber, hashValue) {
             for (const c of Object.values(callbacks)) {
-                c(lineNumber, hash);
+                c(lineNumber, hashValue);
             }
         };
         const fileContents = fs.readFileSync(filepath).toString();

lib/fingerprints.test.js

@@ -108,7 +108,9 @@ ava_1.default("hash", (t) => {
 });
 function testResolveUriToFile(uri, index, artifactsURIs) {
     const location = { uri, index };
-    const artifacts = artifactsURIs.map((uri) => ({ location: { uri } }));
+    const artifacts = artifactsURIs.map((artifactURI) => ({
+        location: { uri: artifactURI },
+    }));
     return fingerprints.resolveUriToFile(location, artifacts, process.cwd(), logging_1.getRunnerLogger(true));
 }
 ava_1.default("resolveUriToFile", (t) => {
@@ -119,13 +121,13 @@ ava_1.default("resolveUriToFile", (t) => {
     const cwd = process.cwd();
     const filepath = __filename;
     t.true(filepath.startsWith(`${cwd}/`));
-    const relativeFilepaht = filepath.substring(cwd.length + 1);
+    const relativeFilepath = filepath.substring(cwd.length + 1);
     // Absolute paths are unmodified
     t.is(testResolveUriToFile(filepath, undefined, []), filepath);
     t.is(testResolveUriToFile(`file://${filepath}`, undefined, []), filepath);
     // Relative paths are made absolute
-    t.is(testResolveUriToFile(relativeFilepaht, undefined, []), filepath);
-    t.is(testResolveUriToFile(`file://${relativeFilepaht}`, undefined, []), filepath);
+    t.is(testResolveUriToFile(relativeFilepath, undefined, []), filepath);
+    t.is(testResolveUriToFile(`file://${relativeFilepath}`, undefined, []), filepath);
     // Absolute paths outside the src root are discarded
     t.is(testResolveUriToFile("/src/foo/bar.js", undefined, []), undefined);
     t.is(testResolveUriToFile("file:///src/foo/bar.js", undefined, []), undefined);
@@ -135,7 +137,7 @@ ava_1.default("resolveUriToFile", (t) => {
     // Invalid URIs are discarded
     t.is(testResolveUriToFile(1, undefined, []), undefined);
     t.is(testResolveUriToFile(undefined, undefined, []), undefined);
-    // Non-existant files are discarded
+    // Non-existent files are discarded
     t.is(testResolveUriToFile(`${filepath}2`, undefined, []), undefined);
     // Index is resolved
     t.is(testResolveUriToFile(undefined, 0, [filepath]), filepath);

lib/init-action.js

@@ -13,7 +13,7 @@ const init_1 = require("./init");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
 const repository_1 = require("./repository");
-async function sendSuccessStatusReport(startedAt, config) {
+async function sendSuccessStatusReport(startedAt, config, toolsVersion) {
     var _a;
     const statusReportBase = await actionsUtil.createStatusReportBase("init", "success", startedAt);
     const languages = config.languages.join(",");
@@ -42,6 +42,8 @@ async function sendSuccessStatusReport(startedAt, config) {
         paths_ignore: pathsIgnore,
         disable_default_queries: disableDefaultQueries,
         queries: queries.join(","),
+        tools_input: actionsUtil.getOptionalInput("tools") || "",
+        tools_resolved_version: toolsVersion,
     };
     await actionsUtil.sendStatusReport(statusReport);
 }
@@ -50,14 +52,26 @@ async function run() {
     const logger = logging_1.getActionsLogger();
     let config;
     let codeql;
+    let toolsVersion;
     try {
         actionsUtil.prepareLocalRunEnvironment();
-        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("init", "starting", startedAt), true))) {
+        const workflowErrors = await actionsUtil.getWorkflowErrors();
+        if (workflowErrors.length > 0) {
+            core.warning(actionsUtil.formatWorkflowErrors(workflowErrors));
+        }
+        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("init", "starting", startedAt, actionsUtil.formatWorkflowCause(workflowErrors))))) {
             return;
         }
-        codeql = await init_1.initCodeQL(actionsUtil.getOptionalInput("tools"), actionsUtil.getRequiredInput("token"), actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"), actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"), "actions", logger);
-        config = await init_1.initConfig(actionsUtil.getOptionalInput("languages"), actionsUtil.getOptionalInput("queries"), actionsUtil.getOptionalInput("config-file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"), codeql, actionsUtil.getRequiredEnvParam("GITHUB_WORKSPACE"), actionsUtil.getRequiredInput("token"), actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"), logger);
-        if (config.languages.includes(languages_1.Language.python)) {
+        const apiDetails = {
+            auth: actionsUtil.getRequiredInput("token"),
+            url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
+        };
+        const initCodeQLResult = await init_1.initCodeQL(actionsUtil.getOptionalInput("tools"), apiDetails, actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"), "actions", logger);
+        codeql = initCodeQLResult.codeql;
+        toolsVersion = initCodeQLResult.toolsVersion;
+        config = await init_1.initConfig(actionsUtil.getOptionalInput("languages"), actionsUtil.getOptionalInput("queries"), actionsUtil.getOptionalInput("config-file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"), codeql, actionsUtil.getRequiredEnvParam("GITHUB_WORKSPACE"), apiDetails, "actions", logger);
+        if (config.languages.includes(languages_1.Language.python) &&
+            actionsUtil.getRequiredInput("setup-python-dependencies") === "true") {
             try {
                 await init_1.installPythonDeps(codeql, logger);
             }
@@ -91,6 +105,7 @@ async function run() {
                 await init_1.injectWindowsTracer("Runner.Worker.exe", undefined, config, codeql, tracerConfig);
             }
         }
+        core.setOutput("codeql-path", config.codeQLCmd);
     }
     catch (error) {
         core.setFailed(error.message);
@@ -98,10 +113,16 @@ async function run() {
         await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("init", "failure", startedAt, error.message, error.stack));
         return;
     }
-    await sendSuccessStatusReport(startedAt, config);
+    await sendSuccessStatusReport(startedAt, config, toolsVersion);
 }
-run().catch((e) => {
-    core.setFailed(`init action failed: ${e}`);
-    console.log(e);
-});
+async function runWrapper() {
+    try {
+        await run();
+    }
+    catch (error) {
+        core.setFailed(`init action failed: ${error}`);
+        console.log(error);
+    }
+}
+void runWrapper();
 //# sourceMappingURL=init-action.js.map

lib/init-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-action.js","sourceRoot":"","sources":["../src/init-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAG9C,iCAMgB;AAChB,2CAAuC;AACvC,uCAA6C;AAC7C,6CAAkD;AAkBlD,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,MAA0B;;IAE1B,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,MAAM,EACN,SAAS,EACT,SAAS,CACV,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACvE,GAAG,CACJ,CAAC;IACF,MAAM,qBAAqB,GAAG,MAAM,CAAC,iBAAiB,CACpD,yBAAyB,CAC1B;QACC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY,SAAG,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,0CAAE,IAAI,EAAE,CAAC;IACnE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QAC9D,OAAO,CAAC,IAAI,CACV,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/D,CAAC;KACH;IACD,IAAI,YAAY,KAAK,SAAS,EAAE;QAC9B,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YACzC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACxB,CAAC,CAAC,YAAY,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C;IAED,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,SAAS;QACT,kBAAkB,EAAE,iBAAiB,IAAI,EAAE;QAC3C,KAAK;QACL,YAAY,EAAE,WAAW;QACzB,uBAAuB,EAAE,qBAAqB;QAC9C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;KAC3B,CAAC;IAEF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,IAAI,MAAc,CAAC;IAEnB,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EACvE,IAAI,CACL,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,GAAG,MAAM,iBAAU,CACvB,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,GAAG,MAAM,iBAAU,CACvB,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,EACzC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EACvC,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAC3C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,MAAM,EACN,WAAW,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EACnD,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,MAAM,CACP,CAAC;QAEF,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAQ,CAAC,MAAM,CAAC,EAAE;YAC9C,IAAI;gBACF,MAAM,wBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,CAAC,OAAO,CACZ,GAAG,GAAG,CAAC,OAAO,2FAA2F,CAC1G,CAAC;aACH;SACF;KACF;IAAC,OAAO,CAAC,EAAE;QACV,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,CAAC,CAAC,OAAO,CACV,CACF,CAAC;QACF,OAAO;KACR;IAED,IAAI;QACF,mBAAmB;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE;YACX,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,CACV,6GAA6G,CAC9G,CAAC;SACH;QAED,mGAAmG;QACnG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAE7C,MAAM,YAAY,GAAG,MAAM,cAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,SAAS,EAAE;YAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBAC3D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;aACjC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,0BAAmB,CACvB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,MAAM,EACN,YAAY,CACb,CAAC;aACH;SACF;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;IACD,MAAM,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IAChB,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"init-action.js","sourceRoot":"","sources":["../src/init-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAG9C,iCAMgB;AAChB,2CAAuC;AACvC,uCAA6C;AAC7C,6CAAkD;AAsBlD,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,MAA0B,EAC1B,YAAoB;;IAEpB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,MAAM,EACN,SAAS,EACT,SAAS,CACV,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACvE,GAAG,CACJ,CAAC;IACF,MAAM,qBAAqB,GAAG,MAAM,CAAC,iBAAiB,CACpD,yBAAyB,CAC1B;QACC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY,SAAG,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,0CAAE,IAAI,EAAE,CAAC;IACnE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QAC9D,OAAO,CAAC,IAAI,CACV,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/D,CAAC;KACH;IACD,IAAI,YAAY,KAAK,SAAS,EAAE;QAC9B,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YACzC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACxB,CAAC,CAAC,YAAY,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C;IAED,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,SAAS;QACT,kBAAkB,EAAE,iBAAiB,IAAI,EAAE;QAC3C,KAAK;QACL,YAAY,EAAE,WAAW;QACzB,uBAAuB,EAAE,qBAAqB;QAC9C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,WAAW,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE;QACxD,sBAAsB,EAAE,YAAY;KACrC,CAAC;IAEF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,IAAI,MAAc,CAAC;IACnB,IAAI,YAAoB,CAAC;IAEzB,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QAEzC,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,iBAAiB,EAAE,CAAC;QAE7D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;SAChE;QAED,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAChD,CACF,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QAEF,MAAM,gBAAgB,GAAG,MAAM,iBAAU,CACvC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,UAAU,EACV,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;QACjC,YAAY,GAAG,gBAAgB,CAAC,YAAY,CAAC;QAE7C,MAAM,GAAG,MAAM,iBAAU,CACvB,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,EACzC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EACvC,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAC3C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,MAAM,EACN,WAAW,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EACnD,UAAU,EACV,SAAS,EACT,MAAM,CACP,CAAC;QAEF,IACE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAQ,CAAC,MAAM,CAAC;YAC1C,WAAW,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,KAAK,MAAM,EACpE;YACA,IAAI;gBACF,MAAM,wBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,CAAC,OAAO,CACZ,GAAG,GAAG,CAAC,OAAO,2FAA2F,CAC1G,CAAC;aACH;SACF;KACF;IAAC,OAAO,CAAC,EAAE;QACV,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,CAAC,CAAC,OAAO,CACV,CACF,CAAC;QACF,OAAO;KACR;IAED,IAAI;QACF,mBAAmB;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE;YACX,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,CACV,6GAA6G,CAC9G,CAAC;SACH;QAED,mGAAmG;QACnG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAE7C,MAAM,YAAY,GAAG,MAAM,cAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,SAAS,EAAE;YAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBAC3D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;aACjC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,0BAAmB,CACvB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,MAAM,EACN,YAAY,CACb,CAAC;aACH;SACF;QAED,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;KACjD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;IACD,MAAM,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/init.js

@@ -9,23 +9,24 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 const analysisPaths = __importStar(require("./analysis-paths"));
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
 const tracer_config_1 = require("./tracer-config");
 const util = __importStar(require("./util"));
-async function initCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir, mode, logger) {
+async function initCodeQL(codeqlURL, apiDetails, tempDir, toolsDir, mode, logger) {
     logger.startGroup("Setup CodeQL tools");
-    const codeql = await codeql_1.setupCodeQL(codeqlURL, githubAuth, githubUrl, tempDir, toolsDir, mode, logger);
+    const { codeql, toolsVersion } = await codeql_1.setupCodeQL(codeqlURL, apiDetails, tempDir, toolsDir, mode, logger);
     await codeql.printVersion();
     logger.endGroup();
-    return codeql;
+    return { codeql, toolsVersion };
 }
 exports.initCodeQL = initCodeQL;
-async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger) {
+async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
     logger.startGroup("Load language configuration");
-    const config = await configUtils.initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, githubAuth, githubUrl, logger);
+    const config = await configUtils.initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger);
     analysisPaths.printPathFiltersWarning(config, logger);
     logger.endGroup();
     return config;
@@ -102,6 +103,10 @@ async function injectWindowsTracer(processName, processLevel, config, codeql, tr
           Write-Host "Found Runner.Worker.exe process which means we are running on GitHub Actions"
           Write-Host "Aborting search early and using process: $p"
           Break
+        } elseif ($p[0].Name -eq "Agent.Worker.exe") {
+          Write-Host "Found Agent.Worker.exe process which means we are running on Azure Pipelines"
+          Write-Host "Aborting search early and using process: $p"
+          Break
         } else {
           $id = $p[0].ParentProcessId
         }
@@ -112,7 +117,7 @@ async function injectWindowsTracer(processName, processLevel, config, codeql, tr
     }
     const injectTracerPath = path.join(config.tempDir, "inject-tracer.ps1");
     fs.writeFileSync(injectTracerPath, script);
-    await new toolrunnner.ToolRunner("powershell", [
+    await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [
         "-ExecutionPolicy",
         "Bypass",
         "-file",
@@ -123,29 +128,22 @@ async function injectWindowsTracer(processName, processLevel, config, codeql, tr
 exports.injectWindowsTracer = injectWindowsTracer;
 async function installPythonDeps(codeql, logger) {
     logger.startGroup("Setup Python dependencies");
-    if (process.platform === "darwin") {
-        logger.info("Currently, auto-installing python dependencies is not supported on MacOS");
-        logger.endGroup();
-        return;
-    }
     const scriptsFolder = path.resolve(__dirname, "../python-setup");
     // Setup tools on the Github hosted runners
     if (process.env["ImageOS"] !== undefined) {
         try {
             if (process.platform === "win32") {
-                await new toolrunnner.ToolRunner("powershell", [
-                    path.join(scriptsFolder, "install_tools.ps1"),
-                ]).exec();
+                await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [path.join(scriptsFolder, "install_tools.ps1")]).exec();
             }
             else {
-                await new toolrunnner.ToolRunner(path.join(scriptsFolder, "install_tools.sh")).exec();
+                await new toolrunner.ToolRunner(path.join(scriptsFolder, "install_tools.sh")).exec();
             }
         }
         catch (e) {
             // This script tries to install some needed tools in the runner. It should not fail, but if it does
             // we just abort the process without failing the action
             logger.endGroup();
-            logger.warning("Unable to download and extract the tools needed for installing the python dependecies. You can call this action with 'setup-python-dependencies: false' to disable this process.");
+            logger.warning("Unable to download and extract the tools needed for installing the python dependencies. You can call this action with 'setup-python-dependencies: false' to disable this process.");
             return;
         }
     }
@@ -153,14 +151,14 @@ async function installPythonDeps(codeql, logger) {
     try {
         const script = "auto_install_packages.py";
         if (process.platform === "win32") {
-            await new toolrunnner.ToolRunner("py", [
+            await new toolrunner.ToolRunner(await safeWhich.safeWhich("py"), [
                 "-3",
                 path.join(scriptsFolder, script),
                 path.dirname(codeql.getPath()),
             ]).exec();
         }
         else {
-            await new toolrunnner.ToolRunner(path.join(scriptsFolder, script), [
+            await new toolrunner.ToolRunner(path.join(scriptsFolder, script), [
                 path.dirname(codeql.getPath()),
             ]).exec();
         }

lib/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,0EAA4D;AAE5D,gEAAkD;AAClD,qCAA+C;AAC/C,4DAA8C;AAG9C,mDAAwE;AACxE,6CAA+B;AAExB,KAAK,UAAU,UAAU,CAC9B,SAA6B,EAC7B,UAAkB,EAClB,SAAiB,EACjB,OAAe,EACf,QAAgB,EAChB,IAAe,EACf,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,oBAAW,CAC9B,SAAS,EACT,UAAU,EACV,SAAS,EACT,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,MAAM,CACP,CAAC;IACF,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AAtBD,gCAsBC;AAEM,KAAK,UAAU,UAAU,CAC9B,cAAkC,EAClC,YAAgC,EAChC,UAA8B,EAC9B,UAAyB,EACzB,OAAe,EACf,YAAoB,EACpB,MAAc,EACd,YAAoB,EACpB,UAAkB,EAClB,SAAiB,EACjB,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,cAAc,EACd,YAAY,EACZ,UAAU,EACV,UAAU,EACV,OAAO,EACP,YAAY,EACZ,MAAM,EACN,YAAY,EACZ,UAAU,EACV,SAAS,EACT,MAAM,CACP,CAAC;IACF,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AA9BD,gCA8BC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAElC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9E,sEAAsE;IACtE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,yBAAyB;QACzB,MAAM,MAAM,CAAC,YAAY,CACvB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,EACR,UAAU,CACX,CAAC;KACH;IAED,OAAO,MAAM,uCAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAnBD,0BAmBC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+CAA+C;AACxC,KAAK,UAAU,mBAAmB,CACvC,WAA+B,EAC/B,YAAgC,EAChC,MAA0B,EAC1B,MAAc,EACd,YAA0B;IAE1B,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,KAAK,SAAS,EAAE;QAC7B,MAAM,GAAG;;;;;;;;;;;;uCAY0B,WAAW;;8BAEpB,WAAW;;;;;;;;gDAQO,CAAC;KAC9C;SAAM;QACL,oEAAoE;QACpE,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,6EAA6E;QAC7E,oFAAoF;QACpF,6CAA6C;QAC7C,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG;;;;;;;;4BAQe,YAAY;;;;;;;;;;;;;;;;;gDAiBQ,CAAC;KAC9C;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxE,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,IAAI,WAAW,CAAC,UAAU,CAC9B,YAAY,EACZ;QACE,kBAAkB;QAClB,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,IAAI,CAAC,OAAO,CACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAC9B,OAAO,EACP,OAAO,EACP,YAAY,CACb;KACF,EACD,EAAE,GAAG,EAAE,EAAE,0BAA0B,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAxFD,kDAwFC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;QACjC,MAAM,CAAC,IAAI,CACT,0EAA0E,CAC3E,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO;KACR;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEjE,2CAA2C;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE;QACxC,IAAI;YACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE;oBAC7C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC;iBAC9C,CAAC,CAAC,IAAI,EAAE,CAAC;aACX;iBAAM;gBACL,MAAM,IAAI,WAAW,CAAC,UAAU,CAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAC7C,CAAC,IAAI,EAAE,CAAC;aACV;SACF;QAAC,OAAO,CAAC,EAAE;YACV,mGAAmG;YACnG,uDAAuD;YACvD,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,CACZ,kLAAkL,CACnL,CAAC;YACF,OAAO;SACR;KACF;IAED,uBAAuB;IACvB,IAAI;QACF,MAAM,MAAM,GAAG,0BAA0B,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;YAChC,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE;gBACrC,IAAI;gBACJ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;aAAM;YACL,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE;gBACjE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,CACZ,+IAA+I,CAChJ,CAAC;QACF,OAAO;KACR;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AA1DD,8CA0DC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAEpD,gEAAkD;AAElD,qCAA+C;AAC/C,4DAA8C;AAG9C,mDAAwE;AACxE,6CAA+B;AAExB,KAAK,UAAU,UAAU,CAC9B,SAA6B,EAC7B,UAA4B,EAC5B,OAAe,EACf,QAAgB,EAChB,IAAe,EACf,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAW,CAChD,SAAS,EACT,UAAU,EACV,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,MAAM,CACP,CAAC;IACF,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC;AApBD,gCAoBC;AAEM,KAAK,UAAU,UAAU,CAC9B,cAAkC,EAClC,YAAgC,EAChC,UAA8B,EAC9B,UAAyB,EACzB,OAAe,EACf,YAAoB,EACpB,MAAc,EACd,YAAoB,EACpB,UAA4B,EAC5B,IAAe,EACf,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,cAAc,EACd,YAAY,EACZ,UAAU,EACV,UAAU,EACV,OAAO,EACP,YAAY,EACZ,MAAM,EACN,YAAY,EACZ,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;IACF,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AA9BD,gCA8BC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAElC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9E,sEAAsE;IACtE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,yBAAyB;QACzB,MAAM,MAAM,CAAC,YAAY,CACvB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,EACR,UAAU,CACX,CAAC;KACH;IAED,OAAO,MAAM,uCAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAnBD,0BAmBC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+CAA+C;AACxC,KAAK,UAAU,mBAAmB,CACvC,WAA+B,EAC/B,YAAgC,EAChC,MAA0B,EAC1B,MAAc,EACd,YAA0B;IAE1B,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,KAAK,SAAS,EAAE;QAC7B,MAAM,GAAG;;;;;;;;;;;;uCAY0B,WAAW;;8BAEpB,WAAW;;;;;;;;gDAQO,CAAC;KAC9C;SAAM;QACL,oEAAoE;QACpE,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,6EAA6E;QAC7E,oFAAoF;QACpF,6CAA6C;QAC7C,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG;;;;;;;;4BAQe,YAAY;;;;;;;;;;;;;;;;;;;;;gDAqBQ,CAAC;KAC9C;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxE,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EACvC;QACE,kBAAkB;QAClB,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,IAAI,CAAC,OAAO,CACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAC9B,OAAO,EACP,OAAO,EACP,YAAY,CACb;KACF,EACD,EAAE,GAAG,EAAE,EAAE,0BAA0B,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AA5FD,kDA4FC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEjE,2CAA2C;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE;QACxC,IAAI;YACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EACvC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAChD,CAAC,IAAI,EAAE,CAAC;aACV;iBAAM;gBACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAC7C,CAAC,IAAI,EAAE,CAAC;aACV;SACF;QAAC,OAAO,CAAC,EAAE;YACV,mGAAmG;YACnG,uDAAuD;YACvD,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,CACZ,mLAAmL,CACpL,CAAC;YACF,OAAO;SACR;KACF;IAED,uBAAuB;IACvB,IAAI;QACF,MAAM,MAAM,GAAG,0BAA0B,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;YAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBAC/D,IAAI;gBACJ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;aAAM;YACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE;gBAChE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,CACZ,+IAA+I,CAChJ,CAAC;QACF,OAAO;KACR;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AAnDD,8CAmDC"}

lib/languages.js

@@ -33,7 +33,9 @@ function parseLanguage(language) {
 }
 exports.parseLanguage = parseLanguage;
 function isTracedLanguage(language) {
-    return ["cpp", "java", "csharp"].includes(language);
+    return (["cpp", "java", "csharp"].includes(language) ||
+        (process.env["CODEQL_EXTRACTOR_GO_BUILD_TRACING"] === "on" &&
+            language === Language.go));
 }
 exports.isTracedLanguage = isTracedLanguage;
 function isScannedLanguage(language) {

lib/languages.js.map

@@ -1 +1 @@
-{"version":3,"file":"languages.js","sourceRoot":"","sources":["../src/languages.ts"],"names":[],"mappings":";;AAAA,wCAAwC;AACxC,IAAY,QAOX;AAPD,WAAY,QAAQ;IAClB,6BAAiB,CAAA;IACjB,uBAAW,CAAA;IACX,qBAAS,CAAA;IACT,yBAAa,CAAA;IACb,qCAAyB,CAAA;IACzB,6BAAiB,CAAA;AACnB,CAAC,EAPW,QAAQ,GAAR,gBAAQ,KAAR,gBAAQ,QAOnB;AAED,iCAAiC;AACjC,MAAM,gBAAgB,GAAiC;IACrD,CAAC,EAAE,QAAQ,CAAC,GAAG;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG;IACnB,IAAI,EAAE,QAAQ,CAAC,MAAM;IACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAChC,CAAC;AAEF,gGAAgG;AAChG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,0BAA0B;IAC1B,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAElC,6BAA6B;IAC7B,IAAI,QAAQ,IAAI,QAAQ,EAAE;QACxB,OAAO,QAAoB,CAAC;KAC7B;IAED,yBAAyB;IACzB,IAAI,QAAQ,IAAI,gBAAgB,EAAE;QAChC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;KACnC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAfD,sCAeC;AAED,SAAgB,gBAAgB,CAAC,QAAkB;IACjD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;AAFD,4CAEC;AAED,SAAgB,iBAAiB,CAAC,QAAkB;IAClD,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAFD,8CAEC"}
+{"version":3,"file":"languages.js","sourceRoot":"","sources":["../src/languages.ts"],"names":[],"mappings":";;AAAA,wCAAwC;AACxC,IAAY,QAOX;AAPD,WAAY,QAAQ;IAClB,6BAAiB,CAAA;IACjB,uBAAW,CAAA;IACX,qBAAS,CAAA;IACT,yBAAa,CAAA;IACb,qCAAyB,CAAA;IACzB,6BAAiB,CAAA;AACnB,CAAC,EAPW,QAAQ,GAAR,gBAAQ,KAAR,gBAAQ,QAOnB;AAED,iCAAiC;AACjC,MAAM,gBAAgB,GAAiC;IACrD,CAAC,EAAE,QAAQ,CAAC,GAAG;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG;IACnB,IAAI,EAAE,QAAQ,CAAC,MAAM;IACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAChC,CAAC;AAEF,gGAAgG;AAChG,SAAgB,aAAa,CAAC,QAAgB;IAC5C,0BAA0B;IAC1B,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAElC,6BAA6B;IAC7B,IAAI,QAAQ,IAAI,QAAQ,EAAE;QACxB,OAAO,QAAoB,CAAC;KAC7B;IAED,yBAAyB;IACzB,IAAI,QAAQ,IAAI,gBAAgB,EAAE;QAChC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;KACnC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAfD,sCAeC;AAED,SAAgB,gBAAgB,CAAC,QAAkB;IACjD,OAAO,CACL,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,KAAK,IAAI;YACxD,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC,CAC5B,CAAC;AACJ,CAAC;AAND,4CAMC;AAED,SAAgB,iBAAiB,CAAC,QAAkB;IAClD,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAFD,8CAEC"}

lib/languages.test.js

@@ -7,7 +7,7 @@ const ava_1 = __importDefault(require("ava"));
 const languages_1 = require("./languages");
 const testing_utils_1 = require("./testing-utils");
 testing_utils_1.setupTests(ava_1.default);
-ava_1.default("parseLangauge", async (t) => {
+ava_1.default("parseLanguage", async (t) => {
     // Exact matches
     t.deepEqual(languages_1.parseLanguage("csharp"), languages_1.Language.csharp);
     t.deepEqual(languages_1.parseLanguage("cpp"), languages_1.Language.cpp);

lib/runner.js

@@ -103,14 +103,18 @@ program
         logger.info(`Cleaning temp directory ${tempDir}`);
         fs.rmdirSync(tempDir, { recursive: true });
         fs.mkdirSync(tempDir, { recursive: true });
+        const apiDetails = {
+            auth: cmd.githubAuth,
+            url: util_1.parseGithubUrl(cmd.githubUrl),
+        };
         let codeql;
         if (cmd.codeqlPath !== undefined) {
             codeql = codeql_1.getCodeQL(cmd.codeqlPath);
         }
         else {
-            codeql = await init_1.initCodeQL(undefined, cmd.githubAuth, util_1.parseGithubUrl(cmd.githubUrl), tempDir, toolsDir, "runner", logger);
+            codeql = (await init_1.initCodeQL(undefined, apiDetails, tempDir, toolsDir, "runner", logger)).codeql;
         }
-        const config = await init_1.initConfig(cmd.languages, cmd.queries, cmd.configFile, repository_1.parseRepositoryNwo(cmd.repository), tempDir, toolsDir, codeql, cmd.checkoutPath || process.cwd(), cmd.githubAuth, util_1.parseGithubUrl(cmd.githubUrl), logger);
+        const config = await init_1.initConfig(cmd.languages, cmd.queries, cmd.configFile, repository_1.parseRepositoryNwo(cmd.repository), tempDir, toolsDir, codeql, cmd.checkoutPath || process.cwd(), apiDetails, "runner", logger);
         const tracerConfig = await init_1.runInit(codeql, config);
         if (tracerConfig === undefined) {
             return;
@@ -118,7 +122,7 @@ program
         if (process.platform === "win32") {
             await init_1.injectWindowsTracer(parseTraceProcessName(), parseTraceProcessLevel(), config, codeql, tracerConfig);
         }
-        // Always output a json file of the env that can be consumed programatically
+        // Always output a json file of the env that can be consumed programmatically
         const jsonEnvFile = path.join(config.tempDir, codeqlEnvJsonFilename);
         fs.writeFileSync(jsonEnvFile, JSON.stringify(tracerConfig.env));
         if (process.platform === "win32") {
@@ -133,7 +137,7 @@ program
                 .join("\n");
             fs.writeFileSync(powershellEnvFile, powershellEnvFileContents);
             logger.info(`\nCodeQL environment output to "${jsonEnvFile}", "${batEnvFile}" and "${powershellEnvFile}". ` +
-                `Please export these variables to future processes so the build can be traced. ` +
+                `Please export these variables to future processes so that CodeQL can monitor the build. ` +
                 `If using cmd/batch run "call ${batEnvFile}" ` +
                 `or if using PowerShell run "cat ${powershellEnvFile} | Invoke-Expression".`);
         }
@@ -146,7 +150,7 @@ program
                 .join("\n");
             fs.writeFileSync(shEnvFile, shEnvFileContents);
             logger.info(`\nCodeQL environment output to "${jsonEnvFile}" and "${shEnvFile}". ` +
-                `Please export these variables to future processes so the build can be traced, ` +
+                `Please export these variables to future processes so that CodeQL can monitor the build, ` +
                 `for example by running ". ${shEnvFile}".`);
         }
     }
@@ -219,7 +223,11 @@ program
             throw new Error("Config file could not be found at expected location. " +
                 "Was the 'init' command run with the same '--temp-dir' argument as this command.");
         }
-        await analyze_1.runAnalyze(repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), undefined, undefined, undefined, cmd.checkoutPath || process.cwd(), undefined, cmd.githubAuth, util_1.parseGithubUrl(cmd.githubUrl), cmd.upload, "runner", outputDir, util_1.getMemoryFlag(cmd.ram), util_1.getAddSnippetsFlag(cmd.addSnippets), util_1.getThreadsFlag(cmd.threads, logger), config, logger);
+        const apiDetails = {
+            auth: cmd.githubAuth,
+            url: util_1.parseGithubUrl(cmd.githubUrl),
+        };
+        await analyze_1.runAnalyze(repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), undefined, undefined, undefined, cmd.checkoutPath || process.cwd(), undefined, apiDetails, cmd.upload, "runner", outputDir, util_1.getMemoryFlag(cmd.ram), util_1.getAddSnippetsFlag(cmd.addSnippets), util_1.getThreadsFlag(cmd.threads, logger), config, logger);
     }
     catch (e) {
         logger.error("Analyze failed");
@@ -240,8 +248,12 @@ program
     .option("--debug", "Print more verbose output", false)
     .action(async (cmd) => {
     const logger = logging_1.getRunnerLogger(cmd.debug);
+    const apiDetails = {
+        auth: cmd.githubAuth,
+        url: util_1.parseGithubUrl(cmd.githubUrl),
+    };
     try {
-        await upload_lib.upload(cmd.sarifFile, repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), undefined, undefined, undefined, cmd.checkoutPath || process.cwd(), undefined, cmd.githubAuth, util_1.parseGithubUrl(cmd.githubUrl), "runner", logger);
+        await upload_lib.upload(cmd.sarifFile, repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), undefined, undefined, undefined, cmd.checkoutPath || process.cwd(), undefined, apiDetails, "runner", logger);
     }
     catch (e) {
         logger.error("Upload failed");

lib/toolrunner-error-catcher.js

@@ -7,7 +7,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const toolrunnner = __importStar(require("@actions/exec/lib/toolrunner"));
+const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 /**
  * Wrapper for toolrunner.Toolrunner which checks for specific return code and/or regex matches in console output.
  * Output will be streamed to the live console as well as captured for subsequent processing.
@@ -50,7 +51,7 @@ async function toolrunnerErrorCatcher(commandLine, args, matchers, options) {
     // we capture the original return code or error so that if no match is found we can duplicate the behavior
     let returnState;
     try {
-        returnState = await new toolrunnner.ToolRunner(commandLine, args, {
+        returnState = await new toolrunner.ToolRunner(await safeWhich.safeWhich(commandLine), args, {
             ...options,
             listeners,
             ignoreReturnCode: true,

lib/toolrunner-error-catcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolrunner-error-catcher.js","sourceRoot":"","sources":["../src/toolrunner-error-catcher.ts"],"names":[],"mappings":";;;;;;;;;AACA,0EAA4D;AAI5D;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,IAAe,EACf,QAAyB,EACzB,OAAwB;;IAExB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;;YACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,aAAA,OAAO,0CAAE,SAAS,0CAAE,MAAM,MAAK,SAAS,EAAE;gBAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChC;iBAAM;gBACL,4FAA4F;gBAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC5B;QACH,CAAC;QACD,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;;YACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,aAAA,OAAO,0CAAE,SAAS,0CAAE,MAAM,MAAK,SAAS,EAAE;gBAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChC;iBAAM;gBACL,4FAA4F;gBAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC5B;QACH,CAAC;KACF,CAAC;IAEF,0GAA0G;IAC1G,IAAI,WAA2B,CAAC;IAChC,IAAI;QACF,WAAW,GAAG,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE;YAChE,GAAG,OAAO;YACV,SAAS;YACT,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC,IAAI,EAAE,CAAC;KACX;IAAC,OAAO,CAAC,EAAE;QACV,WAAW,GAAG,CAAC,CAAC;KACjB;IAED,mEAAmE;IACnE,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE1C,IAAI,QAAQ,EAAE;QACZ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;YAC9B,IACE,OAAO,CAAC,QAAQ,KAAK,WAAW,WAChC,OAAO,CAAC,WAAW,0CAAE,IAAI,CAAC,MAAM,EAAC,WACjC,OAAO,CAAC,WAAW,0CAAE,IAAI,CAAC,MAAM,EAAC,EACjC;gBACA,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;aAClC;SACF;KACF;IAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE;QACnC,qFAAqF;QACrF,UAAI,OAAO,0CAAE,gBAAgB,EAAE;YAC7B,OAAO,WAAW,CAAC;SACpB;aAAM;YACL,MAAM,IAAI,KAAK,CACb,gBAAgB,WAAW,2BAA2B,WAAW,EAAE,CACpE,CAAC;SACH;KACF;SAAM;QACL,MAAM,WAAW,CAAC;KACnB;AACH,CAAC;AArED,wDAqEC"}
+{"version":3,"file":"toolrunner-error-catcher.js","sourceRoot":"","sources":["../src/toolrunner-error-catcher.ts"],"names":[],"mappings":";;;;;;;;;AACA,yEAA2D;AAC3D,kEAAoD;AAIpD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,IAAe,EACf,QAAyB,EACzB,OAAwB;;IAExB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;;YACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,aAAA,OAAO,0CAAE,SAAS,0CAAE,MAAM,MAAK,SAAS,EAAE;gBAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChC;iBAAM;gBACL,4FAA4F;gBAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC5B;QACH,CAAC;QACD,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;;YACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,aAAA,OAAO,0CAAE,SAAS,0CAAE,MAAM,MAAK,SAAS,EAAE;gBAC5C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAChC;iBAAM;gBACL,4FAA4F;gBAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC5B;QACH,CAAC;KACF,CAAC;IAEF,0GAA0G;IAC1G,IAAI,WAA2B,CAAC;IAChC,IAAI;QACF,WAAW,GAAG,MAAM,IAAI,UAAU,CAAC,UAAU,CAC3C,MAAM,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EACtC,IAAI,EACJ;YACE,GAAG,OAAO;YACV,SAAS;YACT,gBAAgB,EAAE,IAAI;SACvB,CACF,CAAC,IAAI,EAAE,CAAC;KACV;IAAC,OAAO,CAAC,EAAE;QACV,WAAW,GAAG,CAAC,CAAC;KACjB;IAED,mEAAmE;IACnE,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE1C,IAAI,QAAQ,EAAE;QACZ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;YAC9B,IACE,OAAO,CAAC,QAAQ,KAAK,WAAW,WAChC,OAAO,CAAC,WAAW,0CAAE,IAAI,CAAC,MAAM,EAAC,WACjC,OAAO,CAAC,WAAW,0CAAE,IAAI,CAAC,MAAM,EAAC,EACjC;gBACA,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;aAClC;SACF;KACF;IAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE;QACnC,qFAAqF;QACrF,UAAI,OAAO,0CAAE,gBAAgB,EAAE;YAC7B,OAAO,WAAW,CAAC;SACpB;aAAM;YACL,MAAM,IAAI,KAAK,CACb,gBAAgB,WAAW,2BAA2B,WAAW,EAAE,CACpE,CAAC;SACH;KACF;SAAM;QACL,MAAM,WAAW,CAAC;KACnB;AACH,CAAC;AAzED,wDAyEC"}

lib/tracer-config.js

@@ -109,7 +109,7 @@ function concatTracerConfigs(tracerConfigs, config) {
     for (const e of Object.entries(env)) {
         const key = e[0];
         const value = e[1];
-        const lineBuffer = new Buffer(`${key}=${value}\0`, "utf8");
+        const lineBuffer = Buffer.from(`${key}=${value}\0`, "utf8");
         const sizeBuffer = Buffer.alloc(4);
         sizeBuffer.writeInt32LE(lineBuffer.length, 0);
         buffer = Buffer.concat([buffer, sizeBuffer, lineBuffer]);

lib/tracer-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracer-config.js","sourceRoot":"","sources":["../src/tracer-config.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAI7B,2CAAyD;AACzD,6CAA+B;AAO/B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,yBAAyB;IACzB,eAAe;IACf,8BAA8B;IAC9B,wBAAwB;IACxB,0BAA0B;CAC3B,CAAC,CAAC;AAEI,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,MAA0B,EAC1B,QAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CACnC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CACrD,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAiB,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE7C,yDAAyD;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,8DAA8D;QAC9D,IAAI,GAAG,KAAK,4BAA4B,EAAE;YACxC,SAAS;SACV;QACD,wBAAwB;QACxB,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE;YAChC,SAAS;SACV;QACD,mFAAmF;QACnF,iCAAiC;QACjC,IACE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,WAAW;YACvC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7B,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EACzB;YACA,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;SACvB;KACF;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAnCD,gEAmCC;AAED,SAAgB,mBAAmB,CACjC,aAA+C,EAC/C,MAA0B;IAE1B,iGAAiG;IACjG,0FAA0F;IAE1F,yBAAyB;IACzB,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,gEAAgE;YAChE,IAAI,IAAI,KAAK,8BAA8B,EAAE;gBAC3C,eAAe,GAAG,IAAI,CAAC;aACxB;iBAAM,IAAI,IAAI,IAAI,GAAG,EAAE;gBACtB,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE;oBACvB,MAAM,KAAK,CACT,gDAAgD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE,CAClF,CAAC;iBACH;aACF;iBAAM;gBACL,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,CAAC;aACd;SACF;KACF;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,yFAAyF;IACzF,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE;QACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjD,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtD,SAAS,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;KAChC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE;QAC5B,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;aAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,UAAU,IAAI,KAAK,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KACpC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CACjC,MAAM,CAAC,OAAO,EACd,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG;QACrB,cAAc;QACd,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,GAAG,UAAU;KACd,CAAC;IAEF,IAAI,eAAe,EAAE;QACnB,GAAG,CAAC,8BAA8B,CAAC,GAAG,kBAAkB,CAAC;QACzD,OAAO,IAAI,CAAC,CAAC;KACd;IAED,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAElD,uDAAuD;IACvD,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,KAAK,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;KAC1D;IACD,iCAAiC;IACjC,MAAM,OAAO,GAAG,GAAG,IAAI,cAAc,CAAC;IACtC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAvFD,kDAuFC;AAEM,KAAK,UAAU,uBAAuB,CAC3C,MAA0B,EAC1B,MAAc;IAEd,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,4BAAgB,CAAC,CAAC;IAClE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE;QAChC,OAAO,SAAS,CAAC;KAClB;IAED,uDAAuD;IACvD,MAAM,qBAAqB,GAAqC,EAAE,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE;QACtC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,MAAM,0BAA0B,CAChE,MAAM,EACN,MAAM,EACN,QAAQ,CACT,CAAC;KACH;IACD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAE5E,8BAA8B;IAC9B,gBAAgB,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;QACjC,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,IAAI,CACvD,SAAS,EACT,OAAO,EACP,OAAO,EACP,gBAAgB,CACjB,CAAC;KACH;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QACvC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAC5C,SAAS,EACT,OAAO,EACP,SAAS,EACT,gBAAgB,CACjB,CAAC;KACH;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAzCD,0DAyCC"}
+{"version":3,"file":"tracer-config.js","sourceRoot":"","sources":["../src/tracer-config.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAI7B,2CAAyD;AACzD,6CAA+B;AAO/B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,yBAAyB;IACzB,eAAe;IACf,8BAA8B;IAC9B,wBAAwB;IACxB,0BAA0B;CAC3B,CAAC,CAAC;AAEI,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,MAA0B,EAC1B,QAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CACnC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CACrD,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAiB,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAE7C,yDAAyD;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,8DAA8D;QAC9D,IAAI,GAAG,KAAK,4BAA4B,EAAE;YACxC,SAAS;SACV;QACD,wBAAwB;QACxB,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE;YAChC,SAAS;SACV;QACD,mFAAmF;QACnF,iCAAiC;QACjC,IACE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,WAAW;YACvC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7B,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EACzB;YACA,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;SACvB;KACF;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAnCD,gEAmCC;AAED,SAAgB,mBAAmB,CACjC,aAA+C,EAC/C,MAA0B;IAE1B,iGAAiG;IACjG,0FAA0F;IAE1F,yBAAyB;IACzB,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,gEAAgE;YAChE,IAAI,IAAI,KAAK,8BAA8B,EAAE;gBAC3C,eAAe,GAAG,IAAI,CAAC;aACxB;iBAAM,IAAI,IAAI,IAAI,GAAG,EAAE;gBACtB,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE;oBACvB,MAAM,KAAK,CACT,gDAAgD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE,CAClF,CAAC;iBACH;aACF;iBAAM;gBACL,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;gBAClB,OAAO,IAAI,CAAC,CAAC;aACd;SACF;KACF;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,yFAAyF;IACzF,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE;QACnB,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjD,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACtD,SAAS,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;KAChC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE;QAC5B,MAAM,KAAK,GAAG,EAAE;aACb,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;aAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,UAAU,IAAI,KAAK,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;KACpC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CACjC,MAAM,CAAC,OAAO,EACd,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG;QACrB,cAAc;QACd,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,GAAG,UAAU;KACd,CAAC;IAEF,IAAI,eAAe,EAAE;QACnB,GAAG,CAAC,8BAA8B,CAAC,GAAG,kBAAkB,CAAC;QACzD,OAAO,IAAI,CAAC,CAAC;KACd;IAED,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAElD,uDAAuD;IACvD,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;KAC1D;IACD,iCAAiC;IACjC,MAAM,OAAO,GAAG,GAAG,IAAI,cAAc,CAAC;IACtC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAvFD,kDAuFC;AAEM,KAAK,UAAU,uBAAuB,CAC3C,MAA0B,EAC1B,MAAc;IAEd,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,4BAAgB,CAAC,CAAC;IAClE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE;QAChC,OAAO,SAAS,CAAC;KAClB;IAED,uDAAuD;IACvD,MAAM,qBAAqB,GAAqC,EAAE,CAAC;IACnE,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE;QACtC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,MAAM,0BAA0B,CAChE,MAAM,EACN,MAAM,EACN,QAAQ,CACT,CAAC;KACH;IACD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAE5E,8BAA8B;IAC9B,gBAAgB,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE;QACjC,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,IAAI,CACvD,SAAS,EACT,OAAO,EACP,OAAO,EACP,gBAAgB,CACjB,CAAC;KACH;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QACvC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAC5C,SAAS,EACT,OAAO,EACP,SAAS,EACT,gBAAgB,CACjB,CAAC;KACH;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAzCD,0DAyCC"}

lib/tracer-config.test.js

@@ -58,7 +58,6 @@ ava_1.default("getTracerConfigForLanguage - existing / critical vars", async (t)
         process.env["SEMMLE_COPY_EXECUTABLES_ROOT"] = "abc";
         process.env["SEMMLE_DEPTRACE_SOCKET"] = "abc";
         process.env["SEMMLE_JAVA_TOOL_OPTIONS"] = "abc";
-        process.env["SEMMLE_DEPTRACE_SOCKET"] = "abc";
         process.env["CODEQL_VAR"] = "abc";
         // Now CodeQL returns all these variables, and one more, with different values
         const codeQL = codeql_1.setCodeQL({

lib/upload-lib.js

@@ -43,14 +43,14 @@ function combineSarifFiles(sarifFiles) {
 exports.combineSarifFiles = combineSarifFiles;
 // Upload the given payload.
 // If the request fails then this will retry a small number of times.
-async function uploadPayload(payload, repositoryNwo, githubAuth, githubUrl, mode, logger) {
+async function uploadPayload(payload, repositoryNwo, apiDetails, mode, logger) {
     logger.info("Uploading results");
     // If in test mode we don't want to upload the results
     const testMode = process.env["TEST_MODE"] === "true" || false;
     if (testMode) {
         return;
     }
-    const client = api.getApiClient(githubAuth, githubUrl);
+    const client = api.getApiClient(apiDetails, mode, logger);
     const reqURL = mode === "actions"
         ? "PUT /repos/:owner/:repo/code-scanning/analysis"
         : "POST /repos/:owner/:repo/code-scanning/sarifs";
@@ -65,7 +65,7 @@ async function uploadPayload(payload, repositoryNwo, githubAuth, githubUrl, mode
 // Uploads a single sarif file or a directory of sarif files
 // depending on what the path happens to refer to.
 // Returns true iff the upload occurred and succeeded
-async function upload(sarifPath, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, githubAuth, githubUrl, mode, logger) {
+async function upload(sarifPath, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger) {
     const sarifFiles = [];
     if (!fs.existsSync(sarifPath)) {
         throw new Error(`Path does not exist: ${sarifPath}`);
@@ -75,8 +75,8 @@ async function upload(sarifPath, repositoryNwo, commitOid, ref, analysisKey, ana
             .readdirSync(sarifPath)
             .filter((f) => f.endsWith(".sarif"))
             .map((f) => path.resolve(sarifPath, f));
-        for (const path of paths) {
-            sarifFiles.push(path);
+        for (const filepath of paths) {
+            sarifFiles.push(filepath);
         }
         if (sarifFiles.length === 0) {
             throw new Error(`No SARIF files found to upload in "${sarifPath}".`);
@@ -85,7 +85,7 @@ async function upload(sarifPath, repositoryNwo, commitOid, ref, analysisKey, ana
     else {
         sarifFiles.push(sarifPath);
     }
-    return await uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, githubAuth, githubUrl, mode, logger);
+    return await uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger);
 }
 exports.upload = upload;
 // Counts the number of results in the given SARIF file
@@ -119,7 +119,7 @@ function validateSarifFileSchema(sarifFilePath, logger) {
 exports.validateSarifFileSchema = validateSarifFileSchema;
 // Uploads the given set of sarif files.
 // Returns true iff the upload occurred and succeeded
-async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, githubAuth, githubUrl, mode, logger) {
+async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger) {
     logger.info(`Uploading sarif files: ${JSON.stringify(sarifFiles)}`);
     if (mode === "actions") {
         // This check only works on actions as env vars don't persist between calls to the runner
@@ -170,7 +170,7 @@ async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKe
     const numResultInSarif = countResultsInSarif(sarifPayload);
     logger.debug(`Number of results in upload: ${numResultInSarif}`);
     // Make the upload
-    await uploadPayload(payload, repositoryNwo, githubAuth, githubUrl, mode, logger);
+    await uploadPayload(payload, repositoryNwo, apiDetails, mode, logger);
     return {
         raw_upload_size_bytes: rawUploadSizeBytes,
         zipped_upload_size_bytes: zippedUploadSizeBytes,

lib/upload-sarif-action.js

@@ -22,11 +22,15 @@ async function sendSuccessStatusReport(startedAt, uploadStats) {
 }
 async function run() {
     const startedAt = new Date();
-    if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("upload-sarif", "starting", startedAt), true))) {
+    if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("upload-sarif", "starting", startedAt)))) {
         return;
     }
     try {
-        const uploadStats = await upload_lib.upload(actionsUtil.getRequiredInput("sarif_file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), actionsUtil.getRequiredInput("token"), actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"), "actions", logging_1.getActionsLogger());
+        const apiDetails = {
+            auth: actionsUtil.getRequiredInput("token"),
+            url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
+        };
+        const uploadStats = await upload_lib.upload(actionsUtil.getRequiredInput("sarif_file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), apiDetails, "actions", logging_1.getActionsLogger());
         await sendSuccessStatusReport(startedAt, uploadStats);
     }
     catch (error) {
@@ -36,8 +40,14 @@ async function run() {
         return;
     }
 }
-run().catch((e) => {
-    core.setFailed(`codeql/upload-sarif action failed: ${e}`);
-    console.log(e);
-});
+async function runWrapper() {
+    try {
+        await run();
+    }
+    catch (error) {
+        core.setFailed(`codeql/upload-sarif action failed: ${error}`);
+        console.log(error);
+    }
+}
+void runWrapper();
 //# sourceMappingURL=upload-sarif-action.js.map

lib/upload-sarif-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload-sarif-action.js","sourceRoot":"","sources":["../src/upload-sarif-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAA6C;AAC7C,6CAAkD;AAClD,yDAA2C;AAM3C,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,WAA0C;IAE1C,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,cAAc,EACd,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,GAAG,WAAW;KACf,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,UAAU,EACV,SAAS,CACV,EACD,IAAI,CACL,CAAC,EACF;QACA,OAAO;KACR;IAED,IAAI;QACF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CACzC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAC1C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,SAAS,EACT,0BAAgB,EAAE,CACnB,CAAC;QACF,MAAM,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KACvD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;AACH,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IAChB,IAAI,CAAC,SAAS,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"upload-sarif-action.js","sourceRoot":"","sources":["../src/upload-sarif-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAA6C;AAC7C,6CAAkD;AAClD,yDAA2C;AAM3C,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,WAA0C;IAE1C,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,cAAc,EACd,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,GAAG,WAAW;KACf,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,UAAU,EACV,SAAS,CACV,CACF,CAAC,EACF;QACA,OAAO;KACR;IAED,IAAI;QACF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CACzC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAC1C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,UAAU,EACV,SAAS,EACT,0BAAgB,EAAE,CACnB,CAAC;QACF,MAAM,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KACvD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/util.test.js

@@ -66,7 +66,6 @@ ava_1.default("getThreadsFlag() throws if the threads input is not an integer",
     t.throws(() => util.getThreadsFlag("hello!", logging_1.getRunnerLogger(true)));
 });
 ava_1.default("isLocalRun() runs correctly", (t) => {
-    const origLocalRun = process.env.CODEQL_LOCAL_RUN;
     process.env.CODEQL_LOCAL_RUN = "";
     t.assert(!util.isLocalRun());
     process.env.CODEQL_LOCAL_RUN = "false";
@@ -77,7 +76,6 @@ ava_1.default("isLocalRun() runs correctly", (t) => {
     t.assert(util.isLocalRun());
     process.env.CODEQL_LOCAL_RUN = "hucairz";
     t.assert(util.isLocalRun());
-    process.env.CODEQL_LOCAL_RUN = origLocalRun;
 });
 ava_1.default("getExtraOptionsEnvParam() succeeds on valid JSON with invalid options (for now)", (t) => {
     const origExtraOptions = process.env.CODEQL_ACTION_EXTRA_OPTIONS;

node_modules/@chrisgavin/safe-which/README.md

@@ -0,0 +1,2 @@
+# safe-which
+A NodeJS library to guard against Windows binary planting attacks.

node_modules/@chrisgavin/safe-which/build/index.d.ts

@@ -0,0 +1,2 @@
+export declare const isWindows: boolean;
+export declare function safeWhich(program: string): Promise<string>;

node_modules/@chrisgavin/safe-which/build/index.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeWhich = exports.isWindows = void 0;
+const fs = require("fs");
+const path = require("path");
+exports.isWindows = process.platform === "win32";
+const pathSeparator = exports.isWindows ? ";" : ":";
+const defaultPathExt = exports.isWindows ? [".com", ".exe", ".bat", ".cmd"] : [""];
+async function safeWhich(program) {
+    if (program.includes("/") || (program.includes("\\") && exports.isWindows)) {
+        // If the path contains slashes it's either absolute or relative and should not be searched for.
+        return program;
+    }
+    let pathValue = process.env.PATH;
+    if (pathValue === undefined) {
+        throw new Error(`Could not resolve program ${program} because no PATH environment variable was set.`);
+    }
+    let searchPaths = pathValue.split(pathSeparator);
+    let pathExts = defaultPathExt;
+    if (exports.isWindows && process.env.PATHEXT !== undefined) {
+        pathExts = process.env.PATHEXT.split(pathSeparator);
+    }
+    for (let searchPath of searchPaths) {
+        for (let pathExt of pathExts) {
+            let completePath = path.join(searchPath, program + pathExt);
+            try {
+                await fs.promises.access(completePath, fs.constants.X_OK);
+                return completePath;
+            }
+            catch (err) {
+                if (err.code !== "ENOENT") {
+                    throw err;
+                }
+            }
+        }
+    }
+    throw new Error(`Could not find program ${program} on PATH.`);
+}
+exports.safeWhich = safeWhich;
+//# sourceMappingURL=index.js.map

node_modules/@chrisgavin/safe-which/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,yBAAyB;AACzB,6BAA6B;AAEhB,QAAA,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACtD,MAAM,aAAa,GAAG,iBAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5C,MAAM,cAAc,GAAG,iBAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEpE,KAAK,UAAU,SAAS,CAAC,OAAe;IAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,iBAAS,CAAC,EAAE;QACnE,gGAAgG;QAChG,OAAO,OAAO,CAAC;KACf;IAED,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,gDAAgD,CAAC,CAAC;KACtG;IACD,IAAI,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,QAAQ,GAAG,cAAc,CAAC;IAC9B,IAAI,iBAAS,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE;QACnD,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;KACpD;IAED,KAAK,IAAI,UAAU,IAAI,WAAW,EAAE;QACnC,KAAK,IAAI,OAAO,IAAI,QAAQ,EAAE;YAC7B,IAAI,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC;YAC5D,IAAI;gBACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC1D,OAAO,YAAY,CAAC;aACpB;YACD,OAAO,GAAG,EAAE;gBACX,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE;oBAC1B,MAAM,GAAG,CAAC;iBACV;aACD;SACD;KACD;IAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,WAAW,CAAC,CAAC;AAC/D,CAAC;AAhCD,8BAgCC"}

node_modules/@chrisgavin/safe-which/build/index.test.d.ts

@@ -0,0 +1 @@
+export {};

node_modules/@chrisgavin/safe-which/build/index.test.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = require("ava");
+const index_1 = require("./index");
+const path = require("path");
+const originalEnv = process.env;
+const originalWorkingDirectory = process.cwd();
+const testResources = path.resolve(path.join("src", "index.test"));
+ava_1.default.beforeEach(_ => {
+    process.env = { ...originalEnv };
+});
+ava_1.default.afterEach(_ => {
+    process.env = originalEnv;
+    process.chdir(originalWorkingDirectory);
+});
+ava_1.default("relative path with forward-slash is returned as-is", async (t) => {
+    process.env.PATH = path.join(testResources, "path");
+    t.deepEqual(await index_1.safeWhich("./anything"), "./anything");
+});
+ava_1.default("absolute path with forward-slash is returned as-is", async (t) => {
+    process.env.PATH = path.join(testResources, "path");
+    t.deepEqual(await index_1.safeWhich("/usr/bin/anything"), "/usr/bin/anything");
+});
+ava_1.default("binaries in cwd are not returned", async (t) => {
+    process.env.PATH = path.join(testResources, "empty");
+    process.chdir(path.join(testResources, "path"));
+    await t.throwsAsync(index_1.safeWhich("program"));
+    await t.throwsAsync(index_1.safeWhich("has-an-extension"));
+    await t.throwsAsync(index_1.safeWhich("has-an-extension.exe"));
+});
+if (index_1.isWindows) {
+    ava_1.default("program is found if on path with correct extension preference", async (t) => {
+        process.env.PATH = path.join(testResources, "path");
+        process.env.PATHEXT = ".com;.exe";
+        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "path", "has-an-extension.com"));
+        process.env.PATHEXT = ".exe;.com";
+        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "path", "has-an-extension.exe"));
+    });
+    ava_1.default("program is not found if no extension", async (t) => {
+        process.env.PATH = path.join(testResources, "path");
+        await t.throwsAsync(index_1.safeWhich("program"));
+    });
+    ava_1.default("relative path with backward-slash is returned as-is", async (t) => {
+        process.env.PATH = path.join(testResources, "path");
+        t.deepEqual(await index_1.safeWhich(".\\anything"), ".\\anything");
+    });
+    ava_1.default("absolute path with backward-slash is returned as-is", async (t) => {
+        process.env.PATH = path.join(testResources, "path");
+        t.deepEqual(await index_1.safeWhich("C:\\Python27\\python.exe"), "C:\\Python27\\python.exe");
+    });
+    ava_1.default("path order is respected", async (t) => {
+        process.env.PATHEXT = ".com;.exe;.bat";
+        process.env.PATH = path.join(testResources, "path") + ";" + path.join(testResources, "second-path");
+        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "path", "has-an-extension.com"));
+        process.env.PATH = path.join(testResources, "second-path") + ";" + path.join(testResources, "path");
+        t.deepEqual(await index_1.safeWhich("has-an-extension"), path.join(testResources, "second-path", "has-an-extension.bat"));
+    });
+}
+else {
+    ava_1.default("program is found if on path and executable", async (t) => {
+        process.env.PATH = path.join(testResources, "path");
+        t.deepEqual(await index_1.safeWhich("program"), path.join(testResources, "path", "program"));
+    });
+    ava_1.default("program is not found if not executable", async (t) => {
+        process.env.PATH = path.join(testResources, "path");
+        await t.throwsAsync(index_1.safeWhich("non-executable-file"));
+    });
+    ava_1.default("path order is respected", async (t) => {
+        process.env.PATH = path.join(testResources, "path") + ":" + path.join(testResources, "second-path");
+        t.deepEqual(await index_1.safeWhich("program"), path.join(testResources, "path", "program"));
+        process.env.PATH = path.join(testResources, "second-path") + ":" + path.join(testResources, "path");
+        t.deepEqual(await index_1.safeWhich("program"), path.join(testResources, "second-path", "program"));
+    });
+}
+//# sourceMappingURL=index.test.js.map

node_modules/@chrisgavin/safe-which/build/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":";;AAAA,6BAAuB;AACvB,mCAA+C;AAC/C,6BAA6B;AAE7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;AAChC,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAEnE,aAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;IACnB,OAAO,CAAC,GAAG,GAAG,EAAC,GAAG,WAAW,EAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;IAClB,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,oDAAoD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACtE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,oDAAoD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACtE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,CAAC,WAAW,CAAC,iBAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,CAAC,WAAW,CAAC,iBAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,CAAC,WAAW,CAAC,iBAAS,CAAC,sBAAsB,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAI,iBAAS,EAAE;IACd,aAAI,CAAC,+DAA+D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjF,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC3G,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,aAAI,CAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,WAAW,CAAC,iBAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,aAAI,CAAC,qDAAqD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,aAAI,CAAC,qDAAqD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,gBAAgB,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QACpG,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC3G,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;CACH;KACI;IACJ,aAAI,CAAC,4CAA4C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,aAAI,CAAC,wCAAwC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,WAAW,CAAC,iBAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QACpG,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC,CAAC,SAAS,CAAC,MAAM,iBAAS,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;CACH"}

node_modules/@chrisgavin/safe-which/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@chrisgavin/safe-which",
+  "version": "1.0.2",
+  "description": "A NodeJS library to guard against Windows binary planting attacks.",
+  "license": "MIT",
+  "homepage": "https://github.com/chrisgavin/safe-which/",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./build/index.js",
+  "types": "./build/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "pretest": "npm install && npm run build",
+    "test": "ava --verbose --serial ./src/**",
+    "prepublishOnly": "npm install && npm run build && npm version --allow-same-version=true --git-tag-version=false ${GITHUB_REF#refs/tags/}"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@ava/typescript": "^1.1.1",
+    "@types/node": "^14.14.7",
+    "ava": "^3.13.0",
+    "typescript": "^3.8.3"
+  },
+  "ava": {
+    "typescript": {
+      "rewritePaths": {
+        "./src/": "./build/"
+      }
+    }
+  }
+}

package-lock.json

@@ -112,6 +112,11 @@
         "js-tokens": "^4.0.0"
       }
     },
+    "@chrisgavin/safe-which": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@chrisgavin/safe-which/-/safe-which-1.0.2.tgz",
+      "integrity": "sha512-xImXYK6iJvLEDMevGCs5s05iKoFn3ARFShBswRFeWeHp6P1Z0jlYmKcK5+M2TtDoWuz45ay1unmNvV/8t66F2g=="
+    },
     "@concordance/react": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@concordance/react/-/react-2.0.0.tgz",

package.json

@@ -24,7 +24,9 @@
     "@actions/github": "^4.0.0",
     "@actions/http-client": "^1.0.8",
     "@actions/tool-cache": "^1.5.5",
+    "@chrisgavin/safe-which": "^1.0.2",
     "@octokit/plugin-retry": "^3.0.3",
+    "@octokit/types": "^5.5.0",
     "commander": "^6.0.0",
     "console-log-level": "^1.4.1",
     "file-url": "^3.0.0",

python-setup/install_tools.sh

@@ -10,6 +10,10 @@ set -e
 # subsequent actions in the current job, and not the current action.
 export PATH="$HOME/.local/bin:$PATH"
 
+# The Ubuntu 20.04 GHA environment does not come with a Python 2 pip
+curl https://bootstrap.pypa.io/get-pip.py --output get-pip.py
+python2 get-pip.py
+
 python2 -m pip install --user --upgrade pip setuptools wheel
 python3 -m pip install --user --upgrade pip setuptools wheel
 
@@ -18,9 +22,6 @@ python3 -m pip install --user --upgrade pip setuptools wheel
 python2 -m pip install --user virtualenv
 python3 -m pip install --user virtualenv
 
-# venv is required for installation of poetry or pipenv (I forgot which)
-sudo apt-get install -y python3-venv
-
 # We install poetry with pip instead of the recommended way, since the recommended way
 # caused some problem since `poetry run` gives output like:
 #

queries/binary-planting.ql

@@ -0,0 +1,45 @@
+/**
+ * @name Exec call vulnerable to binary planting
+ * @description On Windows, executing a binary with an unqualified name will execute a binary in the working directory in preference to a binary on PATH.
+ * @kind path-problem
+ * @problem.severity error
+ * @id javascript/codeql-action/binary-planting
+ */
+
+import javascript
+import DataFlow
+import DataFlow::PathGraph
+
+class SafeWhichBarrierGuardNode extends DataFlow::BarrierGuardNode, DataFlow::InvokeNode {
+  SafeWhichBarrierGuardNode() { getCalleeName() = "safeWhich" }
+
+  override predicate blocks(boolean outcome, Expr e) {
+    outcome = true and
+    e = getArgument(0).asExpr()
+  }
+}
+
+class BinaryPlantingConfiguration extends DataFlow::Configuration {
+  BinaryPlantingConfiguration() {
+    this = "BinaryPlantingConfiguration"
+  }
+
+  override predicate isSource(Node node) {
+    node.asExpr() instanceof StringLiteral and
+    not node.asExpr().(StringLiteral).getValue().matches("%/%") and
+    not node.getFile().getBaseName().matches("%.test.ts")
+  }
+
+  override predicate isSink(Node node) {
+    node instanceof SystemCommandExecution or
+    exists(InvokeExpr e | e.getCalleeName() = "ToolRunner" and e.getArgument(0) = node.asExpr())
+  }
+
+  override predicate isBarrierGuard(DataFlow::BarrierGuardNode guard) {
+    guard instanceof SafeWhichBarrierGuardNode
+  }
+}
+
+from BinaryPlantingConfiguration cfg, PathNode source, PathNode sink
+where cfg.hasFlowPath(source, sink)
+select source.getNode(), source, sink, "This exec call might be vulnerable to Windows binary planting vulnerabilities."

queries/import-action-entrypoint.ql

@@ -1,6 +1,6 @@
 /**
  * @name Import action entrypoint
- * @description Importing the entrpoint file for an action is dangerous
+ * @description Importing the entrypoint file for an action is dangerous
  * because the code from that action will be run when the file is imported.
  * @kind problem
  * @problem.severity error

src/actions-util.test.ts

@@ -33,16 +33,28 @@ test("getRef() returns head PR ref if GITHUB_SHA not currently checked out", asy
   t.deepEqual(actualRef, "refs/pull/1/head");
 });
 
-test("prepareEnvironment() when a local run", (t) => {
-  const origLocalRun = process.env.CODEQL_LOCAL_RUN;
+test("getAnalysisKey() when a local run", async (t) => {
+  process.env.CODEQL_LOCAL_RUN = "true";
+  process.env.CODEQL_ACTION_ANALYSIS_KEY = "";
+  process.env.GITHUB_JOB = "";
 
+  actionsutil.prepareLocalRunEnvironment();
+
+  const actualAnalysisKey = await actionsutil.getAnalysisKey();
+
+  t.deepEqual(actualAnalysisKey, "LOCAL-RUN:UNKNOWN-JOB");
+});
+
+test("prepareEnvironment() when a local run", (t) => {
   process.env.CODEQL_LOCAL_RUN = "false";
   process.env.GITHUB_JOB = "YYY";
+  process.env.CODEQL_ACTION_ANALYSIS_KEY = "TEST";
 
   actionsutil.prepareLocalRunEnvironment();
 
   // unchanged
   t.deepEqual(process.env.GITHUB_JOB, "YYY");
+  t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "TEST");
 
   process.env.CODEQL_LOCAL_RUN = "true";
 
@@ -50,13 +62,171 @@ test("prepareEnvironment() when a local run", (t) => {
 
   // unchanged
   t.deepEqual(process.env.GITHUB_JOB, "YYY");
+  t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "TEST");
+
+  process.env.CODEQL_ACTION_ANALYSIS_KEY = "";
+
+  actionsutil.prepareLocalRunEnvironment();
+
+  // updated
+  t.deepEqual(process.env.GITHUB_JOB, "YYY");
+  t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "LOCAL-RUN:YYY");
 
   process.env.GITHUB_JOB = "";
+  process.env.CODEQL_ACTION_ANALYSIS_KEY = "";
 
   actionsutil.prepareLocalRunEnvironment();
 
   // updated
   t.deepEqual(process.env.GITHUB_JOB, "UNKNOWN-JOB");
-
-  process.env.CODEQL_LOCAL_RUN = origLocalRun;
+  t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "LOCAL-RUN:UNKNOWN-JOB");
+});
+
+test("validateWorkflow() when on is missing", (t) => {
+  const errors = actionsutil.validateWorkflow({});
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+});
+
+test("validateWorkflow() when on.push is missing", (t) => {
+  const errors = actionsutil.validateWorkflow({ on: {} });
+
+  console.log(errors);
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+});
+
+test("validateWorkflow() when on.push is an array missing pull_request", (t) => {
+  const errors = actionsutil.validateWorkflow({ on: ["push"] });
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPullRequestHook]);
+});
+
+test("validateWorkflow() when on.push is an array missing push", (t) => {
+  const errors = actionsutil.validateWorkflow({ on: ["pull_request"] });
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPushHook]);
+});
+
+test("validateWorkflow() when on.push is valid", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: ["push", "pull_request"],
+  });
+
+  t.deepEqual(errors.length, 0);
+});
+
+test("validateWorkflow() when on.push is a valid superset", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: ["push", "pull_request", "schedule"],
+  });
+
+  t.deepEqual(errors.length, 0);
+});
+
+test("validateWorkflow() when on.push should not have a path", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: {
+      push: { branches: ["main"], paths: ["test/*"] },
+      pull_request: { branches: ["main"] },
+    },
+  });
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.PathsSpecified]);
+});
+
+test("validateWorkflow() when on.push is a correct object", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
+  });
+
+  t.deepEqual(errors.length, 0);
+});
+
+test("validateWorkflow() when on.push is correct with empty objects", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: { push: undefined, pull_request: undefined },
+  });
+
+  console.log(errors);
+
+  t.deepEqual(errors.length, 0);
+});
+
+test("validateWorkflow() when on.push is mismatched", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: {
+      push: { branches: ["main"] },
+      pull_request: { branches: ["feature"] },
+    },
+  });
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+});
+
+test("validateWorkflow() when on.push is not mismatched", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: {
+      push: { branches: ["main", "feature"] },
+      pull_request: { branches: ["main"] },
+    },
+  });
+
+  t.deepEqual(errors.length, 0);
+});
+
+test("validateWorkflow() when on.push is mismatched for pull_request", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: {
+      push: { branches: ["main"] },
+      pull_request: { branches: ["main", "feature"] },
+    },
+  });
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+});
+
+test("validateWorkflow() when on.pull_request for every branch but push specifies branches", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: {
+      push: { branches: ["main"] },
+      pull_request: null,
+    },
+  });
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+});
+
+test("validateWorkflow() when HEAD^2 is checked out", (t) => {
+  const errors = actionsutil.validateWorkflow({
+    on: ["push", "pull_request"],
+    jobs: { test: { steps: [{ run: "git checkout HEAD^2" }] } },
+  });
+
+  t.deepEqual(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]);
+});
+
+test("formatWorkflowErrors() when there is one error", (t) => {
+  const message = actionsutil.formatWorkflowErrors([
+    actionsutil.WorkflowErrors.CheckoutWrongHead,
+  ]);
+  t.true(message.startsWith("1 issue was detected with this workflow:"));
+});
+
+test("formatWorkflowErrors() when there are multiple errors", (t) => {
+  const message = actionsutil.formatWorkflowErrors([
+    actionsutil.WorkflowErrors.CheckoutWrongHead,
+    actionsutil.WorkflowErrors.PathsSpecified,
+  ]);
+  t.true(message.startsWith("2 issues were detected with this workflow:"));
+});
+
+test("formatWorkflowCause()", (t) => {
+  const message = actionsutil.formatWorkflowCause([
+    actionsutil.WorkflowErrors.CheckoutWrongHead,
+    actionsutil.WorkflowErrors.PathsSpecified,
+  ]);
+
+  t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
+  t.deepEqual(actionsutil.formatWorkflowCause([]), undefined);
 });

src/actions-util.ts

@@ -1,5 +1,10 @@
+import * as fs from "fs";
+import * as path from "path";
+
 import * as core from "@actions/core";
-import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as toolrunner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
+import * as yaml from "js-yaml";
 
 import * as api from "./api-client";
 import * as sharedEnv from "./shared-environment";
@@ -52,6 +57,12 @@ export function prepareLocalRunEnvironment() {
   if (!process.env.GITHUB_JOB) {
     core.exportVariable("GITHUB_JOB", "UNKNOWN-JOB");
   }
+  if (!process.env.CODEQL_ACTION_ANALYSIS_KEY) {
+    core.exportVariable(
+      "CODEQL_ACTION_ANALYSIS_KEY",
+      `LOCAL-RUN:${process.env.GITHUB_JOB}`
+    );
+  }
 }
 
 /**
@@ -67,17 +78,21 @@ export const getCommitOid = async function (): Promise<string> {
   // reported on the merge commit.
   try {
     let commitOid = "";
-    await new toolrunnner.ToolRunner("git", ["rev-parse", "HEAD"], {
-      silent: true,
-      listeners: {
-        stdout: (data) => {
-          commitOid += data.toString();
+    await new toolrunner.ToolRunner(
+      await safeWhich.safeWhich("git"),
+      ["rev-parse", "HEAD"],
+      {
+        silent: true,
+        listeners: {
+          stdout: (data) => {
+            commitOid += data.toString();
+          },
+          stderr: (data) => {
+            process.stderr.write(data);
+          },
         },
-        stderr: (data) => {
-          process.stderr.write(data);
-        },
-      },
-    }).exec();
+      }
+    ).exec();
     return commitOid.trim();
   } catch (e) {
     core.info(
@@ -87,10 +102,212 @@ export const getCommitOid = async function (): Promise<string> {
   }
 };
 
+interface WorkflowJobStep {
+  run: any;
+}
+
+interface WorkflowJob {
+  steps?: WorkflowJobStep[];
+}
+
+interface WorkflowTrigger {
+  branches?: string[];
+  paths?: string[];
+}
+
+// on: {} then push/pull_request are undefined
+// on:
+//   push:
+//   pull_request:
+// then push/pull_request are null
+interface WorkflowTriggers {
+  push?: WorkflowTrigger | null;
+  pull_request?: WorkflowTrigger | null;
+}
+
+interface Workflow {
+  jobs?: { [key: string]: WorkflowJob };
+  on?: string | string[] | WorkflowTriggers;
+}
+
+function isObject(o: unknown): o is object {
+  return o !== null && typeof o === "object";
+}
+
+enum MissingTriggers {
+  None = 0,
+  Push = 1,
+  PullRequest = 2,
+}
+
+interface CodedError {
+  message: string;
+  code: string;
+}
+
+function toCodedErrors(errors: {
+  [key: string]: string;
+}): { [key: string]: CodedError } {
+  return Object.entries(errors).reduce((acc, [key, value]) => {
+    acc[key] = { message: value, code: key };
+    return acc;
+  }, {} as ReturnType<typeof toCodedErrors>);
+}
+
+export const WorkflowErrors = toCodedErrors({
+  MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
+  MissingHooks: `Please specify on.push and on.pull_request hooks so that Code Scanning can compare pull requests against the state of the base branch.`,
+  MissingPullRequestHook: `Please specify an on.pull_request hook so that Code Scanning is run against pull requests.`,
+  MissingPushHook: `Please specify an on.push hook so that Code Scanning can compare pull requests against the state of the base branch.`,
+  PathsSpecified: `Using on.push.paths can prevent Code Scanning annotating new alerts in your pull requests.`,
+  PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
+  CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
+});
+
+export function validateWorkflow(doc: Workflow): CodedError[] {
+  const errors: CodedError[] = [];
+
+  // .jobs[key].steps[].run
+  for (const job of Object.values(doc?.jobs || {})) {
+    for (const step of job?.steps || []) {
+      // this was advice that we used to give in the README
+      // we actually want to run the analysis on the merge commit
+      // to produce results that are more inline with expectations
+      // (i.e: this is what will happen if you merge this PR)
+      // and avoid some race conditions
+      if (step?.run === "git checkout HEAD^2") {
+        errors.push(WorkflowErrors.CheckoutWrongHead);
+      }
+    }
+  }
+
+  let missing = MissingTriggers.None;
+
+  if (doc.on === undefined) {
+    missing = MissingTriggers.Push | MissingTriggers.PullRequest;
+  } else if (typeof doc.on === "string") {
+    switch (doc.on) {
+      case "push":
+        missing = MissingTriggers.PullRequest;
+        break;
+      case "pull_request":
+        missing = MissingTriggers.Push;
+        break;
+      default:
+        missing = MissingTriggers.Push | MissingTriggers.PullRequest;
+        break;
+    }
+  } else if (Array.isArray(doc.on)) {
+    if (!doc.on.includes("push")) {
+      missing = missing | MissingTriggers.Push;
+    }
+    if (!doc.on.includes("pull_request")) {
+      missing = missing | MissingTriggers.PullRequest;
+    }
+  } else if (isObject(doc.on)) {
+    if (!Object.prototype.hasOwnProperty.call(doc.on, "pull_request")) {
+      missing = missing | MissingTriggers.PullRequest;
+    }
+    if (!Object.prototype.hasOwnProperty.call(doc.on, "push")) {
+      missing = missing | MissingTriggers.Push;
+    } else {
+      const paths = doc.on.push?.paths;
+      // if you specify paths or paths-ignore you can end up with commits that have no baseline
+      // if they didn't change any files
+      // currently we cannot go back through the history and find the most recent baseline
+      if (Array.isArray(paths) && paths.length > 0) {
+        errors.push(WorkflowErrors.PathsSpecified);
+      }
+      const pathsIgnore = doc.on.push?.["paths-ignore"];
+      if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
+        errors.push(WorkflowErrors.PathsIgnoreSpecified);
+      }
+    }
+
+    if (doc.on.push) {
+      const push = doc.on.push.branches || [];
+
+      if (doc.on.pull_request) {
+        const pull_request = doc.on.pull_request.branches || [];
+        const difference = pull_request.filter(
+          (value) => !push.includes(value)
+        );
+        if (difference.length > 0) {
+          // there are branches in pull_request that may not have a baseline
+          // because we are not building them on push
+          errors.push(WorkflowErrors.MismatchedBranches);
+        }
+      } else if (push.length > 0) {
+        // push is set up to run on a subset of branches
+        // and you could open a PR against a branch with no baseline
+        errors.push(WorkflowErrors.MismatchedBranches);
+      }
+    }
+  }
+
+  switch (missing) {
+    case MissingTriggers.PullRequest | MissingTriggers.Push:
+      errors.push(WorkflowErrors.MissingHooks);
+      break;
+    case MissingTriggers.PullRequest:
+      errors.push(WorkflowErrors.MissingPullRequestHook);
+      break;
+    case MissingTriggers.Push:
+      errors.push(WorkflowErrors.MissingPushHook);
+      break;
+  }
+
+  return errors;
+}
+
+export async function getWorkflowErrors(): Promise<CodedError[]> {
+  const workflow = await getWorkflow();
+
+  if (workflow === undefined) {
+    return [];
+  }
+
+  return validateWorkflow(workflow);
+}
+
+export function formatWorkflowErrors(errors: CodedError[]): string {
+  const issuesWere = errors.length === 1 ? "issue was" : "issues were";
+
+  const errorsList = errors.map((e) => e.message).join(" ");
+
+  return `${errors.length} ${issuesWere} detected with this workflow: ${errorsList}`;
+}
+
+export function formatWorkflowCause(errors: CodedError[]): undefined | string {
+  if (errors.length === 0) {
+    return undefined;
+  }
+  return errors.map((e) => e.code).join(",");
+}
+
+export async function getWorkflow(): Promise<Workflow | undefined> {
+  const relativePath = await getWorkflowPath();
+  const absolutePath = path.join(
+    getRequiredEnvParam("GITHUB_WORKSPACE"),
+    relativePath
+  );
+
+  try {
+    return yaml.safeLoad(fs.readFileSync(absolutePath, "utf-8"));
+  } catch (e) {
+    core.warning(`Could not read workflow: ${e.toString()}`);
+    return undefined;
+  }
+}
+
 /**
  * Get the path of the currently executing workflow.
  */
 async function getWorkflowPath(): Promise<string> {
+  if (isLocalRun()) {
+    return getRequiredEnvParam("WORKFLOW_PATH");
+  }
+
   const repo_nwo = getRequiredEnvParam("GITHUB_REPOSITORY").split("/");
   const owner = repo_nwo[0];
   const repo = repo_nwo[1];
@@ -191,7 +408,9 @@ export interface StatusReportBase {
   ref: string;
   // Name of the action being executed
   action_name: ActionName;
-  // Version if the action being executed, as a commit oid
+  // Version of the action being executed, as a ref
+  action_ref?: string;
+  // Version of the action being executed, as a commit oid
   action_oid: string;
   // Time the first action started. Normally the init action
   started_at: string;
@@ -241,6 +460,11 @@ export async function createStatusReportBase(
       workflowStartedAt
     );
   }
+  // If running locally then the GITHUB_ACTION_REF cannot be trusted as it may be for the previous action
+  // See https://github.com/actions/runner/issues/803
+  const actionRef = isRunningLocalAction()
+    ? undefined
+    : process.env["GITHUB_ACTION_REF"];
 
   const statusReport: StatusReportBase = {
     workflow_run_id: workflowRunID,
@@ -250,6 +474,7 @@ export async function createStatusReportBase(
     commit_oid: commitOid,
     ref,
     action_name: actionName,
+    action_ref: actionRef,
     action_oid: "unknown", // TODO decide if it's possible to fill this in
     started_at: workflowStartedAt,
     action_started_at: actionStartedAt.toISOString(),
@@ -274,6 +499,14 @@ export async function createStatusReportBase(
   return statusReport;
 }
 
+interface HTTPError {
+  status: number;
+}
+
+function isHTTPError(arg: any): arg is HTTPError {
+  return arg?.status !== undefined && Number.isInteger(arg.status);
+}
+
 /**
  * Send a status report to the code_scanning/analysis/status endpoint.
  *
@@ -284,14 +517,8 @@ export async function createStatusReportBase(
  * Returns whether sending the status report was successful of not.
  */
 export async function sendStatusReport<S extends StatusReportBase>(
-  statusReport: S,
-  ignoreFailures?: boolean
+  statusReport: S
 ): Promise<boolean> {
-  if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
-    core.debug("Not sending status report to GitHub Enterprise");
-    return true;
-  }
-
   if (isLocalRun()) {
     core.debug("Not sending status report because this is a local run");
     return true;
@@ -303,35 +530,71 @@ export async function sendStatusReport<S extends StatusReportBase>(
   const nwo = getRequiredEnvParam("GITHUB_REPOSITORY");
   const [owner, repo] = nwo.split("/");
   const client = api.getActionsApiClient();
-  const statusResponse = await client.request(
-    "PUT /repos/:owner/:repo/code-scanning/analysis/status",
-    {
-      owner,
-      repo,
-      data: statusReportJSON,
-    }
-  );
 
-  if (!ignoreFailures) {
-    // If the status report request fails with a 403 or a 404, then this is a deliberate
-    // message from the endpoint that the SARIF upload can be expected to fail too,
-    // so the action should fail to avoid wasting actions minutes.
-    //
-    // Other failure responses (or lack thereof) could be transitory and should not
-    // cause the action to fail.
-    if (statusResponse.status === 403) {
-      core.setFailed(
-        "The repo on which this action is running is not opted-in to CodeQL code scanning."
-      );
-      return false;
-    }
-    if (statusResponse.status === 404) {
-      core.setFailed(
-        "Not authorized to used the CodeQL code scanning feature on this repo."
-      );
-      return false;
+  try {
+    await client.request(
+      "PUT /repos/:owner/:repo/code-scanning/analysis/status",
+      {
+        owner,
+        repo,
+        data: statusReportJSON,
+      }
+    );
+
+    return true;
+  } catch (e) {
+    if (isHTTPError(e)) {
+      switch (e.status) {
+        case 403:
+          core.setFailed(
+            "The repo on which this action is running is not opted-in to CodeQL code scanning."
+          );
+          return false;
+        case 404:
+          core.setFailed(
+            "Not authorized to used the CodeQL code scanning feature on this repo."
+          );
+          return false;
+        case 422:
+          // schema incompatibility when reporting status
+          // this means that this action version is no longer compatible with the API
+          // we still want to continue as it is likely the analysis endpoint will work
+          if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
+            core.warning(
+              "CodeQL Action version is incompatible with the code scanning endpoint. Please update to a compatible version of codeql-action."
+            );
+          } else {
+            core.warning(
+              "CodeQL Action is out-of-date. Please upgrade to the latest version of codeql-action."
+            );
+          }
+
+          return true;
+      }
     }
+
+    // something else has gone wrong and the request/response will be logged by octokit
+    // it's possible this is a transient error and we should continue scanning
+    core.error(
+      "An unexpected error occured when sending code scanning status report."
+    );
+    return true;
   }
-
-  return true;
+}
+
+// Is the current action executing a local copy (i.e. we're running a workflow on the codeql-action repo itself)
+// as opposed to running a remote action (i.e. when another repo references us)
+export function isRunningLocalAction(): boolean {
+  const relativeScriptPath = getRelativeScriptPath();
+  return (
+    relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath)
+  );
+}
+
+// Get the location where the action is running from.
+// This can be used to get the actions name or tell if we're running a local action.
+export function getRelativeScriptPath(): string {
+  const runnerTemp = getRequiredEnvParam("RUNNER_TEMP");
+  const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
+  return path.relative(actionsDirectory, __filename);
 }

src/analyze-action.ts

@@ -1,7 +1,11 @@
 import * as core from "@actions/core";
 
 import * as actionsUtil from "./actions-util";
-import { AnalysisStatusReport, runAnalyze } from "./analyze";
+import {
+  AnalysisStatusReport,
+  runAnalyze,
+  CodeQLAnalysisError,
+} from "./analyze";
 import { getConfig } from "./config-utils";
 import { getActionsLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
@@ -45,8 +49,7 @@ async function run() {
           "finish",
           "starting",
           startedAt
-        ),
-        true
+        )
       ))
     ) {
       return;
@@ -61,6 +64,10 @@ async function run() {
         "Config file could not be found at expected location. Has the 'init' action been called?"
       );
     }
+    const apiDetails = {
+      auth: actionsUtil.getRequiredInput("token"),
+      url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
+    };
     stats = await runAnalyze(
       parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")),
       await actionsUtil.getCommitOid(),
@@ -70,8 +77,7 @@ async function run() {
       actionsUtil.getWorkflowRunID(),
       actionsUtil.getRequiredInput("checkout_path"),
       actionsUtil.getRequiredInput("matrix"),
-      actionsUtil.getRequiredInput("token"),
-      actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
+      apiDetails,
       actionsUtil.getRequiredInput("upload") === "true",
       "actions",
       actionsUtil.getRequiredInput("output"),
@@ -84,6 +90,11 @@ async function run() {
   } catch (error) {
     core.setFailed(error.message);
     console.log(error);
+
+    if (error instanceof CodeQLAnalysisError) {
+      stats = { ...error.queriesStatusReport };
+    }
+
     await sendStatusReport(startedAt, stats, error);
     return;
   }
@@ -91,7 +102,13 @@ async function run() {
   await sendStatusReport(startedAt, stats);
 }
 
-run().catch((e) => {
-  core.setFailed(`analyze action failed: ${e}`);
-  console.log(e);
-});
+async function runWrapper() {
+  try {
+    await run();
+  } catch (error) {
+    core.setFailed(`analyze action failed: ${error}`);
+    console.log(error);
+  }
+}
+
+void runWrapper();

src/analyze.ts

@@ -1,9 +1,10 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as toolrunner from "@actions/exec/lib/toolrunner";
 
 import * as analysisPaths from "./analysis-paths";
+import { GitHubApiDetails } from "./api-client";
 import { getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { isScannedLanguage, Language } from "./languages";
@@ -13,6 +14,17 @@ import * as sharedEnv from "./shared-environment";
 import * as upload_lib from "./upload-lib";
 import * as util from "./util";
 
+export class CodeQLAnalysisError extends Error {
+  queriesStatusReport: QueriesStatusReport;
+
+  constructor(queriesStatusReport: QueriesStatusReport, message: string) {
+    super(message);
+
+    this.name = "CodeQLAnalysisError";
+    this.queriesStatusReport = queriesStatusReport;
+  }
+}
+
 export interface QueriesStatusReport {
   // Time taken in ms to analyze builtin queries for cpp (or undefined if this language was not analyzed)
   analyze_builtin_queries_cpp_duration_ms?: number;
@@ -38,7 +50,7 @@ export interface QueriesStatusReport {
   analyze_custom_queries_javascript_duration_ms?: number;
   // Time taken in ms to analyze custom queries for python (or undefined if this language was not analyzed)
   analyze_custom_queries_python_duration_ms?: number;
-  // Name of language that errored during analysis (or undefined if no langauge failed)
+  // Name of language that errored during analysis (or undefined if no language failed)
   analyze_failure_language?: string;
 }
 
@@ -62,7 +74,7 @@ async function setupPythonExtractor(logger: Logger) {
     },
   };
 
-  await new toolrunnner.ToolRunner(
+  await new toolrunner.ToolRunner(
     codeqlPython,
     [
       "-c",
@@ -74,7 +86,7 @@ async function setupPythonExtractor(logger: Logger) {
   process.env["LGTM_INDEX_IMPORT_PATH"] = output;
 
   output = "";
-  await new toolrunnner.ToolRunner(
+  await new toolrunner.ToolRunner(
     codeqlPython,
     ["-c", "import sys; print(sys.version_info[0])"],
     options
@@ -111,6 +123,7 @@ async function createdDBForScannedLanguages(
 
 async function finalizeDatabaseCreation(
   config: configUtils.Config,
+  threadsFlag: string,
   logger: Logger
 ) {
   await createdDBForScannedLanguages(config, logger);
@@ -119,7 +132,8 @@ async function finalizeDatabaseCreation(
   for (const language of config.languages) {
     logger.startGroup(`Finalizing ${language}`);
     await codeql.finalizeDatabase(
-      util.getCodeQLDatabasePath(config.tempDir, language)
+      util.getCodeQLDatabasePath(config.tempDir, language),
+      threadsFlag
     );
     logger.endGroup();
   }
@@ -190,10 +204,12 @@ export async function runQueries(
         }
       }
     } catch (e) {
-      logger.error(`Error running analysis for ${language}: ${e}`);
       logger.info(e);
       statusReport.analyze_failure_language = language;
-      return statusReport;
+      throw new CodeQLAnalysisError(
+        statusReport,
+        `Error running analysis for ${language}: ${e}`
+      );
     }
   }
 
@@ -209,8 +225,7 @@ export async function runAnalyze(
   workflowRunID: number | undefined,
   checkoutPath: string,
   environment: string | undefined,
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: GitHubApiDetails,
   doUpload: boolean,
   mode: util.Mode,
   outputDir: string,
@@ -226,7 +241,7 @@ export async function runAnalyze(
   fs.mkdirSync(outputDir, { recursive: true });
 
   logger.info("Finalizing database creation");
-  await finalizeDatabaseCreation(config, logger);
+  await finalizeDatabaseCreation(config, threadsFlag, logger);
 
   logger.info("Analyzing database");
   const queriesStats = await runQueries(
@@ -253,8 +268,7 @@ export async function runAnalyze(
     workflowRunID,
     checkoutPath,
     environment,
-    githubAuth,
-    githubUrl,
+    apiDetails,
     mode,
     logger
   );

src/api-client.test.ts

@@ -0,0 +1,19 @@
+import test from "ava";
+
+import { apiVersionInRange, DisallowedAPIVersionReason } from "./api-client";
+
+test("allowed API versions", async (t) => {
+  t.is(apiVersionInRange("1.33.0", "1.33", "2.0"), undefined);
+  t.is(apiVersionInRange("1.33.1", "1.33", "2.0"), undefined);
+  t.is(apiVersionInRange("1.34.0", "1.33", "2.0"), undefined);
+  t.is(apiVersionInRange("2.0.0", "1.33", "2.0"), undefined);
+  t.is(apiVersionInRange("2.0.1", "1.33", "2.0"), undefined);
+  t.is(
+    apiVersionInRange("1.32.0", "1.33", "2.0"),
+    DisallowedAPIVersionReason.ACTION_TOO_NEW
+  );
+  t.is(
+    apiVersionInRange("2.1.0", "1.33", "2.0"),
+    DisallowedAPIVersionReason.ACTION_TOO_OLD
+  );
+});

src/api-client.ts

@@ -1,24 +1,89 @@
 import * as path from "path";
 
+import { exportVariable } from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
 import * as retry from "@octokit/plugin-retry";
+import { OctokitResponse } from "@octokit/types";
 import consoleLogLevel from "console-log-level";
+import * as semver from "semver";
 
 import { getRequiredEnvParam, getRequiredInput } from "./actions-util";
-import { isLocalRun } from "./util";
+import * as apiCompatibility from "./api-compatibility.json";
+import { Logger, getActionsLogger } from "./logging";
+import { isLocalRun, Mode } from "./util";
+
+export enum DisallowedAPIVersionReason {
+  ACTION_TOO_OLD,
+  ACTION_TOO_NEW,
+}
+
+export interface GitHubApiDetails {
+  auth: string;
+  url: string;
+}
+
+const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+const CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR =
+  "CODEQL_ACTION_WARNED_ABOUT_VERSION";
+let hasBeenWarnedAboutVersion = false;
 
 export const getApiClient = function (
-  githubAuth: string,
-  githubUrl: string,
-  allowLocalRun = false
+  apiDetails: GitHubApiDetails,
+  mode: Mode,
+  logger: Logger,
+  allowLocalRun = false,
+  possibleFailureExpected = false
 ) {
   if (isLocalRun() && !allowLocalRun) {
     throw new Error("Invalid API call in local run");
   }
-  const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
-  return new retryingOctokit(
-    githubUtils.getOctokitOptions(githubAuth, {
-      baseUrl: getApiUrl(githubUrl),
+  const customOctokit = githubUtils.GitHub.plugin(retry.retry, (octokit, _) => {
+    octokit.hook.after("request", (response: OctokitResponse<any>, __) => {
+      if (response.status < 400 && !possibleFailureExpected) {
+        if (hasBeenWarnedAboutVersion) {
+          return;
+        }
+      }
+      if (
+        response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined ||
+        process.env[CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR] === undefined
+      ) {
+        return;
+      }
+      const installedVersion = response.headers[
+        GITHUB_ENTERPRISE_VERSION_HEADER
+      ] as string;
+      const disallowedAPIVersionReason = apiVersionInRange(
+        installedVersion,
+        apiCompatibility.minimumVersion,
+        apiCompatibility.maximumVersion
+      );
+
+      const toolName = mode === "actions" ? "Action" : "Runner";
+
+      if (
+        disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_OLD
+      ) {
+        logger.warning(
+          `The CodeQL ${toolName} version you are using is too old to be compatible with GitHub Enterprise ${installedVersion}. If you experience issues, please upgrade to a more recent version of the CodeQL ${toolName}.`
+        );
+      }
+      if (
+        disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_NEW
+      ) {
+        logger.warning(
+          `GitHub Enterprise ${installedVersion} is too old to be compatible with this version of the CodeQL ${toolName}. If you experience issues, please upgrade to a more recent version of GitHub Enterprise or use an older version of the CodeQL ${toolName}.`
+        );
+      }
+      hasBeenWarnedAboutVersion = true;
+      if (mode === "actions") {
+        exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
+      }
+    });
+  });
+  return new customOctokit(
+    githubUtils.getOctokitOptions(apiDetails.auth, {
+      baseUrl: getApiUrl(apiDetails.url),
       userAgent: "CodeQL Action",
       log: consoleLogLevel({ level: "debug" }),
     })
@@ -40,12 +105,27 @@ function getApiUrl(githubUrl: string): string {
 }
 
 // Temporary function to aid in the transition to running on and off of github actions.
-// Once all code has been coverted this function should be removed or made canonical
+// Once all code has been converted this function should be removed or made canonical
 // and called only from the action entrypoints.
 export function getActionsApiClient(allowLocalRun = false) {
-  return getApiClient(
-    getRequiredInput("token"),
-    getRequiredEnvParam("GITHUB_SERVER_URL"),
-    allowLocalRun
-  );
+  const apiDetails = {
+    auth: getRequiredInput("token"),
+    url: getRequiredEnvParam("GITHUB_SERVER_URL"),
+  };
+
+  return getApiClient(apiDetails, "actions", getActionsLogger(), allowLocalRun);
+}
+
+export function apiVersionInRange(
+  version: string,
+  minimumVersion: string,
+  maximumVersion: string
+): DisallowedAPIVersionReason | undefined {
+  if (!semver.satisfies(version, `>=${minimumVersion}`)) {
+    return DisallowedAPIVersionReason.ACTION_TOO_NEW;
+  }
+  if (!semver.satisfies(version, `<=${maximumVersion}`)) {
+    return DisallowedAPIVersionReason.ACTION_TOO_OLD;
+  }
+  return undefined;
 }

src/api-compatibility.json

@@ -0,0 +1 @@
+{"maximumVersion": "3.0", "minimumVersion": "2.22"}

src/autobuild-action.ts

@@ -7,7 +7,7 @@ import { Language } from "./languages";
 import { getActionsLogger } from "./logging";
 
 interface AutobuildStatusReport extends actionsUtil.StatusReportBase {
-  // Comma-separated set of languages being autobuilt
+  // Comma-separated set of languages being auto-built
   autobuild_languages: string;
   // Language that failed autobuilding (or undefined if all languages succeeded).
   autobuild_failure?: string;
@@ -50,8 +50,7 @@ async function run() {
           "autobuild",
           "starting",
           startedAt
-        ),
-        true
+        )
       ))
     ) {
       return;
@@ -87,7 +86,13 @@ async function run() {
   await sendCompletedStatusReport(startedAt, language ? [language] : []);
 }
 
-run().catch((e) => {
-  core.setFailed(`autobuild action failed.  ${e}`);
-  console.log(e);
-});
+async function runWrapper() {
+  try {
+    await run();
+  } catch (error) {
+    core.setFailed(`autobuild action failed. ${error}`);
+    console.log(error);
+  }
+}
+
+void runWrapper();

src/codeql.test.ts

@@ -12,6 +12,11 @@ import * as util from "./util";
 
 setupTests(test);
 
+const sampleApiDetails = {
+  auth: "token",
+  url: "https://github.com",
+};
+
 test("download codeql bundle cache", async (t) => {
   await util.withTmpDir(async (tmpDir) => {
     const versions = ["20200601", "20200610"];
@@ -28,8 +33,7 @@ test("download codeql bundle cache", async (t) => {
 
       await codeql.setupCodeQL(
         `https://example.com/download/codeql-bundle-${version}/codeql-bundle.tar.gz`,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
         tmpDir,
         tmpDir,
         "runner",
@@ -56,8 +60,7 @@ test("download codeql bundle cache explicitly requested with pinned different ve
 
     await codeql.setupCodeQL(
       "https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz",
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -75,8 +78,7 @@ test("download codeql bundle cache explicitly requested with pinned different ve
 
     await codeql.setupCodeQL(
       "https://example.com/download/codeql-bundle-20200610/codeql-bundle.tar.gz",
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -98,8 +100,7 @@ test("don't download codeql bundle cache with pinned different version cached",
 
     await codeql.setupCodeQL(
       "https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz",
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -110,8 +111,7 @@ test("don't download codeql bundle cache with pinned different version cached",
 
     await codeql.setupCodeQL(
       undefined,
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -135,8 +135,7 @@ test("download codeql bundle cache with different version cached (not pinned)",
 
     await codeql.setupCodeQL(
       "https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz",
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -162,8 +161,7 @@ test("download codeql bundle cache with different version cached (not pinned)",
 
     await codeql.setupCodeQL(
       undefined,
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -187,8 +185,7 @@ test('download codeql bundle cache with pinned different version cached if "late
 
     await codeql.setupCodeQL(
       "https://example.com/download/codeql-bundle-20200601/codeql-bundle.tar.gz",
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -215,8 +212,7 @@ test('download codeql bundle cache with pinned different version cached if "late
 
     await codeql.setupCodeQL(
       "latest",
-      "token",
-      "https://github.com",
+      sampleApiDetails,
       tmpDir,
       tmpDir,
       "runner",
@@ -230,6 +226,15 @@ test('download codeql bundle cache with pinned different version cached if "late
 });
 
 test("parse codeql bundle url version", (t) => {
+  t.deepEqual(
+    codeql.getCodeQLURLVersion(
+      "https://github.com/.../codeql-bundle-20200601/..."
+    ),
+    "20200601"
+  );
+});
+
+test("convert to semver", (t) => {
   const tests = {
     "20200601": "0.0.0-20200601",
     "20200601.0": "0.0.0-20200601.0",
@@ -240,11 +245,9 @@ test("parse codeql bundle url version", (t) => {
   };
 
   for (const [version, expectedVersion] of Object.entries(tests)) {
-    const url = `https://github.com/.../codeql-bundle-${version}/...`;
-
     try {
-      const parsedVersion = codeql.getCodeQLURLVersion(
-        url,
+      const parsedVersion = codeql.convertToSemVer(
+        version,
         getRunnerLogger(true)
       );
       t.deepEqual(parsedVersion, expectedVersion);

src/codeql.ts

@@ -3,14 +3,14 @@ import * as path from "path";
 import * as stream from "stream";
 import * as globalutil from "util";
 
-import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as http from "@actions/http-client";
 import { IHeaders } from "@actions/http-client/interfaces";
 import * as toolcache from "@actions/tool-cache";
 import * as semver from "semver";
 import { v4 as uuidV4 } from "uuid";
 
-import { getRequiredEnvParam } from "./actions-util";
+import { isRunningLocalAction, getRelativeScriptPath } from "./actions-util";
 import * as api from "./api-client";
 import * as defaults from "./defaults.json"; // Referenced from codeql-action-sync-tool!
 import { errorMatchers } from "./error-matcher";
@@ -68,13 +68,13 @@ export interface CodeQL {
   runAutobuild(language: Language): Promise<void>;
   /**
    * Extract code for a scanned language using 'codeql database trace-command'
-   * and running the language extracter.
+   * and running the language extractor.
    */
   extractScannedLanguage(database: string, language: Language): Promise<void>;
   /**
    * Finalize a database using 'codeql database finalize'.
    */
-  finalizeDatabase(databasePath: string): Promise<void>;
+  finalizeDatabase(databasePath: string, threadsFlag: string): Promise<void>;
   /**
    * Run 'codeql resolve queries'.
    */
@@ -132,41 +132,44 @@ function getCodeQLBundleName(): string {
   return `codeql-bundle-${platform}.tar.gz`;
 }
 
-function getCodeQLActionRepository(mode: util.Mode): string {
+function getCodeQLActionRepository(mode: util.Mode, logger: Logger): string {
   if (mode !== "actions") {
     return CODEQL_DEFAULT_ACTION_REPOSITORY;
   }
 
-  // Actions do not know their own repository name,
-  // so we currently use this hack to find the name based on where our files are.
-  // This can be removed once the change to the runner in https://github.com/actions/runner/pull/585 is deployed.
-  const runnerTemp = getRequiredEnvParam("RUNNER_TEMP");
-  const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
-  const relativeScriptPath = path.relative(actionsDirectory, __filename);
-  // This handles the case where the Action does not come from an Action repository,
-  // e.g. our integration tests which use the Action code from the current checkout.
-  if (
-    relativeScriptPath.startsWith("..") ||
-    path.isAbsolute(relativeScriptPath)
-  ) {
+  if (process.env["GITHUB_ACTION_REPOSITORY"] !== undefined) {
+    return process.env["GITHUB_ACTION_REPOSITORY"];
+  }
+
+  // The Actions Runner used with GitHub Enterprise Server 2.22 did not set the GITHUB_ACTION_REPOSITORY variable.
+  // This fallback logic can be removed after the end-of-support for 2.22 on 2021-09-23.
+
+  if (isRunningLocalAction()) {
+    // This handles the case where the Action does not come from an Action repository,
+    // e.g. our integration tests which use the Action code from the current checkout.
+    logger.info(
+      "The CodeQL Action is checked out locally. Using the default CodeQL Action repository."
+    );
     return CODEQL_DEFAULT_ACTION_REPOSITORY;
   }
-  const relativeScriptPathParts = relativeScriptPath.split(path.sep);
+  logger.info(
+    "GITHUB_ACTION_REPOSITORY environment variable was not set. Falling back to legacy method of finding the GitHub Action."
+  );
+  const relativeScriptPathParts = getRelativeScriptPath().split(path.sep);
   return `${relativeScriptPathParts[0]}/${relativeScriptPathParts[1]}`;
 }
 
 async function getCodeQLBundleDownloadURL(
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiDetails,
   mode: util.Mode,
   logger: Logger
 ): Promise<string> {
-  const codeQLActionRepository = getCodeQLActionRepository(mode);
+  const codeQLActionRepository = getCodeQLActionRepository(mode, logger);
   const potentialDownloadSources = [
     // This GitHub instance, and this Action.
-    [githubUrl, codeQLActionRepository],
+    [apiDetails.url, codeQLActionRepository],
     // This GitHub instance, and the canonical Action.
-    [githubUrl, CODEQL_DEFAULT_ACTION_REPOSITORY],
+    [apiDetails.url, CODEQL_DEFAULT_ACTION_REPOSITORY],
     // GitHub.com, and the canonical Action.
     [util.GITHUB_DOTCOM_URL, CODEQL_DEFAULT_ACTION_REPOSITORY],
   ];
@@ -188,7 +191,7 @@ async function getCodeQLBundleDownloadURL(
     const [repositoryOwner, repositoryName] = repository.split("/");
     try {
       const release = await api
-        .getApiClient(githubAuth, githubUrl)
+        .getApiClient(apiDetails, mode, logger, false, true)
         .repos.getReleaseByTag({
           owner: repositoryOwner,
           repo: repositoryName,
@@ -236,13 +239,12 @@ async function toolcacheDownloadTool(
 
 export async function setupCodeQL(
   codeqlURL: string | undefined,
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiDetails,
   tempDir: string,
   toolsDir: string,
   mode: util.Mode,
   logger: Logger
-): Promise<CodeQL> {
+): Promise<{ codeql: CodeQL; toolsVersion: string }> {
   // Setting these two env vars makes the toolcache code safe to use outside,
   // of actions but this is obviously not a great thing we're doing and it would
   // be better to write our own implementation to use outside of actions.
@@ -258,12 +260,12 @@ export async function setupCodeQL(
     }
 
     const codeqlURLVersion = getCodeQLURLVersion(
-      codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`,
-      logger
+      codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`
     );
+    const codeqlURLSemVer = convertToSemVer(codeqlURLVersion, logger);
 
     // If we find the specified version, we always use that.
-    let codeqlFolder = toolcache.find("CodeQL", codeqlURLVersion);
+    let codeqlFolder = toolcache.find("CodeQL", codeqlURLSemVer);
 
     // If we don't find the requested version, in some cases we may allow a
     // different version to save download time if the version hasn't been
@@ -285,21 +287,16 @@ export async function setupCodeQL(
       logger.debug(`CodeQL found in cache ${codeqlFolder}`);
     } else {
       if (!codeqlURL) {
-        codeqlURL = await getCodeQLBundleDownloadURL(
-          githubAuth,
-          githubUrl,
-          mode,
-          logger
-        );
+        codeqlURL = await getCodeQLBundleDownloadURL(apiDetails, mode, logger);
       }
 
       const headers: IHeaders = { accept: "application/octet-stream" };
       // We only want to provide an authorization header if we are downloading
       // from the same GitHub instance the Action is running on.
       // This avoids leaking Enterprise tokens to dotcom.
-      if (codeqlURL.startsWith(`${githubUrl}/`)) {
+      if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
         logger.debug("Downloading CodeQL bundle with token.");
-        headers.authorization = `token ${githubAuth}`;
+        headers.authorization = `token ${apiDetails.auth}`;
       } else {
         logger.debug("Downloading CodeQL bundle without token.");
       }
@@ -318,7 +315,7 @@ export async function setupCodeQL(
       codeqlFolder = await toolcache.cacheDir(
         codeqlExtracted,
         "CodeQL",
-        codeqlURLVersion
+        codeqlURLSemVer
       );
     }
 
@@ -330,23 +327,24 @@ export async function setupCodeQL(
     }
 
     cachedCodeQL = getCodeQLForCmd(codeqlCmd);
-    return cachedCodeQL;
+    return { codeql: cachedCodeQL, toolsVersion: codeqlURLVersion };
   } catch (e) {
     logger.error(e);
     throw new Error("Unable to download and extract CodeQL CLI");
   }
 }
 
-export function getCodeQLURLVersion(url: string, logger: Logger): string {
+export function getCodeQLURLVersion(url: string): string {
   const match = url.match(/\/codeql-bundle-(.*)\//);
   if (match === null || match.length < 2) {
     throw new Error(
       `Malformed tools url: ${url}. Version could not be inferred`
     );
   }
+  return match[1];
+}
 
-  let version = match[1];
-
+export function convertToSemVer(version: string, logger: Logger): string {
   if (!semver.valid(version)) {
     logger.debug(
       `Bundle version ${version} is not in SemVer format. Will treat it as pre-release 0.0.0-${version}.`
@@ -356,9 +354,7 @@ export function getCodeQLURLVersion(url: string, logger: Logger): string {
 
   const s = semver.clean(version);
   if (!s) {
-    throw new Error(
-      `Malformed tools url ${url}. Version should be in SemVer format but have ${version} instead`
-    );
+    throw new Error(`Bundle version ${version} is not in SemVer format.`);
   }
 
   return s;
@@ -435,10 +431,7 @@ function getCodeQLForCmd(cmd: string): CodeQL {
       return cmd;
     },
     async printVersion() {
-      await new toolrunnner.ToolRunner(cmd, [
-        "version",
-        "--format=json",
-      ]).exec();
+      await new toolrunner.ToolRunner(cmd, ["version", "--format=json"]).exec();
     },
     async getTracerEnv(databasePath: string) {
       // Write tracer-env.js to a temp location.
@@ -465,7 +458,7 @@ function getCodeQLForCmd(cmd: string): CodeQL {
       );
 
       const envFile = path.resolve(databasePath, "working", "env.tmp");
-      await new toolrunnner.ToolRunner(cmd, [
+      await new toolrunner.ToolRunner(cmd, [
         "database",
         "trace-command",
         databasePath,
@@ -481,7 +474,7 @@ function getCodeQLForCmd(cmd: string): CodeQL {
       language: Language,
       sourceRoot: string
     ) {
-      await new toolrunnner.ToolRunner(cmd, [
+      await new toolrunner.ToolRunner(cmd, [
         "database",
         "init",
         databasePath,
@@ -512,12 +505,12 @@ function getCodeQLForCmd(cmd: string): CodeQL {
         "-Dmaven.wagon.http.pool=false",
       ].join(" ");
 
-      await new toolrunnner.ToolRunner(autobuildCmd).exec();
+      await new toolrunner.ToolRunner(autobuildCmd).exec();
     },
     async extractScannedLanguage(databasePath: string, language: Language) {
       // Get extractor location
       let extractorPath = "";
-      await new toolrunnner.ToolRunner(
+      await new toolrunner.ToolRunner(
         cmd,
         [
           "resolve",
@@ -561,12 +554,13 @@ function getCodeQLForCmd(cmd: string): CodeQL {
         errorMatchers
       );
     },
-    async finalizeDatabase(databasePath: string) {
+    async finalizeDatabase(databasePath: string, threadsFlag: string) {
       await toolrunnerErrorCatcher(
         cmd,
         [
           "database",
           "finalize",
+          threadsFlag,
           ...getExtraOptionsFromEnv(["database", "finalize"]),
           databasePath,
         ],
@@ -588,7 +582,7 @@ function getCodeQLForCmd(cmd: string): CodeQL {
         codeqlArgs.push("--search-path", extraSearchPath);
       }
       let output = "";
-      await new toolrunnner.ToolRunner(cmd, codeqlArgs, {
+      await new toolrunner.ToolRunner(cmd, codeqlArgs, {
         listeners: {
           stdout: (data: Buffer) => {
             output += data.toString();
@@ -606,13 +600,15 @@ function getCodeQLForCmd(cmd: string): CodeQL {
       addSnippetsFlag: string,
       threadsFlag: string
     ) {
-      await new toolrunnner.ToolRunner(cmd, [
+      await new toolrunner.ToolRunner(cmd, [
         "database",
         "analyze",
         memoryFlag,
         threadsFlag,
         databasePath,
+        "--min-disk-free=1024", // Try to leave at least 1GB free
         "--format=sarif-latest",
+        "--sarif-multicause-markdown",
         `--output=${sarifFile}`,
         addSnippetsFlag,
         ...getExtraOptionsFromEnv(["database", "analyze"]),
@@ -625,9 +621,36 @@ function getCodeQLForCmd(cmd: string): CodeQL {
 /**
  * Gets the options for `path` of `options` as an array of extra option strings.
  */
-function getExtraOptionsFromEnv(path: string[]) {
+function getExtraOptionsFromEnv(paths: string[]) {
   const options: ExtraOptions = util.getExtraOptionsEnvParam();
-  return getExtraOptions(options, path, []);
+  return getExtraOptions(options, paths, []);
+}
+
+/**
+ * Gets `options` as an array of extra option strings.
+ *
+ * - throws an exception mentioning `pathInfo` if this conversion is impossible.
+ */
+function asExtraOptions(options: any, pathInfo: string[]): string[] {
+  if (options === undefined) {
+    return [];
+  }
+  if (!Array.isArray(options)) {
+    const msg = `The extra options for '${pathInfo.join(
+      "."
+    )}' ('${JSON.stringify(options)}') are not in an array.`;
+    throw new Error(msg);
+  }
+  return options.map((o) => {
+    const t = typeof o;
+    if (t !== "string" && t !== "number" && t !== "boolean") {
+      const msg = `The extra option for '${pathInfo.join(
+        "."
+      )}' ('${JSON.stringify(o)}') is not a primitive value.`;
+      throw new Error(msg);
+    }
+    return `${o}`;
+  });
 }
 
 /**
@@ -640,43 +663,17 @@ function getExtraOptionsFromEnv(path: string[]) {
  */
 export function getExtraOptions(
   options: any,
-  path: string[],
+  paths: string[],
   pathInfo: string[]
 ): string[] {
-  /**
-   * Gets `options` as an array of extra option strings.
-   *
-   * - throws an exception mentioning `pathInfo` if this conversion is impossible.
-   */
-  function asExtraOptions(options: any, pathInfo: string[]): string[] {
-    if (options === undefined) {
-      return [];
-    }
-    if (!Array.isArray(options)) {
-      const msg = `The extra options for '${pathInfo.join(
-        "."
-      )}' ('${JSON.stringify(options)}') are not in an array.`;
-      throw new Error(msg);
-    }
-    return options.map((o) => {
-      const t = typeof o;
-      if (t !== "string" && t !== "number" && t !== "boolean") {
-        const msg = `The extra option for '${pathInfo.join(
-          "."
-        )}' ('${JSON.stringify(o)}') is not a primitive value.`;
-        throw new Error(msg);
-      }
-      return `${o}`;
-    });
-  }
   const all = asExtraOptions(options?.["*"], pathInfo.concat("*"));
   const specific =
-    path.length === 0
+    paths.length === 0
       ? asExtraOptions(options, pathInfo)
       : getExtraOptions(
-          options?.[path[0]],
-          path?.slice(1),
-          pathInfo.concat(path[0])
+          options?.[paths[0]],
+          paths?.slice(1),
+          pathInfo.concat(paths[0])
         );
   return all.concat(specific);
 }

src/config-utils.test.ts

@@ -15,6 +15,11 @@ import * as util from "./util";
 
 setupTests(test);
 
+const sampleApiDetails = {
+  auth: "token",
+  url: "https://github.example.com",
+};
+
 // Returns the filepath of the newly-created file
 function createConfigFile(inputFileContents: string, tmpDir: string): string {
   const configFilePath = path.join(tmpDir, "input");
@@ -76,8 +81,8 @@ test("load empty config", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       logger
     );
 
@@ -91,8 +96,8 @@ test("load empty config", async (t) => {
         tmpDir,
         codeQL,
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         logger
       )
     );
@@ -128,8 +133,8 @@ test("loading config saves config", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       logger
     );
 
@@ -154,8 +159,8 @@ test("load input outside of workspace", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -187,8 +192,8 @@ test("load non-local input with invalid repo syntax", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -221,8 +226,8 @@ test("load non-existent input", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -305,8 +310,8 @@ test("load non-empty input", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
 
@@ -347,7 +352,7 @@ test("Default queries are used", async (t) => {
 
     // The important point of this config is that it doesn't specify
     // the disable-default-queries field.
-    // Any other details are hopefully irrelevant for this tetst.
+    // Any other details are hopefully irrelevant for this test.
     const inputFileContents = `
       paths:
         - foo`;
@@ -366,8 +371,8 @@ test("Default queries are used", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
 
@@ -435,8 +440,8 @@ test("Queries can be specified in config file", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
 
@@ -468,7 +473,7 @@ test("Queries from config file can be overridden in workflow file", async (t) =>
     const configFilePath = createConfigFile(inputFileContents, tmpDir);
 
     // This config item should take precedence over the config file but shouldn't affect the default queries.
-    const queries = "./override";
+    const testQueries = "./override";
 
     fs.mkdirSync(path.join(tmpDir, "foo"));
     fs.mkdirSync(path.join(tmpDir, "override"));
@@ -491,15 +496,15 @@ test("Queries from config file can be overridden in workflow file", async (t) =>
 
     const config = await configUtils.initConfig(
       languages,
-      queries,
+      testQueries,
       configFilePath,
       { owner: "github", repo: "example " },
       tmpDir,
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
 
@@ -531,7 +536,7 @@ test("Queries in workflow file can be used in tandem with the 'disable default q
       disable-default-queries: true`;
     const configFilePath = createConfigFile(inputFileContents, tmpDir);
 
-    const queries = "./workflow-query";
+    const testQueries = "./workflow-query";
     fs.mkdirSync(path.join(tmpDir, "workflow-query"));
 
     const resolveQueriesArgs: Array<{
@@ -552,15 +557,15 @@ test("Queries in workflow file can be used in tandem with the 'disable default q
 
     const config = await configUtils.initConfig(
       languages,
-      queries,
+      testQueries,
       configFilePath,
       { owner: "github", repo: "example " },
       tmpDir,
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
 
@@ -583,7 +588,7 @@ test("Multiple queries can be specified in workflow file, no config file require
     fs.mkdirSync(path.join(tmpDir, "override1"));
     fs.mkdirSync(path.join(tmpDir, "override2"));
 
-    const queries = "./override1,./override2";
+    const testQueries = "./override1,./override2";
 
     const resolveQueriesArgs: Array<{
       queries: string[];
@@ -603,15 +608,15 @@ test("Multiple queries can be specified in workflow file, no config file require
 
     const config = await configUtils.initConfig(
       languages,
-      queries,
+      testQueries,
       undefined,
       { owner: "github", repo: "example " },
       tmpDir,
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
 
@@ -648,7 +653,7 @@ test("Queries in workflow file can be added to the set of queries without overri
     const configFilePath = createConfigFile(inputFileContents, tmpDir);
 
     // These queries shouldn't override anything, because the value is prefixed with "+"
-    const queries = "+./additional1,./additional2";
+    const testQueries = "+./additional1,./additional2";
 
     fs.mkdirSync(path.join(tmpDir, "foo"));
     fs.mkdirSync(path.join(tmpDir, "additional1"));
@@ -672,15 +677,15 @@ test("Queries in workflow file can be added to the set of queries without overri
 
     const config = await configUtils.initConfig(
       languages,
-      queries,
+      testQueries,
       configFilePath,
       { owner: "github", repo: "example " },
       tmpDir,
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
 
@@ -741,8 +746,8 @@ test("Invalid queries in workflow file handled correctly", async (t) => {
         tmpDir,
         codeQL,
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       t.fail("initConfig did not throw error");
@@ -803,8 +808,8 @@ test("API client used when reading remote config", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
-      "token",
-      "https://github.example.com",
+      sampleApiDetails,
+      "runner",
       getRunnerLogger(true)
     );
     t.assert(spyGetContents.called);
@@ -827,8 +832,8 @@ test("Remote config handles the case where a directory is provided", async (t) =
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -859,8 +864,8 @@ test("Invalid format of remote config handled correctly", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -887,8 +892,8 @@ test("No detected languages", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -912,8 +917,8 @@ test("Unknown languages", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
-        "token",
-        "https://github.example.com",
+        sampleApiDetails,
+        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -958,8 +963,8 @@ function doInvalidInputTest(
           tmpDir,
           codeQL,
           tmpDir,
-          "token",
-          "https://github.example.com",
+          sampleApiDetails,
+          "runner",
           getRunnerLogger(true)
         );
         throw new Error("initConfig did not throw error");
@@ -1070,20 +1075,20 @@ test("path validations", (t) => {
   const propertyName = "paths";
   const configFile = "./.github/codeql/config.yml";
 
-  for (const path of validPaths) {
+  for (const validPath of validPaths) {
     t.truthy(
       configUtils.validateAndSanitisePath(
-        path,
+        validPath,
         propertyName,
         configFile,
         getRunnerLogger(true)
       )
     );
   }
-  for (const path of invalidPaths) {
+  for (const invalidPath of invalidPaths) {
     t.throws(() =>
       configUtils.validateAndSanitisePath(
-        path,
+        invalidPath,
         propertyName,
         configFile,
         getRunnerLogger(true)

src/config-utils.ts

@@ -9,6 +9,7 @@ import * as externalQueries from "./external-queries";
 import { Language, parseLanguage } from "./languages";
 import { Logger } from "./logging";
 import { RepositoryNwo } from "./repository";
+import { Mode } from "./util";
 
 // Property names from the user-supplied config file.
 const NAME_PROPERTY = "name";
@@ -215,8 +216,8 @@ async function addBuiltinSuiteQueries(
   suiteName: string,
   configFile?: string
 ) {
-  const suite = builtinSuites.find((suite) => suite === suiteName);
-  if (!suite) {
+  const found = builtinSuites.find((suite) => suite === suiteName);
+  if (!found) {
     throw new Error(getQueryUsesInvalid(configFile, suiteName));
   }
 
@@ -387,20 +388,20 @@ export function validateAndSanitisePath(
   logger: Logger
 ): string {
   // Take a copy so we don't modify the original path, so we can still construct error messages
-  let path = originalPath;
+  let newPath = originalPath;
 
   // All paths are relative to the src root, so strip off leading slashes.
-  while (path.charAt(0) === "/") {
-    path = path.substring(1);
+  while (newPath.charAt(0) === "/") {
+    newPath = newPath.substring(1);
   }
 
   // Trailing ** are redundant, so strip them off
-  if (path.endsWith("/**")) {
-    path = path.substring(0, path.length - 2);
+  if (newPath.endsWith("/**")) {
+    newPath = newPath.substring(0, newPath.length - 2);
   }
 
   // An empty path is not allowed as it's meaningless
-  if (path === "") {
+  if (newPath === "") {
     throw new Error(
       getConfigFilePropertyError(
         configFile,
@@ -412,20 +413,20 @@ export function validateAndSanitisePath(
   }
 
   // Check for illegal uses of **
-  if (path.match(pathStarsRegex)) {
+  if (newPath.match(pathStarsRegex)) {
     throw new Error(
       getConfigFilePropertyError(
         configFile,
         propertyName,
         `"${originalPath}" contains an invalid "**" wildcard. ` +
-          `They must be immediately preceeded and followed by a slash as in "/**/", or come at the start or end.`
+          `They must be immediately preceded and followed by a slash as in "/**/", or come at the start or end.`
       )
     );
   }
 
   // Check for other regex characters that we don't support.
   // Output a warning so the user knows, but otherwise continue normally.
-  if (path.match(filterPatternCharactersRegex)) {
+  if (newPath.match(filterPatternCharactersRegex)) {
     logger.warning(
       getConfigFilePropertyError(
         configFile,
@@ -439,7 +440,7 @@ export function validateAndSanitisePath(
   // Ban any uses of backslash for now.
   // This may not play nicely with project layouts.
   // This restriction can be lifted later if we determine they are ok.
-  if (path.indexOf("\\") !== -1) {
+  if (newPath.indexOf("\\") !== -1) {
     throw new Error(
       getConfigFilePropertyError(
         configFile,
@@ -450,7 +451,7 @@ export function validateAndSanitisePath(
     );
   }
 
-  return path;
+  return newPath;
 }
 
 // An undefined configFile in some of these functions indicates that
@@ -590,13 +591,13 @@ export function getUnknownLanguagesError(languages: string[]): string {
  */
 async function getLanguagesInRepo(
   repository: RepositoryNwo,
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiDetails,
+  mode: Mode,
   logger: Logger
 ): Promise<Language[]> {
   logger.debug(`GitHub repo ${repository.owner} ${repository.repo}`);
   const response = await api
-    .getApiClient(githubAuth, githubUrl, true)
+    .getApiClient(apiDetails, mode, logger, true)
     .repos.listLanguages({
       owner: repository.owner,
       repo: repository.repo,
@@ -631,8 +632,8 @@ async function getLanguagesInRepo(
 async function getLanguages(
   languagesInput: string | undefined,
   repository: RepositoryNwo,
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiDetails,
+  mode: Mode,
   logger: Logger
 ): Promise<Language[]> {
   // Obtain from action input 'languages' if set
@@ -644,12 +645,7 @@ async function getLanguages(
 
   if (languages.length === 0) {
     // Obtain languages as all languages in the repo that can be analysed
-    languages = await getLanguagesInRepo(
-      repository,
-      githubAuth,
-      githubUrl,
-      logger
-    );
+    languages = await getLanguagesInRepo(repository, apiDetails, mode, logger);
     logger.info(
       `Automatically detected languages: ${JSON.stringify(languages)}`
     );
@@ -730,15 +726,15 @@ export async function getDefaultConfig(
   toolCacheDir: string,
   codeQL: CodeQL,
   checkoutPath: string,
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiDetails,
+  mode: Mode,
   logger: Logger
 ): Promise<Config> {
   const languages = await getLanguages(
     languagesInput,
     repository,
-    githubAuth,
-    githubUrl,
+    apiDetails,
+    mode,
     logger
   );
   const queries: Queries = {};
@@ -751,7 +747,7 @@ export async function getDefaultConfig(
       queries,
       tempDir,
       checkoutPath,
-      githubUrl,
+      apiDetails.url,
       logger
     );
   }
@@ -780,8 +776,8 @@ async function loadConfig(
   toolCacheDir: string,
   codeQL: CodeQL,
   checkoutPath: string,
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiDetails,
+  mode: Mode,
   logger: Logger
 ): Promise<Config> {
   let parsedYAML: UserConfig;
@@ -791,7 +787,7 @@ async function loadConfig(
     configFile = path.resolve(checkoutPath, configFile);
     parsedYAML = getLocalConfig(configFile, checkoutPath);
   } else {
-    parsedYAML = await getRemoteConfig(configFile, githubAuth, githubUrl);
+    parsedYAML = await getRemoteConfig(configFile, apiDetails, mode, logger);
   }
 
   // Validate that the 'name' property is syntactically correct,
@@ -808,8 +804,8 @@ async function loadConfig(
   const languages = await getLanguages(
     languagesInput,
     repository,
-    githubAuth,
-    githubUrl,
+    apiDetails,
+    mode,
     logger
   );
 
@@ -840,7 +836,7 @@ async function loadConfig(
       queries,
       tempDir,
       checkoutPath,
-      githubUrl,
+      apiDetails.url,
       logger
     );
   }
@@ -865,7 +861,7 @@ async function loadConfig(
         query[QUERIES_USES_PROPERTY],
         tempDir,
         checkoutPath,
-        githubUrl,
+        apiDetails.url,
         logger,
         configFile
       );
@@ -876,12 +872,17 @@ async function loadConfig(
     if (!(parsedYAML[PATHS_IGNORE_PROPERTY] instanceof Array)) {
       throw new Error(getPathsIgnoreInvalid(configFile));
     }
-    for (const path of parsedYAML[PATHS_IGNORE_PROPERTY]!) {
-      if (typeof path !== "string" || path === "") {
+    for (const ignorePath of parsedYAML[PATHS_IGNORE_PROPERTY]!) {
+      if (typeof ignorePath !== "string" || ignorePath === "") {
         throw new Error(getPathsIgnoreInvalid(configFile));
       }
       pathsIgnore.push(
-        validateAndSanitisePath(path, PATHS_IGNORE_PROPERTY, configFile, logger)
+        validateAndSanitisePath(
+          ignorePath,
+          PATHS_IGNORE_PROPERTY,
+          configFile,
+          logger
+        )
       );
     }
   }
@@ -890,12 +891,12 @@ async function loadConfig(
     if (!(parsedYAML[PATHS_PROPERTY] instanceof Array)) {
       throw new Error(getPathsInvalid(configFile));
     }
-    for (const path of parsedYAML[PATHS_PROPERTY]!) {
-      if (typeof path !== "string" || path === "") {
+    for (const includePath of parsedYAML[PATHS_PROPERTY]!) {
+      if (typeof includePath !== "string" || includePath === "") {
         throw new Error(getPathsInvalid(configFile));
       }
       paths.push(
-        validateAndSanitisePath(path, PATHS_PROPERTY, configFile, logger)
+        validateAndSanitisePath(includePath, PATHS_PROPERTY, configFile, logger)
       );
     }
   }
@@ -942,8 +943,8 @@ export async function initConfig(
   toolCacheDir: string,
   codeQL: CodeQL,
   checkoutPath: string,
-  githubAuth: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiDetails,
+  mode: Mode,
   logger: Logger
 ): Promise<Config> {
   let config: Config;
@@ -959,8 +960,8 @@ export async function initConfig(
       toolCacheDir,
       codeQL,
       checkoutPath,
-      githubAuth,
-      githubUrl,
+      apiDetails,
+      mode,
       logger
     );
   } else {
@@ -973,8 +974,8 @@ export async function initConfig(
       toolCacheDir,
       codeQL,
       checkoutPath,
-      githubAuth,
-      githubUrl,
+      apiDetails,
+      mode,
       logger
     );
   }
@@ -1009,8 +1010,9 @@ function getLocalConfig(configFile: string, checkoutPath: string): UserConfig {
 
 async function getRemoteConfig(
   configFile: string,
-  githubAuth: string,
-  githubUrl: string
+  apiDetails: api.GitHubApiDetails,
+  mode: Mode,
+  logger: Logger
 ): Promise<UserConfig> {
   // retrieve the various parts of the config location, and ensure they're present
   const format = new RegExp(
@@ -1023,7 +1025,7 @@ async function getRemoteConfig(
   }
 
   const response = await api
-    .getApiClient(githubAuth, githubUrl, true)
+    .getApiClient(apiDetails, mode, logger, true)
     .repos.getContent({
       owner: pieces.groups.owner,
       repo: pieces.groups.repo,

src/defaults.json

@@ -1,3 +1,3 @@
 {
-	"bundleVersion": "codeql-bundle-20201008"
+	"bundleVersion": "codeql-bundle-20201106"
 }

src/external-queries.test.ts

@@ -1,7 +1,8 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as toolrunner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
 import test from "ava";
 
 import * as externalQueries from "./external-queries";
@@ -36,17 +37,21 @@ test("checkoutExternalQueries", async (t) => {
       ];
       console.log(`Running: git ${command.join(" ")}`);
       try {
-        await new toolrunnner.ToolRunner("git", command, {
-          silent: true,
-          listeners: {
-            stdout: (data) => {
-              stdout += data.toString();
+        await new toolrunner.ToolRunner(
+          await safeWhich.safeWhich("git"),
+          command,
+          {
+            silent: true,
+            listeners: {
+              stdout: (data) => {
+                stdout += data.toString();
+              },
+              stderr: (data) => {
+                stderr += data.toString();
+              },
             },
-            stderr: (data) => {
-              stderr += data.toString();
-            },
-          },
-        }).exec();
+          }
+        ).exec();
       } catch (e) {
         console.log(`Command failed: git ${command.join(" ")}`);
         process.stderr.write(stderr);
@@ -59,6 +64,7 @@ test("checkoutExternalQueries", async (t) => {
     await runGit(["init", repoPath]);
     await runGit(["config", "user.email", "test@github.com"]);
     await runGit(["config", "user.name", "Test Test"]);
+    await runGit(["config", "commit.gpgsign", "false"]);
 
     fs.writeFileSync(path.join(repoPath, "a"), "a content");
     await runGit(["add", "a"]);

src/external-queries.ts

@@ -1,7 +1,8 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as toolrunner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
 
 import { Logger } from "./logging";
 
@@ -28,12 +29,12 @@ export async function checkoutExternalRepository(
 
   if (!fs.existsSync(checkoutLocation)) {
     const repoURL = `${githubUrl}/${repository}`;
-    await new toolrunnner.ToolRunner("git", [
+    await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
       "clone",
       repoURL,
       checkoutLocation,
     ]).exec();
-    await new toolrunnner.ToolRunner("git", [
+    await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
       `--work-tree=${checkoutLocation}`,
       `--git-dir=${checkoutLocation}/.git`,
       "checkout",

src/fingerprints.test.ts

@@ -106,7 +106,9 @@ test("hash", (t: ava.Assertions) => {
 
 function testResolveUriToFile(uri: any, index: any, artifactsURIs: any[]) {
   const location = { uri, index };
-  const artifacts = artifactsURIs.map((uri) => ({ location: { uri } }));
+  const artifacts = artifactsURIs.map((artifactURI) => ({
+    location: { uri: artifactURI },
+  }));
   return fingerprints.resolveUriToFile(
     location,
     artifacts,
@@ -123,16 +125,16 @@ test("resolveUriToFile", (t) => {
   const cwd = process.cwd();
   const filepath = __filename;
   t.true(filepath.startsWith(`${cwd}/`));
-  const relativeFilepaht = filepath.substring(cwd.length + 1);
+  const relativeFilepath = filepath.substring(cwd.length + 1);
 
   // Absolute paths are unmodified
   t.is(testResolveUriToFile(filepath, undefined, []), filepath);
   t.is(testResolveUriToFile(`file://${filepath}`, undefined, []), filepath);
 
   // Relative paths are made absolute
-  t.is(testResolveUriToFile(relativeFilepaht, undefined, []), filepath);
+  t.is(testResolveUriToFile(relativeFilepath, undefined, []), filepath);
   t.is(
-    testResolveUriToFile(`file://${relativeFilepaht}`, undefined, []),
+    testResolveUriToFile(`file://${relativeFilepath}`, undefined, []),
     filepath
   );
 
@@ -151,7 +153,7 @@ test("resolveUriToFile", (t) => {
   t.is(testResolveUriToFile(1, undefined, []), undefined);
   t.is(testResolveUriToFile(undefined, undefined, []), undefined);
 
-  // Non-existant files are discarded
+  // Non-existent files are discarded
   t.is(testResolveUriToFile(`${filepath}2`, undefined, []), undefined);
 
   // Index is resolved

src/fingerprints.ts

@@ -46,7 +46,7 @@ export function hash(callback: hashCallback, input: string) {
   const lineNumbers = Array(BLOCK_SIZE).fill(-1);
 
   // The current hash value, updated as we read each character
-  let hash = Long.ZERO;
+  let hashRaw = Long.ZERO;
   const firstMod = computeFirstMod();
 
   // The current index in the window, will wrap around to zero when we reach BLOCK_SIZE
@@ -63,7 +63,7 @@ export function hash(callback: hashCallback, input: string) {
 
   // Output the current hash and line number to the callback function
   const outputHash = function () {
-    const hashValue = hash.toUnsigned().toString(16);
+    const hashValue = hashRaw.toUnsigned().toString(16);
     if (!hashCounts[hashValue]) {
       hashCounts[hashValue] = 0;
     }
@@ -76,7 +76,7 @@ export function hash(callback: hashCallback, input: string) {
   const updateHash = function (current: number) {
     const begin = window[index];
     window[index] = current;
-    hash = MOD.multiply(hash)
+    hashRaw = MOD.multiply(hashRaw)
       .add(Long.fromInt(current))
       .subtract(firstMod.multiply(Long.fromInt(begin)));
 
@@ -125,7 +125,7 @@ export function hash(callback: hashCallback, input: string) {
 }
 
 // Generate a hash callback function that updates the given result in-place
-// when it recieves a hash for the correct line number. Ignores hashes for other lines.
+// when it receives a hash for the correct line number. Ignores hashes for other lines.
 function locationUpdateCallback(
   result: any,
   location: any,
@@ -138,7 +138,7 @@ function locationUpdateCallback(
     // using the hash of the first line of the file.
     locationStartLine = 1;
   }
-  return function (lineNumber: number, hash: string) {
+  return function (lineNumber: number, hashValue: string) {
     // Ignore hashes for lines that don't concern us
     if (locationStartLine !== lineNumber) {
       return;
@@ -153,10 +153,10 @@ function locationUpdateCallback(
     // If the hash doesn't match the existing fingerprint then
     // output a warning and don't overwrite it.
     if (!existingFingerprint) {
-      result.partialFingerprints.primaryLocationLineHash = hash;
-    } else if (existingFingerprint !== hash) {
+      result.partialFingerprints.primaryLocationLineHash = hashValue;
+    } else if (existingFingerprint !== hashValue) {
       logger.warning(
-        `Calculated fingerprint of ${hash} for file ${location.physicalLocation.artifactLocation.uri} line ${lineNumber}, but found existing inconsistent fingerprint value ${existingFingerprint}`
+        `Calculated fingerprint of ${hashValue} for file ${location.physicalLocation.artifactLocation.uri} line ${lineNumber}, but found existing inconsistent fingerprint value ${existingFingerprint}`
       );
     }
   };
@@ -279,9 +279,9 @@ export function addFingerprints(
   // Now hash each file that was found
   for (const [filepath, callbacks] of Object.entries(callbacksByFile)) {
     // A callback that forwards the hash to all other callbacks for that file
-    const teeCallback = function (lineNumber: number, hash: string) {
+    const teeCallback = function (lineNumber: number, hashValue: string) {
       for (const c of Object.values(callbacks)) {
-        c(lineNumber, hash);
+        c(lineNumber, hashValue);
       }
     };
     const fileContents = fs.readFileSync(filepath).toString();