Update error message with appropriate version

.eslintignore

@@ -1,4 +1,5 @@
 **/webpack.config.js
 lib/**
+runner/dist/**
 src/testdata/**
 tests/**

.github/check-codescanning-config/action.yml

@@ -42,8 +42,6 @@ runs:
         packs: ${{ inputs.packs }}
         tools: ${{ inputs.tools }}
         db-location: ${{ runner.temp }}/codescanning-config-cli-test
-      env:
-        CODEQL_ACTION_TEST_MODE: 'true'
 
     - name: Install dependencies
       shell: bash

.github/dependabot.yml

@@ -1,17 +1,20 @@
 version: 2
 updates:
-  - package-ecosystem: npm
+  - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: weekly
+      interval: "weekly"
+      day: "thursday" # Gives us a working day to merge this before our typical release
     labels:
-      - Update dependencies
+      - "Update dependencies"
     ignore:
       - dependency-name: "*"
-        update-types:
-          - version-update:semver-minor
-          - version-update:semver-patch
-  - package-ecosystem: github-actions
-    directory: "/"
+        update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+  - package-ecosystem: "npm"
+    directory: "/runner"
     schedule:
-      interval: weekly
+      interval: "weekly"
+      day: "thursday" # Gives us a working day to merge this before our typical release
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-minor", "version-update:semver-patch"]

.github/query-filter-test/action.yml

@@ -35,14 +35,14 @@ runs:
         tools: ${{ inputs.tools }}
         db-location: ${{ runner.temp }}/query-filter-test
       env:
-        CODEQL_ACTION_TEST_MODE: "true"
+        TEST_MODE: "true"
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
         upload-database: false
         upload: false
       env:
-        CODEQL_ACTION_TEST_MODE: "true"
+        TEST_MODE: "true"
     - name: Check SARIF
       uses: ./../action/.github/check-sarif
       with:

.github/setup-swift/action.yml

@@ -1,32 +0,0 @@
-name: "Set up Swift"
-description: Performs necessary steps to set up appropriate Swift version.
-inputs:
-  codeql-path:
-    required: true
-runs:
-  using: "composite"
-  steps:
-    - name: Get Swift version
-      id: get_swift_version
-      # We don't support Swift on Windows or prior versions of CLI.
-      if: "(runner.os != 'Windows') && (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
-      shell: bash
-      env: 
-        CODEQL_PATH: ${{inputs.codeql-path}}
-      run: |
-        if [ $RUNNER_OS = "macOS" ]; then
-          PLATFORM="osx64"
-        else # We do not run this step on Windows.
-          PLATFORM="linux64"
-        fi 
-        SWIFT_EXTRACTOR_DIR="$("$CODEQL_PATH" resolve languages --format json | jq -r '.swift[0]')"
-        VERSION="$("$SWIFT_EXTRACTOR_DIR/tools/$PLATFORM/extractor" --version | awk '/version/ { print $3 }')"
-        # Specify 5.7.0, otherwise setup Action will default to latest minor version. 
-        if [ $VERSION = "5.7" ]; then
-          VERSION="5.7.0"
-        fi
-        echo "version=$VERSION" | tee -a $GITHUB_OUTPUT
-    - uses: swift-actions/setup-swift@194625b58a582570f61cc707c3b558086c26b723
-      if: "(runner.os != 'Windows') && (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
-      with:
-        swift-version: "${{steps.get_swift_version.outputs.version}}"

.github/update-release-branch.py

@@ -5,7 +5,7 @@ import json
 import os
 import subprocess
 
-EMPTY_CHANGELOG = """# CodeQL Action Changelog
+EMPTY_CHANGELOG = """# CodeQL Action and CodeQL Runner Changelog
 
 ## [UNRELEASED]
 

.github/workflows/__analyze-ref-input.yml

@@ -7,7 +7,6 @@ name: "PR Check - Analyze: 'ref' and 'sha' from inputs"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -27,23 +26,23 @@ jobs:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: windows-2019
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
+          version: stable-20210319
         - os: windows-2019
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
+          version: stable-20210809
+        - os: windows-2019
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -73,17 +72,14 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
-      with:
-        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}
         languages: cpp,csharp,java,javascript,python
         config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
           github.sha }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
@@ -92,4 +88,6 @@ jobs:
         ref: refs/heads/main
         sha: 5e235361806c361d4d3f8859e3c897658025a9a2
       env:
-      CODEQL_ACTION_TEST_MODE: true
+        TEST_MODE: true
+    env:
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__autobuild-action.yml

@@ -7,7 +7,6 @@ name: PR Check - autobuild-action
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -47,6 +46,8 @@ jobs:
       with:
         languages: csharp
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - uses: ./../action/autobuild
       env:
       # Explicitly disable the CLR tracer.
@@ -57,6 +58,8 @@ jobs:
         CORECLR_PROFILER: ''
         CORECLR_PROFILER_PATH_64: ''
     - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
     - name: Check database
       shell: bash
       run: |
@@ -66,4 +69,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__export-file-baseline-information.yml

@@ -7,7 +7,6 @@ name: PR Check - Export file baseline information
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -44,15 +43,12 @@ jobs:
       with:
         version: ${{ matrix.version }}
     - uses: ./../action/init
-      id: init
       with:
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
       env:
         CODEQL_FILE_BASELINE_INFORMATION: true
-    - uses: ./../action/.github/setup-swift
-      with:
-        codeql-path: ${{steps.init.outputs.codeql-path}}
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
@@ -61,6 +57,7 @@ jobs:
         output: ${{ runner.temp }}/results
       env:
         CODEQL_FILE_BASELINE_INFORMATION: true
+        TEST_MODE: true
     - name: Upload SARIF
       uses: actions/upload-artifact@v3
       with:
@@ -71,7 +68,7 @@ jobs:
       shell: bash
       run: |
         cd "$RUNNER_TEMP/results"
-        expected_baseline_languages="cpp cs go java js py rb swift"
+        expected_baseline_languages="cpp csharp go java js python ruby"
 
         for lang in ${expected_baseline_languages}; do
           rule_name="${lang}/baseline/expected-extracted-files"
@@ -85,5 +82,4 @@ jobs:
           fi
         done
     env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: true # Remove when Swift is GA.
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__extractor-ram-threads.yml

@@ -7,7 +7,6 @@ name: PR Check - Extractor ram and threads options test
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -44,6 +43,8 @@ jobs:
         languages: java
         ram: 230
         threads: 1
+      env:
+        TEST_MODE: true
     - name: Assert Results
       shell: bash
       run: |
@@ -64,4 +65,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__go-custom-queries.yml

@@ -7,7 +7,6 @@ name: 'PR Check - Go: Custom queries'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -27,23 +26,23 @@ jobs:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: windows-2019
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
+          version: stable-20210319
         - os: windows-2019
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
+          version: stable-20210809
+        - os: windows-2019
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -73,9 +72,7 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
+    - uses: actions/setup-go@v3
       with:
         go-version: ^1.13.1
     - uses: ./../action/init
@@ -83,10 +80,14 @@ jobs:
         languages: go
         config-file: ./.github/codeql/custom-queries.yml
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
     env:
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__go-custom-tracing-autobuild.yml

@@ -3,11 +3,10 @@
 #     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with legacy workflow'
+name: 'PR Check - Go: Autobuild custom tracing'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -22,22 +21,22 @@ on:
     - ready_for_review
   workflow_dispatch: {}
 jobs:
-  go-tracing-legacy-workflow:
+  go-custom-tracing-autobuild:
     strategy:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -50,7 +49,7 @@ jobs:
           version: nightly-latest
         - os: macos-latest
           version: nightly-latest
-    name: 'Go: tracing with legacy workflow'
+    name: 'Go: Autobuild custom tracing'
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -61,16 +60,19 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
+    - uses: actions/setup-go@v3
       with:
         go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: go
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
+    - uses: ./../action/autobuild
     - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
     - shell: bash
       run: |
         cd "$RUNNER_TEMP/codeql_databases"
@@ -79,5 +81,6 @@ jobs:
           exit 1
         fi
     env:
+      CODEQL_EXTRACTOR_GO_BUILD_TRACING: on
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__go-custom-tracing.yml

@@ -0,0 +1,92 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pip install ruamel.yaml && python3 sync.py
+# to regenerate this file.
+
+name: 'PR Check - Go: Custom tracing'
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+    - main
+    - releases/v1
+    - releases/v2
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
+  workflow_dispatch: {}
+jobs:
+  go-custom-tracing:
+    strategy:
+      matrix:
+        include:
+        - os: ubuntu-20.04
+          version: stable-20210308
+        - os: macos-latest
+          version: stable-20210308
+        - os: windows-2019
+          version: stable-20210308
+        - os: ubuntu-20.04
+          version: stable-20210319
+        - os: macos-latest
+          version: stable-20210319
+        - os: windows-2019
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
+        - os: macos-latest
+          version: stable-20210809
+        - os: windows-2019
+          version: stable-20210809
+        - os: ubuntu-latest
+          version: cached
+        - os: macos-latest
+          version: cached
+        - os: windows-latest
+          version: cached
+        - os: ubuntu-latest
+          version: latest
+        - os: macos-latest
+          version: latest
+        - os: windows-latest
+          version: latest
+        - os: ubuntu-latest
+          version: nightly-latest
+        - os: macos-latest
+          version: nightly-latest
+        - os: windows-latest
+          version: nightly-latest
+    name: 'Go: Custom tracing'
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v3
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/prepare-test
+      with:
+        version: ${{ matrix.version }}
+    - uses: actions/setup-go@v3
+      with:
+        go-version: ^1.13.1
+    - uses: ./../action/init
+      with:
+        languages: go
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
+    - name: Build code
+      shell: bash
+      run: go build main.go
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+    env:
+      CODEQL_EXTRACTOR_GO_BUILD_TRACING: on
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__go-reconciled-tracing-autobuilder.yml

@@ -3,11 +3,10 @@
 #     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with autobuilder step'
+name: 'PR Check - Go: Reconciled tracing with autobuilder'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -22,22 +21,22 @@ on:
     - ready_for_review
   workflow_dispatch: {}
 jobs:
-  go-tracing-autobuilder:
+  go-reconciled-tracing-autobuilder:
     strategy:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -50,7 +49,7 @@ jobs:
           version: nightly-latest
         - os: macos-latest
           version: nightly-latest
-    name: 'Go: tracing with autobuilder step'
+    name: 'Go: Reconciled tracing with autobuilder'
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -61,17 +60,19 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
+    - uses: actions/setup-go@v3
       with:
         go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: go
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - uses: ./../action/autobuild
     - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
     - shell: bash
       run: |
         if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then
@@ -85,5 +86,6 @@ jobs:
           exit 1
         fi
     env:
+      CODEQL_ACTION_RECONCILE_GO_EXTRACTION: 'true'
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__go-reconciled-tracing-custom-build-steps.yml

@@ -3,11 +3,10 @@
 #     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
-name: 'PR Check - Go: tracing with custom build steps'
+name: 'PR Check - Go: Reconciled tracing with custom build steps'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -22,35 +21,47 @@ on:
     - ready_for_review
   workflow_dispatch: {}
 jobs:
-  go-tracing-custom-build-steps:
+  go-reconciled-tracing-custom-build-steps:
     strategy:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
+        - os: windows-2019
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: windows-2019
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
+          version: stable-20210809
+        - os: windows-2019
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
           version: cached
+        - os: windows-latest
+          version: cached
         - os: ubuntu-latest
           version: latest
         - os: macos-latest
           version: latest
+        - os: windows-latest
+          version: latest
         - os: ubuntu-latest
           version: nightly-latest
         - os: macos-latest
           version: nightly-latest
-    name: 'Go: tracing with custom build steps'
+        - os: windows-latest
+          version: nightly-latest
+    name: 'Go: Reconciled tracing with custom build steps'
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -61,19 +72,21 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
+    - uses: actions/setup-go@v3
       with:
         go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: go
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: go build main.go
     - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
     - shell: bash
       run: |
         # Once we start running Bash 4.2 in all environments, we can replace the
@@ -90,4 +103,6 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+  # Enable reconciled Go tracing beta functionality
+      CODEQL_ACTION_RECONCILE_GO_EXTRACTION: 'true'
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__go-reconciled-tracing-legacy-workflow.yml

@@ -3,11 +3,10 @@
 #     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
-name: PR Check - Swift analysis using a custom build command
+name: 'PR Check - Go: Reconciled tracing with legacy workflow'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -22,23 +21,35 @@ on:
     - ready_for_review
   workflow_dispatch: {}
 jobs:
-  swift-custom-build:
+  go-reconciled-tracing-legacy-workflow:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: latest
+        - os: ubuntu-20.04
+          version: stable-20210308
         - os: macos-latest
-          version: latest
+          version: stable-20210308
+        - os: ubuntu-20.04
+          version: stable-20210319
+        - os: macos-latest
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
+        - os: macos-latest
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
           version: cached
+        - os: ubuntu-latest
+          version: latest
+        - os: macos-latest
+          version: latest
         - os: ubuntu-latest
           version: nightly-latest
         - os: macos-latest
           version: nightly-latest
-    name: Swift analysis using a custom build command
+    name: 'Go: Reconciled tracing with legacy workflow'
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -49,31 +60,27 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
+    - uses: actions/setup-go@v3
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
-      id: init
       with:
-        languages: swift
+        languages: go
         tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - uses: ./../action/.github/setup-swift
-      with:
-        codeql-path: ${{steps.init.outputs.codeql-path}}
-    - name: Check working directory
-      shell: bash
-      run: pwd
-    - name: Build code
-      shell: bash
-      run: ./build.sh
+      env:
+        TEST_MODE: true
     - uses: ./../action/analyze
-      id: analysis
-    - name: Check database
-      shell: bash
+      env:
+        TEST_MODE: true
+    - shell: bash
       run: |
-        SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
-        if [[ ! -d "$SWIFT_DB" ]]; then
-          echo "Did not create a database for Swift."
+        cd "$RUNNER_TEMP/codeql_databases"
+        if [[ ! -d go ]]; then
+          echo "Did not find a Go database"
           exit 1
         fi
     env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
+  # Enable reconciled Go tracing beta functionality
+      CODEQL_ACTION_RECONCILE_GO_EXTRACTION: 'true'
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__init-with-registries.yml

@@ -7,7 +7,6 @@ name: 'PR Check - Packaging: Download using registries'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -55,6 +54,8 @@ jobs:
             packages: "*/*"
             token: "${{ secrets.GITHUB_TOKEN }}"
 
+      env:
+        TEST_MODE: true
     - name: Verify packages installed
       shell: bash
       run: |
@@ -77,4 +78,4 @@ jobs:
             exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__javascript-source-root.yml

@@ -7,7 +7,6 @@ name: PR Check - Custom source root
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -53,6 +52,8 @@ jobs:
         languages: javascript
         source-root: ../new-source-root
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - uses: ./../action/analyze
       with:
         skip-queries: true
@@ -66,4 +67,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__ml-powered-queries.yml

@@ -7,7 +7,6 @@ name: PR Check - ML-powered queries
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -26,11 +25,11 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-20.04
+        - os: ubuntu-latest
           version: stable-20220120
         - os: macos-latest
           version: stable-20220120
-        - os: windows-2019
+        - os: windows-latest
           version: stable-20220120
         - os: ubuntu-latest
           version: cached
@@ -61,22 +60,21 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
-      with:
-        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: javascript
         queries: security-extended
         source-root: ./../action/tests/ml-powered-queries-repo
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
 
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
         upload-database: false
+      env:
+        TEST_MODE: true
 
     - name: Upload SARIF
       uses: actions/upload-artifact@v3
@@ -87,18 +85,24 @@ jobs:
 
     - name: Check sarif
       uses: ./../action/.github/check-sarif
-    # Running on Windows requires CodeQL CLI 2.9.0+.
-      if: "!(matrix.version == 'stable-20220120' && runner.os == 'Windows')"
+      if: matrix.os != 'windows-latest' || matrix.version == 'latest' || matrix.version
+        == 'nightly-latest'
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
         queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
         queries-not-run: foo,bar
 
     - name: Check results
+    # Running ML-powered queries on Windows requires CodeQL CLI 2.9.0+. We don't run these checks
+    # against Windows and `cached` while CodeQL CLI 2.9.0 makes its way into `cached` to avoid the
+    # test starting to fail when the cached CodeQL Bundle gets updated. Once the CodeQL Bundle
+    # containing CodeQL CLI 2.9.0 has been fully released, we can drop this line and start running
+    # these checks on Windows and `cached`.
+      if: matrix.os != 'windows-latest' || matrix.version != 'cached'
       env:
-      # Running on Windows requires CodeQL CLI 2.9.0+.
-        SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220120' &&
-          runner.os == 'Windows') }}
+      # Running on Windows requires CodeQL CLI 2.9.0+, which has so far only made it to 'latest'.
+        SHOULD_RUN_ML_POWERED_QUERIES: ${{ matrix.os != 'windows-latest' || matrix.version
+          == 'latest' || matrix.version == 'nightly-latest' }}
       shell: bash
       run: |
         echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"
@@ -133,4 +137,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__multi-language-autodetect.yml

@@ -7,7 +7,6 @@ name: PR Check - Multi-language repository
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -27,17 +26,17 @@ jobs:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -61,30 +60,20 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
-      with:
-        go-version: ^1.13.1
     - uses: ./../action/init
-      id: init
       with:
         db-location: ${{ runner.temp }}/customDbLocation
         tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - uses: ./../action/.github/setup-swift
-      with:
-        codeql-path: ${{steps.init.outputs.codeql-path}}
-
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
-
     - uses: ./../action/analyze
       id: analysis
-
-    - name: Check language autodetect for all languages excluding Ruby, Swift
-      shell: bash
+      env:
+        TEST_MODE: true
+    - shell: bash
       run: |
         CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
         if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
@@ -116,28 +105,5 @@ jobs:
           echo "Did not create a database for Python, or created it in the wrong location."
           exit 1
         fi
-
-    - name: Check language autodetect for Ruby
-      if: (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version
-        == 'nightly-latest')
-      shell: bash
-      run: |
-        RUBY_DB=${{ fromJson(steps.analysis.outputs.db-locations).ruby }}
-        if [[ ! -d $RUBY_DB ]] || [[ ! $RUBY_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
-          echo "Did not create a database for Ruby, or created it in the wrong location."
-          exit 1
-        fi
-
-    - name: Check language autodetect for Swift
-      if: (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version
-        == 'nightly-latest')
-      shell: bash
-      run: |
-        SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
-        if [[ ! -d $SWIFT_DB ]] || [[ ! $SWIFT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
-          echo "Did not create a database for Swift, or created it in the wrong location."
-          exit 1
-        fi
     env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -7,7 +7,6 @@ name: 'PR Check - Packaging: Config and input passed to the CLI'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -61,12 +60,16 @@ jobs:
         packs: +dsp-testing/codeql-pack1@1.0.0
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
+      env:
+        TEST_MODE: true
 
     - name: Check results
       uses: ./../action/.github/check-sarif
@@ -92,4 +95,4 @@ jobs:
     env:
       CODEQL_PASS_CONFIG_TO_CLI: true
 
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__packaging-config-inputs-js.yml

@@ -7,7 +7,6 @@ name: 'PR Check - Packaging: Config and input'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -61,12 +60,16 @@ jobs:
         packs: +dsp-testing/codeql-pack1@1.0.0
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
+      env:
+        TEST_MODE: true
 
     - name: Check results
       uses: ./../action/.github/check-sarif
@@ -90,4 +93,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__packaging-config-js.yml

@@ -7,7 +7,6 @@ name: 'PR Check - Packaging: Config file'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -60,12 +59,16 @@ jobs:
         config-file: .github/codeql/codeql-config-packaging.yml
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
+      env:
+        TEST_MODE: true
 
     - name: Check results
       uses: ./../action/.github/check-sarif
@@ -89,4 +92,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__packaging-inputs-js.yml

@@ -7,7 +7,6 @@ name: 'PR Check - Packaging: Action input'
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -61,12 +60,16 @@ jobs:
         languages: javascript
         packs: dsp-testing/codeql-pack1@1.0.0, dsp-testing/codeql-pack2, dsp-testing/codeql-pack3:other-query.ql
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
+      env:
+        TEST_MODE: true
 
     - name: Check results
       uses: ./../action/.github/check-sarif
@@ -90,4 +93,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__remote-config.yml

@@ -7,7 +7,6 @@ name: PR Check - Remote config file
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -27,23 +26,23 @@ jobs:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: windows-2019
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
+          version: stable-20210319
         - os: windows-2019
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
+          version: stable-20210809
+        - os: windows-2019
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -73,20 +72,19 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
-      with:
-        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}
         languages: cpp,csharp,java,javascript,python
         config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
           github.sha }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
       env:
-      CODEQL_ACTION_TEST_MODE: true
+        TEST_MODE: true
+    env:
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__rubocop-multi-language.yml

@@ -7,7 +7,6 @@ name: PR Check - RuboCop multi-language
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -60,4 +59,6 @@ jobs:
       with:
         sarif_file: rubocop.sarif
       env:
-      CODEQL_ACTION_TEST_MODE: true
+        TEST_MODE: true
+    env:
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__split-workflow.yml

@@ -7,7 +7,6 @@ name: PR Check - Split workflow
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -55,6 +54,8 @@ jobs:
         packs: +dsp-testing/codeql-pack1@1.0.0
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
@@ -62,6 +63,8 @@ jobs:
       with:
         skip-queries: true
         output: ${{ runner.temp }}/results
+      env:
+        TEST_MODE: true
 
     - name: Assert No Results
       shell: bash
@@ -74,6 +77,8 @@ jobs:
       with:
         output: ${{ runner.temp }}/results
         upload-database: false
+      env:
+        TEST_MODE: true
     - name: Assert Results
       shell: bash
       run: |
@@ -89,4 +94,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__submit-sarif-failure.yml

@@ -1,73 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pip install ruamel.yaml && python3 sync.py
-# to regenerate this file.
-
-name: PR Check - Submit SARIF after failure
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
-on:
-  push:
-    branches:
-    - main
-    - releases/v1
-    - releases/v2
-  pull_request:
-    types:
-    - opened
-    - synchronize
-    - reopened
-    - ready_for_review
-  workflow_dispatch: {}
-jobs:
-  submit-sarif-failure:
-    strategy:
-      matrix:
-        include:
-        - os: ubuntu-latest
-          version: latest
-        - os: ubuntu-latest
-          version: cached
-        - os: ubuntu-latest
-          version: nightly-latest
-    name: Submit SARIF after failure
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v3
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/prepare-test
-      with:
-        version: ${{ matrix.version }}
-    - uses: actions/checkout@v3
-    - uses: ./init
-      with:
-        languages: javascript
-    - name: Fail
-    # We want this job to pass if the Action correctly uploads the SARIF file for
-    # the failed run.
-    # Setting this step to continue on error means that it is marked as completing
-    # successfully, so will not fail the job.
-      continue-on-error: true
-      run: exit 1
-    - uses: ./analyze
-    # In a real workflow, this step wouldn't run. Since we used `continue-on-error`
-    # above, we manually disable it with an `if` condition.
-      if: false
-      with:
-        category: /test-codeql-version:${{ matrix.version }}
-    env:
-  # Internal-only environment variable used to indicate that the post-init Action
-  # should expect to upload a SARIF file for the failed run.
-      CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF: true
-  # Make sure the uploading SARIF files feature is enabled.
-      CODEQL_ACTION_UPLOAD_FAILED_SARIF: true
-  # Upload the failed SARIF file as an integration test of the API endpoint.
-      CODEQL_ACTION_TEST_MODE: false
-  # Mark telemetry for this workflow so it can be treated separately.
-      CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
-

.github/workflows/__swift-autobuild.yml

@@ -1,70 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pip install ruamel.yaml && python3 sync.py
-# to regenerate this file.
-
-name: PR Check - Swift analysis using autobuild
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
-on:
-  push:
-    branches:
-    - main
-    - releases/v1
-    - releases/v2
-  pull_request:
-    types:
-    - opened
-    - synchronize
-    - reopened
-    - ready_for_review
-  workflow_dispatch: {}
-jobs:
-  swift-autobuild:
-    strategy:
-      matrix:
-        include:
-        - os: macos-latest
-          version: latest
-        - os: macos-latest
-          version: cached
-        - os: macos-latest
-          version: nightly-latest
-    name: Swift analysis using autobuild
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v3
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/prepare-test
-      with:
-        version: ${{ matrix.version }}
-    - uses: ./../action/init
-      id: init
-      with:
-        languages: swift
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - uses: ./../action/.github/setup-swift
-      with:
-        codeql-path: ${{steps.init.outputs.codeql-path}}
-    - name: Check working directory
-      shell: bash
-      run: pwd
-    - uses: ./../action/autobuild
-    - uses: ./../action/analyze
-      id: analysis
-    - name: Check database
-      shell: bash
-      run: |
-        SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
-        if [[ ! -d "$SWIFT_DB" ]]; then
-          echo "Did not create a database for Swift."
-          exit 1
-        fi
-    env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__test-autobuild-working-dir.yml

@@ -7,7 +7,6 @@ name: PR Check - Autobuild working directory
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -50,10 +49,14 @@ jobs:
       with:
         languages: java
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - uses: ./../action/autobuild
       with:
         working-directory: autobuild-dir
     - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
     - name: Check database
       shell: bash
       run: |
@@ -63,4 +66,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__test-local-codeql.yml

@@ -7,7 +7,6 @@ name: PR Check - Local CodeQL bundle
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -48,9 +47,13 @@ jobs:
     - uses: ./../action/init
       with:
         tools: ./codeql-bundle.tar.gz
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
     - uses: ./../action/analyze
       env:
-      CODEQL_ACTION_TEST_MODE: true
+        TEST_MODE: true
+    env:
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__test-proxy.yml

@@ -7,7 +7,6 @@ name: PR Check - Proxy test
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -43,10 +42,14 @@ jobs:
       with:
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
     env:
       https_proxy: http://squid-proxy:3128
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true
     container:
       image: ubuntu:22.04
       options: --dns 127.0.0.1

.github/workflows/__test-ruby.yml

@@ -7,7 +7,6 @@ name: PR Check - Ruby analysis
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -22,7 +21,7 @@ on:
     - ready_for_review
   workflow_dispatch: {}
 jobs:
-  ruby:
+  test-ruby:
     strategy:
       matrix:
         include:
@@ -53,8 +52,12 @@ jobs:
       with:
         languages: ruby
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - uses: ./../action/analyze
       id: analysis
+      env:
+        TEST_MODE: true
     - name: Check database
       shell: bash
       run: |
@@ -64,4 +67,5 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      CODEQL_ENABLE_EXPERIMENTAL_FEATURES: 'true'
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__upload-ref-sha-input.yml

@@ -7,7 +7,6 @@ name: "PR Check - Upload-sarif: 'ref' and 'sha' from inputs"
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -27,23 +26,23 @@ jobs:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: windows-2019
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
+          version: stable-20210319
         - os: windows-2019
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
+          version: stable-20210809
+        - os: windows-2019
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -73,17 +72,14 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
-      with:
-        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}
         languages: cpp,csharp,java,javascript,python
         config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
           github.sha }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
       run: ./build.sh
@@ -92,9 +88,13 @@ jobs:
         ref: refs/heads/main
         sha: 5e235361806c361d4d3f8859e3c897658025a9a2
         upload: false
+      env:
+        TEST_MODE: true
     - uses: ./../action/upload-sarif
       with:
         ref: refs/heads/main
         sha: 5e235361806c361d4d3f8859e3c897658025a9a2
       env:
-      CODEQL_ACTION_TEST_MODE: true
+        TEST_MODE: true
+    env:
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/__with-checkout-path.yml

@@ -7,7 +7,6 @@ name: PR Check - Use a custom `checkout_path`
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -27,23 +26,23 @@ jobs:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
+          version: stable-20210308
         - os: macos-latest
-          version: stable-20211005
+          version: stable-20210308
         - os: windows-2019
-          version: stable-20211005
+          version: stable-20210308
         - os: ubuntu-20.04
-          version: stable-20220120
+          version: stable-20210319
         - os: macos-latest
-          version: stable-20220120
+          version: stable-20210319
         - os: windows-2019
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210319
+        - os: ubuntu-20.04
+          version: stable-20210809
         - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
+          version: stable-20210809
+        - os: windows-2019
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -73,11 +72,6 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
-      with:
-        go-version: ^1.13.1
     - uses: actions/checkout@v3
       with:
         ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
@@ -89,6 +83,8 @@ jobs:
         languages: csharp,javascript
         source-path: x/y/z/some-path/tests/multi-language-repo
         debug: true
+      env:
+        TEST_MODE: true
     - name: Build code (non-windows)
       shell: bash
       if: ${{ runner.os != 'Windows' }}
@@ -105,12 +101,16 @@ jobs:
         ref: v1.1.0
         sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
         upload: false
+      env:
+        TEST_MODE: true
 
     - uses: ./../action/upload-sarif
       with:
         ref: v1.1.0
         sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
         checkout_path: x/y/z/some-path/tests/multi-language-repo
+      env:
+        TEST_MODE: true
 
     - name: Verify SARIF after upload
       shell: bash
@@ -141,4 +141,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/codeql.yml

@@ -8,12 +8,6 @@ on:
     # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
     # by other workflows.
     types: [opened, synchronize, reopened, ready_for_review]
-  schedule:
-    # Weekly on Sunday.
-    - cron: '30 1 * * 0'
-
-env:
-  CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
 
 jobs:
   # Identify the CodeQL tool versions to use in the analysis job.
@@ -57,7 +51,7 @@ jobs:
         # be the same as `tools: null`. This allows us to make the job for each of the bundles a
         # required status check.
         #
-        # If we're running on push or schedule, then we can skip running with `tools: latest` when it would be
+        # If we're running on push, then we can skip running with `tools: latest` when it would be
         # the same as running with `tools: null`.
         if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LATEST" ]]; then
           VERSIONS_JSON='[null]'
@@ -81,10 +75,8 @@ jobs:
       security-events: write
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@v3
-    - name: Initialize CodeQL
-      uses: ./init
+    - uses: actions/checkout@v3
+    - uses: ./init
       id: init
       with:
         languages: javascript
@@ -93,5 +85,4 @@ jobs:
     # confirm steps.init.outputs.codeql-path points to the codeql binary
     - name: Print CodeQL Version
       run: ${{steps.init.outputs.codeql-path}} version --format=json
-    - name: Perform CodeQL Analysis
-      uses: ./analyze
+    - uses: ./analyze

.github/workflows/debug-artifacts-failure.yml

@@ -2,9 +2,6 @@
 # when the analyze step fails.
 name: PR Check - Debug artifacts after failure
 env:
-  # Disable Kotlin analysis while it's incompatible with Kotlin 1.8, until we find a
-  # workaround for our PR checks.
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: true
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 on:
   push:
@@ -26,8 +23,6 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     name: Upload debug artifacts after failure in analyze
     continue-on-error: true
-    env:
-      CODEQL_ACTION_TEST_MODE: true
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -40,15 +35,14 @@ jobs:
         uses: ./.github/prepare-test
         with:
           version: latest
-      - uses: actions/setup-go@v3
-        with:
-          go-version: ^1.13.1
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           debug: true
           debug-artifact-name: my-debug-artifacts
           debug-database-name: my-db
+        env:
+          TEST_MODE: true
       - name: Build code
         shell: bash
         run: ./build.sh
@@ -57,6 +51,8 @@ jobs:
         with:
           expect-error: true
           ram: 1
+        env:
+          TEST_MODE: true
   download-and-check-artifacts:
     name: Download and check debug artifacts after failure in analyze
     needs: upload-artifacts
@@ -91,4 +87,4 @@ jobs:
             popd
           done
         env:
-          GO111MODULE: auto
+          INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/debug-artifacts.yml

@@ -1,9 +1,6 @@
 # Checks logs, SARIF, and database bundle debug artifacts exist.
 name: PR Check - Debug artifact upload
 env:
-  # Disable Kotlin analysis while it's incompatible with Kotlin 1.8, until we find a
-  # workaround for our PR checks.
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: true
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 on:
   push:
@@ -24,17 +21,17 @@ jobs:
       matrix:
         include:
           - os: ubuntu-20.04
-          version: stable-20211005
+            version: stable-20210308
           - os: macos-latest
-          version: stable-20211005
+            version: stable-20210308
           - os: ubuntu-20.04
-          version: stable-20220120
+            version: stable-20210319
           - os: macos-latest
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+            version: stable-20210319
+          - os: ubuntu-20.04
+            version: stable-20210809
           - os: macos-latest
-          version: stable-20220401
+            version: stable-20210809
           - os: ubuntu-latest
             version: cached
           - os: macos-latest
@@ -48,8 +45,6 @@ jobs:
           - os: macos-latest
             version: nightly-latest
     name: Upload debug artifacts
-    env:
-      CODEQL_ACTION_TEST_MODE: true
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -60,20 +55,21 @@ jobs:
         uses: ./.github/prepare-test
         with:
           version: ${{ matrix.version }}
-      - uses: actions/setup-go@v3
-        with:
-          go-version: ^1.13.1
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           debug: true
           debug-artifact-name: my-debug-artifacts
           debug-database-name: my-db
+        env:
+          TEST_MODE: true
       - name: Build code
         shell: bash
         run: ./build.sh
       - uses: ./../action/analyze
         id: analysis  
+        env:
+          TEST_MODE: true
   download-and-check-artifacts:
     name: Download and check debug artifacts
     needs: upload-artifacts
@@ -85,10 +81,10 @@ jobs:
       - name: Check expected artifacts exist
         shell: bash
         run: |
-          VERSIONS="stable-20211005 stable-20220120 stable-20220401 cached latest nightly-latest"
+          VERSIONS="stable-20210308 stable-20210319 stable-20210809 cached latest nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
-            if [[ "$version" =~ stable-(20211005|20220120|20210809) ]]; then
+            if [[ "$version" =~ stable-(20210308|20210319|20210809) ]]; then
               # Note the absence of the period in "ubuntu-2004": this is present in the image name
               # but not the artifact name
               OPERATING_SYSTEMS="ubuntu-2004 macos-latest"
@@ -117,4 +113,4 @@ jobs:
             done
           done
         env:
-          GO111MODULE: auto
+          INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/expected-queries-runs.yml

@@ -17,8 +17,6 @@ on:
 jobs:
   expected-queries:
     name: Expected Queries Tests
-    env:
-      CODEQL_ACTION_TEST_MODE: true
     timeout-minutes: 45
     runs-on: ubuntu-latest
     steps:
@@ -33,11 +31,15 @@ jobs:
       with:
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
         upload-database: false
         upload: false
+      env:
+        TEST_MODE: true
 
     - name: Check Sarif
       uses: ./../action/.github/check-sarif

.github/workflows/pr-checks.yml

@@ -88,7 +88,7 @@ jobs:
           fi
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v3
         with:
           python-version: 3.8
 

.github/workflows/python-deps.yml

@@ -28,7 +28,17 @@ jobs:
         matrix:
           os: [ubuntu-20.04, ubuntu-22.04, macos-latest]
           python_deps_type: [pipenv, poetry, requirements, setup_py]
-          python_version: [3]
+          python_version: [2, 3]
+          exclude:
+            # Python2 and poetry are not supported. See https://github.com/actions/setup-python/issues/374
+            - python_version: 2
+              python_deps_type: poetry
+            # Python2 and pipenv are not supported since pipenv v2021.11.5
+            - python_version: 2
+              python_deps_type: pipenv
+            # Python2 is not available on ubuntu-22.04 by default -- see https://github.com/github/codeql-action/pull/1257
+            - python_version: 2
+              os: ubuntu-22.04
 
 
     env:
@@ -128,10 +138,16 @@ jobs:
         fail-fast: false
         matrix:
           python_deps_type: [pipenv, poetry, requirements, setup_py]
-          python_version: [3]
+          python_version: [2, 3]
+          exclude:
+            # Python2 and poetry are not supported. See https://github.com/actions/setup-python/issues/374
+            - python_version: 2
+              python_deps_type: poetry
+            # Python2 and pipenv are not supported since pipenv v2021.11.5
+            - python_version: 2
+              python_deps_type: pipenv
 
     env:
-      CODEQL_ACTION_TEST_MODE: true
       PYTHON_DEPS_TYPE: ${{ matrix.python_deps_type }}
       PYTHON_VERSION: ${{ matrix.python_version }}
 
@@ -139,7 +155,7 @@ jobs:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
     - uses: actions/checkout@v3
 
-    - uses: actions/setup-python@v4
+    - uses: actions/setup-python@v3
       with:
         python-version: ${{ matrix.python_version }}
 
@@ -149,6 +165,8 @@ jobs:
         tools: latest
         languages: python
         setup-python-dependencies: false
+      env:
+        TEST_MODE: true
 
     - name: Test Auto Package Installation
       run: |

.github/workflows/runner-checks.yml

@@ -0,0 +1,412 @@
+name: CodeQL Runner Checks
+
+on:
+  push:
+    branches: [main, releases/v1, releases/v2]
+  pull_request:
+    # Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
+    # by other workflows.
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+jobs:
+  runner-analyze-javascript-ubuntu:
+    name: Runner ubuntu JS analyze
+
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build runner
+        run: |
+          cd runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          # Pass --config-file here, but not for other jobs in this workflow.
+          # This means we're testing the config file parsing in the runner
+          # but not slowing down all jobs unnecessarily as it doesn't add much
+          # testing the parsing on different operating systems and languages.
+          runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Run analyze
+        run: |
+          runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-javascript-windows:
+    name: Runner windows JS analyze
+    timeout-minutes: 45
+    runs-on: windows-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build runner
+        run: |
+          cd runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages javascript --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Run analyze
+        run: |
+          runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-javascript-macos:
+    name: Runner macos JS analyze
+    timeout-minutes: 45
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build runner
+        run: |
+          cd runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Run analyze
+        run: |
+          runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-csharp-ubuntu:
+    name: Runner ubuntu C# analyze
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Move codeql-action
+        shell: bash
+        run: |
+          mkdir ../action
+          mv * .github ../action/
+          mv ../action/tests/multi-language-repo/{*,.github} .
+          mv ../action/.github/workflows .github
+
+      - name: Build runner
+        run: |
+          cd ../action/runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Build code
+        run: |
+          . ./codeql-runner/codeql-env.sh
+          $CODEQL_RUNNER dotnet build /p:UseSharedCompilation=false
+
+      - name: Run analyze
+        run: |
+          ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-csharp-windows:
+    name: Runner windows C# analyze
+
+    # Build tracing currently does not support Windows 2022, so use `windows-2019` instead of
+    # `windows-latest`.
+    timeout-minutes: 45
+    runs-on: windows-2019
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Move codeql-action
+        shell: bash
+        run: |
+          mkdir ../action
+          mv * .github ../action/
+          mv ../action/tests/multi-language-repo/{*,.github} .
+          mv ../action/.github/workflows .github
+
+      - name: Build runner
+        run: |
+          cd ../action/runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Build code
+        shell: powershell
+        run: |
+          cat ./codeql-runner/codeql-env.sh | Invoke-Expression
+          & $Env:CODEQL_RUNNER dotnet build /p:UseSharedCompilation=false
+
+      - name: Upload tracer logs
+        uses: actions/upload-artifact@v3
+        with:
+          name: tracer-logs
+          path: ./codeql-runner/compound-build-tracer.log
+
+      - name: Run analyze
+        run: |
+          ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-csharp-macos:
+    name: Runner macos C# analyze
+    timeout-minutes: 45
+
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Move codeql-action
+        shell: bash
+        run: |
+          mkdir ../action
+          mv * .github ../action/
+          mv ../action/tests/multi-language-repo/{*,.github} .
+          mv ../action/.github/workflows .github
+
+      - name: Build runner
+        run: |
+          cd ../action/runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Build code
+        shell: bash
+        run: |
+          . ./codeql-runner/codeql-env.sh
+          $CODEQL_RUNNER dotnet build /p:UseSharedCompilation=false
+
+      - name: Run analyze
+        run: |
+          ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-csharp-autobuild-ubuntu:
+    name: Runner ubuntu autobuild C# analyze
+    timeout-minutes: 45
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Move codeql-action
+        shell: bash
+        run: |
+          mkdir ../action
+          mv * .github ../action/
+          mv ../action/tests/multi-language-repo/{*,.github} .
+          mv ../action/.github/workflows .github
+
+      - name: Build runner
+        run: |
+          cd ../action/runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Build code
+        run: |
+          ../action/runner/dist/codeql-runner-linux autobuild
+
+      - name: Run analyze
+        run: |
+          ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-csharp-autobuild-windows:
+    timeout-minutes: 45
+    name: Runner windows autobuild C# analyze
+
+    # Build tracing currently does not support Windows 2022, so use `windows-2019` instead of
+    # `windows-latest`.
+    runs-on: windows-2019
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Move codeql-action
+        shell: bash
+        run: |
+          mkdir ../action
+          mv * .github ../action/
+          mv ../action/tests/multi-language-repo/{*,.github} .
+          mv ../action/.github/workflows .github
+
+      - name: Build runner
+        run: |
+          cd ../action/runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Build code
+        shell: powershell
+        run: |
+          ../action/runner/dist/codeql-runner-win.exe autobuild
+
+      - name: Run analyze
+        run: |
+          ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-analyze-csharp-autobuild-macos:
+    name: Runner macos autobuild C# analyze
+
+    runs-on: macos-latest
+    timeout-minutes: 45
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Move codeql-action
+        shell: bash
+        run: |
+          mkdir ../action
+          mv * .github ../action/
+          mv ../action/tests/multi-language-repo/{*,.github} .
+          mv ../action/.github/workflows .github
+
+      - name: Build runner
+        run: |
+          cd ../action/runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Build code
+        shell: bash
+        run: |
+          . codeql-runner/codeql-env.sh
+          CODEQL_RUNNER="$(cat codeql-runner/codeql-env.json | jq -r '.CODEQL_RUNNER')"
+          echo "$CODEQL_RUNNER"
+          $CODEQL_RUNNER ../action/runner/dist/codeql-runner-macos autobuild
+
+      - name: Run analyze
+        run: |
+          ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+  runner-upload-sarif:
+    name: Runner upload sarif
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.base.repo.id == github.event.pull_request.head.repo.id }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build runner
+        run: |
+          cd runner
+          npm install
+          npm run build-runner
+
+      - name: Upload with runner
+        run: |
+          # Deliberately don't use TEST_MODE here. This is specifically testing
+          # the compatibility with the API.
+          runner/dist/codeql-runner-linux upload --sarif-file src/testdata/empty-sarif.sarif --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+  runner-extractor-ram-threads-options:
+    name: Runner ubuntu extractor RAM and threads options
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Build runner
+        run: |
+          cd runner
+          npm install
+          npm run build-runner
+
+      - name: Run init
+        run: |
+          runner/dist/codeql-runner-linux init --ram=230 --threads=1 --repository $GITHUB_REPOSITORY --languages java --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+        env:
+          TEST_MODE: true
+
+      - name: Assert Results
+        shell: bash
+        run: |
+          . ./codeql-runner/codeql-env.sh
+          if [ "${CODEQL_RAM}" != "230" ]; then
+            echo "CODEQL_RAM is '${CODEQL_RAM}' instead of 230"
+            exit 1
+          fi
+          if [ "${CODEQL_EXTRACTOR_JAVA_RAM}" != "230" ]; then
+            echo "CODEQL_EXTRACTOR_JAVA_RAM is '${CODEQL_EXTRACTOR_JAVA_RAM}' instead of 230"
+            exit 1
+          fi
+          if [ "${CODEQL_THREADS}" != "1" ]; then
+            echo "CODEQL_THREADS is '${CODEQL_THREADS}' instead of 1"
+            exit 1
+          fi
+          if [ "${CODEQL_EXTRACTOR_JAVA_THREADS}" != "1" ]; then
+            echo "CODEQL_EXTRACTOR_JAVA_THREADS is '${CODEQL_EXTRACTOR_JAVA_THREADS}' instead of 1"
+            exit 1
+          fi

.github/workflows/script/check-node-modules.sh

@@ -7,10 +7,7 @@ if [ ! -z "$(git status --porcelain)" ]; then
     >&2 echo "Failed: Repo should be clean before testing!"
     exit 1
 fi
-# Pin npm to v8 since v9 doesn't support Node 12.
-# When updating this, make sure to update the npm version in
-# `.github/workflows/update-dependencies.yml` too.
-sudo npm install --force -g npm@^8.19.3
+sudo npm install --force -g npm@8.19.2
 # Reinstall modules and then clean to remove absolute paths
 # Use 'npm ci' instead of 'npm install' as this is intended to be reproducible
 npm ci
@@ -18,7 +15,7 @@ npm run removeNPMAbsolutePaths
 # Check that repo is still clean
 if [ ! -z "$(git status --porcelain)" ]; then
     # If we get a fail here then the PR needs attention
-    >&2 echo "Failed: node_modules are not up to date. Add the 'Update dependencies' label to your PR to update them. Note it is important that node modules are updated on macOS and not any other operating system as there is one dependency (fsevents) that is needed for macOS and may not be installed if dependencies are updated on a Windows or Linux machine."
+    >&2 echo "Failed: node_modules are not up to date. Run 'npm ci && npm run removeNPMAbsolutePaths' on a macOS machine to update and commit. Note it is important this command is run on macOS and not any other operating system as there is one dependency (fsevents) that is needed for macOS and may not be installed if the command is run on a Windows or Linux machine. If there are no changes, run 'npm install --force -g npm@8.19.2' with root permissions first."
     git status
     exit 1
 fi

.github/workflows/script/update-required-checks.sh

@@ -10,7 +10,7 @@ fi
 
 if [ "$#" -eq 1 ]; then
   # If we were passed an argument, use that as the SHA
-  GITHUB_SHA="$1"
+  GITHUB_SHA="$0"
 elif [ "$#" -gt 1 ]; then
   echo "Usage: $0 [SHA]"
   echo "Update the required checks based on the SHA, or main."
@@ -23,7 +23,7 @@ fi
 echo "Getting checks for $GITHUB_SHA"
 
 # Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
-CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or . == "check-expected-release-files" or contains("Update") or contains("update") or contains("test-setup-python-scripts") | not)] | unique | sort')"
+CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") or contains("update") or contains("test-setup-python-scripts") | not)] | unique | sort')"
 
 echo "$CHECKS" | jq
 

.github/workflows/unset-environment-new-cli.yml

@@ -1,13 +1,8 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pip install ruamel.yaml && python3 sync.py
-# to regenerate this file.
-
-name: PR Check - Test unsetting environment variables
+# See `unset-environment-old-cli.yml` for reasoning behind the separate tests.
+name: PR Check - Test unsetting environment variables for CLI version >= 2.5.1
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
 on:
   push:
     branches:
@@ -27,11 +22,7 @@ jobs:
       matrix:
         include:
         - os: ubuntu-20.04
-          version: stable-20211005
-        - os: ubuntu-20.04
-          version: stable-20220120
-        - os: ubuntu-latest
-          version: stable-20220401
+          version: stable-20210809
         - os: ubuntu-latest
           version: cached
         - os: ubuntu-latest
@@ -49,23 +40,19 @@ jobs:
       uses: ./.github/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set up Go
-      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
-      uses: actions/setup-go@v3
-      with:
-        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         db-location: ${{ runner.temp }}/customDbLocation
         tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
     - name: Build code
       shell: bash
-    # Disable Kotlin analysis while it's incompatible with Kotlin 1.8, until we find a
-    # workaround for our PR checks.
-      run: env -i CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN=true PATH="$PATH" HOME="$HOME"
-        ./build.sh
+      run: env -i PATH="$PATH" HOME="$HOME" ./build.sh
     - uses: ./../action/analyze
       id: analysis
+      env:
+        TEST_MODE: true
     - shell: bash
       run: |
         CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
@@ -105,4 +92,4 @@ jobs:
           exit 1
         fi
     env:
-      CODEQL_ACTION_TEST_MODE: true
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/unset-environment-old-cli.yml

@@ -0,0 +1,89 @@
+# There was a bug, fixed in CLI v2.5.1, that didn't propagate environment
+# variables that the Java tracer needed. Here we test all languages
+# except Java for these CLI versions. In `unset-environment-new-cli.yml`
+# we test all languages for recent CLI versions.
+name: PR Check - Test unsetting environment variables for CLI version < 2.5.1
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+    - main
+    - releases/v1
+    - releases/v2
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
+  workflow_dispatch: {}
+jobs:
+  unset-environment:
+    strategy:
+      matrix:
+        include:
+        - os: ubuntu-20.04
+          version: stable-20210308
+        - os: ubuntu-20.04
+          version: stable-20210319
+    name: Test unsetting environment variables
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Check out repository
+      uses: actions/checkout@v3
+    - name: Prepare test
+      id: prepare-test
+      uses: ./.github/prepare-test
+      with:
+        version: ${{ matrix.version }}
+    - uses: ./../action/init
+      with:
+        languages: csharp,cpp,go,javascript,python
+        db-location: ${{ runner.temp }}/customDbLocation
+        tools: ${{ steps.prepare-test.outputs.tools-url }}
+      env:
+        TEST_MODE: true
+    - name: Build code
+      shell: bash
+      run: env -i PATH="$PATH" HOME="$HOME" ./build.sh
+    - uses: ./../action/analyze
+      id: analysis
+      env:
+        TEST_MODE: true
+    - shell: bash
+      run: |
+        CPP_DB="${{ fromJson(steps.analysis.outputs.db-locations).cpp }}"
+        if [[ ! -d "$CPP_DB" ]] || [[ ! "$CPP_DB" == "${RUNNER_TEMP}/customDbLocation/cpp" ]]; then
+          echo "::error::Did not create a database for CPP, or created it in the wrong location." \
+            "Expected location was '${RUNNER_TEMP}/customDbLocation/cpp' but actual was '${CPP_DB}'"
+          exit 1
+        fi
+        CSHARP_DB="${{ fromJson(steps.analysis.outputs.db-locations).csharp }}"
+        if [[ ! -d "$CSHARP_DB" ]] || [[ ! "$CSHARP_DB" == "${RUNNER_TEMP}/customDbLocation/csharp" ]]; then
+          echo "::error::Did not create a database for C Sharp, or created it in the wrong location." \
+            "Expected location was '${RUNNER_TEMP}/customDbLocation/csharp' but actual was '${CSHARP_DB}'"
+          exit 1
+        fi
+        GO_DB="${{ fromJson(steps.analysis.outputs.db-locations).go }}"
+        if [[ ! -d "$GO_DB" ]] || [[ ! "$GO_DB" == "${RUNNER_TEMP}/customDbLocation/go" ]]; then
+          echo "::error::Did not create a database for Go, or created it in the wrong location." \
+            "Expected location was '${RUNNER_TEMP}/customDbLocation/go' but actual was '${GO_DB}'"
+          exit 1
+        fi
+        JAVASCRIPT_DB="${{ fromJson(steps.analysis.outputs.db-locations).javascript }}"
+        if [[ ! -d "$JAVASCRIPT_DB" ]] || [[ ! "$JAVASCRIPT_DB" == "${RUNNER_TEMP}/customDbLocation/javascript" ]]; then
+          echo "::error::Did not create a database for Javascript, or created it in the wrong location." \
+            "Expected location was '${RUNNER_TEMP}/customDbLocation/javascript' but actual was '${JAVASCRIPT_DB}'"
+          exit 1
+        fi
+        PYTHON_DB="${{ fromJson(steps.analysis.outputs.db-locations).python }}"
+        if [[ ! -d "$PYTHON_DB" ]] || [[ ! "$PYTHON_DB" == "${RUNNER_TEMP}/customDbLocation/python" ]]; then
+          echo "::error::Did not create a database for Python, or created it in the wrong location." \
+            "Expected location was '${RUNNER_TEMP}/customDbLocation/python' but actual was '${PYTHON_DB}'"
+          exit 1
+        fi
+    env:
+      INTERNAL_CODEQL_ACTION_DEBUG_LOC: true

.github/workflows/update-dependencies.yml

@@ -27,10 +27,7 @@ jobs:
       run: |
         git fetch origin "$BRANCH" --depth=1
         git checkout "origin/$BRANCH"
-        # Pin npm to v8 since v9 doesn't support Node 12.
-        # When updating this, make sure to update the npm version in
-        # `.github/workflows/script/check-node-modules.sh` too.
-        sudo npm install --force -g npm@^8.19.3
+        sudo npm install --force -g npm@latest
         npm install
         npm ci
         npm run removeNPMAbsolutePaths

.github/workflows/update-release-branch.yml

@@ -29,7 +29,7 @@ jobs:
         fetch-depth: 0
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v3
       with:
         python-version: 3.8
 

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v3
         with:
           python-version: "3.7"
       - name: Checkout CodeQL Action
@@ -35,7 +35,7 @@ jobs:
         env:
           ENTERPRISE_RELEASES_PATH: ${{ github.workspace }}/enterprise-releases/
       - name: Commit Changes
-        uses: peter-evans/create-pull-request@2b011faafdcbc9ceb11414d64d0573f37c774b04 # v4.2.3
+        uses: peter-evans/create-pull-request@c7f493a8000b8aeb17a1332e326ba76b57cb83eb # v3.4.1
         with:
           commit-message: Update supported GitHub Enterprise Server versions.
           title: Update supported GitHub Enterprise Server versions.

.gitignore

@@ -1,2 +1,4 @@
+/runner/dist/
+/runner/node_modules/
 # Ignore for example failing-tests.json from AVA
 node_modules/.cache

.npmrc

@@ -1 +0,0 @@
-lockfile-version=3

CHANGELOG.md

@@ -1,165 +1,129 @@
 # CodeQL Action Changelog
 
-## 1.1.39 - 18 Jan 2023
+## [UNRELEASED]
 
-- CodeQL Action v1 is now deprecated, and is no longer updated or supported. For better performance, improved security, and new features, upgrade to v2. For more information, see [this changelog post](https://github.blog/changelog/2023-01-18-code-scanning-codeql-action-v1-is-now-deprecated/). [#1467](https://github.com/github/codeql-action/pull/1466)
-- Python automatic dependency installation will no longer fail for projects using Poetry that specify `virtualenvs.options.no-pip = true` in their `poetry.toml`. [#1431](https://github.com/github/codeql-action/pull/1431)
-- Avoid printing a stack trace and error message when the action fails to find the SHA at the
-  current directory. This will happen in several non-error states and so we now avoid cluttering the
-  log with this message. [#1485](https://github.com/github/codeql-action/pull/1485)
+- Update the ML-powered additional query pack for JavaScript to version 0.4.0.
 
-## 1.1.38 - 12 Jan 2023
-
-- Update default CodeQL bundle version to 2.12.0. [#1466](https://github.com/github/codeql-action/pull/1466)
-
-## 1.1.37 - 14 Dec 2022
-
-- Update default CodeQL bundle version to 2.11.6. [#1433](https://github.com/github/codeql-action/pull/1433)
-
-## 1.1.36 - 08 Dec 2022
-
-- Update default CodeQL bundle version to 2.11.5. [#1412](https://github.com/github/codeql-action/pull/1412)
-- Add a step that tries to upload a SARIF file for the workflow run when that workflow run fails. This will help better surface failed code scanning workflow runs. [#1393](https://github.com/github/codeql-action/pull/1393)
-- Python automatic dependency installation will no longer consider dependency code installed in venv as user-written, for projects using Poetry that specify `virtualenvs.in-project = true` in their `poetry.toml`. [#1419](https://github.com/github/codeql-action/pull/1419)
-
-## 1.1.35 - 01 Dec 2022
-
-No user facing changes.
-
-## 1.1.34 - 25 Nov 2022
-
-- Update default CodeQL bundle version to 2.11.4. [#1391](https://github.com/github/codeql-action/pull/1391)
-- Fixed a bug where some the `init` action and the `analyze` action would have different sets of experimental feature flags enabled. [#1384](https://github.com/github/codeql-action/pull/1384)
-
-## 1.1.33 - 16 Nov 2022
-
-- Go is now analyzed in the same way as other compiled languages such as C/C++, C#, and Java. This completes the rollout of the feature described in [CodeQL Action version 2.1.27](#2127---06-oct-2022). [#1322](https://github.com/github/codeql-action/pull/1322)
-- Bump the minimum CodeQL bundle version to 2.6.3. [#1358](https://github.com/github/codeql-action/pull/1358)
-
-## 1.1.32 - 14 Nov 2022
-
-- Update default CodeQL bundle version to 2.11.3. [#1348](https://github.com/github/codeql-action/pull/1348)
-- Update the ML-powered additional query pack for JavaScript to version 0.4.0. [#1351](https://github.com/github/codeql-action/pull/1351)
-
-## 1.1.31 - 04 Nov 2022
+## 2.1.31 - 04 Nov 2022
 
 - The `rb/weak-cryptographic-algorithm` Ruby query has been updated to no longer report uses of hash functions such as `MD5` and `SHA1` even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. For more information, see the corresponding change in the [github/codeql repository](https://github.com/github/codeql/pull/11129). [#1344](https://github.com/github/codeql-action/pull/1344)
 
-## 1.1.30 - 02 Nov 2022
+## 2.1.30 - 02 Nov 2022
 
 - Improve the error message when using CodeQL bundle version 2.7.2 and earlier in a workflow that runs on a runner image such as `ubuntu-22.04` that uses glibc version 2.34 and later. [#1334](https://github.com/github/codeql-action/pull/1334)
 
-## 1.1.29 - 26 Oct 2022
+## 2.1.29 - 26 Oct 2022
 
 - Update default CodeQL bundle version to 2.11.2. [#1320](https://github.com/github/codeql-action/pull/1320)
 
-## 1.1.28 - 18 Oct 2022
+## 2.1.28 - 18 Oct 2022
 
 - Update default CodeQL bundle version to 2.11.1. [#1294](https://github.com/github/codeql-action/pull/1294)
 - Replace uses of GitHub Actions command `set-output` because it is now deprecated. See more information in the [GitHub Changelog](https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/). [#1301](https://github.com/github/codeql-action/pull/1301)
 
-## 1.1.27 - 06 Oct 2022
+## 2.1.27 - 06 Oct 2022
 
 - We are rolling out a feature of the CodeQL Action in October 2022 that changes the way that Go code is analyzed to be more consistent with other compiled languages like C/C++, C#, and Java. You do not need to alter your code scanning workflows. If you encounter any problems, please [file an issue](https://github.com/github/codeql-action/issues) or open a private ticket with GitHub Support and request an escalation to engineering.
 
-## 1.1.26 - 29 Sep 2022
+## 2.1.26 - 29 Sep 2022
 
 - Update default CodeQL bundle version to 2.11.0. [#1267](https://github.com/github/codeql-action/pull/1267)
 
-## 1.1.25 - 21 Sep 2022
+## 2.1.25 - 21 Sep 2022
 
 - We will soon be rolling out a feature of the CodeQL Action that stores some information used to make future runs faster in the GitHub Actions cache. Initially, this will only be enabled on JavaScript repositories, but we plan to add more languages to this soon. The new feature can be disabled by passing the `trap-caching: false` option to your workflow's `init` step, for example if you are already using the GitHub Actions cache for a different purpose and are near the storage limit for it.
-- Add support for Python automatic dependency installation with Poetry 1.2 [#1258](https://github.com/github/codeql-action/pull/1258)
+- Add support for Python automatic dependency installation with Poetry 1.2 [#1258](https://github.com/github/codeql-action/pull/1258).
 
-## 1.1.24 - 16 Sep 2022
+## 2.1.24 - 16 Sep 2022
 
 No user facing changes.
 
-## 1.1.23 - 14 Sep 2022
+## 2.1.23 - 14 Sep 2022
 
 - Allow CodeQL packs to be downloaded from GitHub Enterprise Server instances, using the new `registries` input for the `init` action.  [#1221](https://github.com/github/codeql-action/pull/1221)
 - Update default CodeQL bundle version to 2.10.5. [#1240](https://github.com/github/codeql-action/pull/1240)
 
-## 1.1.22 - 01 Sep 2022
+## 2.1.22 - 01 Sep 2022
 
 - Downloading CodeQL packs has been moved to the `init` step. Previously, CodeQL packs were downloaded during the `analyze` step. [#1218](https://github.com/github/codeql-action/pull/1218)
 - Update default CodeQL bundle version to 2.10.4. [#1224](https://github.com/github/codeql-action/pull/1224)
 - The newly released [Poetry 1.2](https://python-poetry.org/blog/announcing-poetry-1.2.0) is not yet supported. In the most common case where the CodeQL Action is automatically installing Python dependencies, it will continue to install and use Poetry 1.1 on its own. However, in certain cases such as with self-hosted runners, you may need to ensure Poetry 1.1 is installed yourself.
 
-## 1.1.21 - 25 Aug 2022
+## 2.1.21 - 25 Aug 2022
 
 - Improve error messages when the code scanning configuration file includes an invalid `queries` block or an invalid `query-filters` block. [#1208](https://github.com/github/codeql-action/pull/1208)
 - Fix a bug where Go build tracing could fail on Windows. [#1209](https://github.com/github/codeql-action/pull/1209)
 
-## 1.1.20 - 22 Aug 2022
+## 2.1.20 - 22 Aug 2022
 
 No user facing changes.
 
-## 1.1.19 - 17 Aug 2022
+## 2.1.19 - 17 Aug 2022
 
 - Add the ability to filter queries from a code scanning run by using the `query-filters` option in the code scanning configuration file. [#1098](https://github.com/github/codeql-action/pull/1098)
 - In debug mode, debug artifacts are now uploaded even if a step in the Actions workflow fails. [#1159](https://github.com/github/codeql-action/pull/1159)
 - Update default CodeQL bundle version to 2.10.3. [#1178](https://github.com/github/codeql-action/pull/1178)
 - The combination of python2 and Pipenv is no longer supported. [#1181](https://github.com/github/codeql-action/pull/1181)
 
-## 1.1.18 - 03 Aug 2022
+## 2.1.18 - 03 Aug 2022
 
 - Update default CodeQL bundle version to 2.10.2.  [#1156](https://github.com/github/codeql-action/pull/1156)
 
-## 1.1.17 - 28 Jul 2022
+## 2.1.17 - 28 Jul 2022
 
 - Update default CodeQL bundle version to 2.10.1.  [#1143](https://github.com/github/codeql-action/pull/1143)
 
-## 1.1.16 - 13 Jul 2022
+## 2.1.16 - 13 Jul 2022
 
 - You can now quickly debug a job that uses the CodeQL Action by re-running the job from the GitHub UI and selecting the "Enable debug logging" option. [#1132](https://github.com/github/codeql-action/pull/1132)
 - You can now see diagnostic messages produced by the analysis in the logs of the `analyze` Action by enabling debug mode. To enable debug mode, pass `debug: true` to the `init` Action, or [enable step debug logging](https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging#enabling-step-debug-logging). This feature is available for CodeQL CLI version 2.10.0 and later. [#1133](https://github.com/github/codeql-action/pull/1133)
 
-## 1.1.15 - 28 Jun 2022
+## 2.1.15 - 28 Jun 2022
 
 - CodeQL query packs listed in the `packs` configuration field will be skipped if their target language is not being analyzed in the current Actions job. Previously, this would throw an error. [#1116](https://github.com/github/codeql-action/pull/1116)
 - The combination of python2 and poetry is no longer supported. See <https://github.com/actions/setup-python/issues/374> for more details. [#1124](https://github.com/github/codeql-action/pull/1124)
 - Update default CodeQL bundle version to 2.10.0. [#1123](https://github.com/github/codeql-action/pull/1123)
 
-## 1.1.14 - 22 Jun 2022
+## 2.1.14 - 22 Jun 2022
 
 No user facing changes.
 
-## 1.1.13 - 21 Jun 2022
+## 2.1.13 - 21 Jun 2022
 
 - Update default CodeQL bundle version to 2.9.4. [#1100](https://github.com/github/codeql-action/pull/1100)
 
-## 1.1.12 - 01 Jun 2022
+## 2.1.12 - 01 Jun 2022
 
 - Update default CodeQL bundle version to 2.9.3. [#1084](https://github.com/github/codeql-action/pull/1084)
 
-## 1.1.11 - 17 May 2022
+## 2.1.11 - 17 May 2022
 
 - Update default CodeQL bundle version to 2.9.2. [#1074](https://github.com/github/codeql-action/pull/1074)
 
-## 1.1.10 - 10 May 2022
+## 2.1.10 - 10 May 2022
 
 - Update default CodeQL bundle version to 2.9.1. [#1056](https://github.com/github/codeql-action/pull/1056)
 - When `wait-for-processing` is enabled, the workflow will now fail if there were any errors that occurred during processing of the analysis results.
 
-## 1.1.9 - 27 Apr 2022
+## 2.1.9 - 27 Apr 2022
 
 - Add `working-directory` input to the `autobuild` action. [#1024](https://github.com/github/codeql-action/pull/1024)
 - The `analyze` and `upload-sarif` actions will now wait up to 2 minutes for processing to complete after they have uploaded the results so they can report any processing errors that occurred. This behavior can be disabled by setting the `wait-for-processing` action input to `"false"`. [#1007](https://github.com/github/codeql-action/pull/1007)
 - Update default CodeQL bundle version to 2.9.0.
 - Fix a bug where [status reporting fails on Windows](https://github.com/github/codeql-action/issues/1041). [#1042](https://github.com/github/codeql-action/pull/1042)
 
-## 1.1.8 - 08 Apr 2022
+## 2.1.8 - 08 Apr 2022
 
 - Update default CodeQL bundle version to 2.8.5. [#1014](https://github.com/github/codeql-action/pull/1014)
 - Fix error where the init action would fail due to a GitHub API request that was taking too long to complete [#1025](https://github.com/github/codeql-action/pull/1025)
 
-## 1.1.7 - 05 Apr 2022
+## 2.1.7 - 05 Apr 2022
 
 - A bug where additional queries specified in the workflow file would sometimes not be respected has been fixed. [#1018](https://github.com/github/codeql-action/pull/1018)
 
-## 1.1.6 - 30 Mar 2022
+## 2.1.6 - 30 Mar 2022
 
+- [v2+ only] The CodeQL Action now runs on Node.js v16. [#1000](https://github.com/github/codeql-action/pull/1000)
 - Update default CodeQL bundle version to 2.8.4. [#990](https://github.com/github/codeql-action/pull/990)
 - Fix a bug where an invalid `commit_oid` was being sent to code scanning when a custom checkout path was being used. [#956](https://github.com/github/codeql-action/pull/956)
 
@@ -320,7 +284,7 @@ No user facing changes.
 ## 1.0.4 - 28 Jun 2021
 
 - Fix `RUNNER_TEMP environment variable must be set` when using runner. [#594](https://github.com/github/codeql-action/pull/594)
-- Fix counting of lines of code for C# projects. [#586](https://github.com/github/codeql-action/pull/586)
+- Fix couting of lines of code for C# projects. [#586](https://github.com/github/codeql-action/pull/586)
 
 ## 1.0.3 - 23 Jun 2021
 

CONTRIBUTING.md

@@ -38,6 +38,10 @@ To see the effect of your changes and to test them, push your changes in a branc
 
 As well as the unit tests (see _Common tasks_ above), there are integration tests, defined in `.github/workflows/integration-testing.yml`.  These are run by a CI check.  Depending on the change you’re making, you may want to add a test to this file or extend an existing one.
 
+### Building the CodeQL runner
+
+Navigate to the `runner` directory and run `npm install` to install dependencies needed only for compiling the CodeQL runner. Run `npm run build-runner` to output files to the `runner/dist` directory.
+
 ## Submitting a pull request
 
 1. [Fork][fork] and clone the repository

README.md

@@ -59,7 +59,7 @@ jobs:
         uses: github/codeql-action/init@v2
         # Override language selection by uncommenting this and choosing your languages
         # with:
-        #   languages: go, javascript, csharp, python, cpp, java, ruby
+        #   languages: go, javascript, csharp, python, cpp, java
 
       # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
       # If this step fails, then you should remove it and run the build manually (see below).

analyze/action.yml

@@ -12,7 +12,6 @@ inputs:
   upload:
     description: Upload the SARIF file to Code Scanning
     required: false
-    # If changing this, make sure to update workflow.ts accordingly.
     default: "true"
   cleanup-level:
     description: "Level of cleanup to perform on CodeQL databases at the end of the analyze step. This should either be 'none' to skip cleanup, or be a valid argument for the --mode flag of the CodeQL CLI command 'codeql database cleanup' as documented at https://codeql.github.com/docs/codeql-cli/manual/database-cleanup"
@@ -45,7 +44,6 @@ inputs:
   checkout_path:
     description: "The path at which the analyzed repository was checked out. Used to relativize any absolute paths in the uploaded SARIF file."
     required: false
-    # If changing this, make sure to update workflow.ts accordingly.
     default: ${{ github.workspace }}
   ref:
     description: "The ref where results will be uploaded. If not provided, the Action will use the GITHUB_REF environment variable. If provided, the sha input must be provided as well. This input is not available in pull requests from forks."
@@ -78,6 +76,6 @@ outputs:
   sarif-id:
     description: The ID of the uploaded SARIF file.
 runs:
-  using: "node12"
+  using: "node16"
   main: "../lib/analyze-action.js"
   post: "../lib/analyze-action-post.js"

autobuild/action.yml

@@ -13,5 +13,5 @@ inputs:
       $GITHUB_WORKSPACE as its working directory.
     required: false
 runs:
-  using: 'node12'
+  using: 'node16'
   main: '../lib/autobuild-action.js'

init/action.yml

@@ -105,6 +105,6 @@ outputs:
   codeql-path:
     description: The path of the CodeQL binary used for analysis
 runs:
-  using: 'node12'
+  using: 'node16'
   main: '../lib/init-action.js'
   post: '../lib/init-action-post.js'

lib/actions-util.js

@@ -19,24 +19,29 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.printDebugLogs = exports.isAnalyzingDefaultBranch = exports.getRelativeScriptPath = exports.isRunningLocalAction = exports.workflowEventName = exports.sendStatusReport = exports.createStatusReportBase = exports.getActionsStatus = exports.getRef = exports.computeAutomationID = exports.getAutomationID = exports.getAnalysisKey = exports.determineMergeBaseCommitOid = exports.getCommitOid = exports.getTemporaryDirectory = exports.getOptionalInput = exports.getRequiredInput = void 0;
+exports.printDebugLogs = exports.isAnalyzingDefaultBranch = exports.getRelativeScriptPath = exports.isRunningLocalAction = exports.workflowEventName = exports.sendStatusReport = exports.createStatusReportBase = exports.getActionsStatus = exports.getRef = exports.computeAutomationID = exports.getAutomationID = exports.getAnalysisKey = exports.getWorkflowRunID = exports.getWorkflow = exports.formatWorkflowCause = exports.formatWorkflowErrors = exports.validateWorkflow = exports.getWorkflowErrors = exports.WorkflowErrors = exports.patternIsSuperset = exports.determineMergeBaseCommitOid = exports.getCommitOid = exports.getTemporaryDirectory = exports.getOptionalInput = exports.getRequiredInput = void 0;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const safeWhich = __importStar(require("@chrisgavin/safe-which"));
+const yaml = __importStar(require("js-yaml"));
 const api = __importStar(require("./api-client"));
 const sharedEnv = __importStar(require("./shared-environment"));
 const util_1 = require("./util");
-const workflow_1 = require("./workflow");
 // eslint-disable-next-line import/no-commonjs
 const pkg = require("../package.json");
+/**
+ * The utils in this module are meant to be run inside of the action only.
+ * Code paths from the runner should not enter this module.
+ */
 /**
  * Wrapper around core.getInput for inputs that always have a value.
  * Also see getOptionalInput.
  *
- * This allows us to get stronger type checking of required/optional inputs.
+ * This allows us to get stronger type checking of required/optional inputs
+ * and make behaviour more consistent between actions and the runner.
  */
 function getRequiredInput(name) {
     return core.getInput(name, { required: true });
@@ -46,7 +51,8 @@ exports.getRequiredInput = getRequiredInput;
  * Wrapper around core.getInput that converts empty inputs to undefined.
  * Also see getRequiredInput.
  *
- * This allows us to get stronger type checking of required/optional inputs.
+ * This allows us to get stronger type checking of required/optional inputs
+ * and make behaviour more consistent between actions and the runner.
  */
 const getOptionalInput = function (name) {
     const value = core.getInput(name);
@@ -88,9 +94,8 @@ const getCommitOid = async function (checkoutPath, ref = "HEAD") {
         return commitOid.trim();
     }
     catch (e) {
-        core.info("Could not determine current commit SHA using git. Continuing with data from user input or environment.");
-        core.debug(`Reason: ${e.message}`);
-        core.debug(e.stack || "NO STACK");
+        core.info(`Failed to call git to get current commit. Continuing with data from environment or input: ${e}`);
+        core.info(e.stack || "NO STACK");
         return (0, exports.getOptionalInput)("sha") || (0, util_1.getRequiredEnvParam)("GITHUB_SHA");
     }
 };
@@ -146,6 +151,225 @@ const determineMergeBaseCommitOid = async function () {
     }
 };
 exports.determineMergeBaseCommitOid = determineMergeBaseCommitOid;
+function isObject(o) {
+    return o !== null && typeof o === "object";
+}
+const GLOB_PATTERN = new RegExp("(\\*\\*?)");
+function escapeRegExp(string) {
+    return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); // $& means the whole matched string
+}
+function patternToRegExp(value) {
+    return new RegExp(`^${value
+        .toString()
+        .split(GLOB_PATTERN)
+        .reduce(function (arr, cur) {
+        if (cur === "**") {
+            arr.push(".*?");
+        }
+        else if (cur === "*") {
+            arr.push("[^/]*?");
+        }
+        else if (cur) {
+            arr.push(escapeRegExp(cur));
+        }
+        return arr;
+    }, [])
+        .join("")}$`);
+}
+// this function should return true if patternA is a superset of patternB
+// e.g: * is a superset of main-* but main-* is not a superset of *.
+function patternIsSuperset(patternA, patternB) {
+    return patternToRegExp(patternA).test(patternB);
+}
+exports.patternIsSuperset = patternIsSuperset;
+function branchesToArray(branches) {
+    if (typeof branches === "string") {
+        return [branches];
+    }
+    if (Array.isArray(branches)) {
+        if (branches.length === 0) {
+            return "**";
+        }
+        return branches;
+    }
+    return "**";
+}
+function toCodedErrors(errors) {
+    return Object.entries(errors).reduce((acc, [key, value]) => {
+        acc[key] = { message: value, code: key };
+        return acc;
+    }, {});
+}
+// code to send back via status report
+// message to add as a warning annotation to the run
+exports.WorkflowErrors = toCodedErrors({
+    MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
+    MissingPushHook: `Please specify an on.push hook so that Code Scanning can compare pull requests against the state of the base branch.`,
+    PathsSpecified: `Using on.push.paths can prevent Code Scanning annotating new alerts in your pull requests.`,
+    PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
+    CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
+});
+function getWorkflowErrors(doc) {
+    var _a, _b, _c, _d, _e;
+    const errors = [];
+    const jobName = process.env.GITHUB_JOB;
+    if (jobName) {
+        const job = (_a = doc === null || doc === void 0 ? void 0 : doc.jobs) === null || _a === void 0 ? void 0 : _a[jobName];
+        const steps = job === null || job === void 0 ? void 0 : job.steps;
+        if (Array.isArray(steps)) {
+            for (const step of steps) {
+                // this was advice that we used to give in the README
+                // we actually want to run the analysis on the merge commit
+                // to produce results that are more inline with expectations
+                // (i.e: this is what will happen if you merge this PR)
+                // and avoid some race conditions
+                if ((step === null || step === void 0 ? void 0 : step.run) === "git checkout HEAD^2") {
+                    errors.push(exports.WorkflowErrors.CheckoutWrongHead);
+                    break;
+                }
+            }
+        }
+    }
+    let missingPush = false;
+    if (doc.on === undefined) {
+        // this is not a valid config
+    }
+    else if (typeof doc.on === "string") {
+        if (doc.on === "pull_request") {
+            missingPush = true;
+        }
+    }
+    else if (Array.isArray(doc.on)) {
+        const hasPush = doc.on.includes("push");
+        const hasPullRequest = doc.on.includes("pull_request");
+        if (hasPullRequest && !hasPush) {
+            missingPush = true;
+        }
+    }
+    else if (isObject(doc.on)) {
+        const hasPush = Object.prototype.hasOwnProperty.call(doc.on, "push");
+        const hasPullRequest = Object.prototype.hasOwnProperty.call(doc.on, "pull_request");
+        if (!hasPush && hasPullRequest) {
+            missingPush = true;
+        }
+        if (hasPush && hasPullRequest) {
+            const paths = (_b = doc.on.push) === null || _b === void 0 ? void 0 : _b.paths;
+            // if you specify paths or paths-ignore you can end up with commits that have no baseline
+            // if they didn't change any files
+            // currently we cannot go back through the history and find the most recent baseline
+            if (Array.isArray(paths) && paths.length > 0) {
+                errors.push(exports.WorkflowErrors.PathsSpecified);
+            }
+            const pathsIgnore = (_c = doc.on.push) === null || _c === void 0 ? void 0 : _c["paths-ignore"];
+            if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
+                errors.push(exports.WorkflowErrors.PathsIgnoreSpecified);
+            }
+        }
+        // if doc.on.pull_request is null that means 'all branches'
+        // if doc.on.pull_request is undefined that means 'off'
+        // we only want to check for mismatched branches if pull_request is on.
+        if (doc.on.pull_request !== undefined) {
+            const push = branchesToArray((_d = doc.on.push) === null || _d === void 0 ? void 0 : _d.branches);
+            if (push !== "**") {
+                const pull_request = branchesToArray((_e = doc.on.pull_request) === null || _e === void 0 ? void 0 : _e.branches);
+                if (pull_request !== "**") {
+                    const difference = pull_request.filter((value) => !push.some((o) => patternIsSuperset(o, value)));
+                    if (difference.length > 0) {
+                        // there are branches in pull_request that may not have a baseline
+                        // because we are not building them on push
+                        errors.push(exports.WorkflowErrors.MismatchedBranches);
+                    }
+                }
+                else if (push.length > 0) {
+                    // push is set up to run on a subset of branches
+                    // and you could open a PR against a branch with no baseline
+                    errors.push(exports.WorkflowErrors.MismatchedBranches);
+                }
+            }
+        }
+    }
+    if (missingPush) {
+        errors.push(exports.WorkflowErrors.MissingPushHook);
+    }
+    return errors;
+}
+exports.getWorkflowErrors = getWorkflowErrors;
+async function validateWorkflow() {
+    let workflow;
+    try {
+        workflow = await getWorkflow();
+    }
+    catch (e) {
+        return `error: getWorkflow() failed: ${String(e)}`;
+    }
+    let workflowErrors;
+    try {
+        workflowErrors = getWorkflowErrors(workflow);
+    }
+    catch (e) {
+        return `error: getWorkflowErrors() failed: ${String(e)}`;
+    }
+    if (workflowErrors.length > 0) {
+        let message;
+        try {
+            message = formatWorkflowErrors(workflowErrors);
+        }
+        catch (e) {
+            return `error: formatWorkflowErrors() failed: ${String(e)}`;
+        }
+        core.warning(message);
+    }
+    return formatWorkflowCause(workflowErrors);
+}
+exports.validateWorkflow = validateWorkflow;
+function formatWorkflowErrors(errors) {
+    const issuesWere = errors.length === 1 ? "issue was" : "issues were";
+    const errorsList = errors.map((e) => e.message).join(" ");
+    return `${errors.length} ${issuesWere} detected with this workflow: ${errorsList}`;
+}
+exports.formatWorkflowErrors = formatWorkflowErrors;
+function formatWorkflowCause(errors) {
+    if (errors.length === 0) {
+        return undefined;
+    }
+    return errors.map((e) => e.code).join(",");
+}
+exports.formatWorkflowCause = formatWorkflowCause;
+async function getWorkflow() {
+    const relativePath = await getWorkflowPath();
+    const absolutePath = path.join((0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), relativePath);
+    return yaml.load(fs.readFileSync(absolutePath, "utf-8"));
+}
+exports.getWorkflow = getWorkflow;
+/**
+ * Get the path of the currently executing workflow.
+ */
+async function getWorkflowPath() {
+    const repo_nwo = (0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY").split("/");
+    const owner = repo_nwo[0];
+    const repo = repo_nwo[1];
+    const run_id = Number((0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID"));
+    const apiClient = api.getActionsApiClient();
+    const runsResponse = await apiClient.request("GET /repos/:owner/:repo/actions/runs/:run_id?exclude_pull_requests=true", {
+        owner,
+        repo,
+        run_id,
+    });
+    const workflowUrl = runsResponse.data.workflow_url;
+    const workflowResponse = await apiClient.request(`GET ${workflowUrl}`);
+    return workflowResponse.data.path;
+}
+/**
+ * Get the workflow run ID.
+ */
+function getWorkflowRunID() {
+    const workflowRunID = parseInt((0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID"), 10);
+    if (Number.isNaN(workflowRunID)) {
+        throw new Error("GITHUB_RUN_ID must define a non NaN workflow run ID");
+    }
+    return workflowRunID;
+}
+exports.getWorkflowRunID = getWorkflowRunID;
 /**
  * Get the analysis key parameter for the current job.
  *
@@ -159,7 +383,7 @@ async function getAnalysisKey() {
     if (analysisKey !== undefined) {
         return analysisKey;
     }
-    const workflowPath = await (0, workflow_1.getWorkflowPath)();
+    const workflowPath = await getWorkflowPath();
     const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");
     analysisKey = `${workflowPath}:${jobName}`;
     core.exportVariable(analysisKeyEnvVar, analysisKey);
@@ -174,10 +398,10 @@ async function getAutomationID() {
 exports.getAutomationID = getAutomationID;
 function computeAutomationID(analysis_key, environment) {
     let automationID = `${analysis_key}/`;
-    const matrix = (0, util_1.parseMatrixInput)(environment);
-    if (matrix !== undefined) {
     // the id has to be deterministic so we sort the fields
-        for (const entry of Object.entries(matrix).sort()) {
+    if (environment !== undefined && environment !== "null") {
+        const environmentObject = JSON.parse(environment);
+        for (const entry of Object.entries(environmentObject).sort()) {
             if (typeof entry[1] === "string") {
                 automationID += `${entry[0]}:${entry[1]}/`;
             }
@@ -208,7 +432,7 @@ async function getRef() {
     if ((hasRefInput || hasShaInput) && !(hasRefInput && hasShaInput)) {
         throw new Error("Both 'ref' and 'sha' are required if one of them is provided.");
     }
-    const ref = refInput || getRefFromEnv();
+    const ref = refInput || (0, util_1.getRequiredEnvParam)("GITHUB_REF");
     const sha = shaInput || (0, util_1.getRequiredEnvParam)("GITHUB_SHA");
     // If the ref is a user-provided input, we have to skip logic
     // and assume that it is really where they want to upload the results.
@@ -241,26 +465,6 @@ async function getRef() {
     }
 }
 exports.getRef = getRef;
-function getRefFromEnv() {
-    // To workaround a limitation of Actions dynamic workflows not setting
-    // the GITHUB_REF in some cases, we accept also the ref within the
-    // CODE_SCANNING_REF variable. When possible, however, we prefer to use
-    // the GITHUB_REF as that is a protected variable and cannot be overwritten.
-    let refEnv;
-    try {
-        refEnv = (0, util_1.getRequiredEnvParam)("GITHUB_REF");
-    }
-    catch (e) {
-        // If the GITHUB_REF is not set, we try to rescue by getting the
-        // CODE_SCANNING_REF.
-        const maybeRef = process.env["CODE_SCANNING_REF"];
-        if (maybeRef === undefined || maybeRef.length === 0) {
-            throw e;
-        }
-        refEnv = maybeRef;
-    }
-    return refEnv;
-}
 function getActionsStatus(error, otherFailureCause) {
     if (error || otherFailureCause) {
         return error instanceof util_1.UserError ? "user-error" : "failure";
@@ -375,7 +579,7 @@ async function sendStatusReport(statusReport) {
     }
     const nwo = (0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY");
     const [owner, repo] = nwo.split("/");
-    const client = api.getApiClient();
+    const client = api.getActionsApiClient();
     try {
         await client.request("PUT /repos/:owner/:repo/code-scanning/analysis/status", {
             owner,

lib/actions-util.test.js

@@ -25,10 +25,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
+const yaml = __importStar(require("js-yaml"));
 const sinon = __importStar(require("sinon"));
 const actionsutil = __importStar(require("./actions-util"));
 const testing_utils_1 = require("./testing-utils");
 const util_1 = require("./util");
+function errorCodes(actual, expected) {
+    return [actual.map(({ code }) => code), expected.map(({ code }) => code)];
+}
 (0, testing_utils_1.setupTests)(ava_1.default);
 (0, ava_1.default)("getRef() throws on the empty string", async (t) => {
     process.env["GITHUB_REF"] = "";
@@ -94,30 +98,6 @@ const util_1 = require("./util");
         getAdditionalInputStub.restore();
     });
 });
-(0, ava_1.default)("getRef() returns CODE_SCANNING_REF as a fallback for GITHUB_REF", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        const expectedRef = "refs/pull/1/HEAD";
-        const currentSha = "a".repeat(40);
-        process.env["CODE_SCANNING_REF"] = expectedRef;
-        process.env["GITHUB_REF"] = "";
-        process.env["GITHUB_SHA"] = currentSha;
-        const actualRef = await actionsutil.getRef();
-        t.deepEqual(actualRef, expectedRef);
-    });
-});
-(0, ava_1.default)("getRef() returns GITHUB_REF over CODE_SCANNING_REF if both are provided", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        const expectedRef = "refs/pull/1/merge";
-        const currentSha = "a".repeat(40);
-        process.env["CODE_SCANNING_REF"] = "refs/pull/1/HEAD";
-        process.env["GITHUB_REF"] = expectedRef;
-        process.env["GITHUB_SHA"] = currentSha;
-        const actualRef = await actionsutil.getRef();
-        t.deepEqual(actualRef, expectedRef);
-    });
-});
 (0, ava_1.default)("getRef() throws an error if only `ref` is provided as an input", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
@@ -163,9 +143,340 @@ const util_1 = require("./util");
     actualAutomationID = actionsutil.computeAutomationID(".github/workflows/codeql-analysis.yml:analyze", undefined);
     t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
 });
+(0, ava_1.default)("getWorkflowErrors() when on is empty", (t) => {
+    const errors = actionsutil.getWorkflowErrors({ on: {} });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is an array missing pull_request", (t) => {
+    const errors = actionsutil.getWorkflowErrors({ on: ["push"] });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is an array missing push", (t) => {
+    const errors = actionsutil.getWorkflowErrors({ on: ["pull_request"] });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MissingPushHook]));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is valid", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: ["push", "pull_request"],
+    });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is a valid superset", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: ["push", "pull_request", "schedule"],
+    });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push should not have a path", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["main"], paths: ["test/*"] },
+            pull_request: { branches: ["main"] },
+        },
+    });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.PathsSpecified]));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is a correct object", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
+    });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.pull_requests is a string", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: { push: { branches: ["main"] }, pull_request: { branches: "*" } },
+    });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.pull_requests is a string and correct", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: { push: { branches: "*" }, pull_request: { branches: "*" } },
+    });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is correct with empty objects", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.load(`
+on:
+  push:
+  pull_request:
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is mismatched", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["feature"] },
+        },
+    });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is not mismatched", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["main", "feature"] },
+            pull_request: { branches: ["main"] },
+        },
+    });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push is mismatched for pull_request", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["main"] },
+            pull_request: { branches: ["main", "feature"] },
+        },
+    });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
+});
+(0, ava_1.default)("getWorkflowErrors() for a range of malformed workflows", (t) => {
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: {
+            push: 1,
+            pull_request: 1,
+        },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: 1,
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: [1],
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { 1: 1 },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: 1 },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: [1] },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: { steps: 1 } },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: { steps: [{ notrun: "git checkout HEAD^2" }] } },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: [undefined] },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(1), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: {
+            push: {
+                branches: 1,
+            },
+            pull_request: {
+                branches: 1,
+            },
+        },
+    }), []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.pull_request for every branch but push specifies branches", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+`));
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.pull_request for wildcard branches", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["feature/*"] },
+            pull_request: { branches: "feature/moose" },
+        },
+    });
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.pull_request for mismatched wildcard branches", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["feature/moose"] },
+            pull_request: { branches: "feature/*" },
+        },
+    });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
+});
+(0, ava_1.default)("getWorkflowErrors() when HEAD^2 is checked out", (t) => {
+    process.env.GITHUB_JOB = "test";
+    const errors = actionsutil.getWorkflowErrors({
+        on: ["push", "pull_request"],
+        jobs: { test: { steps: [{ run: "git checkout HEAD^2" }] } },
+    });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]));
+});
+(0, ava_1.default)("formatWorkflowErrors() when there is one error", (t) => {
+    const message = actionsutil.formatWorkflowErrors([
+        actionsutil.WorkflowErrors.CheckoutWrongHead,
+    ]);
+    t.true(message.startsWith("1 issue was detected with this workflow:"));
+});
+(0, ava_1.default)("formatWorkflowErrors() when there are multiple errors", (t) => {
+    const message = actionsutil.formatWorkflowErrors([
+        actionsutil.WorkflowErrors.CheckoutWrongHead,
+        actionsutil.WorkflowErrors.PathsSpecified,
+    ]);
+    t.true(message.startsWith("2 issues were detected with this workflow:"));
+});
+(0, ava_1.default)("formatWorkflowCause() with no errors", (t) => {
+    const message = actionsutil.formatWorkflowCause([]);
+    t.deepEqual(message, undefined);
+});
+(0, ava_1.default)("formatWorkflowCause()", (t) => {
+    const message = actionsutil.formatWorkflowCause([
+        actionsutil.WorkflowErrors.CheckoutWrongHead,
+        actionsutil.WorkflowErrors.PathsSpecified,
+    ]);
+    t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
+    t.deepEqual(actionsutil.formatWorkflowCause([]), undefined);
+});
+(0, ava_1.default)("patternIsSuperset()", (t) => {
+    t.false(actionsutil.patternIsSuperset("main-*", "main"));
+    t.true(actionsutil.patternIsSuperset("*", "*"));
+    t.true(actionsutil.patternIsSuperset("*", "main-*"));
+    t.false(actionsutil.patternIsSuperset("main-*", "*"));
+    t.false(actionsutil.patternIsSuperset("main-*", "main"));
+    t.true(actionsutil.patternIsSuperset("main", "main"));
+    t.false(actionsutil.patternIsSuperset("*", "feature/*"));
+    t.true(actionsutil.patternIsSuperset("**", "feature/*"));
+    t.false(actionsutil.patternIsSuperset("feature-*", "**"));
+    t.false(actionsutil.patternIsSuperset("a/**/c", "a/**/d"));
+    t.false(actionsutil.patternIsSuperset("a/**/c", "a/**"));
+    t.true(actionsutil.patternIsSuperset("a/**", "a/**/c"));
+    t.true(actionsutil.patternIsSuperset("a/**/c", "a/main-**/c"));
+    t.false(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/d/**/c"));
+    t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/c/**/c"));
+    t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/d/**/c"));
+    t.false(actionsutil.patternIsSuperset("a/**/c/d/**/c", "a/**/b/**/c"));
+    t.false(actionsutil.patternIsSuperset("a/main-**/c", "a/**/c"));
+    t.true(actionsutil.patternIsSuperset("/robin/*/release/*", "/robin/moose/release/goose"));
+    t.false(actionsutil.patternIsSuperset("/robin/moose/release/goose", "/robin/*/release/*"));
+});
+(0, ava_1.default)("getWorkflowErrors() when branches contain dots", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.load(`
+  on:
+    push:
+      branches: [4.1, master]
+    pull_request:
+      # The branches below must be a subset of the branches above
+      branches: [4.1, master]
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on.push has a trailing comma", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master, ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() should only report the current job's CheckoutWrongHead", (t) => {
+    process.env.GITHUB_JOB = "test";
+    const errors = actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+jobs:
+  test:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test2:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test3:
+    steps: []
+`));
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]));
+});
+(0, ava_1.default)("getWorkflowErrors() should not report a different job's CheckoutWrongHead", (t) => {
+    process.env.GITHUB_JOB = "test3";
+    const errors = actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+jobs:
+  test:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test2:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test3:
+    steps: []
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() when on is missing", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+(0, ava_1.default)("getWorkflowErrors() with a different on setup", (t) => {
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on: "workflow_dispatch"
+`)), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on: [workflow_dispatch]
+`)), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on:
+  workflow_dispatch: {}
+`)), []));
+});
+(0, ava_1.default)("getWorkflowErrors() should not report an error if PRs are totally unconfigured", (t) => {
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+`)), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.load(`
+name: "CodeQL"
+on: ["push"]
+`)), []));
+});
 (0, ava_1.default)("initializeEnvironment", (t) => {
-    (0, util_1.initializeEnvironment)("1.2.3");
+    (0, util_1.initializeEnvironment)(util_1.Mode.actions, "1.2.3");
+    t.deepEqual((0, util_1.getMode)(), util_1.Mode.actions);
     t.deepEqual(process.env.CODEQL_ACTION_VERSION, "1.2.3");
+    (0, util_1.initializeEnvironment)(util_1.Mode.runner, "4.5.6");
+    t.deepEqual((0, util_1.getMode)(), util_1.Mode.runner);
+    t.deepEqual(process.env.CODEQL_ACTION_VERSION, "4.5.6");
 });
 (0, ava_1.default)("isAnalyzingDefaultBranch()", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {

lib/analyze-action-env.test.js

@@ -45,7 +45,6 @@ const util = __importStar(require("./util"));
             .stub(actionsUtil, "createStatusReportBase")
             .resolves({});
         sinon.stub(actionsUtil, "sendStatusReport").resolves(true);
-        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
         const gitHubVersion = {
             type: util.GitHubVariant.DOTCOM,
         };

lib/analyze-action-env.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-action-env.test.js","sourceRoot":"","sources":["../src/analyze-action-env.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,4DAA8C;AAC9C,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,8DAA8D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;aAC3C,QAAQ,CAAC,EAAkC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEnE,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,uEAAuE;QACvE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analyze-action-env.test.js","sourceRoot":"","sources":["../src/analyze-action-env.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,4DAA8C;AAC9C,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,8DAA8D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;aAC3C,QAAQ,CAAC,EAAkC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,uEAAuE;QACvE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action-input.test.js

@@ -61,7 +61,6 @@ const util = __importStar(require("./util"));
         optionalInputStub.withArgs("cleanup-level").returns("none");
         optionalInputStub.withArgs("expect-error").returns("false");
         sinon.stub(util, "getGitHubVersion").resolves(gitHubVersion);
-        sinon.stub(actionsUtil, "isAnalyzingDefaultBranch").resolves(true);
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
         (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {});
         process.env["CODEQL_THREADS"] = "1";

lib/analyze-action-input.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-action-input.test.js","sourceRoot":"","sources":["../src/analyze-action-input.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,4DAA8C;AAC9C,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,sDAAsD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;aAC3C,QAAQ,CAAC,EAAkC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnE,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,4DAA4D;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analyze-action-input.test.js","sourceRoot":"","sources":["../src/analyze-action-input.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,4DAA8C;AAC9C,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,sDAAsD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;aAC3C,QAAQ,CAAC,EAAkC,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,4DAA4D;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action.js

@@ -39,7 +39,6 @@ const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
 const repository_1 = require("./repository");
-const shared_environment_1 = require("./shared-environment");
 const trap_caching_1 = require("./trap-caching");
 const upload_lib = __importStar(require("./upload-lib"));
 const util = __importStar(require("./util"));
@@ -97,38 +96,37 @@ function doesGoExtractionOutputExist(config) {
         ].some((ext) => fileName.endsWith(ext))));
 }
 /**
- * We attempt to autobuild Go to preserve compatibility for users who have
- * set up Go using a legacy scanning style CodeQL workflow, i.e. one without
- * an autobuild step or manual build steps.
+ * When Go extraction reconciliation is enabled, either via the feature
+ * or an environment variable, we will attempt to autobuild Go to preserve
+ * compatibility for users who have set up Go using a legacy scanning style
+ * CodeQL workflow, i.e. one without an autobuild step or manual build
+ * steps.
  *
  * - We detect whether an autobuild step is present by checking the
  * `util.DID_AUTOBUILD_GO_ENV_VAR_NAME` environment variable, which is set
  * when the autobuilder is invoked.
- * - We detect whether the Go database has already been finalized in case it
- * has been manually set in a prior Action step.
  * - We approximate whether manual build steps are present by looking at
  * whether any extraction output already exists for Go.
  */
-async function runAutobuildIfLegacyGoWorkflow(config, logger) {
+async function runAutobuildIfLegacyGoWorkflow(config, featureEnablement, logger) {
     if (!config.languages.includes(languages_1.Language.go)) {
         return;
     }
-    if (process.env[util.DID_AUTOBUILD_GO_ENV_VAR_NAME] === "true") {
-        logger.debug("Won't run Go autobuild since it has already been run.");
+    if (!(await util.isGoExtractionReconciliationEnabled(featureEnablement))) {
+        logger.debug("Won't run Go autobuild since Go extraction reconciliation is not enabled.");
         return;
     }
-    if ((0, analyze_1.dbIsFinalized)(config, languages_1.Language.go, logger)) {
-        logger.debug("Won't run Go autobuild since there is already a finalized database for Go.");
+    if (process.env[util.DID_AUTOBUILD_GO_ENV_VAR_NAME] === "true") {
+        // This log line is info level while Go extraction reconciliation is in beta.
+        // We will make it debug level once Go extraction reconciliation is GA.
+        logger.info("Won't run Go autobuild since it has already been run.");
         return;
     }
     // This captures whether a user has added manual build steps for Go
     if (doesGoExtractionOutputExist(config)) {
-        logger.debug("Won't run Go autobuild since at least one file of Go code has already been extracted.");
-        // If the user has run the manual build step, and has set the `CODEQL_EXTRACTOR_GO_BUILD_TRACING`
-        // variable, we suggest they remove it from their workflow.
-        if ("CODEQL_EXTRACTOR_GO_BUILD_TRACING" in process.env) {
-            logger.warning(`The CODEQL_EXTRACTOR_GO_BUILD_TRACING environment variable has no effect on workflows with manual build steps, so we recommend that you remove it from your workflow.`);
-        }
+        // This log line is info level while Go extraction reconciliation is in beta.
+        // We will make it debug level once Go extraction reconciliation is GA.
+        logger.info("Won't run Go autobuild since at least one file of Go code has already been extracted.");
         return;
     }
     await (0, autobuild_1.runAutobuild)(languages_1.Language.go, config, logger);
@@ -141,7 +139,7 @@ async function run() {
     let trapCacheUploadTime = undefined;
     let dbCreationTimings = undefined;
     let didUploadTrapCaches = false;
-    util.initializeEnvironment(pkg.version);
+    util.initializeEnvironment(util.Mode.actions, pkg.version);
     await util.checkActionVersion(pkg.version);
     const logger = (0, logging_1.getActionsLogger)();
     try {
@@ -155,16 +153,16 @@ async function run() {
         if (hasBadExpectErrorInput()) {
             throw new Error("`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork.");
         }
-        await util.enrichEnvironment(await (0, codeql_1.getCodeQL)(config.codeQLCmd));
+        await util.enrichEnvironment(util.Mode.actions, await (0, codeql_1.getCodeQL)(config.codeQLCmd));
         const apiDetails = (0, api_client_1.getApiDetails)();
         const outputDir = actionsUtil.getRequiredInput("output");
         const threads = util.getThreadsFlag(actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"], logger);
         const memory = util.getMemoryFlag(actionsUtil.getOptionalInput("ram") || process.env["CODEQL_RAM"]);
         const repositoryNwo = (0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY"));
-        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
-        const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, actionsUtil.getTemporaryDirectory(), logger);
-        await runAutobuildIfLegacyGoWorkflow(config, logger);
-        dbCreationTimings = await (0, analyze_1.runFinalize)(outputDir, threads, memory, config, logger);
+        const gitHubVersion = await (0, api_client_1.getGitHubVersionActionsOnly)();
+        const features = new feature_flags_1.Features(gitHubVersion, apiDetails, repositoryNwo, logger);
+        await runAutobuildIfLegacyGoWorkflow(config, features, logger);
+        dbCreationTimings = await (0, analyze_1.runFinalize)(outputDir, threads, memory, config, logger, features);
         if (actionsUtil.getRequiredInput("skip-queries") !== "true") {
             runStats = await (0, analyze_1.runQueries)(outputDir, memory, util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), threads, actionsUtil.getOptionalInput("category"), config, logger, features);
         }
@@ -177,7 +175,7 @@ async function run() {
         }
         core.setOutput("db-locations", dbLocations);
         if (runStats && actionsUtil.getRequiredInput("upload") === "true") {
-            uploadResult = await upload_lib.uploadFromActions(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger);
+            uploadResult = await upload_lib.uploadFromActions(outputDir, config.gitHubVersion, apiDetails, logger);
             core.setOutput("sarif-id", uploadResult.sarifID);
         }
         else {
@@ -196,13 +194,12 @@ async function run() {
         }
         else if (uploadResult !== undefined &&
             actionsUtil.getRequiredInput("wait-for-processing") === "true") {
-            await upload_lib.waitForProcessing((0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), uploadResult.sarifID, (0, logging_1.getActionsLogger)());
+            await upload_lib.waitForProcessing((0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), uploadResult.sarifID, apiDetails, (0, logging_1.getActionsLogger)());
         }
         // If we did not throw an error yet here, but we expect one, throw it.
         if (actionsUtil.getOptionalInput("expect-error") === "true") {
             core.setFailed(`expect-error input was set to true but no error was thrown.`);
         }
-        core.exportVariable(shared_environment_1.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
     }
     catch (origError) {
         const error = origError instanceof Error ? origError : new Error(String(origError));
@@ -210,6 +207,7 @@ async function run() {
             hasBadExpectErrorInput()) {
             core.setFailed(error.message);
         }
+        console.log(error);
         if (error instanceof analyze_1.CodeQLAnalysisError) {
             const stats = { ...error.queriesStatusReport };
             await sendStatusReport(startedAt, config, stats, error, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger);
@@ -239,6 +237,7 @@ async function runWrapper() {
     }
     catch (error) {
         core.setFailed(`analyze action failed: ${error}`);
+        console.log(error);
     }
     await (0, util_1.checkForTimeout)();
 }

lib/analyze.js

@@ -32,6 +32,7 @@ const yaml = __importStar(require("js-yaml"));
 const analysisPaths = __importStar(require("./analysis-paths"));
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
+const count_loc_1 = require("./count-loc");
 const languages_1 = require("./languages");
 const sharedEnv = __importStar(require("./shared-environment"));
 const tracer_config_1 = require("./tracer-config");
@@ -50,7 +51,6 @@ async function setupPythonExtractor(logger) {
         // If CODEQL_PYTHON is not set, no dependencies were installed, so we don't need to do anything
         return;
     }
-    const scriptsFolder = path.resolve(__dirname, "../python-setup");
     let output = "";
     const options = {
         listeners: {
@@ -59,7 +59,10 @@ async function setupPythonExtractor(logger) {
             },
         },
     };
-    await new toolrunner.ToolRunner(codeqlPython, [path.join(scriptsFolder, "find_site_packages.py")], options).exec();
+    await new toolrunner.ToolRunner(codeqlPython, [
+        "-c",
+        "import os; import pip; print(os.path.dirname(os.path.dirname(pip.__file__)))",
+    ], options).exec();
     logger.info(`Setting LGTM_INDEX_IMPORT_PATH=${output}`);
     process.env["LGTM_INDEX_IMPORT_PATH"] = output;
     output = "";
@@ -67,12 +70,12 @@ async function setupPythonExtractor(logger) {
     logger.info(`Setting LGTM_PYTHON_SETUP_VERSION=${output}`);
     process.env["LGTM_PYTHON_SETUP_VERSION"] = output;
 }
-async function createdDBForScannedLanguages(codeql, config, logger) {
+async function createdDBForScannedLanguages(codeql, config, logger, featureEnablement) {
     // Insert the LGTM_INDEX_X env vars at this point so they are set when
     // we extract any scanned languages.
     analysisPaths.includeAndExcludeAnalysisPaths(config);
     for (const language of config.languages) {
-        if ((0, languages_1.isScannedLanguage)(language) &&
+        if ((0, languages_1.isScannedLanguage)(language, await util.isGoExtractionReconciliationEnabled(featureEnablement), logger) &&
             !dbIsFinalized(config, language, logger)) {
             logger.startGroup(`Extracting ${language}`);
             if (language === languages_1.Language.python) {
@@ -96,10 +99,10 @@ function dbIsFinalized(config, language, logger) {
     }
 }
 exports.dbIsFinalized = dbIsFinalized;
-async function finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger) {
+async function finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger, featureEnablement) {
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     const extractionStart = perf_hooks_1.performance.now();
-    await createdDBForScannedLanguages(codeql, config, logger);
+    await createdDBForScannedLanguages(codeql, config, logger, featureEnablement);
     const extractionTime = perf_hooks_1.performance.now() - extractionStart;
     const trapImportStart = perf_hooks_1.performance.now();
     for (const language of config.languages) {
@@ -121,15 +124,32 @@ async function finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger)
 // Runs queries and creates sarif files in the given folder
 async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag, automationDetailsId, config, logger, featureEnablement) {
     const statusReport = {};
+    let locPromise = Promise.resolve({});
+    const cliCanCountBaseline = await cliCanCountLoC();
+    const countLocDebugMode = process.env["INTERNAL_CODEQL_ACTION_DEBUG_LOC"] || config.debugMode;
+    if (!cliCanCountBaseline || countLocDebugMode) {
+        // count the number of lines in the background
+        locPromise = (0, count_loc_1.countLoc)(path.resolve(), 
+        // config.paths specifies external directories. the current
+        // directory is included in the analysis by default. Replicate
+        // that here.
+        config.paths, config.pathsIgnore, config.languages, logger);
+    }
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     await util.logCodeScanningConfigInCli(codeql, featureEnablement, logger);
     for (const language of config.languages) {
         const queries = config.queries[language];
         const queryFilters = validateQueryFilters(config.originalUserInput["query-filters"]);
         const packsWithVersion = config.packs[language] || [];
+        const hasBuiltinQueries = (queries === null || queries === void 0 ? void 0 : queries.builtin.length) > 0;
+        const hasCustomQueries = (queries === null || queries === void 0 ? void 0 : queries.custom.length) > 0;
+        const hasPackWithCustomQueries = packsWithVersion.length > 0;
+        if (!hasBuiltinQueries && !hasCustomQueries && !hasPackWithCustomQueries) {
+            throw new Error(`Unable to analyse ${language} as no queries were selected for this language`);
+        }
         try {
             if (await util.useCodeScanningConfigInCli(codeql, featureEnablement)) {
-                // If we are using the code scanning config in the CLI,
+                // If we are using the codescanning config in the CLI,
                 // much of the work needed to generate the query suites
                 // is done in the CLI. We just need to make a single
                 // call to run all the queries for each language and
@@ -151,15 +171,6 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
                 logger.info(analysisSummary);
             }
             else {
-                // config was generated by the action, so must be interpreted by the action.
-                const hasBuiltinQueries = (queries === null || queries === void 0 ? void 0 : queries.builtin.length) > 0;
-                const hasCustomQueries = (queries === null || queries === void 0 ? void 0 : queries.custom.length) > 0;
-                const hasPackWithCustomQueries = packsWithVersion.length > 0;
-                if (!hasBuiltinQueries &&
-                    !hasCustomQueries &&
-                    !hasPackWithCustomQueries) {
-                    throw new Error(`Unable to analyze ${language} as no queries were selected for this language`);
-                }
                 logger.startGroup(`Running queries for ${language}`);
                 const querySuitePaths = [];
                 if (queries["builtin"].length > 0) {
@@ -189,13 +200,21 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
                 const startTimeInterpretResults = new Date().getTime();
                 const sarifFile = path.join(sarifFolder, `${language}.sarif`);
                 const analysisSummary = await runInterpretResults(language, querySuitePaths, sarifFile, config.debugMode);
+                if (!cliCanCountBaseline) {
+                    await injectLinesOfCode(sarifFile, language, locPromise);
+                }
                 statusReport[`interpret_results_${language}_duration_ms`] =
                     new Date().getTime() - startTimeInterpretResults;
                 logger.endGroup();
                 logger.info(analysisSummary);
             }
+            if (!cliCanCountBaseline || countLocDebugMode) {
+                printLinesOfCodeSummary(logger, language, await locPromise);
+            }
+            if (cliCanCountBaseline) {
                 logger.info(await runPrintLinesOfCode(language));
             }
+        }
         catch (e) {
             logger.info(String(e));
             if (e instanceof Error) {
@@ -208,7 +227,10 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
     return statusReport;
     async function runInterpretResults(language, queries, sarifFile, enableDebugLogging) {
         const databasePath = util.getCodeQLDatabasePath(config, language);
-        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", automationDetailsId);
+        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", automationDetailsId, featureEnablement);
+    }
+    async function cliCanCountLoC() {
+        return await util.codeQlVersionAbove(await (0, codeql_1.getCodeQL)(config.codeQLCmd), codeql_1.CODEQL_VERSION_COUNTS_LINES);
     }
     async function runPrintLinesOfCode(language) {
         const databasePath = util.getCodeQLDatabasePath(config, language);
@@ -263,7 +285,7 @@ function createQuerySuiteContents(queries, queryFilters) {
     return yaml.dump(queries.map((q) => ({ query: q })).concat(queryFilters));
 }
 exports.createQuerySuiteContents = createQuerySuiteContents;
-async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger) {
+async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger, featureEnablement) {
     try {
         await (0, del_1.default)(outputDir, { force: true });
     }
@@ -273,7 +295,7 @@ async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger) {
         }
     }
     await fs.promises.mkdir(outputDir, { recursive: true });
-    const timings = await finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger);
+    const timings = await finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger, featureEnablement);
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     // WARNING: This does not _really_ end tracing, as the tracer will restore its
     // critical environment variables and it'll still be active for all processes
@@ -282,7 +304,7 @@ async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger) {
     // step.
     if (await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
         // Delete variables as specified by the end-tracing script
-        await (0, tracer_config_1.endTracingForCluster)(config);
+        await (0, tracer_config_1.endTracingForCluster)(config, await util.isGoExtractionReconciliationEnabled(featureEnablement), logger);
     }
     else {
         // Delete the tracer config env var to avoid tracing ourselves
@@ -301,6 +323,34 @@ async function runCleanup(config, cleanupLevel, logger) {
     logger.endGroup();
 }
 exports.runCleanup = runCleanup;
+async function injectLinesOfCode(sarifFile, language, locPromise) {
+    var _a;
+    const lineCounts = await locPromise;
+    if (language in lineCounts) {
+        const sarif = JSON.parse(fs.readFileSync(sarifFile, "utf8"));
+        if (Array.isArray(sarif.runs)) {
+            for (const run of sarif.runs) {
+                run.properties = run.properties || {};
+                run.properties.metricResults = run.properties.metricResults || [];
+                for (const metric of run.properties.metricResults) {
+                    // Baseline is inserted when matching rule has tag lines-of-code
+                    if (metric.rule && metric.rule.toolComponent) {
+                        const matchingRule = run.tool.extensions[metric.rule.toolComponent.index].rules[metric.rule.index];
+                        if ((_a = matchingRule.properties.tags) === null || _a === void 0 ? void 0 : _a.includes("lines-of-code")) {
+                            metric.baseline = lineCounts[language];
+                        }
+                    }
+                }
+            }
+        }
+        fs.writeFileSync(sarifFile, JSON.stringify(sarif));
+    }
+}
+function printLinesOfCodeSummary(logger, language, lineCounts) {
+    if (language in lineCounts) {
+        logger.info(`Counted a baseline of ${lineCounts[language]} lines of code for ${language}.`);
+    }
+}
 // exported for testing
 function validateQueryFilters(queryFilters) {
     if (!queryFilters) {

lib/analyze.test.js

@@ -26,8 +26,10 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
 const yaml = __importStar(require("js-yaml"));
+const sinon = __importStar(require("sinon"));
 const analyze_1 = require("./analyze");
 const codeql_1 = require("./codeql");
+const count = __importStar(require("./count-loc"));
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
@@ -37,6 +39,12 @@ const util = __importStar(require("./util"));
 // and correct case of builtin or custom. Also checks the correct search
 // paths are set in the database analyze invocation.
 (0, ava_1.default)("status report fields and search path setting", async (t) => {
+    const mockLinesOfCode = Object.values(languages_1.Language).reduce((obj, lang, i) => {
+        // use a different line count for each language
+        obj[lang] = i + 1;
+        return obj;
+    }, {});
+    sinon.stub(count, "countLoc").resolves(mockLinesOfCode);
     let searchPathsUsed = [];
     return await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
@@ -90,7 +98,6 @@ const util = __importStar(require("./util"));
                     }));
                     return "";
                 },
-                databasePrintBaseline: async () => "",
             });
             searchPathsUsed = [];
             const config = {
@@ -159,8 +166,32 @@ const util = __importStar(require("./util"));
             t.deepEqual(searchPathsUsed, expectedSearchPathsUsed);
             t.true(`interpret_results_${language}_duration_ms` in customStatusReport);
         }
+        verifyLineCounts(tmpDir);
         verifyQuerySuites(tmpDir);
     });
+    function verifyLineCounts(tmpDir) {
+        // eslint-disable-next-line github/array-foreach
+        Object.keys(languages_1.Language).forEach((lang, i) => {
+            verifyLineCountForFile(path.join(tmpDir, `${lang}.sarif`), i + 1);
+        });
+    }
+    function verifyLineCountForFile(filePath, lineCount) {
+        const sarif = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        t.deepEqual(sarif.runs[0].properties.metricResults, [
+            {
+                rule: {
+                    index: 0,
+                    toolComponent: {
+                        index: 0,
+                    },
+                },
+                value: 123,
+                baseline: lineCount,
+            },
+        ]);
+        // when the rule doesn't exist, it should not be added
+        t.deepEqual(sarif.runs[1].properties.metricResults, []);
+    }
     function verifyQuerySuites(tmpDir) {
         const qlsContent = [
             {

lib/api-client.js

@@ -22,7 +22,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getGitHubVersion = exports.getApiClientWithExternalAuth = exports.getApiClient = exports.getApiDetails = exports.DisallowedAPIVersionReason = void 0;
+exports.getGitHubVersionActionsOnly = exports.getActionsApiClient = exports.getApiDetails = exports.getApiClient = exports.DisallowedAPIVersionReason = void 0;
+const path = __importStar(require("path"));
 const githubUtils = __importStar(require("@actions/github/lib/utils"));
 const retry = __importStar(require("@octokit/plugin-retry"));
 const console_log_level_1 = __importDefault(require("console-log-level"));
@@ -36,14 +37,28 @@ var DisallowedAPIVersionReason;
     DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_OLD"] = 0] = "ACTION_TOO_OLD";
     DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_NEW"] = 1] = "ACTION_TOO_NEW";
 })(DisallowedAPIVersionReason = exports.DisallowedAPIVersionReason || (exports.DisallowedAPIVersionReason = {}));
-function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
+const getApiClient = function (apiDetails, { allowExternal = false } = {}) {
     const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth;
     const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
+    const apiURL = apiDetails.apiURL || deriveApiUrl(apiDetails.url);
     return new retryingOctokit(githubUtils.getOctokitOptions(auth, {
-        baseUrl: apiDetails.apiURL,
-        userAgent: `CodeQL-Action/${pkg.version}`,
+        baseUrl: apiURL,
+        userAgent: `CodeQL-${(0, util_1.getMode)()}/${pkg.version}`,
         log: (0, console_log_level_1.default)({ level: "debug" }),
     }));
+};
+exports.getApiClient = getApiClient;
+// Once the runner is deleted, this can also be removed since the GitHub API URL is always available in an environment variable on Actions.
+function deriveApiUrl(githubUrl) {
+    const url = new URL(githubUrl);
+    // If we detect this is trying to connect to github.com
+    // then return with a fixed canonical URL.
+    if (url.hostname === "github.com" || url.hostname === "api.github.com") {
+        return "https://api.github.com";
+    }
+    // Add the /api/v3 API prefix
+    url.pathname = path.join(url.pathname, "api", "v3");
+    return url.toString();
 }
 function getApiDetails() {
     return {
@@ -53,27 +68,30 @@ function getApiDetails() {
     };
 }
 exports.getApiDetails = getApiDetails;
-function getApiClient() {
-    return createApiClientWithDetails(getApiDetails());
+// Temporary function to aid in the transition to running on and off of github actions.
+// Once all code has been converted this function should be removed or made canonical
+// and called only from the action entrypoints.
+function getActionsApiClient() {
+    return (0, exports.getApiClient)(getApiDetails());
 }
-exports.getApiClient = getApiClient;
-function getApiClientWithExternalAuth(apiDetails) {
-    return createApiClientWithDetails(apiDetails, { allowExternal: true });
-}
-exports.getApiClientWithExternalAuth = getApiClientWithExternalAuth;
+exports.getActionsApiClient = getActionsApiClient;
 let cachedGitHubVersion = undefined;
 /**
  * Report the GitHub server version. This is a wrapper around
  * util.getGitHubVersion() that automatically supplies GitHub API details using
- * GitHub Action inputs.
+ * GitHub Action inputs. If you need to get the GitHub server version from the
+ * Runner, please call util.getGitHubVersion() instead.
  *
  * @returns GitHub version
  */
-async function getGitHubVersion() {
+async function getGitHubVersionActionsOnly() {
+    if (!util.isActions()) {
+        throw new Error("getGitHubVersionActionsOnly() works only in an action");
+    }
     if (cachedGitHubVersion === undefined) {
         cachedGitHubVersion = await util.getGitHubVersion(getApiDetails());
     }
     return cachedGitHubVersion;
 }
-exports.getGitHubVersion = getGitHubVersion;
+exports.getGitHubVersionActionsOnly = getGitHubVersionActionsOnly;
 //# sourceMappingURL=api-client.js.map

lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uEAAyD;AACzD,6DAA+C;AAC/C,0EAAgD;AAEhD,iDAAkD;AAClD,6CAA+B;AAC/B,iCAA4D;AAE5D,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAiBD,SAAS,0BAA0B,CACjC,UAAoC,EACpC,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,EAAE;IAE9B,MAAM,IAAI,GACR,CAAC,aAAa,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;IACpE,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,eAAe,CACxB,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAClC,OAAO,EAAE,UAAU,CAAC,MAAM;QAC1B,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;QACzC,GAAG,EAAE,IAAA,2BAAe,EAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO;QACL,IAAI,EAAE,IAAA,+BAAgB,EAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,IAAA,0BAAmB,EAAC,mBAAmB,CAAC;QAC7C,MAAM,EAAE,IAAA,0BAAmB,EAAC,gBAAgB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAND,sCAMC;AAED,SAAgB,YAAY;IAC1B,OAAO,0BAA0B,CAAC,aAAa,EAAE,CAAC,CAAC;AACrD,CAAC;AAFD,oCAEC;AAED,SAAgB,4BAA4B,CAC1C,UAAoC;IAEpC,OAAO,0BAA0B,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAJD,oEAIC;AAED,IAAI,mBAAmB,GAA8B,SAAS,CAAC;AAE/D;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB;IACpC,IAAI,mBAAmB,KAAK,SAAS,EAAE;QACrC,mBAAmB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;KACpE;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AALD,4CAKC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,uEAAyD;AACzD,6DAA+C;AAC/C,0EAAgD;AAEhD,iDAAkD;AAClD,6CAA+B;AAC/B,iCAAqE;AAErE,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAiBM,MAAM,YAAY,GAAG,UAC1B,UAAoC,EACpC,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,EAAE;IAE9B,MAAM,IAAI,GACR,CAAC,aAAa,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;IACpE,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,IAAI,eAAe,CACxB,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAClC,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,UAAU,IAAA,cAAO,GAAE,IAAI,GAAG,CAAC,OAAO,EAAE;QAC/C,GAAG,EAAE,IAAA,2BAAe,EAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAfW,QAAA,YAAY,gBAevB;AAEF,2IAA2I;AAC3I,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,uDAAuD;IACvD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO;QACL,IAAI,EAAE,IAAA,+BAAgB,EAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,IAAA,0BAAmB,EAAC,mBAAmB,CAAC;QAC7C,MAAM,EAAE,IAAA,0BAAmB,EAAC,gBAAgB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAND,sCAMC;AAED,uFAAuF;AACvF,qFAAqF;AACrF,+CAA+C;AAC/C,SAAgB,mBAAmB;IACjC,OAAO,IAAA,oBAAY,EAAC,aAAa,EAAE,CAAC,CAAC;AACvC,CAAC;AAFD,kDAEC;AAED,IAAI,mBAAmB,GAA8B,SAAS,CAAC;AAE/D;;;;;;;GAOG;AACI,KAAK,UAAU,2BAA2B;IAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;KAC1E;IACD,IAAI,mBAAmB,KAAK,SAAS,EAAE;QACrC,mBAAmB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;KACpE;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AARD,kEAQC"}

lib/api-client.test.js

@@ -25,10 +25,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const githubUtils = __importStar(require("@actions/github/lib/utils"));
 const ava_1 = __importDefault(require("ava"));
 const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
 const api_client_1 = require("./api-client");
 const testing_utils_1 = require("./testing-utils");
-const util = __importStar(require("./util"));
+const util_1 = require("./util");
 // eslint-disable-next-line import/no-commonjs
 const pkg = require("../package.json");
 (0, testing_utils_1.setupTests)(ava_1.default);
@@ -38,23 +37,66 @@ ava_1.default.beforeEach(() => {
     pluginStub = sinon.stub(githubUtils.GitHub, "plugin");
     githubStub = sinon.stub();
     pluginStub.returns(githubStub);
-    util.initializeEnvironment(pkg.version);
+    (0, util_1.initializeEnvironment)(util_1.Mode.actions, pkg.version);
 });
-(0, ava_1.default)("getApiClient", async (t) => {
-    sinon.stub(actionsUtil, "getRequiredInput").withArgs("token").returns("xyz");
-    const requiredEnvParamStub = sinon.stub(util, "getRequiredEnvParam");
-    requiredEnvParamStub
-        .withArgs("GITHUB_SERVER_URL")
-        .returns("http://github.localhost");
-    requiredEnvParamStub
-        .withArgs("GITHUB_API_URL")
-        .returns("http://api.github.localhost");
-    (0, api_client_1.getApiClient)();
-    t.assert(githubStub.calledOnceWithExactly({
+(0, ava_1.default)("Get the client API", async (t) => {
+    doTest(t, {
+        auth: "xyz",
+        externalRepoAuth: "abc",
+        url: "http://hucairz",
+    }, undefined, {
+        auth: "token xyz",
+        baseUrl: "http://hucairz/api/v3",
+        userAgent: `CodeQL-Action/${pkg.version}`,
+    });
+});
+(0, ava_1.default)("Get the client API external", async (t) => {
+    doTest(t, {
+        auth: "xyz",
+        externalRepoAuth: "abc",
+        url: "http://hucairz",
+    }, { allowExternal: true }, {
+        auth: "token abc",
+        baseUrl: "http://hucairz/api/v3",
+        userAgent: `CodeQL-Action/${pkg.version}`,
+    });
+});
+(0, ava_1.default)("Get the client API external not present", async (t) => {
+    doTest(t, {
+        auth: "xyz",
+        url: "http://hucairz",
+    }, { allowExternal: true }, {
+        auth: "token xyz",
+        baseUrl: "http://hucairz/api/v3",
+        userAgent: `CodeQL-Action/${pkg.version}`,
+    });
+});
+(0, ava_1.default)("Get the client API with github url", async (t) => {
+    doTest(t, {
+        auth: "xyz",
+        url: "https://github.com/some/invalid/url",
+    }, undefined, {
+        auth: "token xyz",
+        baseUrl: "https://api.github.com",
+        userAgent: `CodeQL-Action/${pkg.version}`,
+    });
+});
+(0, ava_1.default)("Get the API with an API URL directly", async (t) => {
+    doTest(t, {
+        auth: "xyz",
+        url: "http://github.localhost",
+        apiURL: "http://api.github.localhost",
+    }, undefined, {
         auth: "token xyz",
         baseUrl: "http://api.github.localhost",
-        log: sinon.match.any,
         userAgent: `CodeQL-Action/${pkg.version}`,
-    }));
+    });
 });
+function doTest(t, clientArgs, clientOptions, expected) {
+    (0, api_client_1.getApiClient)(clientArgs, clientOptions);
+    const firstCallArgs = githubStub.args[0];
+    // log is a function, so we don't need to test for equality of it
+    delete firstCallArgs[0].log;
+    t.deepEqual(firstCallArgs, [expected]);
+}
 //# sourceMappingURL=api-client.test.js.map

lib/api-client.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.test.js","sourceRoot":"","sources":["../src/api-client.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,uEAAyD;AACzD,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,6CAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAI,UAA2B,CAAC;AAChC,IAAI,UAA2B,CAAC;AAEhC,aAAI,CAAC,UAAU,CAAC,GAAG,EAAE;IACnB,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,oBAAoB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACrE,oBAAoB;SACjB,QAAQ,CAAC,mBAAmB,CAAC;SAC7B,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtC,oBAAoB;SACjB,QAAQ,CAAC,gBAAgB,CAAC;SAC1B,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,IAAA,yBAAY,GAAE,CAAC;IAEf,CAAC,CAAC,MAAM,CACN,UAAU,CAAC,qBAAqB,CAAC;QAC/B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,6BAA6B;QACtC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG;QACpB,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;KAC1C,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"api-client.test.js","sourceRoot":"","sources":["../src/api-client.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,uEAAyD;AACzD,8CAA6C;AAC7C,6CAA+B;AAE/B,6CAA4C;AAC5C,mDAA6C;AAC7C,iCAAqD;AAErD,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAI,UAA2B,CAAC;AAChC,IAAI,UAA2B,CAAC;AAEhC,aAAI,CAAC,UAAU,CAAC,GAAG,EAAE;IACnB,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAA,4BAAqB,EAAC,WAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrC,MAAM,CACJ,CAAC,EACD;QACE,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,KAAK;QACvB,GAAG,EAAE,gBAAgB;KACtB,EACD,SAAS,EACT;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uBAAuB;QAChC,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;KAC1C,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC9C,MAAM,CACJ,CAAC,EACD;QACE,IAAI,EAAE,KAAK;QACX,gBAAgB,EAAE,KAAK;QACvB,GAAG,EAAE,gBAAgB;KACtB,EACD,EAAE,aAAa,EAAE,IAAI,EAAE,EACvB;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uBAAuB;QAChC,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;KAC1C,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1D,MAAM,CACJ,CAAC,EACD;QACE,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,gBAAgB;KACtB,EACD,EAAE,aAAa,EAAE,IAAI,EAAE,EACvB;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,uBAAuB;QAChC,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;KAC1C,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,oCAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrD,MAAM,CACJ,CAAC,EACD;QACE,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,qCAAqC;KAC3C,EACD,SAAS,EACT;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,wBAAwB;QACjC,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;KAC1C,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvD,MAAM,CACJ,CAAC,EACD;QACE,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,yBAAyB;QAC9B,MAAM,EAAE,6BAA6B;KACtC,EACD,SAAS,EACT;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,6BAA6B;QACtC,SAAS,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE;KAC1C,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,SAAS,MAAM,CACb,CAA4B,EAC5B,UAAe,EACf,aAAkB,EAClB,QAAa;IAEb,IAAA,yBAAY,EAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExC,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,iEAAiE;IACjE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5B,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzC,CAAC"}

lib/api-compatibility.json

@@ -1 +1 @@
-{ "maximumVersion": "3.8", "minimumVersion": "3.4" }
+{ "maximumVersion": "3.7", "minimumVersion": "3.3" }

lib/autobuild-action.js

@@ -24,13 +24,15 @@ const actions_util_1 = require("./actions-util");
 const api_client_1 = require("./api-client");
 const autobuild_1 = require("./autobuild");
 const configUtils = __importStar(require("./config-utils"));
+const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
+const repository_1 = require("./repository");
 const util_1 = require("./util");
 // eslint-disable-next-line import/no-commonjs
 const pkg = require("../package.json");
 async function sendCompletedStatusReport(startedAt, allLanguages, failingLanguage, cause) {
-    (0, util_1.initializeEnvironment)(pkg.version);
+    (0, util_1.initializeEnvironment)(util_1.Mode.actions, pkg.version);
     const status = (0, actions_util_1.getActionsStatus)(cause, failingLanguage);
     const statusReportBase = await (0, actions_util_1.createStatusReportBase)("autobuild", status, startedAt, cause === null || cause === void 0 ? void 0 : cause.message, cause === null || cause === void 0 ? void 0 : cause.stack);
     const statusReport = {
@@ -50,13 +52,14 @@ async function run() {
         if (!(await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)("autobuild", "starting", startedAt)))) {
             return;
         }
-        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
-        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
+        const gitHubVersion = await (0, api_client_1.getGitHubVersionActionsOnly)();
+        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger, util_1.Mode.actions);
+        const features = new feature_flags_1.Features(gitHubVersion, (0, api_client_1.getApiDetails)(), (0, repository_1.parseRepositoryNwo)((0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY")), logger);
         const config = await configUtils.getConfig((0, actions_util_1.getTemporaryDirectory)(), logger);
         if (config === undefined) {
             throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
         }
-        languages = await (0, autobuild_1.determineAutobuildLanguages)(config, logger);
+        languages = await (0, autobuild_1.determineAutobuildLanguages)(config, features, logger);
         if (languages !== undefined) {
             const workingDirectory = (0, actions_util_1.getOptionalInput)("working-directory");
             if (workingDirectory) {

lib/autobuild-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAOwB;AACxB,6CAAgD;AAChD,2CAAwE;AACxE,4DAA8C;AAC9C,2CAAuC;AACvC,uCAA6C;AAC7C,iCAKgB;AAEhB,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AASvC,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;IAEb,IAAA,4BAAqB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAAsB,EACnD,WAAW,EACX,MAAM,EACN,SAAS,EACT,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,EACd,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,IAAA,+BAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,MAAM,IAAA,yBAAkB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,eAAe,GAAyB,SAAS,CAAC;IACtD,IAAI,SAAS,GAA2B,SAAS,CAAC;IAClD,IAAI;QACF,IACE,CAAC,CAAC,MAAM,IAAA,+BAAgB,EACtB,MAAM,IAAA,qCAAsB,EAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CACjE,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QAED,SAAS,GAAG,MAAM,IAAA,uCAA2B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE;YAC3B,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;YAC/D,IAAI,gBAAgB,EAAE;gBACpB,MAAM,CAAC,IAAI,CACT,6CAA6C,gBAAgB,EAAE,CAChE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;aACjC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;gBAChC,eAAe,GAAG,QAAQ,CAAC;gBAC3B,MAAM,IAAA,wBAAY,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,EAAE,EAAE;oBAC5B,IAAI,CAAC,cAAc,CAAC,oCAA6B,EAAE,MAAM,CAAC,CAAC;iBAC5D;aACF;SACF;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CACZ,mIACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,yBAAyB,CAC7B,SAAS,EACT,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,EACf,eAAe,EACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAOwB;AACxB,6CAA0E;AAC1E,2CAAwE;AACxE,4DAA8C;AAC9C,mDAA2C;AAC3C,2CAAuC;AACvC,uCAA6C;AAC7C,6CAAkD;AAClD,iCAOgB;AAEhB,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AASvC,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;IAEb,IAAA,4BAAqB,EAAC,WAAI,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAAsB,EACnD,WAAW,EACX,MAAM,EACN,SAAS,EACT,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,EACd,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,IAAA,+BAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,MAAM,IAAA,yBAAkB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,eAAe,GAAyB,SAAS,CAAC;IACtD,IAAI,SAAS,GAA2B,SAAS,CAAC;IAClD,IAAI;QACF,IACE,CAAC,CAAC,MAAM,IAAA,+BAAgB,EACtB,MAAM,IAAA,qCAAsB,EAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CACjE,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,wCAA2B,GAAE,CAAC;QAC1D,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,EAAE,WAAI,CAAC,OAAO,CAAC,CAAC;QAE/D,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,IAAA,0BAAa,GAAE,EACf,IAAA,+BAAkB,EAAC,IAAA,0BAAmB,EAAC,mBAAmB,CAAC,CAAC,EAC5D,MAAM,CACP,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QAED,SAAS,GAAG,MAAM,IAAA,uCAA2B,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,SAAS,KAAK,SAAS,EAAE;YAC3B,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;YAC/D,IAAI,gBAAgB,EAAE;gBACpB,MAAM,CAAC,IAAI,CACT,6CAA6C,gBAAgB,EAAE,CAChE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;aACjC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;gBAChC,eAAe,GAAG,QAAQ,CAAC;gBAC3B,MAAM,IAAA,wBAAY,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,EAAE,EAAE;oBAC5B,IAAI,CAAC,cAAc,CAAC,oCAA6B,EAAE,MAAM,CAAC,CAAC;iBAC5D;aACF;SACF;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CACZ,mIACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,yBAAyB,CAC7B,SAAS,EACT,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,EACf,eAAe,EACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/autobuild.js

@@ -1,14 +1,35 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAutobuild = exports.determineAutobuildLanguages = void 0;
 const codeql_1 = require("./codeql");
 const languages_1 = require("./languages");
-async function determineAutobuildLanguages(config, logger) {
+const util = __importStar(require("./util"));
+async function determineAutobuildLanguages(config, featureEnablement, logger) {
+    const isGoExtractionReconciliationEnabled = await util.isGoExtractionReconciliationEnabled(featureEnablement);
     // Attempt to find a language to autobuild
     // We want pick the dominant language in the repo from the ones we're able to build
     // The languages are sorted in order specified by user or by lines of code if we got
     // them from the GitHub API, so try to build the first language on the list.
-    const autobuildLanguages = config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l));
+    const autobuildLanguages = config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l, isGoExtractionReconciliationEnabled, logger));
     if (!autobuildLanguages) {
         logger.info("None of the languages in this project require extra build steps");
         return undefined;

lib/autobuild.js.map

@@ -1 +1 @@
-{"version":3,"file":"autobuild.js","sourceRoot":"","sources":["../src/autobuild.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AAErC,2CAAyD;AAGlD,KAAK,UAAU,2BAA2B,CAC/C,MAA0B,EAC1B,MAAc;IAEd,0CAA0C;IAC1C,mFAAmF;IACnF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,IAAA,4BAAgB,EAAC,CAAC,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,kBAAkB,EAAE;QACvB,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;KAClB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAQ,CAAC,EAAE,CACzB,CAAC;IAEF,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,yEAAyE;IACzE,UAAU;IACV,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE;QAChD,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;KAChD;IACD,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,kBAAkB,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE;QACpE,SAAS,CAAC,IAAI,CAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC;KAC7B;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;IAC3C,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,yCAAyC;IACzC,IAAI,2BAA2B,CAAC,MAAM,GAAG,CAAC,EAAE;QAC1C,MAAM,CAAC,OAAO,CACZ,oCAAoC,SAAS,CAAC,IAAI,CAChD,OAAO,CACR,8BAA8B,2BAA2B;aACvD,KAAK,CAAC,CAAC,CAAC;aACR,IAAI,CACH,OAAO,CACR,kFAAkF;YACnF,4BAA4B;YAC5B,0NAA0N,CAC7N,CAAC;KACH;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAtFD,kEAsFC;AAEM,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAA0B,EAC1B,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,qCAAqC,QAAQ,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AATD,oCASC"}
+{"version":3,"file":"autobuild.js","sourceRoot":"","sources":["../src/autobuild.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,qCAAqC;AAGrC,2CAAyD;AAEzD,6CAA+B;AAExB,KAAK,UAAU,2BAA2B,CAC/C,MAA0B,EAC1B,iBAAoC,EACpC,MAAc;IAEd,MAAM,mCAAmC,GACvC,MAAM,IAAI,CAAC,mCAAmC,CAAC,iBAAiB,CAAC,CAAC;IACpE,0CAA0C;IAC1C,mFAAmF;IACnF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,IAAA,4BAAgB,EAAC,CAAC,EAAE,mCAAmC,EAAE,MAAM,CAAC,CACjE,CAAC;IAEF,IAAI,CAAC,kBAAkB,EAAE;QACvB,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;KAClB;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAQ,CAAC,EAAE,CACzB,CAAC;IAEF,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,yEAAyE;IACzE,UAAU;IACV,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE;QAChD,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;KAChD;IACD,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,kBAAkB,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE;QACpE,SAAS,CAAC,IAAI,CAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC;KAC7B;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;IAC3C,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,yCAAyC;IACzC,IAAI,2BAA2B,CAAC,MAAM,GAAG,CAAC,EAAE;QAC1C,MAAM,CAAC,OAAO,CACZ,oCAAoC,SAAS,CAAC,IAAI,CAChD,OAAO,CACR,8BAA8B,2BAA2B;aACvD,KAAK,CAAC,CAAC,CAAC;aACR,IAAI,CACH,OAAO,CACR,kFAAkF;YACnF,4BAA4B;YAC5B,0NAA0N,CAC7N,CAAC;KACH;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAzFD,kEAyFC;AAEM,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAA0B,EAC1B,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,qCAAqC,QAAQ,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AATD,oCASC"}

lib/codeql.js

@@ -22,19 +22,21 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getExtraOptions = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.convertToSemVer = exports.getCodeQLURLVersion = exports.setupCodeQL = exports.getCodeQLActionRepository = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = exports.CODEQL_VERSION_NEW_TRACING = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CODEQL_DEFAULT_ACTION_REPOSITORY = exports.CommandInvocationError = void 0;
+exports.getExtraOptions = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.convertToSemVer = exports.getCodeQLURLVersion = exports.setupCodeQL = exports.getCodeQLActionRepository = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = exports.CODEQL_VERSION_NEW_TRACING = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CODEQL_VERSION_CONFIG_FILES = exports.CODEQL_VERSION_COUNTS_LINES = exports.CODEQL_DEFAULT_ACTION_REPOSITORY = exports.CommandInvocationError = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const toolcache = __importStar(require("@actions/tool-cache"));
 const fast_deep_equal_1 = __importDefault(require("fast-deep-equal"));
 const yaml = __importStar(require("js-yaml"));
+const query_string_1 = __importDefault(require("query-string"));
 const semver = __importStar(require("semver"));
 const uuid_1 = require("uuid");
 const actions_util_1 = require("./actions-util");
 const api = __importStar(require("./api-client"));
 const defaults = __importStar(require("./defaults.json")); // Referenced from codeql-action-sync-tool!
 const error_matcher_1 = require("./error-matcher");
+const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const toolrunner_error_catcher_1 = require("./toolrunner-error-catcher");
 const trap_caching_1 = require("./trap-caching");
@@ -58,23 +60,30 @@ const CODEQL_BUNDLE_VERSION = defaults.bundleVersion;
 exports.CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action";
 /**
  * The oldest version of CodeQL that the Action will run with. This should be
- * at least three minor versions behind the current version and must include the
- * CLI versions shipped with each supported version of GHES.
+ * at least three minor versions behind the current version. The version flags
+ * below can be used to conditionally enable certain features on versions newer
+ * than this. Please record the reason we cannot support an older version.
  *
- * The version flags below can be used to conditionally enable certain features
- * on versions newer than this.
+ * Reason: First version containing fix for the "We still have not reached
+ * idleness" deadlock.
  */
-const CODEQL_MINIMUM_VERSION = "2.6.3";
+const CODEQL_MINIMUM_VERSION = "2.4.5";
 /**
  * Versions of CodeQL that version-flag certain functionality in the Action.
  * For convenience, please keep these in descending order. Once a version
  * flag is older than the oldest supported version above, it may be removed.
  */
+const CODEQL_VERSION_RAM_FINALIZE = "2.5.8";
+const CODEQL_VERSION_DIAGNOSTICS = "2.5.6";
+const CODEQL_VERSION_METRICS = "2.5.5";
+const CODEQL_VERSION_GROUP_RULES = "2.5.5";
+const CODEQL_VERSION_SARIF_GROUP = "2.5.3";
+exports.CODEQL_VERSION_COUNTS_LINES = "2.6.2";
 const CODEQL_VERSION_CUSTOM_QUERY_HELP = "2.7.1";
 const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.10.0";
+exports.CODEQL_VERSION_CONFIG_FILES = "2.10.1";
 const CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED = "2.10.4";
 exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = "2.10.4";
-const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
 /**
  * This variable controls using the new style of tracing from the CodeQL
  * CLI. In particular, with versions above this we will use both indirect
@@ -118,16 +127,30 @@ function getCodeQLBundleName() {
     return `codeql-bundle-${platform}.tar.gz`;
 }
 function getCodeQLActionRepository(logger) {
+    if (!util.isActions()) {
+        return exports.CODEQL_DEFAULT_ACTION_REPOSITORY;
+    }
+    else {
+        return getActionsCodeQLActionRepository(logger);
+    }
+}
+exports.getCodeQLActionRepository = getCodeQLActionRepository;
+function getActionsCodeQLActionRepository(logger) {
+    if (process.env["GITHUB_ACTION_REPOSITORY"] !== undefined) {
+        return process.env["GITHUB_ACTION_REPOSITORY"];
+    }
+    // The Actions Runner used with GitHub Enterprise Server 2.22 did not set the GITHUB_ACTION_REPOSITORY variable.
+    // This fallback logic can be removed after the end-of-support for 2.22 on 2021-09-23.
     if ((0, actions_util_1.isRunningLocalAction)()) {
         // This handles the case where the Action does not come from an Action repository,
         // e.g. our integration tests which use the Action code from the current checkout.
-        // In these cases, the GITHUB_ACTION_REPOSITORY environment variable is not set.
         logger.info("The CodeQL Action is checked out locally. Using the default CodeQL Action repository.");
         return exports.CODEQL_DEFAULT_ACTION_REPOSITORY;
     }
-    return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY");
+    logger.info("GITHUB_ACTION_REPOSITORY environment variable was not set. Falling back to legacy method of finding the GitHub Action.");
+    const relativeScriptPathParts = (0, actions_util_1.getRelativeScriptPath)().split(path.sep);
+    return `${relativeScriptPathParts[0]}/${relativeScriptPathParts[1]}`;
 }
-exports.getCodeQLActionRepository = getCodeQLActionRepository;
 async function getCodeQLBundleDownloadURL(apiDetails, variant, logger) {
     const codeQLActionRepository = getCodeQLActionRepository(logger);
     const potentialDownloadSources = [
@@ -147,14 +170,14 @@ async function getCodeQLBundleDownloadURL(apiDetails, variant, logger) {
     if (variant === util.GitHubVariant.GHAE) {
         try {
             const release = await api
-                .getApiClient()
+                .getApiClient(apiDetails)
                 .request("GET /enterprise/code-scanning/codeql-bundle/find/{tag}", {
                 tag: CODEQL_BUNDLE_VERSION,
             });
             const assetID = release.data.assets[codeQLBundleName];
             if (assetID !== undefined) {
                 const download = await api
-                    .getApiClient()
+                    .getApiClient(apiDetails)
                     .request("GET /enterprise/code-scanning/codeql-bundle/download/{asset_id}", { asset_id: assetID });
                 const downloadURL = download.data.url;
                 logger.info(`Found CodeQL bundle at GitHub AE endpoint with URL ${downloadURL}.`);
@@ -177,7 +200,7 @@ async function getCodeQLBundleDownloadURL(apiDetails, variant, logger) {
         }
         const [repositoryOwner, repositoryName] = repository.split("/");
         try {
-            const release = await api.getApiClient().repos.getReleaseByTag({
+            const release = await api.getApiClient(apiDetails).repos.getReleaseByTag({
                 owner: repositoryOwner,
                 repo: repositoryName,
                 tag: CODEQL_BUNDLE_VERSION,
@@ -195,70 +218,73 @@ async function getCodeQLBundleDownloadURL(apiDetails, variant, logger) {
     }
     return `https://github.com/${exports.CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${CODEQL_BUNDLE_VERSION}/${codeQLBundleName}`;
 }
-async function getCodeQLSource(toolsInput, bypassToolcache, apiDetails, variant, logger) {
-    var _a;
-    if (toolsInput && toolsInput !== "latest" && !toolsInput.startsWith("http")) {
-        return {
-            codeqlTarPath: toolsInput,
-            sourceType: "local",
-            toolsVersion: "local",
-        };
-    }
+/**
+ * Set up CodeQL CLI access.
+ *
+ * @param codeqlURL
+ * @param apiDetails
+ * @param tempDir
+ * @param variant
+ * @param features
+ * @param logger
+ * @param checkVersion Whether to check that CodeQL CLI meets the minimum
+ *        version requirement. Must be set to true outside tests.
+ * @returns a { CodeQL, toolsVersion } object.
+ */
+async function setupCodeQL(codeqlURL, apiDetails, tempDir, variant, features, logger, checkVersion) {
+    try {
         const forceLatestReason = 
         // We use the special value of 'latest' to prioritize the version in the
         // defaults over any pinned cached version.
-    toolsInput === "latest"
+        codeqlURL === "latest"
             ? '"tools: latest" was requested'
             : // If the user hasn't requested a particular CodeQL version, then bypass
                 // the toolcache when the appropriate feature is enabled. This
                 // allows us to quickly rollback a broken bundle that has made its way
                 // into the toolcache.
-            toolsInput === undefined && bypassToolcache
+                codeqlURL === undefined &&
+                    (await features.getValue(feature_flags_1.Feature.BypassToolcacheEnabled))
                     ? "a specific version of CodeQL was not requested and the bypass toolcache feature is enabled"
                     : undefined;
         const forceLatest = forceLatestReason !== undefined;
         if (forceLatest) {
             logger.debug(`Forcing the latest version of the CodeQL tools since ${forceLatestReason}.`);
+            codeqlURL = undefined;
         }
-    const codeqlURL = forceLatest ? undefined : toolsInput;
-    const requestedSemVer = convertToSemVer(getCodeQLURLVersion(codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`), logger);
+        let codeqlFolder;
+        let codeqlURLVersion;
+        if (codeqlURL && !codeqlURL.startsWith("http")) {
+            codeqlFolder = await toolcache.extractTar(codeqlURL);
+            codeqlURLVersion = "local";
+        }
+        else {
+            codeqlURLVersion = getCodeQLURLVersion(codeqlURL || `/${CODEQL_BUNDLE_VERSION}/`);
+            const codeqlURLSemVer = convertToSemVer(codeqlURLVersion, logger);
             // If we find the specified version, we always use that.
-    const codeqlFolder = toolcache.find("CodeQL", requestedSemVer);
-    if (codeqlFolder) {
-        return {
-            codeqlFolder,
-            sourceType: "toolcache",
-            toolsVersion: requestedSemVer,
-        };
-    }
+            codeqlFolder = toolcache.find("CodeQL", codeqlURLSemVer);
             // If we don't find the requested version, in some cases we may allow a
             // different version to save download time if the version hasn't been
             // specified explicitly (in which case we always honor it).
-    if (!codeqlURL && !forceLatest) {
+            if (!codeqlFolder && !codeqlURL && !forceLatest) {
                 const codeqlVersions = toolcache.findAllVersions("CodeQL");
                 if (codeqlVersions.length === 1 && (0, util_1.isGoodVersion)(codeqlVersions[0])) {
                     const tmpCodeqlFolder = toolcache.find("CodeQL", codeqlVersions[0]);
                     if (fs.existsSync(path.join(tmpCodeqlFolder, "pinned-version"))) {
                         logger.debug(`CodeQL in cache overriding the default ${CODEQL_BUNDLE_VERSION}`);
-                return {
-                    codeqlFolder: tmpCodeqlFolder,
-                    sourceType: "toolcache",
-                    toolsVersion: codeqlVersions[0],
-                };
+                        codeqlFolder = tmpCodeqlFolder;
+                        codeqlURLVersion = codeqlVersions[0];
                     }
                 }
             }
-    return {
-        codeqlURL: codeqlURL ||
-            (await getCodeQLBundleDownloadURL(apiDetails, variant, logger)),
-        semanticVersion: requestedSemVer,
-        sourceType: "download",
-        toolsVersion: ((_a = semver.prerelease(requestedSemVer)) === null || _a === void 0 ? void 0 : _a.join(".")) || requestedSemVer,
-    };
-}
-async function downloadCodeQL(codeqlURL, semanticVersion, apiDetails, tempDir, logger) {
+            if (codeqlFolder) {
+                logger.debug(`CodeQL found in cache ${codeqlFolder}`);
+            }
+            else {
+                if (!codeqlURL) {
+                    codeqlURL = await getCodeQLBundleDownloadURL(apiDetails, variant, logger);
+                }
                 const parsedCodeQLURL = new URL(codeqlURL);
-    const searchParams = new URLSearchParams(parsedCodeQLURL.search);
+                const parsedQueryString = query_string_1.default.parse(parsedCodeQLURL.search);
                 const headers = {
                     accept: "application/octet-stream",
                 };
@@ -266,15 +292,13 @@ async function downloadCodeQL(codeqlURL, semanticVersion, apiDetails, tempDir, l
                 // from the same GitHub instance the Action is running on.
                 // This avoids leaking Enterprise tokens to dotcom.
                 // We also don't want to send an authorization header if there's already a token provided in the URL.
-    if (searchParams.has("token")) {
-        logger.debug("CodeQL tools URL contains an authorization token.");
-    }
-    else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
-        logger.debug("Providing an authorization token to download CodeQL tools.");
+                if (codeqlURL.startsWith(`${apiDetails.url}/`) &&
+                    parsedQueryString["token"] === undefined) {
+                    logger.debug("Downloading CodeQL bundle with token.");
                     headers.authorization = `token ${apiDetails.auth}`;
                 }
                 else {
-        logger.debug("Downloading CodeQL tools without an authorization token.");
+                    logger.debug("Downloading CodeQL bundle without token.");
                 }
                 logger.info(`Downloading CodeQL tools from ${codeqlURL}. This may take a while.`);
                 const dest = path.join(tempDir, (0, uuid_1.v4)());
@@ -282,38 +306,8 @@ async function downloadCodeQL(codeqlURL, semanticVersion, apiDetails, tempDir, l
                 const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, undefined, finalHeaders);
                 logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
                 const codeqlExtracted = await toolcache.extractTar(codeqlPath);
-    return await toolcache.cacheDir(codeqlExtracted, "CodeQL", semanticVersion);
-}
-/**
- * Set up CodeQL CLI access.
- *
- * @param toolsInput
- * @param apiDetails
- * @param tempDir
- * @param variant
- * @param bypassToolcache
- * @param logger
- * @param checkVersion Whether to check that CodeQL CLI meets the minimum
- *        version requirement. Must be set to true outside tests.
- * @returns a { CodeQL, toolsVersion } object.
- */
-async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, bypassToolcache, logger, checkVersion) {
-    try {
-        const source = await getCodeQLSource(toolsInput, bypassToolcache, apiDetails, variant, logger);
-        let codeqlFolder;
-        switch (source.sourceType) {
-            case "local":
-                codeqlFolder = await toolcache.extractTar(source.codeqlTarPath);
-                break;
-            case "toolcache":
-                codeqlFolder = source.codeqlFolder;
-                logger.debug(`CodeQL found in cache ${codeqlFolder}`);
-                break;
-            case "download":
-                codeqlFolder = await downloadCodeQL(source.codeqlURL, source.semanticVersion, apiDetails, tempDir, logger);
-                break;
-            default:
-                (0, util_1.assertNever)(source);
+                codeqlFolder = await toolcache.cacheDir(codeqlExtracted, "CodeQL", codeqlURLSemVer);
+            }
         }
         let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql");
         if (process.platform === "win32") {
@@ -323,7 +317,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, bypassToolc
             throw new Error(`Unsupported platform: ${process.platform}`);
         }
         cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion);
-        return { codeql: cachedCodeQL, toolsVersion: source.toolsVersion };
+        return { codeql: cachedCodeQL, toolsVersion: codeqlURLVersion };
     }
     catch (e) {
         logger.error(e instanceof Error ? e : new Error(String(e)));
@@ -399,7 +393,6 @@ function setCodeQL(partialCodeql) {
         databaseRunQueries: resolveFunction(partialCodeql, "databaseRunQueries"),
         databaseInterpretResults: resolveFunction(partialCodeql, "databaseInterpretResults"),
         databasePrintBaseline: resolveFunction(partialCodeql, "databasePrintBaseline"),
-        diagnosticsExport: resolveFunction(partialCodeql, "diagnosticsExport"),
     };
     return cachedCodeQL;
 }
@@ -518,34 +511,36 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 ...getExtraOptionsFromEnv(["database", "init"]),
             ]);
         },
-        async databaseInitCluster(config, sourceRoot, processName, featureEnablement, logger) {
+        async databaseInitCluster(config, sourceRoot, processName, processLevel, featureEnablement, logger) {
             const extraArgs = config.languages.map((language) => `--language=${language}`);
-            if (config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l)).length > 0) {
+            const isGoExtractionReconciliationEnabled = await util.isGoExtractionReconciliationEnabled(featureEnablement);
+            if (config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l, isGoExtractionReconciliationEnabled, logger)).length > 0) {
                 extraArgs.push("--begin-tracing");
                 extraArgs.push(...(await (0, trap_caching_1.getTrapCachingExtractorConfigArgs)(config)));
+                if (processName !== undefined) {
                     extraArgs.push(`--trace-process-name=${processName}`);
+                }
+                else {
+                    // We default to 3 if no other arguments are provided since this was the default
+                    // behaviour of the Runner. Note this path never happens in the CodeQL Action
+                    // because that always passes in a process name.
+                    extraArgs.push(`--trace-process-level=${processLevel || 3}`);
+                }
                 if (
                 // There's a bug in Lua tracing for Go on Windows in versions earlier than
                 // `CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED`, so don't use Lua tracing
                 // when tracing Go on Windows on these CodeQL versions.
                 (await util.codeQlVersionAbove(this, CODEQL_VERSION_LUA_TRACER_CONFIG)) &&
                     config.languages.includes(languages_1.Language.go) &&
-                    (0, languages_1.isTracedLanguage)(languages_1.Language.go) &&
+                    (0, languages_1.isTracedLanguage)(languages_1.Language.go, isGoExtractionReconciliationEnabled, logger) &&
                     process.platform === "win32" &&
                     !(await util.codeQlVersionAbove(this, CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED))) {
                     extraArgs.push("--no-internal-use-lua-tracing");
                 }
             }
-            // A config file is only generated if the CliConfigFileEnabled feature flag is enabled.
-            const configLocation = await generateCodeScanningConfig(codeql, config, featureEnablement, logger);
-            // Only pass external repository token if a config file is going to be parsed by the CLI.
-            let externalRepositoryToken;
+            const configLocation = await generateCodescanningConfig(codeql, config, featureEnablement);
             if (configLocation) {
                 extraArgs.push(`--codescanning-config=${configLocation}`);
-                externalRepositoryToken = (0, actions_util_1.getOptionalInput)("external-repository-token");
-                if (externalRepositoryToken) {
-                    extraArgs.push("--external-repository-token-stdin");
-                }
             }
             await runTool(cmd, [
                 "database",
@@ -555,13 +550,11 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 `--source-root=${sourceRoot}`,
                 ...extraArgs,
                 ...getExtraOptionsFromEnv(["database", "init"]),
-            ], { stdin: externalRepositoryToken });
+            ]);
         },
         async runAutobuild(language) {
             const cmdName = process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh";
-            // The autobuilder for Swift is located in the experimental/ directory.
-            const possibleExperimentalDir = language === languages_1.Language.swift ? "experimental" : "";
-            const autobuildCmd = path.join(path.dirname(cmd), possibleExperimentalDir, language, "tools", cmdName);
+            const autobuildCmd = path.join(path.dirname(cmd), language, "tools", cmdName);
             // Update JAVA_TOOL_OPTIONS to contain '-Dhttp.keepAlive=false'
             // This is because of an issue with Azure pipelines timing out connections after 4 minutes
             // and Maven not properly handling closed connections
@@ -629,10 +622,11 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 "finalize",
                 "--finalize-dataset",
                 threadsFlag,
-                memoryFlag,
                 ...getExtraOptionsFromEnv(["database", "finalize"]),
                 databasePath,
             ];
+            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_RAM_FINALIZE))
+                args.push(memoryFlag);
             await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, args, error_matcher_1.errorMatchers);
         },
         async resolveLanguages() {
@@ -702,9 +696,9 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (querySuitePath) {
                 codeqlArgs.push(querySuitePath);
             }
-            await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, codeqlArgs, error_matcher_1.errorMatchers);
+            await runTool(cmd, codeqlArgs);
         },
-        async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, addSnippetsFlag, threadsFlag, verbosityFlag, automationDetailsId) {
+        async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, addSnippetsFlag, threadsFlag, verbosityFlag, automationDetailsId, featureEnablement) {
             const codeqlArgs = [
                 "database",
                 "interpret-results",
@@ -713,17 +707,21 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 verbosityFlag,
                 `--output=${sarifFile}`,
                 addSnippetsFlag,
-                "--print-diagnostics-summary",
-                "--print-metrics-summary",
-                "--sarif-group-rules-by-pack",
                 ...getExtraOptionsFromEnv(["database", "interpret-results"]),
             ];
+            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_DIAGNOSTICS))
+                codeqlArgs.push("--print-diagnostics-summary");
+            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_METRICS))
+                codeqlArgs.push("--print-metrics-summary");
+            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_GROUP_RULES))
+                codeqlArgs.push("--sarif-group-rules-by-pack");
             if (await util.codeQlVersionAbove(this, CODEQL_VERSION_CUSTOM_QUERY_HELP))
                 codeqlArgs.push("--sarif-add-query-help");
-            if (automationDetailsId !== undefined) {
+            if (automationDetailsId !== undefined &&
+                (await util.codeQlVersionAbove(this, CODEQL_VERSION_SARIF_GROUP))) {
                 codeqlArgs.push("--sarif-category", automationDetailsId);
             }
-            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_FILE_BASELINE_INFORMATION)) {
+            if (await featureEnablement.getValue(feature_flags_1.Feature.FileBaselineInformationEnabled, this)) {
                 codeqlArgs.push("--sarif-add-baseline-file-info");
             }
             codeqlArgs.push(databasePath);
@@ -731,8 +729,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 codeqlArgs.push(...querySuitePaths);
             }
             // capture stdout, which contains analysis summaries
-            const returnState = await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, codeqlArgs, error_matcher_1.errorMatchers);
-            return returnState.stdout;
+            return await runTool(cmd, codeqlArgs);
         },
         async databasePrintBaseline(databasePath) {
             const codeqlArgs = [
@@ -808,22 +805,9 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             ];
             await new toolrunner.ToolRunner(cmd, args).exec();
         },
-        async diagnosticsExport(sarifFile, automationDetailsId) {
-            const args = [
-                "diagnostics",
-                "export",
-                "--format=sarif-latest",
-                `--output=${sarifFile}`,
-                ...getExtraOptionsFromEnv(["diagnostics", "export"]),
-            ];
-            if (automationDetailsId !== undefined) {
-                args.push("--sarif-category", automationDetailsId);
-            }
-            await new toolrunner.ToolRunner(cmd, args).exec();
-        },
     };
-    // To ensure that status reports include the CodeQL CLI version wherever
-    // possible, we want to call getVersion(), which populates the version value
+    // To ensure that status reports include the CodeQL CLI version whereever
+    // possbile, we want to call getVersion(), which populates the version value
     // used by status reporting, at the earliest opportunity. But invoking
     // getVersion() directly here breaks tests that only pretend to create a
     // CodeQL object. So instead we rely on the assumption that all non-test
@@ -890,26 +874,20 @@ exports.getExtraOptions = getExtraOptions;
  *     status reports on GitHub.com.
  */
 const maxErrorSize = 20000;
-async function runTool(cmd, args = [], opts = {}) {
+async function runTool(cmd, args = []) {
     let output = "";
     let error = "";
     const exitCode = await new toolrunner.ToolRunner(cmd, args, {
         listeners: {
             stdout: (data) => {
-                output += data.toString("utf8");
+                output += data.toString();
             },
             stderr: (data) => {
-                let readStartIndex = 0;
-                // If the error is too large, then we only take the last 20,000 characters
-                if (data.length - maxErrorSize > 0) {
-                    // Eg: if we have 20,000 the start index should be 2.
-                    readStartIndex = data.length - maxErrorSize + 1;
-                }
-                error += data.toString("utf8", readStartIndex);
+                const toRead = Math.min(maxErrorSize - error.length, data.length);
+                error += data.toString("utf8", 0, toRead);
             },
         },
         ignoreReturnCode: true,
-        ...(opts.stdin ? { input: Buffer.from(opts.stdin || "") } : {}),
     }).exec();
     if (exitCode !== 0)
         throw new CommandInvocationError(cmd, args, exitCode, error, output);
@@ -923,7 +901,7 @@ async function runTool(cmd, args = [], opts = {}) {
  * @param config The configuration to use.
  * @returns the path to the generated user configuration file.
  */
-async function generateCodeScanningConfig(codeql, config, featureEnablement, logger) {
+async function generateCodescanningConfig(codeql, config, featureEnablement) {
     var _a;
     if (!(await util.useCodeScanningConfigInCli(codeql, featureEnablement))) {
         return;
@@ -982,10 +960,6 @@ async function generateCodeScanningConfig(codeql, config, featureEnablement, log
             augmentedConfig.packs["javascript"].push(packString);
         }
     }
-    logger.info(`Writing augmented user configuration file to ${configLocation}`);
-    logger.startGroup("Augmented user configuration file contents");
-    logger.info(yaml.dump(augmentedConfig));
-    logger.endGroup();
     fs.writeFileSync(configLocation, yaml.dump(augmentedConfig));
     return configLocation;
 }

lib/codeql.test.js

@@ -27,13 +27,11 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const toolcache = __importStar(require("@actions/tool-cache"));
-const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 const ava_1 = __importDefault(require("ava"));
 const del_1 = __importDefault(require("del"));
 const yaml = __importStar(require("js-yaml"));
 const nock_1 = __importDefault(require("nock"));
 const sinon = __importStar(require("sinon"));
-const actionsUtil = __importStar(require("./actions-util"));
 const codeql = __importStar(require("./codeql"));
 const defaults = __importStar(require("./defaults.json"));
 const feature_flags_1 = require("./feature-flags");
@@ -46,16 +44,18 @@ const util_1 = require("./util");
 const sampleApiDetails = {
     auth: "token",
     url: "https://github.com",
-    apiURL: "https://api.github.com",
+    apiURL: undefined,
+    registriesAuthTokens: undefined,
 };
 const sampleGHAEApiDetails = {
     auth: "token",
     url: "https://example.githubenterprise.com",
-    apiURL: "https://example.githubenterprise.com/api/v3",
+    apiURL: undefined,
+    registriesAuthTokens: undefined,
 };
 let stubConfig;
 ava_1.default.beforeEach(() => {
-    (0, util_1.initializeEnvironment)("1.2.3");
+    (0, util_1.initializeEnvironment)(util_1.Mode.actions, "1.2.3");
     stubConfig = {
         languages: [languages_1.Language.cpp],
         queries: {},
@@ -81,13 +81,7 @@ ava_1.default.beforeEach(() => {
         trapCacheDownloadTime: 0,
     };
 });
-/**
- * Mocks the API for downloading the bundle tagged `tagName`.
- *
- * @returns the download URL for the bundle. This can be passed to the tools parameter of
- * `codeql.setupCodeQL`.
- */
-async function mockDownloadApi({ apiDetails = sampleApiDetails, isPinned, tagName, }) {
+async function mockApiAndSetupCodeQL({ apiDetails, featureEnablement, isPinned, tmpDir, toolsInput, version, }) {
     var _a;
     const platform = process.platform === "win32"
         ? "win64"
@@ -96,94 +90,97 @@ async function mockDownloadApi({ apiDetails = sampleApiDetails, isPinned, tagNam
             : "osx64";
     const baseUrl = (_a = apiDetails === null || apiDetails === void 0 ? void 0 : apiDetails.url) !== null && _a !== void 0 ? _a : "https://example.com";
     const relativeUrl = apiDetails
-        ? `/github/codeql-action/releases/download/${tagName}/codeql-bundle-${platform}.tar.gz`
-        : `/download/${tagName}/codeql-bundle.tar.gz`;
+        ? `/github/codeql-action/releases/download/${version}/codeql-bundle-${platform}.tar.gz`
+        : `/download/codeql-bundle-${version}/codeql-bundle.tar.gz`;
     (0, nock_1.default)(baseUrl)
         .get(relativeUrl)
         .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle${isPinned ? "-pinned" : ""}.tar.gz`));
-    return `${baseUrl}${relativeUrl}`;
+    return await codeql.setupCodeQL(toolsInput ? toolsInput.input : `${baseUrl}${relativeUrl}`, apiDetails !== null && apiDetails !== void 0 ? apiDetails : sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, featureEnablement !== null && featureEnablement !== void 0 ? featureEnablement : (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true), false);
 }
-async function installIntoToolcache({ apiDetails = sampleApiDetails, isPinned, tagName, tmpDir, }) {
-    const url = await mockDownloadApi({ apiDetails, isPinned, tagName });
-    await codeql.setupCodeQL(url, apiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
-}
-(0, ava_1.default)("downloads and caches explicitly requested bundles that aren't in the toolcache", async (t) => {
+(0, ava_1.default)("download codeql bundle cache", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
         const versions = ["20200601", "20200610"];
         for (let i = 0; i < versions.length; i++) {
             const version = versions[i];
-            const url = await mockDownloadApi({
-                tagName: `codeql-bundle-${version}`,
-                isPinned: false,
-            });
-            const result = await codeql.setupCodeQL(url, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
+            const codeQLConfig = await mockApiAndSetupCodeQL({ version, tmpDir });
             t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
-            t.is(result.toolsVersion, version);
+            t.deepEqual(codeQLConfig.toolsVersion, version);
         }
         t.is(toolcache.findAllVersions("CodeQL").length, 2);
     });
 });
-(0, ava_1.default)("downloads an explicitly requested bundle even if a different version is cached", async (t) => {
+(0, ava_1.default)("download codeql bundle cache explicitly requested with pinned different version cached", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
+        const pinnedCodeQLConfig = await mockApiAndSetupCodeQL({
+            version: "20200601",
             isPinned: true,
             tmpDir,
         });
-        const url = await mockDownloadApi({
-            tagName: "codeql-bundle-20200610",
+        t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
+        t.deepEqual(pinnedCodeQLConfig.toolsVersion, "20200601");
+        const unpinnedCodeQLConfig = await mockApiAndSetupCodeQL({
+            version: "20200610",
+            tmpDir,
         });
-        const result = await codeql.setupCodeQL(url, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
         t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
-        t.deepEqual(result.toolsVersion, "20200610");
+        t.deepEqual(unpinnedCodeQLConfig.toolsVersion, "20200610");
     });
 });
-(0, ava_1.default)("uses a cached bundle when no tools input is given", async (t) => {
+(0, ava_1.default)("don't download codeql bundle cache with pinned different version cached", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
+        const pinnedCodeQLConfig = await mockApiAndSetupCodeQL({
+            version: "20200601",
             isPinned: true,
             tmpDir,
         });
-        const result = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
-        t.deepEqual(result.toolsVersion, "0.0.0-20200601");
+        t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
+        t.deepEqual(pinnedCodeQLConfig.toolsVersion, "20200601");
+        const codeQLConfig = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true), false);
+        t.deepEqual(codeQLConfig.toolsVersion, "0.0.0-20200601");
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 1);
     });
 });
-(0, ava_1.default)("downloads bundle if only an unpinned version is cached", async (t) => {
+(0, ava_1.default)("download codeql bundle cache with different version cached (not pinned)", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
-            isPinned: false,
+        const cachedCodeQLConfig = await mockApiAndSetupCodeQL({
+            version: "20200601",
             tmpDir,
         });
-        await mockDownloadApi({
-            tagName: defaults.bundleVersion,
+        t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
+        t.deepEqual(cachedCodeQLConfig.toolsVersion, "20200601");
+        const codeQLConfig = await mockApiAndSetupCodeQL({
+            version: defaults.bundleVersion,
+            tmpDir,
+            apiDetails: sampleApiDetails,
+            toolsInput: { input: undefined },
         });
-        const result = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
-        t.deepEqual(result.toolsVersion, defaults.bundleVersion.replace("codeql-bundle-", ""));
+        t.deepEqual(codeQLConfig.toolsVersion, defaults.bundleVersion.replace("codeql-bundle-", ""));
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 2);
     });
 });
-(0, ava_1.default)('downloads bundle if "latest" tools specified but not cached', async (t) => {
+(0, ava_1.default)('download codeql bundle cache with pinned different version cached if "latest" tools specified', async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        await installIntoToolcache({
-            tagName: "codeql-bundle-20200601",
+        const pinnedCodeQLConfig = await mockApiAndSetupCodeQL({
+            version: "20200601",
             isPinned: true,
             tmpDir,
         });
-        await mockDownloadApi({
-            tagName: defaults.bundleVersion,
+        t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
+        t.deepEqual(pinnedCodeQLConfig.toolsVersion, "20200601");
+        const latestCodeQLConfig = await mockApiAndSetupCodeQL({
+            version: defaults.bundleVersion,
+            apiDetails: sampleApiDetails,
+            toolsInput: { input: "latest" },
+            tmpDir,
         });
-        const result = await codeql.setupCodeQL("latest", sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, (0, logging_1.getRunnerLogger)(true), false);
-        t.deepEqual(result.toolsVersion, defaults.bundleVersion.replace("codeql-bundle-", ""));
+        t.deepEqual(latestCodeQLConfig.toolsVersion, defaults.bundleVersion.replace("codeql-bundle-", ""));
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 2);
     });
@@ -201,15 +198,20 @@ for (const [isFeatureEnabled, toolsInput, shouldToolcacheBeBypassed,] of TOOLCAC
     (0, ava_1.default)(`download codeql bundle ${shouldToolcacheBeBypassed ? "bypasses" : "does not bypass"} toolcache when feature ${isFeatureEnabled ? "enabled" : "disabled"} and tools: ${toolsInput} passed`, async (t) => {
         await util.withTmpDir(async (tmpDir) => {
             (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-            await installIntoToolcache({
-                tagName: "codeql-bundle-20200601",
+            await mockApiAndSetupCodeQL({
+                version: "codeql-bundle-20200601",
+                apiDetails: sampleApiDetails,
                 isPinned: true,
                 tmpDir,
             });
-            await mockDownloadApi({
-                tagName: defaults.bundleVersion,
+            t.assert(toolcache.find("CodeQL", "0.0.0-20200601"));
+            await mockApiAndSetupCodeQL({
+                version: defaults.bundleVersion,
+                apiDetails: sampleApiDetails,
+                featureEnablement: (0, testing_utils_1.createFeatures)(isFeatureEnabled ? [feature_flags_1.Feature.BypassToolcacheEnabled] : []),
+                toolsInput: { input: toolsInput },
+                tmpDir,
             });
-            await codeql.setupCodeQL(toolsInput, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, isFeatureEnabled, (0, logging_1.getRunnerLogger)(true), false);
             const cachedVersions = toolcache.findAllVersions("CodeQL");
             t.is(cachedVersions.length, shouldToolcacheBeBypassed ? 2 : 1);
         });
@@ -238,24 +240,7 @@ for (const [isFeatureEnabled, toolsInput, shouldToolcacheBeBypassed,] of TOOLCAC
         (0, nock_1.default)("https://example.githubenterprise.com")
             .get(`/github/codeql-action/releases/download/${defaults.bundleVersion}/${codeQLBundleName}`)
             .replyWithFile(200, path.join(__dirname, `/../src/testdata/codeql-bundle-pinned.tar.gz`));
-        // This is a workaround to mock `api.getApiDetails()` since it doesn't seem to be possible to
-        // mock this directly. The difficulty is that `getApiDetails()` is called locally in
-        // `api-client.ts`, but `sinon.stub(api, "getApiDetails")` only affects calls to
-        // `getApiDetails()` via an imported `api` module.
-        sinon
-            .stub(actionsUtil, "getRequiredInput")
-            .withArgs("token")
-            .returns(sampleGHAEApiDetails.auth);
-        const requiredEnvParamStub = sinon.stub(util, "getRequiredEnvParam");
-        requiredEnvParamStub
-            .withArgs("GITHUB_SERVER_URL")
-            .returns(sampleGHAEApiDetails.url);
-        requiredEnvParamStub
-            .withArgs("GITHUB_API_URL")
-            .returns(sampleGHAEApiDetails.apiURL);
-        sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
-        process.env["GITHUB_ACTION_REPOSITORY"] = "github/codeql-action";
-        await codeql.setupCodeQL(undefined, sampleGHAEApiDetails, tmpDir, util.GitHubVariant.GHAE, false, (0, logging_1.getRunnerLogger)(true), false);
+        await codeql.setupCodeQL(undefined, sampleGHAEApiDetails, tmpDir, util.GitHubVariant.GHAE, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true), false);
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 1);
     });
@@ -306,14 +291,15 @@ for (const [isFeatureEnabled, toolsInput, shouldToolcacheBeBypassed,] of TOOLCAC
 });
 (0, ava_1.default)("getCodeQLActionRepository", (t) => {
     const logger = (0, logging_1.getRunnerLogger)(true);
-    (0, util_1.initializeEnvironment)("1.2.3");
+    (0, util_1.initializeEnvironment)(util_1.Mode.runner, "1.2.3");
+    const repoActions = codeql.getCodeQLActionRepository(logger);
+    t.deepEqual(repoActions, "github/codeql-action");
+    (0, util_1.initializeEnvironment)(util_1.Mode.actions, "1.2.3");
     // isRunningLocalAction() === true
     delete process.env["GITHUB_ACTION_REPOSITORY"];
     process.env["RUNNER_TEMP"] = path.dirname(__dirname);
     const repoLocalRunner = codeql.getCodeQLActionRepository(logger);
     t.deepEqual(repoLocalRunner, "github/codeql-action");
-    // isRunningLocalAction() === false
-    sinon.stub(actionsUtil, "isRunningLocalAction").returns(false);
     process.env["GITHUB_ACTION_REPOSITORY"] = "xxx/yyy";
     const repoEnv = codeql.getCodeQLActionRepository(logger);
     t.deepEqual(repoEnv, "xxx/yyy");
@@ -322,18 +308,14 @@ for (const [isFeatureEnabled, toolsInput, shouldToolcacheBeBypassed,] of TOOLCAC
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves("2.7.0");
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
-    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", (0, testing_utils_1.createFeatures)([]));
     t.false(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be absent, but it is present");
 });
 (0, ava_1.default)("databaseInterpretResults() sets --sarif-add-query-help for 2.7.1", async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves("2.7.1");
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
-    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", (0, testing_utils_1.createFeatures)([]));
     t.true(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be present, but it is absent");
 });
 (0, ava_1.default)("databaseInitCluster() without injected codescanning config", async (t) => {
@@ -341,8 +323,6 @@ for (const [isFeatureEnabled, toolsInput, shouldToolcacheBeBypassed,] of TOOLCAC
         const runnerConstructorStub = stubToolRunnerConstructor();
         const codeqlObject = await codeql.getCodeQLForTesting();
         sinon.stub(codeqlObject, "getVersion").resolves("2.8.1");
-        // safeWhich throws because of the test CodeQL object.
-        sinon.stub(safeWhich, "safeWhich").resolves("");
         const thisStubConfig = {
             ...stubConfig,
             tempDir,
@@ -352,7 +332,7 @@ for (const [isFeatureEnabled, toolsInput, shouldToolcacheBeBypassed,] of TOOLCAC
                 packsInputCombines: false,
             },
         };
-        await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, undefined, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         const args = runnerConstructorStub.firstCall.args[1];
         // should NOT have used an config file
         const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
@@ -367,14 +347,14 @@ const injectedConfigMacro = ava_1.default.macro({
             const codeqlObject = await codeql.getCodeQLForTesting();
             sinon
                 .stub(codeqlObject, "getVersion")
-                .resolves(feature_flags_1.featureConfig[feature_flags_1.Feature.CliConfigFileEnabled].minimumVersion);
+                .resolves(codeql.CODEQL_VERSION_CONFIG_FILES);
             const thisStubConfig = {
                 ...stubConfig,
                 ...configOverride,
                 tempDir,
                 augmentationProperties,
             };
-            await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.CliConfigFileEnabled]), (0, logging_1.getRunnerLogger)(true));
+            await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, undefined, (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.CliConfigFileEnabled]), (0, logging_1.getRunnerLogger)(true));
             const args = runnerConstructorStub.firstCall.args[1];
             // should have used an config file
             const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
@@ -397,7 +377,7 @@ const injectedConfigMacro = ava_1.default.macro({
     queriesInputCombines: false,
     packsInputCombines: false,
 }, {}, {
-    packs: ["codeql/javascript-experimental-atm-queries@~0.4.0"],
+    packs: ["codeql/javascript-experimental-atm-queries@~0.3.0"],
 });
 (0, ava_1.default)("injected ML queries with existing packs", injectedConfigMacro, {
     injectedMlQueries: true,
@@ -411,7 +391,7 @@ const injectedConfigMacro = ava_1.default.macro({
     packs: {
         javascript: [
             "codeql/something-else",
-            "codeql/javascript-experimental-atm-queries@~0.4.0",
+            "codeql/javascript-experimental-atm-queries@~0.3.0",
         ],
     },
 });
@@ -426,7 +406,7 @@ const injectedConfigMacro = ava_1.default.macro({
 }, {
     packs: {
         cpp: ["codeql/something-else"],
-        javascript: ["codeql/javascript-experimental-atm-queries@~0.4.0"],
+        javascript: ["codeql/javascript-experimental-atm-queries@~0.3.0"],
     },
 });
 (0, ava_1.default)("injected packs from input", injectedConfigMacro, {
@@ -479,7 +459,7 @@ const injectedConfigMacro = ava_1.default.macro({
         },
     },
 }, {
-    packs: ["xxx", "yyy", "codeql/javascript-experimental-atm-queries@~0.4.0"],
+    packs: ["xxx", "yyy", "codeql/javascript-experimental-atm-queries@~0.3.0"],
 });
 // similar, but with queries
 (0, ava_1.default)("injected queries from input", injectedConfigMacro, {
@@ -573,8 +553,8 @@ const injectedConfigMacro = ava_1.default.macro({
         const codeqlObject = await codeql.getCodeQLForTesting();
         sinon
             .stub(codeqlObject, "getVersion")
-            .resolves(feature_flags_1.featureConfig[feature_flags_1.Feature.CliConfigFileEnabled].minimumVersion);
-        await codeqlObject.databaseInitCluster(stubConfig, "", undefined, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            .resolves(codeql.CODEQL_VERSION_CONFIG_FILES);
+        await codeqlObject.databaseInitCluster(stubConfig, "", undefined, undefined, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         const args = runnerConstructorStub.firstCall.args[1];
         // should have used an config file
         const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
@@ -584,22 +564,24 @@ const injectedConfigMacro = ava_1.default.macro({
         process.env["CODEQL_PASS_CONFIG_TO_CLI"] = origCODEQL_PASS_CONFIG_TO_CLI;
     }
 });
-(0, ava_1.default)("databaseInterpretResults() sets --sarif-add-baseline-file-info for 2.11.3", async (t) => {
+(0, ava_1.default)("databaseInterpretResults() sets --sarif-add-baseline-file-info when feature enabled", async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves("2.11.3");
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
-    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    // We need to set a CodeQL version such that running `databaseInterpretResults` does not crash.
+    // The version of CodeQL is checked separately to determine feature enablement, and does not
+    // otherwise impact this test, so set it to 0.0.0.
+    sinon.stub(codeqlObject, "getVersion").resolves("0.0.0");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.FileBaselineInformationEnabled]));
     t.true(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-baseline-file-info"), "--sarif-add-baseline-file-info should be present, but it is absent");
 });
-(0, ava_1.default)("databaseInterpretResults() does not set --sarif-add-baseline-file-info for 2.11.2", async (t) => {
+(0, ava_1.default)("databaseInterpretResults() does not set --sarif-add-baseline-file-info if feature disabled", async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves("2.11.2");
-    // safeWhich throws because of the test CodeQL object.
-    sinon.stub(safeWhich, "safeWhich").resolves("");
-    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
+    // We need to set a CodeQL version such that running `databaseInterpretResults` does not crash.
+    // The version of CodeQL is checked upstream to determine feature enablement, so it does not
+    // affect this test.
+    sinon.stub(codeqlObject, "getVersion").resolves("0.0.0");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", (0, testing_utils_1.createFeatures)([]));
     t.false(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-baseline-file-info"), "--sarif-add-baseline-file-info must be absent, but it is present");
 });
 function stubToolRunnerConstructor() {

lib/config-utils.js

@@ -19,7 +19,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.downloadPacks = exports.getConfig = exports.getPathToParsedConfigFile = exports.initConfig = exports.parsePacks = exports.validatePackSpecification = exports.prettyPrintPack = exports.parsePacksSpecification = exports.parsePacksFromConfig = exports.calculateAugmentation = exports.getDefaultConfig = exports.getRawLanguages = exports.getLanguages = exports.getLanguagesInRepo = exports.getUnknownLanguagesError = exports.getNoLanguagesError = exports.getConfigFileDirectoryGivenMessage = exports.getConfigFileFormatInvalidMessage = exports.getConfigFileRepoFormatInvalidMessage = exports.getConfigFileDoesNotExistErrorMessage = exports.getConfigFileOutsideWorkspaceErrorMessage = exports.getLocalPathDoesNotExist = exports.getLocalPathOutsideOfRepository = exports.getPacksStrInvalid = exports.getPacksInvalid = exports.getPacksInvalidSplit = exports.getPathsInvalid = exports.getPathsIgnoreInvalid = exports.getQueryUsesInvalid = exports.getQueriesMissingUses = exports.getQueriesInvalid = exports.getDisableDefaultQueriesInvalid = exports.getNameInvalid = exports.validateAndSanitisePath = exports.defaultAugmentationProperties = void 0;
+exports.downloadPacks = exports.getConfig = exports.getPathToParsedConfigFile = exports.initConfig = exports.parsePacks = exports.validatePackSpecification = exports.prettyPrintPack = exports.parsePacksSpecification = exports.parsePacksFromConfig = exports.calculateAugmentation = exports.getDefaultConfig = exports.getUnknownLanguagesError = exports.getNoLanguagesError = exports.getConfigFileDirectoryGivenMessage = exports.getConfigFileFormatInvalidMessage = exports.getConfigFileRepoFormatInvalidMessage = exports.getConfigFileDoesNotExistErrorMessage = exports.getConfigFileOutsideWorkspaceErrorMessage = exports.getLocalPathDoesNotExist = exports.getLocalPathOutsideOfRepository = exports.getPacksStrInvalid = exports.getPacksInvalid = exports.getPacksInvalidSplit = exports.getPathsInvalid = exports.getPathsIgnoreInvalid = exports.getQueryUsesInvalid = exports.getQueriesMissingUses = exports.getQueriesInvalid = exports.getDisableDefaultQueriesInvalid = exports.getNameInvalid = exports.validateAndSanitisePath = exports.defaultAugmentationProperties = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 // We need to import `performance` on Node 12
@@ -240,12 +240,8 @@ async function parseQueryUses(languages, codeQL, resultMap, packs, queryUses, te
     if (queryUses.indexOf("/") === -1 && queryUses.indexOf("@") === -1) {
         return await addBuiltinSuiteQueries(languages, codeQL, resultMap, packs, queryUses, featureEnablement, configFile);
     }
-    // Otherwise, must be a reference to another repo.
-    // If config parsing is handled in CLI, then this repo will be downloaded
-    // later by the CLI.
-    if (!(await (0, util_1.useCodeScanningConfigInCli)(codeQL, featureEnablement))) {
+    // Otherwise, must be a reference to another repo
     await addRemoteQueries(codeQL, resultMap, queryUses, tempDir, apiDetails, logger, configFile);
-    }
     return false;
 }
 // Regex validating stars in paths or paths-ignore entries.
@@ -389,12 +385,11 @@ function getUnknownLanguagesError(languages) {
 }
 exports.getUnknownLanguagesError = getUnknownLanguagesError;
 /**
- * Gets the set of languages in the current repository that are
- * scannable by CodeQL.
+ * Gets the set of languages in the current repository
  */
-async function getLanguagesInRepo(repository, logger) {
+async function getLanguagesInRepo(repository, apiDetails, logger) {
     logger.debug(`GitHub repo ${repository.owner} ${repository.repo}`);
-    const response = await api.getApiClient().repos.listLanguages({
+    const response = await api.getApiClient(apiDetails).repos.listLanguages({
         owner: repository.owner,
         repo: repository.repo,
     });
@@ -412,7 +407,6 @@ async function getLanguagesInRepo(repository, logger) {
     }
     return [...languages];
 }
-exports.getLanguagesInRepo = getLanguagesInRepo;
 /**
  * Get the languages to analyse.
  *
@@ -423,17 +417,19 @@ exports.getLanguagesInRepo = getLanguagesInRepo;
  * If no languages could be detected from either the workflow or the repository
  * then throw an error.
  */
-async function getLanguages(codeQL, languagesInput, repository, logger) {
-    // Obtain languages without filtering them.
-    const { rawLanguages, autodetected } = await getRawLanguages(languagesInput, repository, logger);
-    let languages = rawLanguages.map(languages_1.resolveAlias);
-    if (autodetected) {
+async function getLanguages(codeQL, languagesInput, repository, apiDetails, logger) {
+    // Obtain from action input 'languages' if set
+    let languages = (languagesInput || "")
+        .split(",")
+        .map((x) => x.trim())
+        .filter((x) => x.length > 0);
+    logger.info(`Languages from configuration: ${JSON.stringify(languages)}`);
+    if (languages.length === 0) {
+        // Obtain languages as all languages in the repo that can be analysed
+        languages = await getLanguagesInRepo(repository, apiDetails, logger);
         const availableLanguages = await codeQL.resolveLanguages();
         languages = languages.filter((value) => value in availableLanguages);
-        logger.info(`Automatically detected languages: ${languages.join(", ")}`);
-    }
-    else {
-        logger.info(`Languages from configuration: ${languages.join(", ")}`);
+        logger.info(`Automatically detected languages: ${JSON.stringify(languages)}`);
     }
     // If the languages parameter was not given and no languages were
     // detected then fail here as this is a workflow configuration error.
@@ -444,51 +440,19 @@ async function getLanguages(codeQL, languagesInput, repository, logger) {
     const parsedLanguages = [];
     const unknownLanguages = [];
     for (const language of languages) {
-        // We know this is not an alias since we resolved it above.
         const parsedLanguage = (0, languages_1.parseLanguage)(language);
         if (parsedLanguage === undefined) {
             unknownLanguages.push(language);
         }
-        else if (!parsedLanguages.includes(parsedLanguage)) {
+        else if (parsedLanguages.indexOf(parsedLanguage) === -1) {
             parsedLanguages.push(parsedLanguage);
         }
     }
-    // Any unknown languages here would have come directly from the input
-    // since we filter unknown languages coming from the GitHub API.
     if (unknownLanguages.length > 0) {
         throw new Error(getUnknownLanguagesError(unknownLanguages));
     }
     return parsedLanguages;
 }
-exports.getLanguages = getLanguages;
-/**
- * Gets the set of languages in the current repository without checking to
- * see if these languages are actually supported by CodeQL.
- *
- * @param languagesInput The languages from the workflow input
- * @param repository the owner/name of the repository
- * @param logger a logger
- * @returns A tuple containing a list of languages in this repository that might be
- * analyzable and whether or not this list was determined automatically.
- */
-async function getRawLanguages(languagesInput, repository, logger) {
-    // Obtain from action input 'languages' if set
-    let rawLanguages = (languagesInput || "")
-        .split(",")
-        .map((x) => x.trim().toLowerCase())
-        .filter((x) => x.length > 0);
-    let autodetected;
-    if (rawLanguages.length) {
-        autodetected = false;
-    }
-    else {
-        autodetected = true;
-        // Obtain all languages in the repo that can be analysed
-        rawLanguages = (await getLanguagesInRepo(repository, logger));
-    }
-    return { rawLanguages, autodetected };
-}
-exports.getRawLanguages = getRawLanguages;
 async function addQueriesAndPacksFromWorkflow(codeQL, queriesInput, languages, resultMap, packs, tempDir, workspacePath, apiDetails, featureEnablement, logger) {
     let injectedMlQueries = false;
     queriesInput = queriesInput.trim();
@@ -514,7 +478,7 @@ function shouldAddConfigFileQueries(queriesInput) {
  * Get the default config for when the user has not supplied one.
  */
 async function getDefaultConfig(languagesInput, rawQueriesInput, rawPacksInput, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, featureEnablement, logger) {
-    const languages = await getLanguages(codeQL, languagesInput, repository, logger);
+    const languages = await getLanguages(codeQL, languagesInput, repository, apiDetails, logger);
     const queries = {};
     for (const language of languages) {
         queries[language] = {
@@ -588,7 +552,7 @@ async function loadConfig(languagesInput, rawQueriesInput, rawPacksInput, config
             throw new Error(getNameInvalid(configFile));
         }
     }
-    const languages = await getLanguages(codeQL, languagesInput, repository, logger);
+    const languages = await getLanguages(codeQL, languagesInput, repository, apiDetails, logger);
     const queries = {};
     for (const language of languages) {
         queries[language] = {
@@ -929,14 +893,8 @@ async function initConfig(languagesInput, queriesInput, packsInput, registriesIn
     else {
         config = await loadConfig(languagesInput, queriesInput, packsInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, featureEnablement, logger);
     }
-    // When using the codescanning config in the CLI, pack downloads
-    // happen in the CLI during the `database init` command, so no need
-    // to download them here.
-    await (0, util_1.logCodeScanningConfigInCli)(codeQL, featureEnablement, logger);
-    if (!(await (0, util_1.useCodeScanningConfigInCli)(codeQL, featureEnablement))) {
     // The list of queries should not be empty for any language. If it is then
     // it is a user configuration error.
-        // This check occurs in the CLI when it parses the config file.
     for (const language of config.languages) {
         const hasBuiltinQueries = ((_a = config.queries[language]) === null || _a === void 0 ? void 0 : _a.builtin.length) > 0;
         const hasCustomQueries = ((_b = config.queries[language]) === null || _b === void 0 ? void 0 : _b.custom.length) > 0;
@@ -946,6 +904,11 @@ async function initConfig(languagesInput, queriesInput, packsInput, registriesIn
                 "Please make sure that the default queries are enabled, or you are specifying queries to run.");
         }
     }
+    // When using the codescanning config in the CLI, pack downloads
+    // happen in the CLI during the `database init` command, so no need
+    // to download them here.
+    await (0, util_1.logCodeScanningConfigInCli)(codeQL, featureEnablement, logger);
+    if (!(await (0, util_1.useCodeScanningConfigInCli)(codeQL, featureEnablement))) {
         const registries = parseRegistries(registriesInput);
         await downloadPacks(codeQL, config.languages, config.packs, registries, apiDetails, config.tempDir, logger);
     }
@@ -991,7 +954,7 @@ async function getRemoteConfig(configFile, apiDetails) {
         throw new Error(getConfigFileRepoFormatInvalidMessage(configFile));
     }
     const response = await api
-        .getApiClientWithExternalAuth(apiDetails)
+        .getApiClient(apiDetails, { allowExternal: true })
         .repos.getContent({
         owner: pieces.groups.owner,
         repo: pieces.groups.repo,

lib/config-utils.test.js

@@ -34,7 +34,6 @@ const configUtils = __importStar(require("./config-utils"));
 const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
-const repository_1 = require("./repository");
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
 (0, testing_utils_1.setupTests)(ava_1.default);
@@ -62,7 +61,6 @@ function mockGetContents(content) {
         .stub(client.repos, "getContent")
         .resolves(response);
     sinon.stub(api, "getApiClient").value(() => client);
-    sinon.stub(api, "getApiClientWithExternalAuth").value(() => client);
     return spyGetContents;
 }
 function mockListLanguages(languages) {
@@ -934,7 +932,11 @@ function parseInputAndConfigMacro(t, packsFromConfig, packsFromInput, languages,
     languages, "/a/b", mockLogger), expected);
 }
 parseInputAndConfigMacro.title = (providedTitle) => `Parse Packs input and config: ${providedTitle}`;
-const mockLogger = (0, logging_1.getRunnerLogger)(true);
+const mockLogger = {
+    info: (message) => {
+        console.log(message);
+    },
+};
 function parseInputAndConfigErrorMacro(t, packsFromConfig, packsFromInput, languages, packsFromInputOverride, expected) {
     t.throws(() => {
         configUtils.parsePacks(packsFromConfig, packsFromInput, packsFromInputOverride, languages, "/a/b", mockLogger);
@@ -1234,86 +1236,4 @@ const calculateAugmentationErrorMacro = ava_1.default.macro({
         }, { instanceOf: Error }, "Invalid 'registries' input. Must be an array of objects with 'url' and 'packages' properties.");
     });
 });
-// getLanguages
-const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
-// eslint-disable-next-line github/array-foreach
-[
-    {
-        name: "languages from input",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
-        languagesInput: "jAvAscript, \n jaVa",
-        languagesInRepository: ["SwiFt", "other"],
-        expectedLanguages: ["javascript", "java"],
-        expectedApiCall: false,
-    },
-    {
-        name: "languages from github api",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
-        languagesInput: "",
-        languagesInRepository: ["  jAvAscript\n \t", " jaVa", "SwiFt", "other"],
-        expectedLanguages: ["javascript", "java"],
-        expectedApiCall: true,
-    },
-    {
-        name: "aliases from input",
-        codeqlResolvedLanguages: ["javascript", "csharp", "cpp", "java", "python"],
-        languagesInput: "  typEscript\n \t, C#, c , KoTlin",
-        languagesInRepository: ["SwiFt", "other"],
-        expectedLanguages: ["javascript", "csharp", "cpp", "java"],
-        expectedApiCall: false,
-    },
-    {
-        name: "duplicate languages from input",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
-        languagesInput: "jAvAscript, \n jaVa, kotlin, typescript",
-        languagesInRepository: ["SwiFt", "other"],
-        expectedLanguages: ["javascript", "java"],
-        expectedApiCall: false,
-    },
-    {
-        name: "aliases from github api",
-        codeqlResolvedLanguages: ["javascript", "csharp", "cpp", "java", "python"],
-        languagesInput: "",
-        languagesInRepository: ["  typEscript\n \t", " C#", "c", "other"],
-        expectedLanguages: ["javascript", "csharp", "cpp"],
-        expectedApiCall: true,
-    },
-    {
-        name: "no languages",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
-        languagesInput: "",
-        languagesInRepository: [],
-        expectedApiCall: true,
-        expectedError: configUtils.getNoLanguagesError(),
-    },
-    {
-        name: "unrecognized languages from input",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
-        languagesInput: "a, b, c, javascript",
-        languagesInRepository: [],
-        expectedApiCall: false,
-        expectedError: configUtils.getUnknownLanguagesError(["a", "b"]),
-    },
-].forEach((args) => {
-    (0, ava_1.default)(`getLanguages: ${args.name}`, async (t) => {
-        const mockRequest = (0, testing_utils_1.mockLanguagesInRepo)(args.languagesInRepository);
-        const languages = args.codeqlResolvedLanguages.reduce((acc, lang) => ({
-            ...acc,
-            [lang]: true,
-        }), {});
-        const codeQL = (0, codeql_1.setCodeQL)({
-            resolveLanguages: () => Promise.resolve(languages),
-        });
-        if (args.expectedLanguages) {
-            // happy path
-            const actualLanguages = await configUtils.getLanguages(codeQL, args.languagesInput, mockRepositoryNwo, mockLogger);
-            t.deepEqual(actualLanguages.sort(), args.expectedLanguages.sort());
-        }
-        else {
-            // there is an error
-            await t.throwsAsync(async () => await configUtils.getLanguages(codeQL, args.languagesInput, mockRepositoryNwo, mockLogger), { message: args.expectedError });
-        }
-        t.deepEqual(mockRequest.called, args.expectedApiCall);
-    });
-});
 //# sourceMappingURL=config-utils.test.js.map

lib/count-loc.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.countLoc = void 0;
+const github_linguist_1 = require("github-linguist");
+const languages_1 = require("./languages");
+// Map from linguist language names to language prefixes used in the action and codeql
+const linguistToMetrics = {
+    c: languages_1.Language.cpp,
+    "c++": languages_1.Language.cpp,
+    "c#": languages_1.Language.csharp,
+    go: languages_1.Language.go,
+    java: languages_1.Language.java,
+    javascript: languages_1.Language.javascript,
+    python: languages_1.Language.python,
+    ruby: languages_1.Language.ruby,
+    typescript: languages_1.Language.javascript,
+};
+const nameToLinguist = Object.entries(linguistToMetrics).reduce((obj, [key, name]) => {
+    if (!obj[name]) {
+        obj[name] = [];
+    }
+    obj[name].push(key);
+    return obj;
+}, {});
+/**
+ * Count the lines of code of the specified language using the include
+ * and exclude glob paths.
+ *
+ * @param cwd the root directory to start the count from
+ * @param include glob patterns to include in the search for relevant files
+ * @param exclude glob patterns to exclude in the search for relevant files
+ * @param dbLanguages list of languages to include in the results
+ * @param logger object to log results
+ */
+async function countLoc(cwd, include, exclude, dbLanguages, logger) {
+    const result = await new github_linguist_1.LocDir({
+        cwd,
+        include: Array.isArray(include) && include.length > 0 ? include : ["**"],
+        exclude,
+        analysisLanguages: dbLanguages.flatMap((lang) => nameToLinguist[lang]),
+    }).loadInfo();
+    // The analysis counts LoC in all languages. We need to
+    // extract the languages we care about. Also, note that
+    // the analysis uses slightly different names for language.
+    const lineCounts = Object.entries(result.languages).reduce((obj, [language, { code }]) => {
+        const metricsLanguage = linguistToMetrics[language];
+        if (metricsLanguage && dbLanguages.includes(metricsLanguage)) {
+            obj[metricsLanguage] = code + (obj[metricsLanguage] || 0);
+        }
+        return obj;
+    }, {});
+    if (Object.keys(lineCounts).length) {
+        logger.debug("Lines of code count:");
+        for (const [language, count] of Object.entries(lineCounts)) {
+            logger.debug(`  ${language}: ${count}`);
+        }
+    }
+    else {
+        logger.info("Could not determine the baseline lines of code count in this repository. " +
+            "Because of this, it will not be possible to compare the lines " +
+            "of code analyzed by code scanning with the baseline. This will not affect " +
+            "the results produced by code scanning. If you have any questions, you can " +
+            "raise an issue at https://github.com/github/codeql-action/issues. Please " +
+            "include a link to the repository if public, or otherwise information about " +
+            "the code scanning workflow you are using.");
+    }
+    return lineCounts;
+}
+exports.countLoc = countLoc;
+//# sourceMappingURL=count-loc.js.map

lib/count-loc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"count-loc.js","sourceRoot":"","sources":["../src/count-loc.ts"],"names":[],"mappings":";;;AAAA,qDAAyC;AAEzC,2CAAuC;AAGvC,sFAAsF;AACtF,MAAM,iBAAiB,GAA6B;IAClD,CAAC,EAAE,oBAAQ,CAAC,GAAG;IACf,KAAK,EAAE,oBAAQ,CAAC,GAAG;IACnB,IAAI,EAAE,oBAAQ,CAAC,MAAM;IACrB,EAAE,EAAE,oBAAQ,CAAC,EAAE;IACf,IAAI,EAAE,oBAAQ,CAAC,IAAI;IACnB,UAAU,EAAE,oBAAQ,CAAC,UAAU;IAC/B,MAAM,EAAE,oBAAQ,CAAC,MAAM;IACvB,IAAI,EAAE,oBAAQ,CAAC,IAAI;IACnB,UAAU,EAAE,oBAAQ,CAAC,UAAU;CAChC,CAAC;AAEF,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAC7D,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;IACnB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACd,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;KAChB;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC,EACD,EAAgC,CACjC,CAAC;AAEF;;;;;;;;;GASG;AACI,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,OAAiB,EACjB,OAAiB,EACjB,WAAuB,EACvB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAI,wBAAM,CAAC;QAC9B,GAAG;QACH,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO;QACP,iBAAiB,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACvE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,uDAAuD;IACvD,uDAAuD;IACvD,2DAA2D;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,eAAe,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,eAAe,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE;YAC5D,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;SAC3D;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EACD,EAA8B,CAC/B,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE;QAClC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;YAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;SACzC;KACF;SAAM;QACL,MAAM,CAAC,IAAI,CACT,2EAA2E;YACzE,gEAAgE;YAChE,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,6EAA6E;YAC7E,2CAA2C,CAC9C,CAAC;KACH;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AA9CD,4BA8CC"}

lib/count-loc.test.js

@@ -0,0 +1,78 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const ava_1 = __importDefault(require("ava"));
+const count_loc_1 = require("./count-loc");
+const languages_1 = require("./languages");
+const logging_1 = require("./logging");
+const testing_utils_1 = require("./testing-utils");
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("ensure lines of code works for cpp and js", async (t) => {
+    const results = await (0, count_loc_1.countLoc)(path.join(__dirname, "../tests/multi-language-repo"), [], [], [languages_1.Language.cpp, languages_1.Language.javascript], (0, logging_1.getRunnerLogger)(true));
+    t.deepEqual(results, {
+        cpp: 6,
+        javascript: 9,
+    });
+});
+(0, ava_1.default)("ensure lines of code works for csharp", async (t) => {
+    const results = await (0, count_loc_1.countLoc)(path.join(__dirname, "../tests/multi-language-repo"), [], [], [languages_1.Language.csharp], (0, logging_1.getRunnerLogger)(true));
+    t.deepEqual(results, {
+        csharp: 10,
+    });
+});
+(0, ava_1.default)("ensure lines of code can handle undefined language", async (t) => {
+    const results = await (0, count_loc_1.countLoc)(path.join(__dirname, "../tests/multi-language-repo"), [], [], [languages_1.Language.javascript, languages_1.Language.python, "hucairz"], (0, logging_1.getRunnerLogger)(true));
+    t.deepEqual(results, {
+        javascript: 9,
+        python: 5,
+    });
+});
+(0, ava_1.default)("ensure lines of code can handle empty languages", async (t) => {
+    const results = await (0, count_loc_1.countLoc)(path.join(__dirname, "../tests/multi-language-repo"), [], [], [], (0, logging_1.getRunnerLogger)(true));
+    t.deepEqual(results, {});
+});
+(0, ava_1.default)("ensure lines of code can handle includes", async (t) => {
+    // note that "**" is always included. The includes are for extra
+    // directories outside the normal structure.
+    const results = await (0, count_loc_1.countLoc)(path.join(__dirname, "../tests/multi-language-repo"), ["../../src/testdata"], [], [languages_1.Language.javascript], (0, logging_1.getRunnerLogger)(true));
+    t.deepEqual(results, {
+        javascript: 12,
+    });
+});
+(0, ava_1.default)("ensure lines of code can handle empty includes", async (t) => {
+    // note that "**" is always included. The includes are for extra
+    // directories outside the normal structure.
+    const results = await (0, count_loc_1.countLoc)(path.join(__dirname, "../tests/multi-language-repo"), ["idontexist"], [], [languages_1.Language.javascript], (0, logging_1.getRunnerLogger)(true));
+    t.deepEqual(results, {
+    // should get no results
+    });
+});
+(0, ava_1.default)("ensure lines of code can handle exclude", async (t) => {
+    const results = await (0, count_loc_1.countLoc)(path.join(__dirname, "../tests/multi-language-repo"), [], ["**/*.py"], [languages_1.Language.javascript, languages_1.Language.python], (0, logging_1.getRunnerLogger)(true));
+    t.deepEqual(results, {
+        javascript: 9,
+    });
+});
+//# sourceMappingURL=count-loc.test.js.map

lib/count-loc.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"count-loc.test.js","sourceRoot":"","sources":["../src/count-loc.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AAEvB,2CAAuC;AACvC,2CAAuC;AACvC,uCAA4C;AAC5C,mDAA6C;AAE7C,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,2CAA2C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC5D,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAQ,EAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EACpD,EAAE,EACF,EAAE,EACF,CAAC,oBAAQ,CAAC,GAAG,EAAE,oBAAQ,CAAC,UAAU,CAAC,EACnC,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;IAEF,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;QACnB,GAAG,EAAE,CAAC;QACN,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,uCAAuC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxD,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAQ,EAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EACpD,EAAE,EACF,EAAE,EACF,CAAC,oBAAQ,CAAC,MAAM,CAAC,EACjB,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;IAEF,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,EAAE;KACX,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,oDAAoD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrE,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAQ,EAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EACpD,EAAE,EACF,EAAE,EACF,CAAC,oBAAQ,CAAC,UAAU,EAAE,oBAAQ,CAAC,MAAM,EAAE,SAAqB,CAAC,EAC7D,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;IAEF,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;QACnB,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,CAAC;KACV,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,iDAAiD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClE,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAQ,EAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EACpD,EAAE,EACF,EAAE,EACF,EAAE,EACF,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;IAEF,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,0CAA0C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC3D,gEAAgE;IAChE,4CAA4C;IAC5C,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAQ,EAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EACpD,CAAC,oBAAoB,CAAC,EACtB,EAAE,EACF,CAAC,oBAAQ,CAAC,UAAU,CAAC,EACrB,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;IAEF,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;QACnB,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,gDAAgD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjE,gEAAgE;IAChE,4CAA4C;IAC5C,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAQ,EAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EACpD,CAAC,YAAY,CAAC,EACd,EAAE,EACF,CAAC,oBAAQ,CAAC,UAAU,CAAC,EACrB,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;IAEF,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;IACnB,wBAAwB;KACzB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1D,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAQ,EAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EACpD,EAAE,EACF,CAAC,SAAS,CAAC,EACX,CAAC,oBAAQ,CAAC,UAAU,EAAE,oBAAQ,CAAC,MAAM,CAAC,EACtC,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;IAEF,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE;QACnB,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/database-upload.js

@@ -41,36 +41,28 @@ async function uploadDatabases(repositoryNwo, config, apiDetails, logger) {
         logger.debug("Not analyzing default branch. Skipping upload.");
         return;
     }
-    const client = (0, api_client_1.getApiClient)();
+    const client = (0, api_client_1.getApiClient)(apiDetails);
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     for (const language of config.languages) {
-        try {
         // Upload the database bundle.
         // Although we are uploading arbitrary file contents to the API, it's worth
         // noting that it's the API's job to validate that the contents is acceptable.
         // This API method is available to anyone with write access to the repo.
-            const bundledDb = await (0, util_1.bundleDb)(config, language, codeql, language);
-            const bundledDbSize = fs.statSync(bundledDb).size;
-            const bundledDbReadStream = fs.createReadStream(bundledDb);
+        const payload = fs.readFileSync(await (0, util_1.bundleDb)(config, language, codeql, language));
         try {
             await client.request(`POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name`, {
                 owner: repositoryNwo.owner,
                 repo: repositoryNwo.repo,
                 language,
                 name: `${language}-database`,
-                    data: bundledDbReadStream,
+                data: payload,
                 headers: {
                     authorization: `token ${apiDetails.auth}`,
                     "Content-Type": "application/zip",
-                        "Content-Length": bundledDbSize,
                 },
             });
             logger.debug(`Successfully uploaded database for ${language}`);
         }
-            finally {
-                bundledDbReadStream.close();
-            }
-        }
         catch (e) {
             console.log(e);
             // Log a warning but don't fail the workflow

lib/database-upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAIrC,6CAA+B;AAC/B,iCAAkC;AAE3B,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE;QAC9D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;KACR;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;QAC3D,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO;KACR;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACnD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;KACR;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI;gBACF,MAAM,MAAM,CAAC,OAAO,CAClB,wGAAwG,EACxG;oBACE,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;aAChE;oBAAS;gBACR,mBAAmB,CAAC,KAAK,EAAE,CAAC;aAC7B;SACF;QAAC,OAAO,CAAC,EAAE;YACV,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;SACnE;KACF;AACH,CAAC;AA7DD,0CA6DC"}
+{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAIrC,6CAA+B;AAC/B,iCAAkC;AAE3B,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE;QAC9D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;KACR;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;QAC3D,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO;KACR;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACnD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;KACR;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,EAAC,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,8BAA8B;QAC9B,2EAA2E;QAC3E,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAC7B,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CACnD,CAAC;QACF,IAAI;YACF,MAAM,MAAM,CAAC,OAAO,CAClB,wGAAwG,EACxG;gBACE,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;gBACxB,QAAQ;gBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;gBAC5B,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;oBACzC,cAAc,EAAE,iBAAiB;iBAClC;aACF,CACF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;SAChE;QAAC,OAAO,CAAC,EAAE;YACV,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;SACnE;KACF;AACH,CAAC;AAxDD,0CAwDC"}

lib/database-upload.test.js

@@ -36,7 +36,7 @@ const testing_utils_1 = require("./testing-utils");
 const util_1 = require("./util");
 (0, testing_utils_1.setupTests)(ava_1.default);
 ava_1.default.beforeEach(() => {
-    (0, util_1.initializeEnvironment)("1.2.3");
+    (0, util_1.initializeEnvironment)(util_1.Mode.actions, "1.2.3");
 });
 const testRepoName = { owner: "github", repo: "example" };
 const testApiDetails = {

lib/defaults.json

@@ -1,6 +1,3 @@
 {
-    "bundleVersion": "codeql-bundle-20230105",
-    "cliVersion": "2.12.0",
-    "priorBundleVersion": "codeql-bundle-20221211",
-    "priorCliVersion": "2.11.6"
+    "bundleVersion": "codeql-bundle-20221024"
 }

lib/error-matcher.js

@@ -12,10 +12,6 @@ exports.namedMatchersForTesting = {
         message: "No code found during the build. Please see:\n" +
             "https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning#no-code-found-during-the-build",
     },
-    fatalError: {
-        outputRegex: new RegExp("A fatal error occurred"),
-        message: "A fatal error occurred.",
-    },
 };
 // we collapse the matches into an array for use in execErrorCatcher
 exports.errorMatchers = Object.values(exports.namedMatchersForTesting);

lib/error-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-matcher.js","sourceRoot":"","sources":["../src/error-matcher.ts"],"names":[],"mappings":";;;AAQA,qCAAqC;AACxB,QAAA,uBAAuB,GAAoC;IACtE;;MAEE;IACF,iBAAiB,EAAE;QACjB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,IAAI,MAAM,CAAC,2CAA2C,CAAC;QACpE,OAAO,EACL,+CAA+C;YAC/C,yJAAyJ;KAC5J;IACD,UAAU,EAAE;QACV,WAAW,EAAE,IAAI,MAAM,CAAC,wBAAwB,CAAC;QACjD,OAAO,EAAE,yBAAyB;KACnC;CACF,CAAC;AAEF,oEAAoE;AACvD,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,+BAAuB,CAAC,CAAC"}
+{"version":3,"file":"error-matcher.js","sourceRoot":"","sources":["../src/error-matcher.ts"],"names":[],"mappings":";;;AAQA,qCAAqC;AACxB,QAAA,uBAAuB,GAAoC;IACtE;;MAEE;IACF,iBAAiB,EAAE;QACjB,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,IAAI,MAAM,CAAC,2CAA2C,CAAC;QACpE,OAAO,EACL,+CAA+C;YAC/C,yJAAyJ;KAC5J;CACF,CAAC;AAEF,oEAAoE;AACvD,QAAA,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,+BAAuB,CAAC,CAAC"}

lib/error-matcher.test.js

@@ -16,9 +16,6 @@ NB We test the regexes for all the matchers against example log output snippets.
   2020-09-07T17:39:53.9251124Z [2020-09-07 17:39:53] [ERROR] Spawned process exited abnormally (code 255; tried to run: [/opt/hostedtoolcache/CodeQL/0.0.0-20200630/x64/codeql/javascript/tools/autobuild.sh])
   `));
 });
-(0, ava_1.default)("fatalError matches against example log output", async (t) => {
-    t.assert(testErrorMatcher("fatalError", "A fatal error occurred: Could not process query metadata for test-query.ql"));
-});
 function testErrorMatcher(matcherName, logSample) {
     if (!(matcherName in error_matcher_1.namedMatchersForTesting)) {
         throw new Error(`Unknown matcher ${matcherName}`);