Merge pull request #1659 from github/update-v2.3.1-da583b07a

* Update changelog and version after v2.3.0

* Update checked-in dependencies

* Throw full error for CLI bundle download (#1657)

* Add `workload_run_attempt` to analysis upload (#1658)

* Refactor status report upload logic

Previously we had duplicated the logic to check `GITHUB_RUN_ID`. We now call the `getWorkflowRunID()` method for the status report upload method, and move the logic for the run attempt to `getWorkflowRunAttempt()`

* Add `workflow_run_attempt` to analysis payload

* Stop allowing `undefined` run IDs and attempts

Because we already throw an error if the ID or attempt aren't numbers, we don't have to allow `undefined` values into the payload.

* Update changelog for v2.3.1

---------

Co-authored-by: github-actions[bot] <github-actions@github.com>
Co-authored-by: Chuan-kai Lin <cklin@github.com>
Co-authored-by: Angela P Wen <angelapwen@github.com>

CHANGELOG.md

@@ -1,5 +1,9 @@
 # CodeQL Action Changelog
 
+## 2.3.1 - 26 Apr 2023
+
+No user facing changes.
+
 ## 2.3.0 - 21 Apr 2023
 
 - Update default CodeQL bundle version to 2.13.0. [#1649](https://github.com/github/codeql-action/pull/1649)

lib/actions-util.js

@@ -290,16 +290,8 @@ exports.getActionVersion = getActionVersion;
 async function createStatusReportBase(actionName, status, actionStartedAt, cause, exception) {
     const commitOid = (0, exports.getOptionalInput)("sha") || process.env["GITHUB_SHA"] || "";
     const ref = await getRef();
-    const workflowRunIDStr = process.env["GITHUB_RUN_ID"];
+    const workflowRunID = (0, workflow_1.getWorkflowRunID)();
-    let workflowRunID = -1;
+    const workflowRunAttempt = (0, workflow_1.getWorkflowRunAttempt)();
-    if (workflowRunIDStr) {
-        workflowRunID = parseInt(workflowRunIDStr, 10);
-    }
-    const workflowRunAttemptStr = process.env["GITHUB_RUN_ATTEMPT"];
-    let workflowRunAttempt = -1;
-    if (workflowRunAttemptStr) {
-        workflowRunAttempt = parseInt(workflowRunAttemptStr, 10);
-    }
     const workflowName = process.env["GITHUB_WORKFLOW"] || "";
     const jobName = process.env["GITHUB_JOB"] || "";
     const analysis_key = await getAnalysisKey();

lib/codeql.js

@@ -122,8 +122,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
         };
     }
     catch (e) {
-        logger.error((0, util_1.wrapError)(e).message);
+        throw new Error(`Unable to download and extract CodeQL CLI: ${(0, util_1.wrapError)(e).message}`);
-        throw new Error("Unable to download and extract CodeQL CLI");
     }
 }
 exports.setupCodeQL = setupCodeQL;

lib/upload-lib.js

@@ -134,7 +134,7 @@ exports.findSarifFilesInDir = findSarifFilesInDir;
 // Uploads a single sarif file or a directory of sarif files
 // depending on what the path happens to refer to.
 async function uploadFromActions(sarifPath, checkoutPath, category, logger) {
-    return await uploadFiles(getSarifFilePaths(sarifPath), (0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(checkoutPath), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), category, util.getRequiredEnvParam("GITHUB_WORKFLOW"), workflow.getWorkflowRunID(), checkoutPath, actionsUtil.getRequiredInput("matrix"), logger);
+    return await uploadFiles(getSarifFilePaths(sarifPath), (0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(checkoutPath), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), category, util.getRequiredEnvParam("GITHUB_WORKFLOW"), workflow.getWorkflowRunID(), workflow.getWorkflowRunAttempt(), checkoutPath, actionsUtil.getRequiredInput("matrix"), logger);
 }
 exports.uploadFromActions = uploadFromActions;
 function getSarifFilePaths(sarifPath) {
@@ -197,7 +197,7 @@ function validateSarifFileSchema(sarifFilePath, logger) {
 exports.validateSarifFileSchema = validateSarifFileSchema;
 // buildPayload constructs a map ready to be uploaded to the API from the given
 // parameters, respecting the current mode and target GitHub instance version.
-function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, workflowRunID, checkoutURI, environment, toolNames, mergeBaseCommitOid) {
+function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, workflowRunID, workflowRunAttempt, checkoutURI, environment, toolNames, mergeBaseCommitOid) {
     const payloadObj = {
         commit_oid: commitOid,
         ref,
@@ -205,6 +205,7 @@ function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, wo
         analysis_name: analysisName,
         sarif: zippedSarif,
         workflow_run_id: workflowRunID,
+        workflow_run_attempt: workflowRunAttempt,
         checkout_uri: checkoutURI,
         environment,
         started_at: process.env[shared_environment_1.CODEQL_WORKFLOW_STARTED_AT],
@@ -235,7 +236,7 @@ function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, wo
 exports.buildPayload = buildPayload;
 // Uploads the given set of sarif files.
 // Returns true iff the upload occurred and succeeded
-async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, category, analysisName, workflowRunID, sourceRoot, environment, logger) {
+async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, category, analysisName, workflowRunID, workflowRunAttempt, sourceRoot, environment, logger) {
     logger.startGroup("Uploading results");
     logger.info(`Processing sarif files: ${JSON.stringify(sarifFiles)}`);
     // Validate that the files we were asked to upload are all valid SARIF files
@@ -252,7 +253,7 @@ async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKe
     const sarifPayload = JSON.stringify(sarif);
     const zippedSarif = zlib_1.default.gzipSync(sarifPayload).toString("base64");
     const checkoutURI = (0, file_url_1.default)(sourceRoot);
-    const payload = buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, workflowRunID, checkoutURI, environment, toolNames, await actionsUtil.determineMergeBaseCommitOid());
+    const payload = buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, workflowRunID, workflowRunAttempt, checkoutURI, environment, toolNames, await actionsUtil.determineMergeBaseCommitOid());
     // Log some useful debug info about the info
     const rawUploadSizeBytes = sarifPayload.length;
     logger.debug(`Raw upload size: ${rawUploadSizeBytes} bytes`);

lib/upload-lib.test.js

@@ -48,7 +48,7 @@ ava_1.default.beforeEach(() => {
 });
 (0, ava_1.default)("validate correct payload used for push, PR merge commit, and PR head", async (t) => {
     process.env["GITHUB_EVENT_NAME"] = "push";
-    const pushPayload = uploadLib.buildPayload("commit", "refs/heads/master", "key", undefined, "", undefined, "/opt/src", undefined, ["CodeQL", "eslint"], "mergeBaseCommit");
+    const pushPayload = uploadLib.buildPayload("commit", "refs/heads/master", "key", undefined, "", 1234, 1, "/opt/src", undefined, ["CodeQL", "eslint"], "mergeBaseCommit");
     // Not triggered by a pull request
     t.falsy(pushPayload.base_ref);
     t.falsy(pushPayload.base_sha);
@@ -56,11 +56,11 @@ ava_1.default.beforeEach(() => {
     process.env["GITHUB_SHA"] = "commit";
     process.env["GITHUB_BASE_REF"] = "master";
     process.env["GITHUB_EVENT_PATH"] = `${__dirname}/../src/testdata/pull_request.json`;
-    const prMergePayload = uploadLib.buildPayload("commit", "refs/pull/123/merge", "key", undefined, "", undefined, "/opt/src", undefined, ["CodeQL", "eslint"], "mergeBaseCommit");
+    const prMergePayload = uploadLib.buildPayload("commit", "refs/pull/123/merge", "key", undefined, "", 1234, 1, "/opt/src", undefined, ["CodeQL", "eslint"], "mergeBaseCommit");
     // Uploads for a merge commit use the merge base
     t.deepEqual(prMergePayload.base_ref, "refs/heads/master");
     t.deepEqual(prMergePayload.base_sha, "mergeBaseCommit");
-    const prHeadPayload = uploadLib.buildPayload("headCommit", "refs/pull/123/head", "key", undefined, "", undefined, "/opt/src", undefined, ["CodeQL", "eslint"], "mergeBaseCommit");
+    const prHeadPayload = uploadLib.buildPayload("headCommit", "refs/pull/123/head", "key", undefined, "", 1234, 1, "/opt/src", undefined, ["CodeQL", "eslint"], "mergeBaseCommit");
     // Uploads for the head use the PR base
     t.deepEqual(prHeadPayload.base_ref, "refs/heads/master");
     t.deepEqual(prHeadPayload.base_sha, "f95f852bd8fca8fcc58a9a2d6c842781e32a215e");

lib/workflow.js

@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCheckoutPathInputOrThrow = exports.getUploadInputOrThrow = exports.getCategoryInputOrThrow = exports.getWorkflowRunID = exports.getWorkflowRelativePath = exports.getWorkflow = exports.formatWorkflowCause = exports.formatWorkflowErrors = exports.validateWorkflow = exports.getWorkflowErrors = exports.WorkflowErrors = exports.patternIsSuperset = void 0;
+exports.getCheckoutPathInputOrThrow = exports.getUploadInputOrThrow = exports.getCategoryInputOrThrow = exports.getWorkflowRunAttempt = exports.getWorkflowRunID = exports.getWorkflowRelativePath = exports.getWorkflow = exports.formatWorkflowCause = exports.formatWorkflowErrors = exports.validateWorkflow = exports.getWorkflowErrors = exports.WorkflowErrors = exports.patternIsSuperset = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const zlib_1 = __importDefault(require("zlib"));
@@ -252,13 +252,32 @@ exports.getWorkflowRelativePath = getWorkflowRelativePath;
  * Get the workflow run ID.
  */
 function getWorkflowRunID() {
-    const workflowRunID = parseInt((0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID"), 10);
+    const workflowRunIdString = (0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID");
+    const workflowRunID = parseInt(workflowRunIdString, 10);
     if (Number.isNaN(workflowRunID)) {
-        throw new Error("GITHUB_RUN_ID must define a non NaN workflow run ID");
+        throw new Error(`GITHUB_RUN_ID must define a non NaN workflow run ID. Current value is ${workflowRunIdString}`);
+    }
+    if (workflowRunID < 0) {
+        throw new Error(`GITHUB_RUN_ID must be a non-negative integer. Current value is ${workflowRunIdString}`);
     }
     return workflowRunID;
 }
 exports.getWorkflowRunID = getWorkflowRunID;
+/**
+ * Get the workflow run attempt number.
+ */
+function getWorkflowRunAttempt() {
+    const workflowRunAttemptString = (0, util_1.getRequiredEnvParam)("GITHUB_RUN_ID");
+    const workflowRunAttempt = parseInt(workflowRunAttemptString, 10);
+    if (Number.isNaN(workflowRunAttempt)) {
+        throw new Error(`GITHUB_RUN_ATTEMPT must define a non NaN workflow run attempt. Current value is ${workflowRunAttemptString}`);
+    }
+    if (workflowRunAttempt <= 0) {
+        throw new Error(`GITHUB_RUN_ATTEMPT must be a positive integer. Current value is ${workflowRunAttemptString}`);
+    }
+    return workflowRunAttempt;
+}
+exports.getWorkflowRunAttempt = getWorkflowRunAttempt;
 function getStepsCallingAction(job, actionName) {
     if (job.uses) {
         throw new Error(`Could not get steps calling ${actionName} since the job calls a reusable workflow.`);

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.3.0",
+      "version": "2.3.1",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

src/actions-util.ts

@@ -21,7 +21,11 @@ import {
   parseMatrixInput,
   UserError,
 } from "./util";
-import { getWorkflowRelativePath } from "./workflow";
+import {
+  getWorkflowRunID,
+  getWorkflowRunAttempt,
+  getWorkflowRelativePath,
+} from "./workflow";
 
 // eslint-disable-next-line import/no-commonjs
 const pkg = require("../package.json") as JSONSchemaForNPMPackageJsonFiles;
@@ -407,16 +411,8 @@ export async function createStatusReportBase(
 ): Promise<StatusReportBase> {
   const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || "";
   const ref = await getRef();
-  const workflowRunIDStr = process.env["GITHUB_RUN_ID"];
+  const workflowRunID = getWorkflowRunID();
-  let workflowRunID = -1;
+  const workflowRunAttempt = getWorkflowRunAttempt();
-  if (workflowRunIDStr) {
-    workflowRunID = parseInt(workflowRunIDStr, 10);
-  }
-  const workflowRunAttemptStr = process.env["GITHUB_RUN_ATTEMPT"];
-  let workflowRunAttempt = -1;
-  if (workflowRunAttemptStr) {
-    workflowRunAttempt = parseInt(workflowRunAttemptStr, 10);
-  }
   const workflowName = process.env["GITHUB_WORKFLOW"] || "";
   const jobName = process.env["GITHUB_JOB"] || "";
   const analysis_key = await getAnalysisKey();

src/codeql.ts

@@ -340,8 +340,9 @@ export async function setupCodeQL(
       toolsVersion,
     };
   } catch (e) {
-    logger.error(wrapError(e).message);
+    throw new Error(
-    throw new Error("Unable to download and extract CodeQL CLI");
+      `Unable to download and extract CodeQL CLI: ${wrapError(e).message}`
+    );
   }
 }
 

src/upload-lib.test.ts

@@ -37,7 +37,8 @@ test("validate correct payload used for push, PR merge commit, and PR head", asy
     "key",
     undefined,
     "",
-    undefined,
+    1234,
+    1,
     "/opt/src",
     undefined,
     ["CodeQL", "eslint"],
@@ -59,7 +60,8 @@ test("validate correct payload used for push, PR merge commit, and PR head", asy
     "key",
     undefined,
     "",
-    undefined,
+    1234,
+    1,
     "/opt/src",
     undefined,
     ["CodeQL", "eslint"],
@@ -75,7 +77,8 @@ test("validate correct payload used for push, PR merge commit, and PR head", asy
     "key",
     undefined,
     "",
-    undefined,
+    1234,
+    1,
     "/opt/src",
     undefined,
     ["CodeQL", "eslint"],

src/upload-lib.ts

@@ -173,6 +173,7 @@ export async function uploadFromActions(
     category,
     util.getRequiredEnvParam("GITHUB_WORKFLOW"),
     workflow.getWorkflowRunID(),
+    workflow.getWorkflowRunAttempt(),
     checkoutPath,
     actionsUtil.getRequiredInput("matrix"),
     logger
@@ -255,7 +256,8 @@ export function buildPayload(
   analysisKey: string | undefined,
   analysisName: string | undefined,
   zippedSarif: string,
-  workflowRunID: number | undefined,
+  workflowRunID: number,
+  workflowRunAttempt: number,
   checkoutURI: string,
   environment: string | undefined,
   toolNames: string[],
@@ -268,6 +270,7 @@ export function buildPayload(
     analysis_name: analysisName,
     sarif: zippedSarif,
     workflow_run_id: workflowRunID,
+    workflow_run_attempt: workflowRunAttempt,
     checkout_uri: checkoutURI,
     environment,
     started_at: process.env[CODEQL_WORKFLOW_STARTED_AT],
@@ -312,7 +315,8 @@ async function uploadFiles(
   analysisKey: string,
   category: string | undefined,
   analysisName: string | undefined,
-  workflowRunID: number | undefined,
+  workflowRunID: number,
+  workflowRunAttempt: number,
   sourceRoot: string,
   environment: string | undefined,
   logger: Logger
@@ -352,6 +356,7 @@ async function uploadFiles(
     analysisName,
     zippedSarif,
     workflowRunID,
+    workflowRunAttempt,
     checkoutURI,
     environment,
     toolNames,

src/workflow.ts

@@ -312,13 +312,40 @@ export async function getWorkflowRelativePath(): Promise<string> {
  * Get the workflow run ID.
  */
 export function getWorkflowRunID(): number {
-  const workflowRunID = parseInt(getRequiredEnvParam("GITHUB_RUN_ID"), 10);
+  const workflowRunIdString = getRequiredEnvParam("GITHUB_RUN_ID");
+  const workflowRunID = parseInt(workflowRunIdString, 10);
   if (Number.isNaN(workflowRunID)) {
-    throw new Error("GITHUB_RUN_ID must define a non NaN workflow run ID");
+    throw new Error(
+      `GITHUB_RUN_ID must define a non NaN workflow run ID. Current value is ${workflowRunIdString}`
+    );
+  }
+  if (workflowRunID < 0) {
+    throw new Error(
+      `GITHUB_RUN_ID must be a non-negative integer. Current value is ${workflowRunIdString}`
+    );
   }
   return workflowRunID;
 }
 
+/**
+ * Get the workflow run attempt number.
+ */
+export function getWorkflowRunAttempt(): number {
+  const workflowRunAttemptString = getRequiredEnvParam("GITHUB_RUN_ID");
+  const workflowRunAttempt = parseInt(workflowRunAttemptString, 10);
+  if (Number.isNaN(workflowRunAttempt)) {
+    throw new Error(
+      `GITHUB_RUN_ATTEMPT must define a non NaN workflow run attempt. Current value is ${workflowRunAttemptString}`
+    );
+  }
+  if (workflowRunAttempt <= 0) {
+    throw new Error(
+      `GITHUB_RUN_ATTEMPT must be a positive integer. Current value is ${workflowRunAttemptString}`
+    );
+  }
+  return workflowRunAttempt;
+}
+
 function getStepsCallingAction(
   job: WorkflowJob,
   actionName: string