Merge pull request #3012 from github/update-v3.29.6-67a6ea72b

Merge main into releases/v3

.github/copilot-instructions.md

@@ -0,0 +1,5 @@
+# CodeQL Action - Copilot Instructions
+
+The CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from.
+
+GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that starts with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.

.github/workflows/__all-platform-bundle.yml

@@ -45,6 +45,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'true'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - id: init
         uses: ./../action/init
         with:

.github/workflows/__analyze-ref-input.yml

@@ -49,6 +49,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__build-mode-manual.yml

@@ -45,6 +45,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__export-file-baseline-information.yml

@@ -49,6 +49,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__go-custom-queries.yml

@@ -47,9 +47,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
           go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml

@@ -45,10 +45,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
-      # We need a Go version that ships with statically linked binaries on Linux
           go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml

@@ -45,10 +45,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
-      # We need a Go version that ships with statically linked binaries on Linux
           go-version: '>=1.21.0'
+          cache: false
       - name: Remove `file` program
         run: |
           echo $(which file)

.github/workflows/__go-indirect-tracing-workaround.yml

@@ -45,10 +45,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
-      # We need a Go version that ships with statically linked binaries on Linux
           go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.16.6
-          - os: macos-latest
-            version: stable-v2.16.6
           - os: ubuntu-latest
             version: stable-v2.17.6
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: macos-latest
             version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
@@ -75,11 +75,10 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
-          go-version: ~1.24.0
-      # to avoid potentially misleading autobuilder results where we expect it to download
-      # dependencies successfully, but they actually come from a warm cache
+          go-version: '>=1.21.0'
           cache: false
       - uses: ./../action/init
         with:

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.16.6
-          - os: macos-latest
-            version: stable-v2.16.6
           - os: ubuntu-latest
             version: stable-v2.17.6
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: macos-latest
             version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
@@ -75,11 +75,10 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
-          go-version: ~1.24.0
-      # to avoid potentially misleading autobuilder results where we expect it to download
-      # dependencies successfully, but they actually come from a warm cache
+          go-version: '>=1.21.0'
           cache: false
       - uses: ./../action/init
         with:

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            version: stable-v2.16.6
-          - os: macos-latest
-            version: stable-v2.16.6
           - os: ubuntu-latest
             version: stable-v2.17.6
           - os: macos-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: macos-latest
             version: stable-v2.20.7
+          - os: ubuntu-latest
+            version: stable-v2.21.4
+          - os: macos-latest
+            version: stable-v2.21.4
           - os: ubuntu-latest
             version: default
           - os: macos-latest
@@ -75,11 +75,10 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
-          go-version: ~1.24.0
-      # to avoid potentially misleading autobuilder results where we expect it to download
-      # dependencies successfully, but they actually come from a warm cache
+          go-version: '>=1.21.0'
           cache: false
       - uses: ./../action/init
         with:

.github/workflows/__multi-language-autodetect.yml

@@ -27,10 +27,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
-            version: stable-v2.16.6
-          - os: ubuntu-latest
-            version: stable-v2.16.6
           - os: macos-latest
             version: stable-v2.17.6
           - os: ubuntu-latest
@@ -47,6 +43,10 @@ jobs:
             version: stable-v2.20.7
           - os: ubuntu-latest
             version: stable-v2.20.7
+          - os: macos-latest
+            version: stable-v2.21.4
+          - os: ubuntu-latest
+            version: stable-v2.21.4
           - os: macos-latest
             version: default
           - os: ubuntu-latest
@@ -75,10 +75,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
-      - uses: actions/setup-go@v5
+      - name: Install Go
+        uses: actions/setup-go@v5
         with:
           go-version: '>=1.21.0'
-
+          cache: false
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -61,6 +61,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           config-file: .github/codeql/codeql-config-packaging3.yml

.github/workflows/__packaging-config-inputs-js.yml

@@ -61,6 +61,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           config-file: .github/codeql/codeql-config-packaging3.yml

.github/workflows/__packaging-config-js.yml

@@ -61,6 +61,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           config-file: .github/codeql/codeql-config-packaging.yml

.github/workflows/__packaging-inputs-js.yml

@@ -61,6 +61,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           config-file: .github/codeql/codeql-config-packaging2.yml

.github/workflows/__quality-queries.yml

@@ -0,0 +1,117 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
+# to regenerate this file.
+
+name: PR Check - Quality queries input
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+jobs:
+  quality-queries:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: linked
+          - os: macos-latest
+            version: linked
+          - os: windows-latest
+            version: linked
+          - os: ubuntu-latest
+            version: nightly-latest
+          - os: macos-latest
+            version: nightly-latest
+          - os: windows-latest
+            version: nightly-latest
+    name: Quality queries input
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - uses: ./../action/init
+        with:
+          languages: javascript
+          quality-queries: code-quality
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - uses: ./../action/analyze
+        with:
+          output: ${{ runner.temp }}/results
+          upload-database: false
+      - name: Upload security SARIF
+        uses: actions/upload-artifact@v4
+        with:
+          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.sarif.json
+          path: ${{ runner.temp }}/results/javascript.sarif
+          retention-days: 7
+      - name: Upload quality SARIF
+        uses: actions/upload-artifact@v4
+        with:
+          name: quality-queries-${{ matrix.os }}-${{ matrix.version }}.quality.sarif.json
+          path: ${{ runner.temp }}/results/javascript.quality.sarif
+          retention-days: 7
+      - name: Check quality query does not appear in security SARIF
+        uses: actions/github-script@v7
+        env:
+          SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
+          EXPECT_PRESENT: 'false'
+        with:
+          script: ${{ env.CHECK_SCRIPT }}
+      - name: Check quality query appears in quality SARIF
+        uses: actions/github-script@v7
+        env:
+          SARIF_PATH: ${{ runner.temp }}/results/javascript.quality.sarif
+          EXPECT_PRESENT: 'true'
+        with:
+          script: ${{ env.CHECK_SCRIPT }}
+    env:
+      CHECK_SCRIPT: |
+        const fs = require('fs');
+
+        const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
+        const expectPresent = JSON.parse(process.env['EXPECT_PRESENT']);
+        const run = sarif.runs[0];
+        const extensions = run.tool.extensions;
+
+        if (extensions === undefined) {
+          core.setFailed('`extensions` property not found in the SARIF run property bag.');
+        }
+
+        // ID of a query we want to check the presence for
+        const targetId = 'js/regex/always-matches';
+        const found = extensions.find(extension => extension.rules && extension.rules.find(rule => rule.id === targetId));
+
+        if (found && expectPresent) {
+          console.log(`Found rule with id '${targetId}'.`);
+        } else if (!found && !expectPresent) {
+          console.log(`Rule with id '${targetId}' was not found.`);
+        } else {
+          core.setFailed(`${ found ? "Found" : "Didn't find" } rule ${targetId}`);
+        }
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__remote-config.yml

@@ -47,6 +47,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__rubocop-multi-language.yml

@@ -46,7 +46,7 @@ jobs:
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
       - name: Set up Ruby
-        uses: ruby/setup-ruby@13e7a03dc3ac6c3798f4570bfead2aed4d96abfb # v1.244.0
+        uses: ruby/setup-ruby@2a7b30092b0caf9c046252510f9273b4875f3db9 # v1.254.0
         with:
           ruby-version: 2.6
       - name: Install Code Scanning integration

.github/workflows/__split-workflow.yml

@@ -55,6 +55,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           config-file: .github/codeql/codeql-config-packaging3.yml

.github/workflows/__swift-custom-build.yml

@@ -49,6 +49,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         id: init
         with:

.github/workflows/__test-local-codeql.yml

@@ -45,6 +45,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - name: Fetch a CodeQL bundle
         shell: bash
         env:

.github/workflows/__unset-environment.yml

@@ -47,6 +47,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         id: init
         with:
@@ -54,9 +59,6 @@ jobs:
       # Swift is not supported on Ubuntu so we manually exclude it from the list here
           languages: cpp,csharp,go,java,javascript,python,ruby
           tools: ${{ steps.prepare-test.outputs.tools-url }}
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '>=1.21.0'
       - name: Build code
         shell: bash
         run: env -i PATH="$PATH" HOME="$HOME" ./build.sh

.github/workflows/__upload-quality-sarif.yml

@@ -0,0 +1,78 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
+# to regenerate this file.
+
+name: 'PR Check - Upload-sarif: code quality endpoint'
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+jobs:
+  upload-quality-sarif:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            version: default
+          - os: macos-latest
+            version: default
+          - os: windows-latest
+            version: default
+    name: 'Upload-sarif: code quality endpoint'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
+      - uses: ./../action/init
+        with:
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+          languages: cpp,csharp,java,javascript,python
+          config-file: ${{ github.repository }}/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{
+            github.sha }}
+          quality-queries: code-quality
+      - name: Build code
+        shell: bash
+        run: ./build.sh
+  # Generate some SARIF we can upload with the upload-sarif step
+      - uses: ./../action/analyze
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+          upload: never
+      - uses: ./../action/upload-sarif
+        with:
+          ref: refs/heads/main
+          sha: 5e235361806c361d4d3f8859e3c897658025a9a2
+    env:
+      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__upload-ref-sha-input.yml

@@ -49,6 +49,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - uses: ./../action/init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__with-checkout-path.yml

@@ -49,6 +49,11 @@ jobs:
           version: ${{ matrix.version }}
           use-all-platform-bundle: 'false'
           setup-kotlin: 'true'
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '>=1.21.0'
+          cache: false
       - name: Delete original checkout
         shell: bash
         run: |

.github/workflows/update-proxy-release.yml

@@ -0,0 +1,101 @@
+name: Update dependency proxy release assets
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The tag of CodeQL Bundle release that contains the proxy binaries as release assets"
+        type: string
+        required: true
+
+jobs:
+  update:
+    name: Update code and create PR
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # needed to push the updated files
+      pull-requests: write # needed to create the PR
+    env:
+      RELEASE_TAG: ${{ inputs.tag }}
+    steps:
+      - name: Check release tag format
+        id: checks
+        shell: bash
+        run: |
+          if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
+            exit 1
+          fi
+
+          echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
+
+      - name: Check that the release exists
+        shell: bash
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          (gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # ensure we have all tags and can push commits
+          ref: main
+
+      - name: Update git config
+        shell: bash
+        run: |
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "github-actions[bot]"
+
+      - name: Update release tag and version
+        shell: bash
+        run: |
+          NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
+          sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
+          sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
+
+      - name: Compile TypeScript and commit changes
+        shell: bash
+        env:
+          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
+        run: |
+          set -exu
+          git checkout -b "$TARGET_BRANCH"
+
+          npm run build
+          git add ./src/start-proxy-action.ts
+          git add ./lib
+          git commit -m "Update release used by \`start-proxy\` action"
+
+      - name: Push changes and open PR
+        shell: bash
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
+          PR_FLAG: ${{ (github.event_name == 'workflow_dispatch' && '--draft') || '--dry-run' }}
+        run: |
+          set -exu
+          pr_title="Update release used by \`start-proxy\` to \`$RELEASE_TAG\`"
+          pr_body=$(cat << EOF
+            This PR updates the \`start-proxy\` action to use the private registry proxy binaries that
+            are attached as release assets to the \`$RELEASE_TAG\` release.
+
+
+            Please do the following before merging:
+
+            - [ ] Verify that the changes to the code are correct.
+            - [ ] Mark the PR as ready for review to trigger the CI.
+          EOF
+          )
+
+          git push origin "$TARGET_BRANCH"
+          gh pr create \
+            --head "$TARGET_BRANCH" \
+            --base "main" \
+            --title "${pr_title}" \
+            --body "${pr_body}" \
+            $PR_FLAG

CHANGELOG.md

@@ -2,11 +2,45 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## 3.29.6 - 07 Aug 2025
+
+- The `cleanup-level` input to the `analyze` Action is now deprecated. The CodeQL Action has written a limited amount of intermediate results to the database since version 2.2.5, and now automatically manages cleanup. [#2999](https://github.com/github/codeql-action/pull/2999)
+- Update default CodeQL bundle version to 2.22.3. [#3000](https://github.com/github/codeql-action/pull/3000)
+
+## 3.29.5 - 29 Jul 2025
+
+- Update default CodeQL bundle version to 2.22.2. [#2986](https://github.com/github/codeql-action/pull/2986)
+
+## 3.29.4 - 23 Jul 2025
+
+No user facing changes.
+
+## 3.29.3 - 21 Jul 2025
+
+No user facing changes.
+
+## 3.29.2 - 30 Jun 2025
+
+- Experimental: When the `quality-queries` input for the `init` action is provided with an argument, separate `.quality.sarif` files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#2935](https://github.com/github/codeql-action/pull/2935)
+
+## 3.29.1 - 27 Jun 2025
+
+- Fix bug in PR analysis where user-provided `include` query filter fails to exclude non-included queries. [#2938](https://github.com/github/codeql-action/pull/2938)
+- Update default CodeQL bundle version to 2.22.1. [#2950](https://github.com/github/codeql-action/pull/2950)
+
 ## 3.29.0 - 11 Jun 2025
 
 - Update default CodeQL bundle version to 2.22.0. [#2925](https://github.com/github/codeql-action/pull/2925)
 - Bump minimum CodeQL bundle version to 2.16.6. [#2912](https://github.com/github/codeql-action/pull/2912)
 
+## 3.28.21 - 28 July 2025
+
+No user facing changes.
+
+## 3.28.20 - 21 July 2025
+
+- Remove support for combining SARIF files from a single upload for GHES 3.18, see [the changelog post](https://github.blog/changelog/2024-05-06-code-scanning-will-stop-combining-runs-from-a-single-upload/). [#2959](https://github.com/github/codeql-action/pull/2959)
+
 ## 3.28.19 - 03 Jun 2025
 
 - The CodeQL Action no longer includes its own copy of the extractor for the `actions` language, which is currently in public preview.

README.md

@@ -55,7 +55,7 @@ For compiled languages:
 
 - `manual` build mode will typically produce the most precise results, but it is more difficult to set up and will cause the analysis to take slightly more time to run.
 - `autobuild` build mode is simpler to set up, but will only work for projects with generic build steps that can be guessed by the heuristics of the autobuild scripts. If `autobuild` fails, then you must switch to `manual` or `none`. If `autobuild` succeeds, then the results and run time will be the same as `manual` mode.
-- `none` build mode is also simpler to set up and is slightly faster to run, but there is a possibility that some alerts will be missed. This may happen if your repository does any code generation during compilation or if there are any dependencies downloaded from registries that the workflow does not have access to. `none` is not yet supported by C/C++, Swift, Go, or Kotlin.
+- `none` build mode is also simpler to set up and is slightly faster to run, but there is a possibility that some alerts will be missed. This may happen if your repository does any code generation during compilation or if there are any dependencies downloaded from registries that the workflow does not have access to. `none` is not yet supported by Swift, Go, or Kotlin. It is in public preview for C/C++.
 
 
 ## Supported versions of the CodeQL Action
@@ -70,11 +70,11 @@ We typically release new minor versions of the CodeQL Action and Bundle when a n
 
 | Minimum CodeQL Action | Minimum CodeQL Bundle Version | GitHub Environment | Notes |
 |-----------------------|-------------------------------|--------------------|-------|
+| `v3.28.21`  | `2.21.3` | Enterprise Server 3.18 | |
 | `v3.28.12`  | `2.20.7` | Enterprise Server 3.17 | |
 | `v3.28.6`  | `2.20.3` | Enterprise Server 3.16 | |
 | `v3.28.6`  | `2.20.3` | Enterprise Server 3.15 | |
 | `v3.28.6` | `2.20.3` | Enterprise Server 3.14 | |
-| `v3.28.6` | `2.20.3` | Enterprise Server 3.13 | |
 
 See the full list of GHES release and deprecation dates at [GitHub Enterprise Server releases](https://docs.github.com/en/enterprise-server/admin/all-releases#releases-of-github-enterprise-server).
 

analyze/action.yml

@@ -19,9 +19,10 @@ inputs:
     # If changing this, make sure to update workflow.ts accordingly.
     default: "always"
   cleanup-level:
-    description: "Level of cleanup to perform on CodeQL databases at the end of the analyze step. This should either be 'none' to skip cleanup, or be a valid argument for the --cache-cleanup flag of the CodeQL CLI command 'codeql database cleanup' as documented at https://codeql.github.com/docs/codeql-cli/manual/database-cleanup"
+    description: >-
+      DEPRECATED. This option is ignored since, for performance reasons, the CodeQL Action no longer saves
+      intermediate results during evaluation.
     required: false
-    default: "brutal"
   ram:
     description: >-
       The amount of memory in MB that can be used by CodeQL for database finalization and query execution.

eslint.config.mjs

@@ -138,6 +138,7 @@ export default [
     rules: {
       "@typescript-eslint/no-explicit-any": "off",
       "@typescript-eslint/no-unsafe-assignment": "off",
+      "@typescript-eslint/no-unsafe-enum-comparison": "off",
       "@typescript-eslint/no-unsafe-member-access": "off",
       "@typescript-eslint/no-var-requires": "off",
       "@typescript-eslint/prefer-regexp-exec": "off",

init/action.yml

@@ -83,6 +83,9 @@ inputs:
   queries:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
+  quality-queries:
+    description: '[Internal] Comma-separated list of code quality queries to run.'
+    required: false
   packs:
     description: >-
       Comma-separated list of packs to run. Reference a pack in the format `scope/name[@version]`. If `version` is not

lib/actions-util.js

@@ -49,10 +49,14 @@ exports.isDefaultSetup = isDefaultSetup;
 exports.prettyPrintInvocation = prettyPrintInvocation;
 exports.ensureEndsInPeriod = ensureEndsInPeriod;
 exports.runTool = runTool;
+exports.getPullRequestBranches = getPullRequestBranches;
+exports.isAnalyzingPullRequest = isAnalyzingPullRequest;
+exports.fixCodeQualityCategory = fixCodeQualityCategory;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
+const github = __importStar(require("@actions/github"));
 const io = __importStar(require("@actions/io"));
 const util_1 = require("./util");
 // eslint-disable-next-line import/no-commonjs, @typescript-eslint/no-require-imports
@@ -261,7 +265,7 @@ function prettyPrintInvocation(cmd, args) {
  * An error from a tool invocation, with associated exit code, stderr, etc.
  */
 class CommandInvocationError extends Error {
-    constructor(cmd, args, exitCode, stderr, stdout) {
+    constructor(cmd, args, exitCode, stderr, stdout = "") {
         const prettyCommand = prettyPrintInvocation(cmd, args);
         const lastLine = ensureEndsInPeriod(stderr.trim().split("\n").pop()?.trim() || "n/a");
         super(`Failed to run "${prettyCommand}". ` +
@@ -352,4 +356,75 @@ const restoreInputs = function () {
     }
 };
 exports.restoreInputs = restoreInputs;
+/**
+ * Returns the base and head branches of the pull request being analyzed.
+ *
+ * @returns the base and head branches of the pull request, or undefined if
+ * we are not analyzing a pull request.
+ */
+function getPullRequestBranches() {
+    const pullRequest = github.context.payload.pull_request;
+    if (pullRequest) {
+        return {
+            base: pullRequest.base.ref,
+            // We use the head label instead of the head ref here, because the head
+            // ref lacks owner information and by itself does not uniquely identify
+            // the head branch (which may be in a forked repository).
+            head: pullRequest.head.label,
+        };
+    }
+    // PR analysis under Default Setup does not have the pull_request context,
+    // but it should set CODE_SCANNING_REF and CODE_SCANNING_BASE_BRANCH.
+    const codeScanningRef = process.env.CODE_SCANNING_REF;
+    const codeScanningBaseBranch = process.env.CODE_SCANNING_BASE_BRANCH;
+    if (codeScanningRef && codeScanningBaseBranch) {
+        return {
+            base: codeScanningBaseBranch,
+            // PR analysis under Default Setup analyzes the PR head commit instead of
+            // the merge commit, so we can use the provided ref directly.
+            head: codeScanningRef,
+        };
+    }
+    return undefined;
+}
+/**
+ * Returns whether we are analyzing a pull request.
+ */
+function isAnalyzingPullRequest() {
+    return getPullRequestBranches() !== undefined;
+}
+/**
+ * A workaround for code quality to map category names from old default setup workflows
+ * to ones that the code quality service expects.
+ */
+const qualityCategoryMapping = {
+    "c#": "csharp",
+    cpp: "c-cpp",
+    c: "c-cpp",
+    "c++": "c-cpp",
+    java: "java-kotlin",
+    javascript: "javascript-typescript",
+    typescript: "javascript-typescript",
+    kotlin: "java-kotlin",
+};
+/** Adjusts the category string for a Code Quality SARIF file if an "old"
+ * category identifier is used by Default Setup.
+ */
+function fixCodeQualityCategory(logger, category) {
+    // The `category` should always be set by Default Setup. We perform this check
+    // to avoid potential issues if Code Quality supports Advanced Setup in the future
+    // and before this workaround is removed.
+    if (category !== undefined &&
+        isDefaultSetup() &&
+        category.startsWith("/language:")) {
+        const language = category.substring("/language:".length);
+        const mappedLanguage = qualityCategoryMapping[language];
+        if (mappedLanguage) {
+            const newCategory = `/language:${mappedLanguage}`;
+            logger.info(`Adjusted category for Code Quality from '${category}' to '${newCategory}'.`);
+            return newCategory;
+        }
+    }
+    return category;
+}
 //# sourceMappingURL=actions-util.js.map

lib/actions-util.test.js

@@ -1,14 +1,79 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const github = __importStar(require("@actions/github"));
 const ava_1 = __importDefault(require("ava"));
+const actions_util_1 = require("./actions-util");
 const api_client_1 = require("./api-client");
 const environment_1 = require("./environment");
+const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
 const util_1 = require("./util");
 (0, testing_utils_1.setupTests)(ava_1.default);
+function withMockedContext(mockPayload, testFn) {
+    const originalPayload = github.context.payload;
+    github.context.payload = mockPayload;
+    try {
+        return testFn();
+    }
+    finally {
+        github.context.payload = originalPayload;
+    }
+}
+function withMockedEnv(envVars, testFn) {
+    const originalEnv = { ...process.env };
+    // Apply environment changes
+    for (const [key, value] of Object.entries(envVars)) {
+        if (value === undefined) {
+            delete process.env[key];
+        }
+        else {
+            process.env[key] = value;
+        }
+    }
+    try {
+        return testFn();
+    }
+    finally {
+        // Restore original environment
+        process.env = originalEnv;
+    }
+}
 (0, ava_1.default)("computeAutomationID()", async (t) => {
     let actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", '{"language": "javascript", "os": "linux"}');
     t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/language:javascript/os:linux/");
@@ -25,8 +90,103 @@ const util_1 = require("./util");
     actualAutomationID = (0, api_client_1.computeAutomationID)(".github/workflows/codeql-analysis.yml:analyze", undefined);
     t.deepEqual(actualAutomationID, ".github/workflows/codeql-analysis.yml:analyze/");
 });
+(0, ava_1.default)("getPullRequestBranches() with pull request context", (t) => {
+    withMockedContext({
+        pull_request: {
+            number: 123,
+            base: { ref: "main" },
+            head: { label: "user:feature-branch" },
+        },
+    }, () => {
+        t.deepEqual((0, actions_util_1.getPullRequestBranches)(), {
+            base: "main",
+            head: "user:feature-branch",
+        });
+        t.is((0, actions_util_1.isAnalyzingPullRequest)(), true);
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined with push context", (t) => {
+    withMockedContext({
+        push: {
+            ref: "refs/heads/main",
+        },
+    }, () => {
+        t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+        t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() with Default Setup environment variables", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: "refs/heads/feature-branch",
+            CODE_SCANNING_BASE_BRANCH: "main",
+        }, () => {
+            t.deepEqual((0, actions_util_1.getPullRequestBranches)(), {
+                base: "main",
+                head: "refs/heads/feature-branch",
+            });
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), true);
+        });
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined when only CODE_SCANNING_REF is set", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: "refs/heads/feature-branch",
+            CODE_SCANNING_BASE_BRANCH: undefined,
+        }, () => {
+            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+        });
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined when only CODE_SCANNING_BASE_BRANCH is set", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: undefined,
+            CODE_SCANNING_BASE_BRANCH: "main",
+        }, () => {
+            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+        });
+    });
+});
+(0, ava_1.default)("getPullRequestBranches() returns undefined when no PR context", (t) => {
+    withMockedContext({}, () => {
+        withMockedEnv({
+            CODE_SCANNING_REF: undefined,
+            CODE_SCANNING_BASE_BRANCH: undefined,
+        }, () => {
+            t.is((0, actions_util_1.getPullRequestBranches)(), undefined);
+            t.is((0, actions_util_1.isAnalyzingPullRequest)(), false);
+        });
+    });
+});
 (0, ava_1.default)("initializeEnvironment", (t) => {
     (0, util_1.initializeEnvironment)("1.2.3");
     t.deepEqual(process.env[environment_1.EnvVar.VERSION], "1.2.3");
 });
+(0, ava_1.default)("fixCodeQualityCategory", (t) => {
+    withMockedEnv({
+        GITHUB_EVENT_NAME: "dynamic",
+    }, () => {
+        const logger = (0, logging_1.getRunnerLogger)(true);
+        // Categories that should get adjusted.
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:c#"), "/language:csharp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:cpp"), "/language:c-cpp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:c"), "/language:c-cpp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:java"), "/language:java-kotlin");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:javascript"), "/language:javascript-typescript");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:typescript"), "/language:javascript-typescript");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:kotlin"), "/language:java-kotlin");
+        // Categories that should not get adjusted.
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:csharp"), "/language:csharp");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:go"), "/language:go");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "/language:actions"), "/language:actions");
+        // Other cases.
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, undefined), undefined);
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "random string"), "random string");
+        t.is((0, actions_util_1.fixCodeQualityCategory)(logger, "kotlin"), "kotlin");
+    });
+});
 //# sourceMappingURL=actions-util.test.js.map

lib/analyze-action-env.test.js

@@ -68,6 +68,7 @@ const util = __importStar(require("./util"));
         };
         sinon.stub(configUtils, "getConfig").resolves({
             gitHubVersion,
+            augmentationProperties: {},
             languages: [],
             packs: [],
             trapCaches: {},
@@ -75,8 +76,8 @@ const util = __importStar(require("./util"));
         const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
         requiredInputStub.withArgs("token").returns("fake-token");
         requiredInputStub.withArgs("upload-database").returns("false");
+        requiredInputStub.withArgs("output").returns("out");
         const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
-        optionalInputStub.withArgs("cleanup-level").returns("none");
         optionalInputStub.withArgs("expect-error").returns("false");
         sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);

lib/analyze-action-env.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-action-env.test.js","sourceRoot":"","sources":["../src/analyze-action-env.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,kDAAoC;AACpC,4DAA8C;AAC9C,sDAAwC;AACxC,8DAAgD;AAChD,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,8DAA8D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC;aAC5C,QAAQ,CAAC,EAAmC,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEhE,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,uEAAuE;QACvE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,iEAAiE;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analyze-action-env.test.js","sourceRoot":"","sources":["../src/analyze-action-env.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,kDAAoC;AACpC,4DAA8C;AAC9C,sDAAwC;AACxC,8DAAgD;AAChD,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,8DAA8D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC;aAC5C,QAAQ,CAAC,EAAmC,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEhE,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,sBAAsB,EAAE,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,uEAAuE;QACvE,0EAA0E;QAC1E,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,iEAAiE;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action-input.test.js

@@ -67,6 +67,7 @@ const util = __importStar(require("./util"));
         };
         sinon.stub(configUtils, "getConfig").resolves({
             gitHubVersion,
+            augmentationProperties: {},
             languages: [],
             packs: [],
             trapCaches: {},
@@ -74,8 +75,8 @@ const util = __importStar(require("./util"));
         const requiredInputStub = sinon.stub(actionsUtil, "getRequiredInput");
         requiredInputStub.withArgs("token").returns("fake-token");
         requiredInputStub.withArgs("upload-database").returns("false");
+        requiredInputStub.withArgs("output").returns("out");
         const optionalInputStub = sinon.stub(actionsUtil, "getOptionalInput");
-        optionalInputStub.withArgs("cleanup-level").returns("none");
         optionalInputStub.withArgs("expect-error").returns("false");
         sinon.stub(api, "getGitHubVersion").resolves(gitHubVersion);
         sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);

lib/analyze-action-input.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-action-input.test.js","sourceRoot":"","sources":["../src/analyze-action-input.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,kDAAoC;AACpC,4DAA8C;AAC9C,sDAAwC;AACxC,8DAAgD;AAChD,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,sDAAsD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC;aAC5C,QAAQ,CAAC,EAAmC,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChE,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,4DAA4D;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,iEAAiE;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analyze-action-input.test.js","sourceRoot":"","sources":["../src/analyze-action-input.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,mDAAqC;AACrC,kDAAoC;AACpC,4DAA8C;AAC9C,sDAAwC;AACxC,8DAAgD;AAChD,mDAIyB;AACzB,6CAA+B;AAE/B,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,iCAAiC;AAEjC,IAAA,aAAI,EAAC,sDAAsD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvE,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,sCAAsC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,wBAAwB,CAAC;QACzD,KAAK;aACF,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC;aAC5C,QAAQ,CAAC,EAAmC,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,aAAa,GAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;SAChC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC5C,aAAa;YACb,sBAAsB,EAAE,EAAE;YAC1B,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;SACkB,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACtE,iBAAiB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChE,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAA,0CAA0B,EAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC;QAEnC,4DAA4D;QAC5D,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,iEAAiE;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAElD,uEAAuE;QACvE,oEAAoE;QACpE,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,aAAa,CAAC,UAAU,CAAC;QAE/B,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action.js

@@ -55,6 +55,7 @@ const environment_1 = require("./environment");
 const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
+const overlay_database_utils_1 = require("./overlay-database-utils");
 const repository_1 = require("./repository");
 const statusReport = __importStar(require("./status-report"));
 const status_report_1 = require("./status-report");
@@ -94,8 +95,8 @@ function hasBadExpectErrorInput() {
  * indicating whether Go extraction has extracted at least one file.
  */
 function doesGoExtractionOutputExist(config) {
-    const golangDbDirectory = util.getCodeQLDatabasePath(config, languages_1.Language.go);
-    const trapDirectory = path_1.default.join(golangDbDirectory, "trap", languages_1.Language.go);
+    const golangDbDirectory = util.getCodeQLDatabasePath(config, languages_1.KnownLanguage.go);
+    const trapDirectory = path_1.default.join(golangDbDirectory, "trap", languages_1.KnownLanguage.go);
     return (fs.existsSync(trapDirectory) &&
         fs
             .readdirSync(trapDirectory)
@@ -122,7 +123,7 @@ function doesGoExtractionOutputExist(config) {
  * whether any extraction output already exists for Go.
  */
 async function runAutobuildIfLegacyGoWorkflow(config, logger) {
-    if (!config.languages.includes(languages_1.Language.go)) {
+    if (!config.languages.includes(languages_1.KnownLanguage.go)) {
         return;
     }
     if (config.buildMode) {
@@ -133,7 +134,7 @@ async function runAutobuildIfLegacyGoWorkflow(config, logger) {
         logger.debug("Won't run Go autobuild since it has already been run.");
         return;
     }
-    if ((0, analyze_1.dbIsFinalized)(config, languages_1.Language.go, logger)) {
+    if ((0, analyze_1.dbIsFinalized)(config, languages_1.KnownLanguage.go, logger)) {
         logger.debug("Won't run Go autobuild since there is already a finalized database for Go.");
         return;
     }
@@ -148,7 +149,7 @@ async function runAutobuildIfLegacyGoWorkflow(config, logger) {
         return;
     }
     logger.debug("Running Go autobuild because extraction output (TRAP files) for Go code has not been found.");
-    await (0, autobuild_1.runAutobuild)(config, languages_1.Language.go, logger);
+    await (0, autobuild_1.runAutobuild)(config, languages_1.KnownLanguage.go, logger);
 }
 async function run() {
     const startedAt = new Date();
@@ -185,6 +186,10 @@ async function run() {
         if (hasBadExpectErrorInput()) {
             throw new util.ConfigurationError("`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork.");
         }
+        if (actionsUtil.getOptionalInput("cleanup-level") !== "") {
+            logger.info("The 'cleanup-level' input is ignored since the CodeQL Action now automatically " +
+                "manages database cleanup. This input can safely be removed from your workflow.");
+        }
         const apiDetails = (0, api_client_1.getApiDetails)();
         const outputDir = actionsUtil.getRequiredInput("output");
         core.exportVariable(environment_1.EnvVar.SARIF_RESULTS_OUTPUT_DIR, outputDir);
@@ -201,12 +206,8 @@ async function run() {
         await (0, analyze_1.warnIfGoInstalledAfterInit)(config, logger);
         await runAutobuildIfLegacyGoWorkflow(config, logger);
         dbCreationTimings = await (0, analyze_1.runFinalize)(outputDir, threads, memory, codeql, config, logger);
-        const cleanupLevel = actionsUtil.getOptionalInput("cleanup-level") || "brutal";
         if (actionsUtil.getRequiredInput("skip-queries") !== "true") {
-            runStats = await (0, analyze_1.runQueries)(outputDir, memory, util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), threads, cleanupLevel, diffRangePackDir, actionsUtil.getOptionalInput("category"), config, logger, features);
-        }
-        if (cleanupLevel !== "none") {
-            await (0, analyze_1.runCleanup)(config, cleanupLevel, logger);
+            runStats = await (0, analyze_1.runQueries)(outputDir, memory, util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), threads, diffRangePackDir, actionsUtil.getOptionalInput("category"), config, logger, features);
         }
         const dbLocations = {};
         for (const language of config.languages) {
@@ -216,14 +217,22 @@ async function run() {
         core.setOutput("sarif-output", path_1.default.resolve(outputDir));
         const uploadInput = actionsUtil.getOptionalInput("upload");
         if (runStats && actionsUtil.getUploadValue(uploadInput) === "always") {
-            uploadResult = await uploadLib.uploadFiles(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), features, logger);
+            uploadResult = await uploadLib.uploadFiles(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), features, logger, uploadLib.CodeScanningTarget);
             core.setOutput("sarif-id", uploadResult.sarifID);
+            if (config.augmentationProperties.qualityQueriesInput !== undefined) {
+                const qualityUploadResult = await uploadLib.uploadFiles(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.fixCodeQualityCategory(logger, actionsUtil.getOptionalInput("category")), features, logger, uploadLib.CodeQualityTarget);
+                core.setOutput("quality-sarif-id", qualityUploadResult.sarifID);
+            }
         }
         else {
             logger.info("Not uploading results");
         }
-        // Possibly upload the database bundles for remote queries
-        await (0, database_upload_1.uploadDatabases)(repositoryNwo, config, apiDetails, logger);
+        // Possibly upload the overlay-base database to actions cache.
+        // If databases are to be uploaded, they will first be cleaned up at the overlay level.
+        await (0, overlay_database_utils_1.uploadOverlayBaseDatabaseToCache)(codeql, config, logger);
+        // Possibly upload the database bundles for remote queries.
+        // If databases are to be uploaded, they will first be cleaned up at the clear level.
+        await (0, database_upload_1.uploadDatabases)(repositoryNwo, codeql, config, apiDetails, logger);
         // Possibly upload the TRAP caches for later re-use
         const trapCacheUploadStartTime = perf_hooks_1.performance.now();
         didUploadTrapCaches = await (0, trap_caching_1.uploadTrapCaches)(codeql, config, logger);

lib/analyze.js

@@ -36,21 +36,21 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.exportedForTesting = exports.CodeQLAnalysisError = void 0;
+exports.exportedForTesting = exports.defaultSuites = exports.CodeQLAnalysisError = void 0;
 exports.runExtraction = runExtraction;
 exports.dbIsFinalized = dbIsFinalized;
 exports.setupDiffInformedQueryRun = setupDiffInformedQueryRun;
+exports.resolveQuerySuiteAlias = resolveQuerySuiteAlias;
 exports.runQueries = runQueries;
 exports.runFinalize = runFinalize;
 exports.warnIfGoInstalledAfterInit = warnIfGoInstalledAfterInit;
-exports.runCleanup = runCleanup;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const perf_hooks_1 = require("perf_hooks");
 const io = __importStar(require("@actions/io"));
 const del_1 = __importDefault(require("del"));
 const yaml = __importStar(require("js-yaml"));
-const actionsUtil = __importStar(require("./actions-util"));
+const actions_util_1 = require("./actions-util");
 const api_client_1 = require("./api-client");
 const autobuild_1 = require("./autobuild");
 const codeql_1 = require("./codeql");
@@ -61,6 +61,7 @@ const environment_1 = require("./environment");
 const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
+const overlay_database_utils_1 = require("./overlay-database-utils");
 const repository_1 = require("./repository");
 const tracer_config_1 = require("./tracer-config");
 const util = __importStar(require("./util"));
@@ -91,13 +92,13 @@ async function runExtraction(codeql, config, logger) {
             logger.debug(`Database for ${language} has already been finalized, skipping extraction.`);
             continue;
         }
-        if (shouldExtractLanguage(config, language)) {
+        if (await shouldExtractLanguage(codeql, config, language)) {
             logger.startGroup(`Extracting ${language}`);
-            if (language === languages_1.Language.python) {
+            if (language === languages_1.KnownLanguage.python) {
                 await setupPythonExtractor(logger);
             }
             if (config.buildMode) {
-                if (language === languages_1.Language.cpp &&
+                if (language === languages_1.KnownLanguage.cpp &&
                     config.buildMode === util_1.BuildMode.Autobuild) {
                     await (0, autobuild_1.setupCppAutobuild)(codeql, logger);
                 }
@@ -105,7 +106,8 @@ async function runExtraction(codeql, config, logger) {
                 // database scratch directory by default. For dependency caching purposes, we want
                 // a stable path that caches can be restored into and that we can cache at the
                 // end of the workflow (i.e. that does not get removed when the scratch directory is).
-                if (language === languages_1.Language.java && config.buildMode === util_1.BuildMode.None) {
+                if (language === languages_1.KnownLanguage.java &&
+                    config.buildMode === util_1.BuildMode.None) {
                     process.env["CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_DEPENDENCY_DIR"] =
                         (0, dependency_caching_1.getJavaTempDependencyDir)();
                 }
@@ -118,11 +120,11 @@ async function runExtraction(codeql, config, logger) {
         }
     }
 }
-function shouldExtractLanguage(config, language) {
+async function shouldExtractLanguage(codeql, config, language) {
     return (config.buildMode === util_1.BuildMode.None ||
         (config.buildMode === util_1.BuildMode.Autobuild &&
             process.env[environment_1.EnvVar.AUTOBUILD_DID_COMPLETE_SUCCESSFULLY] !== "true") ||
-        (!config.buildMode && (0, languages_1.isScannedLanguage)(language)));
+        (!config.buildMode && (await codeql.isScannedLanguage(language))));
 }
 function dbIsFinalized(config, language, logger) {
     const dbPath = util.getCodeQLDatabasePath(config, language);
@@ -245,7 +247,7 @@ function getDiffRanges(fileDiff, logger) {
     // uses forward slashes as the path separator, so on Windows we need to
     // replace any backslashes with forward slashes.
     const filename = path
-        .join(actionsUtil.getRequiredInput("checkout_path"), fileDiff.filename)
+        .join((0, actions_util_1.getRequiredInput)("checkout_path"), fileDiff.filename)
         .replaceAll(path.sep, "/");
     if (fileDiff.patch === undefined) {
         if (fileDiff.changes === 0) {
@@ -339,7 +341,7 @@ function writeDiffRangeDataExtensionPack(logger, ranges) {
         // range to a non-empty list that cannot match any alert location.
         ranges = [{ path: "", startLine: 0, endLine: 0 }];
     }
-    const diffRangeDir = path.join(actionsUtil.getTemporaryDirectory(), "pr-diff-range");
+    const diffRangeDir = path.join((0, actions_util_1.getTemporaryDirectory)(), "pr-diff-range");
     // We expect the Actions temporary directory to already exist, so are mainly
     // using `recursive: true` to avoid errors if the directory already exists,
     // for example if the analyze Action is run multiple times in the same job.
@@ -385,25 +387,69 @@ extensions:
     (0, diff_informed_analysis_utils_1.writeDiffRangesJsonFile)(logger, ranges);
     return diffRangeDir;
 }
+// A set of default query suite names that are understood by the CLI.
+exports.defaultSuites = new Set([
+    "security-experimental",
+    "security-extended",
+    "security-and-quality",
+    "code-quality",
+    "code-scanning",
+]);
+/**
+ * If `maybeSuite` is the name of a default query suite, it is resolved into the corresponding
+ * query suite name for the given `language`. Otherwise, `maybeSuite` is returned as is.
+ *
+ * @param language The language for which to resolve the default query suite name.
+ * @param maybeSuite The string that potentially contains the name of a default query suite.
+ * @returns Returns the resolved query suite name, or the unmodified input.
+ */
+function resolveQuerySuiteAlias(language, maybeSuite) {
+    if (exports.defaultSuites.has(maybeSuite)) {
+        return `${language}-${maybeSuite}.qls`;
+    }
+    return maybeSuite;
+}
 // Runs queries and creates sarif files in the given folder
-async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag, cleanupLevel, diffRangePackDir, automationDetailsId, config, logger, features) {
+async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag, diffRangePackDir, automationDetailsId, config, logger, features) {
     const statusReport = {};
     const queryFlags = [memoryFlag, threadsFlag];
-    if (cleanupLevel !== "overlay") {
+    const incrementalMode = [];
+    // Preserve cached intermediate results for overlay-base databases.
+    if (config.augmentationProperties.overlayDatabaseMode !==
+        overlay_database_utils_1.OverlayDatabaseMode.OverlayBase) {
         queryFlags.push("--expect-discarded-cache");
     }
     statusReport.analysis_is_diff_informed = diffRangePackDir !== undefined;
     if (diffRangePackDir) {
         queryFlags.push(`--additional-packs=${diffRangePackDir}`);
         queryFlags.push("--extension-packs=codeql-action/pr-diff-range");
+        incrementalMode.push("diff-informed");
     }
-    const sarifRunPropertyFlag = diffRangePackDir
-        ? "--sarif-run-property=incrementalMode=diff-informed"
+    statusReport.analysis_is_overlay =
+        config.augmentationProperties.overlayDatabaseMode ===
+            overlay_database_utils_1.OverlayDatabaseMode.Overlay;
+    statusReport.analysis_builds_overlay_base_database =
+        config.augmentationProperties.overlayDatabaseMode ===
+            overlay_database_utils_1.OverlayDatabaseMode.OverlayBase;
+    if (config.augmentationProperties.overlayDatabaseMode ===
+        overlay_database_utils_1.OverlayDatabaseMode.Overlay) {
+        incrementalMode.push("overlay");
+    }
+    const sarifRunPropertyFlag = incrementalMode.length > 0
+        ? `--sarif-run-property=incrementalMode=${incrementalMode.join(",")}`
         : undefined;
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     for (const language of config.languages) {
         try {
             const sarifFile = path.join(sarifFolder, `${language}.sarif`);
+            const queries = [];
+            if (config.augmentationProperties.qualityQueriesInput !== undefined) {
+                queries.push(path.join(util.getCodeQLDatabasePath(config, language), "temp", "config-queries.qls"));
+                for (const qualityQuery of config.augmentationProperties
+                    .qualityQueriesInput) {
+                    queries.push(resolveQuerySuiteAlias(language, qualityQuery.uses));
+                }
+            }
             // The work needed to generate the query suites
             // is done in the CLI. We just need to make a single
             // call to run all the queries for each language and
@@ -411,7 +457,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
             logger.startGroup(`Running queries for ${language}`);
             const startTimeRunQueries = new Date().getTime();
             const databasePath = util.getCodeQLDatabasePath(config, language);
-            await codeql.databaseRunQueries(databasePath, queryFlags);
+            await codeql.databaseRunQueries(databasePath, queryFlags, queries);
             logger.debug(`Finished running queries for ${language}.`);
             // TODO should not be using `builtin` here. We should be using `all` instead.
             // The status report does not support `all` yet.
@@ -419,12 +465,22 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
                 new Date().getTime() - startTimeRunQueries;
             logger.startGroup(`Interpreting results for ${language}`);
             const startTimeInterpretResults = new Date();
-            const analysisSummary = await runInterpretResults(language, undefined, sarifFile, config.debugMode);
+            const analysisSummary = await runInterpretResults(language, undefined, sarifFile, config.debugMode, automationDetailsId);
+            let qualityAnalysisSummary;
+            if (config.augmentationProperties.qualityQueriesInput !== undefined) {
+                logger.info(`Interpreting quality results for ${language}`);
+                const qualityCategory = (0, actions_util_1.fixCodeQualityCategory)(logger, automationDetailsId);
+                const qualitySarifFile = path.join(sarifFolder, `${language}.quality.sarif`);
+                qualityAnalysisSummary = await runInterpretResults(language, config.augmentationProperties.qualityQueriesInput.map((i) => resolveQuerySuiteAlias(language, i.uses)), qualitySarifFile, config.debugMode, qualityCategory);
+            }
             const endTimeInterpretResults = new Date();
             statusReport[`interpret_results_${language}_duration_ms`] =
                 endTimeInterpretResults.getTime() - startTimeInterpretResults.getTime();
             logger.endGroup();
             logger.info(analysisSummary);
+            if (qualityAnalysisSummary) {
+                logger.info(qualityAnalysisSummary);
+            }
             if (await features.getValue(feature_flags_1.Feature.QaTelemetryEnabled)) {
                 const perQueryAlertCounts = getPerQueryAlertCounts(sarifFile);
                 const perQueryAlertCountEventReport = {
@@ -449,9 +505,9 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
         }
     }
     return statusReport;
-    async function runInterpretResults(language, queries, sarifFile, enableDebugLogging) {
+    async function runInterpretResults(language, queries, sarifFile, enableDebugLogging, category) {
         const databasePath = util.getCodeQLDatabasePath(config, language);
-        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", sarifRunPropertyFlag, automationDetailsId, config, features);
+        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", sarifRunPropertyFlag, category, config, features);
     }
     /** Get an object with all queries and their counts parsed from a SARIF file path. */
     function getPerQueryAlertCounts(sarifPath) {
@@ -503,7 +559,7 @@ async function warnIfGoInstalledAfterInit(config, logger) {
         const goBinaryPath = await io.which("go", true);
         if (goInitPath !== goBinaryPath) {
             logger.warning(`Expected \`which go\` to return ${goInitPath}, but got ${goBinaryPath}: please ensure that the correct version of Go is installed before the \`codeql-action/init\` Action is used.`);
-            (0, diagnostics_1.addDiagnostic)(config, languages_1.Language.go, (0, diagnostics_1.makeDiagnostic)("go/workflow/go-installed-after-codeql-init", "Go was installed after the `codeql-action/init` Action was run", {
+            (0, diagnostics_1.addDiagnostic)(config, languages_1.KnownLanguage.go, (0, diagnostics_1.makeDiagnostic)("go/workflow/go-installed-after-codeql-init", "Go was installed after the `codeql-action/init` Action was run", {
                 markdownMessage: "To avoid interfering with the CodeQL analysis, perform all installation steps before calling the `github/codeql-action/init` Action.",
                 visibility: {
                     statusPage: true,
@@ -515,15 +571,6 @@ async function warnIfGoInstalledAfterInit(config, logger) {
         }
     }
 }
-async function runCleanup(config, cleanupLevel, logger) {
-    logger.startGroup("Cleaning up databases");
-    for (const language of config.languages) {
-        const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
-        const databasePath = util.getCodeQLDatabasePath(config, language);
-        await codeql.databaseCleanup(databasePath, cleanupLevel);
-    }
-    logger.endGroup();
-}
 exports.exportedForTesting = {
     getDiffRanges,
 };

lib/analyze.test.js

@@ -63,7 +63,7 @@ const util = __importStar(require("./util"));
         const addSnippetsFlag = "";
         const threadsFlag = "";
         sinon.stub(uploadLib, "validateSarifFileSchema");
-        for (const language of Object.values(languages_1.Language)) {
+        for (const language of Object.values(languages_1.KnownLanguage)) {
             (0, codeql_1.setCodeQL)({
                 databaseRunQueries: async () => { },
                 packDownload: async () => ({ packs: [] }),
@@ -114,9 +114,11 @@ const util = __importStar(require("./util"));
             fs.mkdirSync(util.getCodeQLDatabasePath(config, language), {
                 recursive: true,
             });
-            const statusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, "brutal", undefined, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.QaTelemetryEnabled]));
+            const statusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.QaTelemetryEnabled]));
             t.deepEqual(Object.keys(statusReport).sort(), [
+                "analysis_builds_overlay_base_database",
                 "analysis_is_diff_informed",
+                "analysis_is_overlay",
                 `analyze_builtin_queries_${language}_duration_ms`,
                 "event_reports",
                 `interpret_results_${language}_duration_ms`,
@@ -313,4 +315,17 @@ function runGetDiffRanges(changes, patch) {
     const diffRanges = runGetDiffRanges(2, ["@@ 30 +50,2 @@", "+1", "+2"]);
     t.deepEqual(diffRanges, undefined);
 });
+(0, ava_1.default)("resolveQuerySuiteAlias", (t) => {
+    // default query suite names should resolve to something language-specific ending in `.qls`.
+    for (const suite of analyze_1.defaultSuites) {
+        const resolved = (0, analyze_1.resolveQuerySuiteAlias)(languages_1.KnownLanguage.go, suite);
+        t.assert(resolved.endsWith(".qls"), "Resolved default suite doesn't end in .qls");
+        t.assert(resolved.indexOf(languages_1.KnownLanguage.go) >= 0, "Resolved default suite doesn't contain language name");
+    }
+    // other inputs should be returned unchanged
+    const names = ["foo", "bar", "codeql/go-queries@1.0"];
+    for (const name of names) {
+        t.deepEqual((0, analyze_1.resolveQuerySuiteAlias)(languages_1.KnownLanguage.go, name), name);
+    }
+});
 //# sourceMappingURL=analyze.test.js.map

lib/api-compatibility.json

@@ -1 +1 @@
-{ "maximumVersion": "3.18", "minimumVersion": "3.13" }
+{ "maximumVersion": "3.18", "minimumVersion": "3.14" }

lib/autobuild.js

@@ -46,7 +46,7 @@ const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const repository_1 = require("./repository");
 const util_1 = require("./util");
-async function determineAutobuildLanguages(_codeql, config, logger) {
+async function determineAutobuildLanguages(codeql, config, logger) {
     if (config.buildMode === util_1.BuildMode.None ||
         config.buildMode === util_1.BuildMode.Manual) {
         logger.info(`Using build mode "${config.buildMode}", nothing to autobuild. ` +
@@ -57,8 +57,8 @@ async function determineAutobuildLanguages(_codeql, config, logger) {
     // We want pick the dominant language in the repo from the ones we're able to build
     // The languages are sorted in order specified by user or by lines of code if we got
     // them from the GitHub API, so try to build the first language on the list.
-    const autobuildLanguages = config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l));
-    if (!autobuildLanguages) {
+    const autobuildLanguages = await (0, util_1.asyncFilter)(config.languages, async (language) => await codeql.isTracedLanguage(language));
+    if (autobuildLanguages.length === 0) {
         logger.info("None of the languages in this project require extra build steps");
         return undefined;
     }
@@ -89,7 +89,7 @@ async function determineAutobuildLanguages(_codeql, config, logger) {
      * This special case behavior should be removed as part of the next major
      * version of the CodeQL Action.
      */
-    const autobuildLanguagesWithoutGo = autobuildLanguages.filter((l) => l !== languages_1.Language.go);
+    const autobuildLanguagesWithoutGo = autobuildLanguages.filter((l) => l !== languages_1.KnownLanguage.go);
     const languages = [];
     // First run the autobuilder for the first non-Go traced language, if one
     // exists.
@@ -99,7 +99,7 @@ async function determineAutobuildLanguages(_codeql, config, logger) {
     // If Go is requested, run the Go autobuilder last to ensure it doesn't
     // interfere with the other autobuilder.
     if (autobuildLanguages.length !== autobuildLanguagesWithoutGo.length) {
-        languages.push(languages_1.Language.go);
+        languages.push(languages_1.KnownLanguage.go);
     }
     logger.debug(`Will autobuild ${languages.join(" and ")}.`);
     // In general the autobuilders for other traced languages may conflict with
@@ -145,7 +145,7 @@ async function setupCppAutobuild(codeql, logger) {
 async function runAutobuild(config, language, logger) {
     logger.startGroup(`Attempting to automatically build ${language} code`);
     const codeQL = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
-    if (language === languages_1.Language.cpp) {
+    if (language === languages_1.KnownLanguage.cpp) {
         await setupCppAutobuild(codeQL, logger);
     }
     if (config.buildMode) {
@@ -154,7 +154,7 @@ async function runAutobuild(config, language, logger) {
     else {
         await codeQL.runAutobuild(config, language);
     }
-    if (language === languages_1.Language.go) {
+    if (language === languages_1.KnownLanguage.go) {
         core.exportVariable(environment_1.EnvVar.DID_AUTOBUILD_GOLANG, "true");
     }
     logger.endGroup();

lib/autobuild.js.map

@@ -1 +1 @@
-{"version":3,"file":"autobuild.js","sourceRoot":"","sources":["../src/autobuild.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,kEAiGC;AAED,8CAmCC;AAED,oCAmBC;AAzKD,oDAAsC;AAEtC,iDAA6E;AAC7E,6CAAgD;AAChD,qCAA6C;AAE7C,uCAAmC;AACnC,+CAAuC;AACvC,mDAAmE;AACnE,2CAAyD;AAEzD,6CAAgD;AAChD,iCAAmC;AAE5B,KAAK,UAAU,2BAA2B,CAC/C,OAAe,EACf,MAA0B,EAC1B,MAAc;IAEd,IACE,MAAM,CAAC,SAAS,KAAK,gBAAS,CAAC,IAAI;QACnC,MAAM,CAAC,SAAS,KAAK,gBAAS,CAAC,MAAM,EACrC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,SAAS,2BAA2B;YAC9D,OAAO,gBAAM,CAAC,kBAAkB,wBAAwB,CAC3D,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,mFAAmF;IACnF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,IAAA,4BAAgB,EAAC,CAAC,CAAC,CACpB,CAAC;IAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,oBAAQ,CAAC,EAAE,CACzB,CAAC;IAEF,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,yEAAyE;IACzE,UAAU;IACV,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,kBAAkB,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;IAC3C,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,yCAAyC;IACzC,IAAI,2BAA2B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,OAAO,CACZ,oCAAoC,SAAS,CAAC,IAAI,CAChD,OAAO,CACR,8BAA8B,2BAA2B;aACvD,KAAK,CAAC,CAAC,CAAC;aACR,IAAI,CACH,OAAO,CACR,kFAAkF;YACnF,OAAO,gBAAM,CAAC,4BAA4B,wBAAwB,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,6BAAa,CAAC,uBAAO,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,WAAW,GAAG,4CAA4C,CAAC;IACjE,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAA,6BAAgB,GAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,aAAa,EACb,IAAA,oCAAqB,GAAE,EACvB,MAAM,CACP,CAAC;IACF,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,EAAE,CAAC;QACvE,yEAAyE;QACzE,IACE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,aAAa;YACnD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CACT,aAAa,WAAW,sCACtB,IAAA,mCAAoB,GAAE,KAAK,SAAS;gBAClC,CAAC,CAAC,8BAA8B,MAAM,yDAAyD,gBAAM,CAAC,oBAAoB,wBAAwB;gBAClJ,CAAC,CAAC,EACN,EAAE,CACH,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,YAAY,WAAW,yCAAyC,MAAM,yCAAyC,gBAAM,CAAC,oBAAoB,wBAAwB,CACnK,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,aAAa,WAAW,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,QAAkB,EAClB,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,qCAAqC,QAAQ,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,oBAAQ,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,KAAK,oBAAQ,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,oBAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC"}
+{"version":3,"file":"autobuild.js","sourceRoot":"","sources":["../src/autobuild.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,kEAkGC;AAED,8CAmCC;AAED,oCAmBC;AA1KD,oDAAsC;AAEtC,iDAA6E;AAC7E,6CAAgD;AAChD,qCAA6C;AAE7C,uCAAmC;AACnC,+CAAuC;AACvC,mDAAmE;AACnE,2CAAsD;AAEtD,6CAAgD;AAChD,iCAAgD;AAEzC,KAAK,UAAU,2BAA2B,CAC/C,MAAc,EACd,MAA0B,EAC1B,MAAc;IAEd,IACE,MAAM,CAAC,SAAS,KAAK,gBAAS,CAAC,IAAI;QACnC,MAAM,CAAC,SAAS,KAAK,gBAAS,CAAC,MAAM,EACrC,CAAC;QACD,MAAM,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,SAAS,2BAA2B;YAC9D,OAAO,gBAAM,CAAC,kBAAkB,wBAAwB,CAC3D,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,mFAAmF;IACnF,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,MAAM,IAAA,kBAAW,EAC1C,MAAM,CAAC,SAAS,EAChB,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAC5D,CAAC;IAEF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,MAAM,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,yBAAa,CAAC,EAAE,CAC9B,CAAC;IAEF,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,yEAAyE;IACzE,UAAU;IACV,IAAI,2BAA2B,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,kBAAkB,CAAC,MAAM,KAAK,2BAA2B,CAAC,MAAM,EAAE,CAAC;QACrE,SAAS,CAAC,IAAI,CAAC,yBAAa,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3D,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;IAC3C,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,yCAAyC;IACzC,IAAI,2BAA2B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,OAAO,CACZ,oCAAoC,SAAS,CAAC,IAAI,CAChD,OAAO,CACR,8BAA8B,2BAA2B;aACvD,KAAK,CAAC,CAAC,CAAC;aACR,IAAI,CACH,OAAO,CACR,kFAAkF;YACnF,OAAO,gBAAM,CAAC,4BAA4B,wBAAwB,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,6BAAa,CAAC,uBAAO,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,WAAW,GAAG,4CAA4C,CAAC;IACjE,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAA,6BAAgB,GAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,aAAa,EACb,aAAa,EACb,IAAA,oCAAqB,GAAE,EACvB,MAAM,CACP,CAAC;IACF,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,EAAE,CAAC;QACvE,yEAAyE;QACzE,IACE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,aAAa;YACnD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,EAC9B,CAAC;YACD,MAAM,CAAC,IAAI,CACT,aAAa,WAAW,sCACtB,IAAA,mCAAoB,GAAE,KAAK,SAAS;gBAClC,CAAC,CAAC,8BAA8B,MAAM,yDAAyD,gBAAM,CAAC,oBAAoB,wBAAwB;gBAClJ,CAAC,CAAC,EACN,EAAE,CACH,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,YAAY,WAAW,yCAAyC,MAAM,yCAAyC,gBAAM,CAAC,oBAAoB,wBAAwB,CACnK,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,aAAa,WAAW,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,QAAkB,EAClB,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,qCAAqC,QAAQ,OAAO,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,yBAAa,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,KAAK,yBAAa,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,oBAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC"}

lib/cli-errors.js

@@ -1,11 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cliErrorsConfig = exports.CliConfigErrorCategory = exports.CliError = void 0;
-exports.getCliConfigCategoryIfExists = getCliConfigCategoryIfExists;
 exports.wrapCliConfigurationError = wrapCliConfigurationError;
 const actions_util_1 = require("./actions-util");
 const doc_url_1 = require("./doc-url");
 const util_1 = require("./util");
+const SUPPORTED_PLATFORMS = [
+    ["linux", "x64"],
+    ["win32", "x64"],
+    ["darwin", "x64"],
+    ["darwin", "arm64"],
+];
 /**
  * An error from a CodeQL CLI invocation, with associated exit code, stderr, etc.
  */
@@ -124,6 +129,7 @@ var CliConfigErrorCategory;
     CliConfigErrorCategory["NoSourceCodeSeen"] = "NoSourceCodeSeen";
     CliConfigErrorCategory["NoSupportedBuildCommandSucceeded"] = "NoSupportedBuildCommandSucceeded";
     CliConfigErrorCategory["NoSupportedBuildSystemDetected"] = "NoSupportedBuildSystemDetected";
+    CliConfigErrorCategory["NotFoundInRegistry"] = "NotFoundInRegistry";
     CliConfigErrorCategory["OutOfMemoryOrDisk"] = "OutOfMemoryOrDisk";
     CliConfigErrorCategory["PackCannotBeFound"] = "PackCannotBeFound";
     CliConfigErrorCategory["PackMissingAuth"] = "PackMissingAuth";
@@ -150,7 +156,7 @@ exports.cliErrorsConfig = {
     },
     [CliConfigErrorCategory.GradleBuildFailed]: {
         cliErrorMessageCandidates: [
-            new RegExp("[autobuild] FAILURE: Build failed with an exception."),
+            new RegExp("\\[autobuild\\] FAILURE: Build failed with an exception."),
         ],
     },
     // Version of CodeQL CLI is incompatible with this version of the CodeQL Action
@@ -243,6 +249,11 @@ exports.cliErrorsConfig = {
             new RegExp("does not support the .* build mode. Please try using one of the following build modes instead"),
         ],
     },
+    [CliConfigErrorCategory.NotFoundInRegistry]: {
+        cliErrorMessageCandidates: [
+            new RegExp("'.*' not found in the registry '.*'"),
+        ],
+    },
 };
 /**
  * Check if the given CLI error or exit code, if applicable, apply to any known
@@ -266,11 +277,29 @@ function getCliConfigCategoryIfExists(cliError) {
     return undefined;
 }
 /**
- * Changes an error received from the CLI to a ConfigurationError with optionally an extra
- * error message appended, if it exists in a known set of configuration errors. Otherwise,
+ * Check if we are running on an unsupported platform/architecture combination.
+ */
+function isUnsupportedPlatform() {
+    return !SUPPORTED_PLATFORMS.some(([platform, arch]) => platform === process.platform && arch === process.arch);
+}
+/**
+ * Transform a CLI error into a ConfigurationError for an unsupported platform.
+ */
+function getUnsupportedPlatformError(cliError) {
+    return new util_1.ConfigurationError("The CodeQL CLI does not support the platform/architecture combination of " +
+        `${process.platform}/${process.arch} ` +
+        `(see ${doc_url_1.DocUrl.SYSTEM_REQUIREMENTS}). ` +
+        `The underlying error was: ${cliError.message}`);
+}
+/**
+ * Changes an error received from the CLI to a ConfigurationError with the message
+ * optionally being transformed, if it is a known configuration error. Otherwise,
  * simply returns the original error.
  */
 function wrapCliConfigurationError(cliError) {
+    if (isUnsupportedPlatform()) {
+        return getUnsupportedPlatformError(cliError);
+    }
     const cliConfigErrorCategory = getCliConfigCategoryIfExists(cliError);
     if (cliConfigErrorCategory === undefined) {
         return cliError;

lib/cli-errors.test.js

@@ -0,0 +1,220 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actions_util_1 = require("./actions-util");
+const cli_errors_1 = require("./cli-errors");
+const testing_utils_1 = require("./testing-utils");
+const util_1 = require("./util");
+(0, testing_utils_1.setupTests)(ava_1.default);
+(0, ava_1.default)("CliError constructor with fatal errors", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "finalize"], 32, "Running TRAP import for CodeQL database...\nA fatal error occurred: Evaluator heap must be at least 384.00 MiB\nA fatal error occurred: Dataset import failed with code 2");
+    const cliError = new cli_errors_1.CliError(commandError);
+    t.is(cliError.exitCode, 32);
+    t.is(cliError.stderr, "Running TRAP import for CodeQL database...\nA fatal error occurred: Evaluator heap must be at least 384.00 MiB\nA fatal error occurred: Dataset import failed with code 2");
+    t.true(cliError.message.includes("A fatal error occurred: Dataset import failed with code 2."));
+    t.true(cliError.message.includes("Context: A fatal error occurred: Evaluator heap must be at least 384.00 MiB."));
+});
+(0, ava_1.default)("CliError constructor with single fatal error", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "A fatal error occurred: Out of memory");
+    const cliError = new cli_errors_1.CliError(commandError);
+    t.is(cliError.exitCode, 1);
+    t.true(cliError.message.includes("A fatal error occurred: Out of memory"));
+    t.false(cliError.message.includes("Context:"));
+});
+(0, ava_1.default)("CliError constructor with autobuild errors", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuild] [ERROR] Build failed\n[autobuild] [ERROR] Compilation error");
+    const cliError = new cli_errors_1.CliError(commandError);
+    t.is(cliError.exitCode, 1);
+    t.true(cliError.message.includes("We were unable to automatically build your code"));
+    t.true(cliError.message.includes("Build failed\nCompilation error"));
+});
+(0, ava_1.default)("CliError constructor with truncated autobuild errors", (t) => {
+    const stderr = Array.from({ length: 12 }, (_, i) => `[autobuild] [ERROR] Error ${i + 1}`).join("\n");
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, stderr);
+    const cliError = new cli_errors_1.CliError(commandError);
+    t.true(cliError.message.includes("(truncated)"));
+    // Should only include first 10 errors plus truncation message
+    const errorLines = cliError.message
+        .split("Encountered the following error: ")[1]
+        .split("\n");
+    t.is(errorLines.length, 11); // 10 errors + "(truncated)"
+});
+(0, ava_1.default)("CliError constructor with generic error", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some generic error message\nLast line of error");
+    const cliError = new cli_errors_1.CliError(commandError);
+    t.is(cliError.exitCode, 1);
+    t.true(cliError.message.includes('Encountered a fatal error while running "codeql version"'));
+    t.true(cliError.message.includes("Exit code was 1 and last log line was: Last line of error."));
+});
+(0, ava_1.default)("CliError constructor with empty stderr", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "");
+    const cliError = new cli_errors_1.CliError(commandError);
+    t.true(cliError.message.includes("last log line was: n/a"));
+});
+for (const [platform, arch] of [
+    ["weird_plat", "x64"],
+    ["linux", "arm64"],
+    ["win32", "arm64"],
+]) {
+    (0, ava_1.default)(`wrapCliConfigurationError - ${platform}/${arch} unsupported`, (t) => {
+        sinon.stub(process, "platform").value(platform);
+        sinon.stub(process, "arch").value(arch);
+        const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some error");
+        const cliError = new cli_errors_1.CliError(commandError);
+        const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+        t.true(wrappedError instanceof util_1.ConfigurationError);
+        t.true(wrappedError.message.includes("CodeQL CLI does not support the platform/architecture combination"));
+        t.true(wrappedError.message.includes(`${platform}/${arch}`));
+    });
+}
+(0, ava_1.default)("wrapCliConfigurationError - supported platform", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some error");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    // Should return the original error since platform is supported
+    t.is(wrappedError, cliError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - autobuild error", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "We were unable to automatically build your code");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+    t.true(wrappedError.message.includes("We were unable to automatically build your code"));
+});
+(0, ava_1.default)("wrapCliConfigurationError - init called twice", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "Refusing to create databases /some/path but could not process any of it");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+    t.true(wrappedError.message.includes('Is the "init" action called twice in the same job?'));
+});
+(0, ava_1.default)("wrapCliConfigurationError - no source code seen by exit code", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "finalize"], 32, "Some other error message");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - no source code seen by message", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "finalize"], 1, "CodeQL detected code written in JavaScript but could not process any of it");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - out of memory error with additional message", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "analyze"], 1, "CodeQL is out of memory.");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+    t.true(wrappedError.message.includes("For more information, see https://gh.io/troubleshooting-code-scanning/out-of-disk-or-memory"));
+});
+(0, ava_1.default)("wrapCliConfigurationError - gradle build failed", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuild] FAILURE: Build failed with an exception.");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - maven build failed", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuild] [ERROR] Failed to execute goal");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - swift build failed", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "[autobuilder/build] [build-command-failed] `autobuild` failed to run the build command");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - pack cannot be found", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["pack", "install"], 1, "Query pack my-pack cannot be found. Check the spelling of the pack.");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - pack missing auth", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["pack", "download"], 1, "GitHub Container registry returned 403 Forbidden");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - invalid config file", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["database", "create"], 1, "Config file .codeql/config.yml is not valid");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - incompatible CLI version", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "is not compatible with this CodeQL CLI");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    t.true(wrappedError instanceof util_1.ConfigurationError);
+});
+(0, ava_1.default)("wrapCliConfigurationError - unknown error remains unchanged", (t) => {
+    const commandError = new actions_util_1.CommandInvocationError("codeql", ["version"], 1, "Some unknown error that doesn't match any patterns");
+    const cliError = new cli_errors_1.CliError(commandError);
+    const wrappedError = (0, cli_errors_1.wrapCliConfigurationError)(cliError);
+    // Should return the original CliError since it doesn't match any known patterns
+    t.is(wrappedError, cliError);
+    t.true(wrappedError instanceof cli_errors_1.CliError);
+    t.false(wrappedError instanceof util_1.ConfigurationError);
+});
+// Test all error categories to ensure they're properly configured
+(0, ava_1.default)("all CLI config error categories have valid configurations", (t) => {
+    const allCategories = Object.values(cli_errors_1.CliConfigErrorCategory);
+    for (const category of allCategories) {
+        // Each category should be a string
+        t.is(typeof category, "string");
+        // Create a test error that matches this category
+        let testError;
+        switch (category) {
+            case cli_errors_1.CliConfigErrorCategory.NoSourceCodeSeen:
+                // This category matches by exit code
+                testError = new cli_errors_1.CliError(new actions_util_1.CommandInvocationError("codeql", [], 32, "some error"));
+                break;
+            default:
+                // For other categories, we'll test with a generic message that should not match
+                testError = new cli_errors_1.CliError(new actions_util_1.CommandInvocationError("codeql", [], 1, "generic error"));
+                break;
+        }
+        // The test should not throw an error when processing
+        t.notThrows(() => (0, cli_errors_1.wrapCliConfigurationError)(testError));
+    }
+});
+//# sourceMappingURL=cli-errors.test.js.map

lib/codeql.js

@@ -50,6 +50,7 @@ const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const yaml = __importStar(require("js-yaml"));
 const actions_util_1 = require("./actions-util");
 const cli_errors_1 = require("./cli-errors");
+const config_utils_1 = require("./config-utils");
 const doc_url_1 = require("./doc-url");
 const environment_1 = require("./environment");
 const feature_flags_1 = require("./feature-flags");
@@ -77,15 +78,15 @@ const CODEQL_MINIMUM_VERSION = "2.16.6";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.16.6";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.17.6";
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.12";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.13";
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2025-04-03";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2025-06-19";
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
 /*
@@ -176,6 +177,8 @@ function setCodeQL(partialCodeql) {
         printVersion: resolveFunction(partialCodeql, "printVersion"),
         supportsFeature: resolveFunction(partialCodeql, "supportsFeature", async (feature) => !!partialCodeql.getVersion &&
             (0, tools_features_1.isSupportedToolsFeature)(await partialCodeql.getVersion(), feature)),
+        isTracedLanguage: resolveFunction(partialCodeql, "isTracedLanguage"),
+        isScannedLanguage: resolveFunction(partialCodeql, "isScannedLanguage"),
         databaseInitCluster: resolveFunction(partialCodeql, "databaseInitCluster"),
         runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),
         extractScannedLanguage: resolveFunction(partialCodeql, "extractScannedLanguage"),
@@ -186,7 +189,7 @@ function setCodeQL(partialCodeql) {
         resolveQueries: resolveFunction(partialCodeql, "resolveQueries"),
         resolveBuildEnvironment: resolveFunction(partialCodeql, "resolveBuildEnvironment"),
         packDownload: resolveFunction(partialCodeql, "packDownload"),
-        databaseCleanup: resolveFunction(partialCodeql, "databaseCleanup"),
+        databaseCleanupCluster: resolveFunction(partialCodeql, "databaseCleanupCluster"),
         databaseBundle: resolveFunction(partialCodeql, "databaseBundle"),
         databaseRunQueries: resolveFunction(partialCodeql, "databaseRunQueries"),
         databaseInterpretResults: resolveFunction(partialCodeql, "databaseInterpretResults"),
@@ -254,14 +257,22 @@ async function getCodeQLForCmd(cmd, checkVersion) {
         async supportsFeature(feature) {
             return (0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), feature);
         },
-        async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, overlayDatabaseMode, logger) {
+        async isTracedLanguage(language) {
+            const extractorPath = await this.resolveExtractor(language);
+            const tracingConfigPath = path.join(extractorPath, "tools", "tracing-config.lua");
+            return fs.existsSync(tracingConfigPath);
+        },
+        async isScannedLanguage(language) {
+            return !(await this.isTracedLanguage(language));
+        },
+        async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) {
             const extraArgs = config.languages.map((language) => `--language=${language}`);
             if (await (0, tracer_config_1.shouldEnableIndirectTracing)(codeql, config)) {
                 extraArgs.push("--begin-tracing");
                 extraArgs.push(...(await getTrapCachingExtractorConfigArgs(config)));
                 extraArgs.push(`--trace-process-name=${processName}`);
             }
-            const codeScanningConfigFile = await generateCodeScanningConfig(config, logger);
+            const codeScanningConfigFile = await writeCodeScanningConfigFile(config, logger);
             const externalRepositoryToken = (0, actions_util_1.getOptionalInput)("external-repository-token");
             extraArgs.push(`--codescanning-config=${codeScanningConfigFile}`);
             if (externalRepositoryToken) {
@@ -276,6 +287,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             const overwriteFlag = (0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), tools_features_1.ToolsFeature.ForceOverwrite)
                 ? "--force-overwrite"
                 : "--overwrite";
+            const overlayDatabaseMode = config.augmentationProperties.overlayDatabaseMode;
             if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.Overlay) {
                 const overlayChangesFile = await (0, overlay_database_utils_1.writeOverlayChangesFile)(config, sourceRoot, logger);
                 extraArgs.push(`--overlay-changes=${overlayChangesFile}`);
@@ -450,7 +462,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 throw new Error(`Unexpected output from codeql resolve build-environment: ${e} in\n${output}`);
             }
         },
-        async databaseRunQueries(databasePath, flags) {
+        async databaseRunQueries(databasePath, flags, queries = []) {
             const codeqlArgs = [
                 "database",
                 "run-queries",
@@ -459,6 +471,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 "--intra-layer-parallelism",
                 "--min-disk-free=1024", // Try to leave at least 1GB free
                 "-v",
+                ...queries,
                 ...getExtraOptionsFromEnv(["database", "run-queries"], {
                     ignoringOptions: ["--expect-discarded-cache"],
                 }),
@@ -563,18 +576,21 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 throw new Error(`Attempted to download specified packs but got an error:\n${output}\n${e}`);
             }
         },
-        async databaseCleanup(databasePath, cleanupLevel) {
+        async databaseCleanupCluster(config, cleanupLevel) {
             const cacheCleanupFlag = (await util.codeQlVersionAtLeast(this, CODEQL_VERSION_CACHE_CLEANUP))
                 ? "--cache-cleanup"
                 : "--mode";
-            const codeqlArgs = [
-                "database",
-                "cleanup",
-                databasePath,
-                `${cacheCleanupFlag}=${cleanupLevel}`,
-                ...getExtraOptionsFromEnv(["database", "cleanup"]),
-            ];
-            await runCli(cmd, codeqlArgs);
+            for (const language of config.languages) {
+                const databasePath = util.getCodeQLDatabasePath(config, language);
+                const codeqlArgs = [
+                    "database",
+                    "cleanup",
+                    databasePath,
+                    `${cacheCleanupFlag}=${cleanupLevel}`,
+                    ...getExtraOptionsFromEnv(["database", "cleanup"]),
+                ];
+                await runCli(cmd, codeqlArgs);
+            }
         },
         async databaseBundle(databasePath, outputFilePath, databaseName) {
             const args = [
@@ -754,53 +770,9 @@ async function runCli(cmd, args = [], opts = {}) {
  * @param config The configuration to use.
  * @returns the path to the generated user configuration file.
  */
-async function generateCodeScanningConfig(config, logger) {
+async function writeCodeScanningConfigFile(config, logger) {
     const codeScanningConfigFile = getGeneratedCodeScanningConfigPath(config);
-    // make a copy so we can modify it
-    const augmentedConfig = (0, util_1.cloneObject)(config.originalUserInput);
-    // Inject the queries from the input
-    if (config.augmentationProperties.queriesInput) {
-        if (config.augmentationProperties.queriesInputCombines) {
-            augmentedConfig.queries = (augmentedConfig.queries || []).concat(config.augmentationProperties.queriesInput);
-        }
-        else {
-            augmentedConfig.queries = config.augmentationProperties.queriesInput;
-        }
-    }
-    if (augmentedConfig.queries?.length === 0) {
-        delete augmentedConfig.queries;
-    }
-    // Inject the packs from the input
-    if (config.augmentationProperties.packsInput) {
-        if (config.augmentationProperties.packsInputCombines) {
-            // At this point, we already know that this is a single-language analysis
-            if (Array.isArray(augmentedConfig.packs)) {
-                augmentedConfig.packs = (augmentedConfig.packs || []).concat(config.augmentationProperties.packsInput);
-            }
-            else if (!augmentedConfig.packs) {
-                augmentedConfig.packs = config.augmentationProperties.packsInput;
-            }
-            else {
-                // At this point, we know there is only one language.
-                // If there were more than one language, an error would already have been thrown.
-                const language = Object.keys(augmentedConfig.packs)[0];
-                augmentedConfig.packs[language] = augmentedConfig.packs[language].concat(config.augmentationProperties.packsInput);
-            }
-        }
-        else {
-            augmentedConfig.packs = config.augmentationProperties.packsInput;
-        }
-    }
-    if (Array.isArray(augmentedConfig.packs) && !augmentedConfig.packs.length) {
-        delete augmentedConfig.packs;
-    }
-    augmentedConfig["query-filters"] = [
-        ...(config.augmentationProperties.defaultQueryFilters || []),
-        ...(augmentedConfig["query-filters"] || []),
-    ];
-    if (augmentedConfig["query-filters"]?.length === 0) {
-        delete augmentedConfig["query-filters"];
-    }
+    const augmentedConfig = (0, config_utils_1.generateCodeScanningConfig)(config.originalUserInput, config.augmentationProperties);
     logger.info(`Writing augmented user configuration file to ${codeScanningConfigFile}`);
     logger.startGroup("Augmented user configuration file contents");
     logger.info(yaml.dump(augmentedConfig));

lib/codeql.test.js

@@ -49,11 +49,11 @@ const sinon = __importStar(require("sinon"));
 const actionsUtil = __importStar(require("./actions-util"));
 const cli_errors_1 = require("./cli-errors");
 const codeql = __importStar(require("./codeql"));
+const config_utils_1 = require("./config-utils");
 const defaults = __importStar(require("./defaults.json"));
 const doc_url_1 = require("./doc-url");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
-const overlay_database_utils_1 = require("./overlay-database-utils");
 const setup_codeql_1 = require("./setup-codeql");
 const testing_utils_1 = require("./testing-utils");
 const tools_features_1 = require("./tools-features");
@@ -65,7 +65,7 @@ const NO_FEATURES = (0, testing_utils_1.createFeatures)([]);
 ava_1.default.beforeEach(() => {
     (0, util_1.initializeEnvironment)("1.2.3");
     stubConfig = (0, testing_utils_1.createTestConfig)({
-        languages: [languages_1.Language.cpp],
+        languages: [languages_1.KnownLanguage.cpp],
     });
 });
 async function installIntoToolcache({ apiDetails = testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, cliVersion, isPinned, tagName, tmpDir, }) {
@@ -96,6 +96,15 @@ function mockApiDetails(apiDetails) {
     process.env["GITHUB_SERVER_URL"] = apiDetails.url;
     process.env["GITHUB_API_URL"] = apiDetails.apiURL || "";
 }
+async function stubCodeql() {
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
+    sinon
+        .stub(codeqlObject, "isTracedLanguage")
+        .withArgs(languages_1.KnownLanguage.cpp)
+        .resolves(true);
+    return codeqlObject;
+}
 (0, ava_1.default)("downloads and caches explicitly requested bundles that aren't in the toolcache", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
@@ -328,15 +337,14 @@ const injectedConfigMacro = ava_1.default.macro({
     exec: async (t, augmentationProperties, configOverride, expectedConfig) => {
         await util.withTmpDir(async (tempDir) => {
             const runnerConstructorStub = stubToolRunnerConstructor();
-            const codeqlObject = await codeql.getCodeQLForTesting();
-            sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("1.0.0"));
+            const codeqlObject = await stubCodeql();
             const thisStubConfig = {
                 ...stubConfig,
                 ...configOverride,
                 tempDir,
                 augmentationProperties,
             };
-            await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, undefined, overlay_database_utils_1.OverlayDatabaseMode.None, (0, logging_1.getRunnerLogger)(true));
+            await codeqlObject.databaseInitCluster(thisStubConfig, "", undefined, undefined, (0, logging_1.getRunnerLogger)(true));
             const args = runnerConstructorStub.firstCall.args[1];
             // should have used an config file
             const configArg = args.find((arg) => arg.startsWith("--codescanning-config="));
@@ -350,18 +358,16 @@ const injectedConfigMacro = ava_1.default.macro({
     title: (providedTitle = "") => `databaseInitCluster() injected config: ${providedTitle}`,
 });
 (0, ava_1.default)("basic", injectedConfigMacro, {
-    queriesInputCombines: false,
-    packsInputCombines: false,
+    ...config_utils_1.defaultAugmentationProperties,
 }, {}, {});
 (0, ava_1.default)("injected packs from input", injectedConfigMacro, {
-    queriesInputCombines: false,
-    packsInputCombines: false,
+    ...config_utils_1.defaultAugmentationProperties,
     packsInput: ["xxx", "yyy"],
 }, {}, {
     packs: ["xxx", "yyy"],
 });
 (0, ava_1.default)("injected packs from input with existing packs combines", injectedConfigMacro, {
-    queriesInputCombines: false,
+    ...config_utils_1.defaultAugmentationProperties,
     packsInputCombines: true,
     packsInput: ["xxx", "yyy"],
 }, {
@@ -376,8 +382,7 @@ const injectedConfigMacro = ava_1.default.macro({
     },
 });
 (0, ava_1.default)("injected packs from input with existing packs overrides", injectedConfigMacro, {
-    queriesInputCombines: false,
-    packsInputCombines: false,
+    ...config_utils_1.defaultAugmentationProperties,
     packsInput: ["xxx", "yyy"],
 }, {
     originalUserInput: {
@@ -390,8 +395,7 @@ const injectedConfigMacro = ava_1.default.macro({
 });
 // similar, but with queries
 (0, ava_1.default)("injected queries from input", injectedConfigMacro, {
-    queriesInputCombines: false,
-    packsInputCombines: false,
+    ...config_utils_1.defaultAugmentationProperties,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
 }, {}, {
     queries: [
@@ -404,8 +408,7 @@ const injectedConfigMacro = ava_1.default.macro({
     ],
 });
 (0, ava_1.default)("injected queries from input overrides", injectedConfigMacro, {
-    queriesInputCombines: false,
-    packsInputCombines: false,
+    ...config_utils_1.defaultAugmentationProperties,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
 }, {
     originalUserInput: {
@@ -422,8 +425,8 @@ const injectedConfigMacro = ava_1.default.macro({
     ],
 });
 (0, ava_1.default)("injected queries from input combines", injectedConfigMacro, {
+    ...config_utils_1.defaultAugmentationProperties,
     queriesInputCombines: true,
-    packsInputCombines: false,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
 }, {
     originalUserInput: {
@@ -443,6 +446,7 @@ const injectedConfigMacro = ava_1.default.macro({
     ],
 });
 (0, ava_1.default)("injected queries from input combines 2", injectedConfigMacro, {
+    ...config_utils_1.defaultAugmentationProperties,
     queriesInputCombines: true,
     packsInputCombines: true,
     queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
@@ -457,6 +461,7 @@ const injectedConfigMacro = ava_1.default.macro({
     ],
 });
 (0, ava_1.default)("injected queries and packs, but empty", injectedConfigMacro, {
+    ...config_utils_1.defaultAugmentationProperties,
     queriesInputCombines: true,
     packsInputCombines: true,
     queriesInput: [],
@@ -470,9 +475,8 @@ const injectedConfigMacro = ava_1.default.macro({
 (0, ava_1.default)("passes a code scanning config AND qlconfig to the CLI", async (t) => {
     await util.withTmpDir(async (tempDir) => {
         const runnerConstructorStub = stubToolRunnerConstructor();
-        const codeqlObject = await codeql.getCodeQLForTesting();
-        sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
-        await codeqlObject.databaseInitCluster({ ...stubConfig, tempDir }, "", undefined, "/path/to/qlconfig.yml", overlay_database_utils_1.OverlayDatabaseMode.None, (0, logging_1.getRunnerLogger)(true));
+        const codeqlObject = await stubCodeql();
+        await codeqlObject.databaseInitCluster({ ...stubConfig, tempDir }, "", undefined, "/path/to/qlconfig.yml", (0, logging_1.getRunnerLogger)(true));
         const args = runnerConstructorStub.firstCall.args[1];
         // should have used a config file
         const hasCodeScanningConfigArg = args.some((arg) => arg.startsWith("--codescanning-config="));
@@ -485,10 +489,9 @@ const injectedConfigMacro = ava_1.default.macro({
 (0, ava_1.default)("does not pass a qlconfig to the CLI when it is undefined", async (t) => {
     await util.withTmpDir(async (tempDir) => {
         const runnerConstructorStub = stubToolRunnerConstructor();
-        const codeqlObject = await codeql.getCodeQLForTesting();
-        sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
+        const codeqlObject = await stubCodeql();
         await codeqlObject.databaseInitCluster({ ...stubConfig, tempDir }, "", undefined, undefined, // undefined qlconfigFile
-        overlay_database_utils_1.OverlayDatabaseMode.None, (0, logging_1.getRunnerLogger)(true));
+        (0, logging_1.getRunnerLogger)(true));
         const args = runnerConstructorStub.firstCall.args[1];
         const hasQlconfigArg = args.some((arg) => arg.startsWith("--qlconfig-file="));
         t.false(hasQlconfigArg, "should NOT have injected a qlconfig");
@@ -546,8 +549,7 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     const cliStderr = `Running TRAP import for CodeQL database at /home/runner/work/_temp/codeql_databases/javascript...\n` +
         `${heapError}\n${datasetImportError}.`;
     stubToolRunnerConstructor(32, cliStderr);
-    const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
+    const codeqlObject = await stubCodeql();
     // io throws because of the test CodeQL object.
     sinon.stub(io, "which").resolves("");
     await t.throwsAsync(async () => await codeqlObject.finalizeDatabase("db", "--threads=2", "--ram=2048", false), {
@@ -573,7 +575,7 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
     sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
     // io throws because of the test CodeQL object.
     sinon.stub(io, "which").resolves("");
-    await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.Language.java), {
+    await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.KnownLanguage.java), {
         instanceOf: util.ConfigurationError,
         message: "We were unable to automatically build your code. Please provide manual build steps. " +
             `See ${doc_url_1.DocUrl.AUTOMATIC_BUILD_FAILED} for more information. ` +
@@ -586,12 +588,11 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
 (0, ava_1.default)("runTool truncates long autobuilder errors", async (t) => {
     const stderr = Array.from({ length: 20 }, (_, i) => `[2019-09-18 12:00:00] [autobuild] [ERROR] line${i + 1}`).join("\n");
     stubToolRunnerConstructor(1, stderr);
-    const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
+    const codeqlObject = await stubCodeql();
     sinon.stub(codeqlObject, "resolveExtractor").resolves("/path/to/extractor");
     // io throws because of the test CodeQL object.
     sinon.stub(io, "which").resolves("");
-    await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.Language.java), {
+    await t.throwsAsync(async () => await codeqlObject.runAutobuild(stubConfig, languages_1.KnownLanguage.java), {
         instanceOf: util.ConfigurationError,
         message: "We were unable to automatically build your code. Please provide manual build steps. " +
             `See ${doc_url_1.DocUrl.AUTOMATIC_BUILD_FAILED} for more information. ` +
@@ -621,8 +622,7 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
 (0, ava_1.default)("runTool outputs last line of stderr if fatal error could not be found", async (t) => {
     const cliStderr = "line1\nline2\nline3\nline4\nline5";
     stubToolRunnerConstructor(32, cliStderr);
-    const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
+    const codeqlObject = await stubCodeql();
     // io throws because of the test CodeQL object.
     sinon.stub(io, "which").resolves("");
     await t.throwsAsync(async () => await codeqlObject.finalizeDatabase("db", "--threads=2", "--ram=2048", false), {
@@ -633,13 +633,12 @@ for (const { codeqlVersion, flagPassed, githubVersion, negativeFlagPassed, } of
 });
 (0, ava_1.default)("Avoids duplicating --overwrite flag if specified in CODEQL_ACTION_EXTRA_OPTIONS", async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
-    const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves((0, testing_utils_1.makeVersionInfo)("2.17.6"));
+    const codeqlObject = await stubCodeql();
     // io throws because of the test CodeQL object.
     sinon.stub(io, "which").resolves("");
     process.env["CODEQL_ACTION_EXTRA_OPTIONS"] =
         '{ "database": { "init": ["--overwrite"] } }';
-    await codeqlObject.databaseInitCluster(stubConfig, "sourceRoot", undefined, undefined, overlay_database_utils_1.OverlayDatabaseMode.None, (0, logging_1.getRunnerLogger)(false));
+    await codeqlObject.databaseInitCluster(stubConfig, "sourceRoot", undefined, undefined, (0, logging_1.getRunnerLogger)(false));
     t.true(runnerConstructorStub.calledOnce);
     const args = runnerConstructorStub.firstCall.args[1];
     t.is(args.filter((option) => option === "--overwrite").length, 1, "--overwrite should only be passed once");

lib/config-utils.js

@@ -42,11 +42,15 @@ exports.getConfigFileFormatInvalidMessage = getConfigFileFormatInvalidMessage;
 exports.getConfigFileDirectoryGivenMessage = getConfigFileDirectoryGivenMessage;
 exports.getNoLanguagesError = getNoLanguagesError;
 exports.getUnknownLanguagesError = getUnknownLanguagesError;
-exports.getLanguagesInRepo = getLanguagesInRepo;
+exports.getSupportedLanguageMap = getSupportedLanguageMap;
+exports.hasActionsWorkflows = hasActionsWorkflows;
+exports.getRawLanguagesInRepo = getRawLanguagesInRepo;
 exports.getLanguages = getLanguages;
+exports.getRawLanguagesNoAutodetect = getRawLanguagesNoAutodetect;
 exports.getRawLanguages = getRawLanguages;
 exports.getDefaultConfig = getDefaultConfig;
 exports.calculateAugmentation = calculateAugmentation;
+exports.getOverlayDatabaseMode = getOverlayDatabaseMode;
 exports.parsePacksFromInput = parsePacksFromInput;
 exports.parsePacksSpecification = parsePacksSpecification;
 exports.validatePackSpecification = validatePackSpecification;
@@ -57,16 +61,20 @@ exports.getConfig = getConfig;
 exports.generateRegistries = generateRegistries;
 exports.wrapEnvironment = wrapEnvironment;
 exports.parseBuildModeInput = parseBuildModeInput;
+exports.generateCodeScanningConfig = generateCodeScanningConfig;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const perf_hooks_1 = require("perf_hooks");
 const yaml = __importStar(require("js-yaml"));
 const semver = __importStar(require("semver"));
+const actions_util_1 = require("./actions-util");
 const api = __importStar(require("./api-client"));
 const caching_utils_1 = require("./caching-utils");
 const diff_informed_analysis_utils_1 = require("./diff-informed-analysis-utils");
 const feature_flags_1 = require("./feature-flags");
+const git_utils_1 = require("./git-utils");
 const languages_1 = require("./languages");
+const overlay_database_utils_1 = require("./overlay-database-utils");
 const trap_caching_1 = require("./trap-caching");
 const util_1 = require("./util");
 // Property names from the user-supplied config file.
@@ -80,7 +88,10 @@ exports.defaultAugmentationProperties = {
     packsInputCombines: false,
     packsInput: undefined,
     queriesInput: undefined,
-    defaultQueryFilters: [],
+    qualityQueriesInput: undefined,
+    extraQueryExclusions: [],
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
 };
 function getPacksStrInvalid(packStr, configFile) {
     return configFile
@@ -119,29 +130,57 @@ function getNoLanguagesError() {
 function getUnknownLanguagesError(languages) {
     return `Did not recognize the following languages: ${languages.join(", ")}`;
 }
+async function getSupportedLanguageMap(codeql) {
+    const resolveResult = await codeql.betterResolveLanguages();
+    const supportedLanguages = {};
+    // Populate canonical language names
+    for (const extractor of Object.keys(resolveResult.extractors)) {
+        supportedLanguages[extractor] = extractor;
+    }
+    // Populate language aliases
+    if (resolveResult.aliases) {
+        for (const [alias, extractor] of Object.entries(resolveResult.aliases)) {
+            supportedLanguages[alias] = extractor;
+        }
+    }
+    return supportedLanguages;
+}
+const baseWorkflowsPath = ".github/workflows";
 /**
- * Gets the set of languages in the current repository that are
- * scannable by CodeQL.
+ * Determines if there exists a `.github/workflows` directory with at least
+ * one file in it, which we use as an indicator that there are Actions
+ * workflows in the workspace. This doesn't perfectly detect whether there
+ * are actually workflows, but should be a good approximation.
+ *
+ * Alternatively, we could check specifically for yaml files, or call the
+ * API to check if it knows about workflows.
+ *
+ * @returns True if the non-empty directory exists, false if not.
  */
-async function getLanguagesInRepo(repository, logger) {
-    logger.debug(`GitHub repo ${repository.owner} ${repository.repo}`);
+function hasActionsWorkflows(sourceRoot) {
+    const workflowsPath = path.resolve(sourceRoot, baseWorkflowsPath);
+    const stats = fs.lstatSync(workflowsPath);
+    return (stats !== undefined &&
+        stats.isDirectory() &&
+        fs.readdirSync(workflowsPath).length > 0);
+}
+/**
+ * Gets the set of languages in the current repository.
+ */
+async function getRawLanguagesInRepo(repository, sourceRoot, logger) {
+    logger.debug(`Automatically detecting languages (${repository.owner}/${repository.repo})`);
     const response = await api.getApiClient().rest.repos.listLanguages({
         owner: repository.owner,
         repo: repository.repo,
     });
     logger.debug(`Languages API response: ${JSON.stringify(response)}`);
-    // The GitHub API is going to return languages in order of popularity,
-    // When we pick a language to autobuild we want to pick the most popular traced language
-    // Since sets in javascript maintain insertion order, using a set here and then splatting it
-    // into an array gives us an array of languages ordered by popularity
-    const languages = new Set();
-    for (const lang of Object.keys(response.data)) {
-        const parsedLang = (0, languages_1.parseLanguage)(lang);
-        if (parsedLang !== undefined) {
-            languages.add(parsedLang);
-        }
+    const result = Object.keys(response.data).map((language) => language.trim().toLowerCase());
+    if (hasActionsWorkflows(sourceRoot)) {
+        logger.debug(`Found a .github/workflows directory`);
+        result.push("actions");
     }
-    return [...languages];
+    logger.debug(`Raw languages in repository: ${result.join(", ")}`);
+    return result;
 }
 /**
  * Get the languages to analyse.
@@ -153,48 +192,44 @@ async function getLanguagesInRepo(repository, logger) {
  * If no languages could be detected from either the workflow or the repository
  * then throw an error.
  */
-async function getLanguages(codeQL, languagesInput, repository, logger) {
+async function getLanguages(codeql, languagesInput, repository, sourceRoot, logger) {
     // Obtain languages without filtering them.
-    const { rawLanguages, autodetected } = await getRawLanguages(languagesInput, repository, logger);
-    let languages = rawLanguages;
-    if (autodetected) {
-        const supportedLanguages = Object.keys(await codeQL.resolveLanguages());
-        languages = languages
-            .map(languages_1.parseLanguage)
-            .filter((value) => value && supportedLanguages.includes(value))
-            .map((value) => value);
-        logger.info(`Automatically detected languages: ${languages.join(", ")}`);
-    }
-    else {
-        const aliases = (await codeQL.betterResolveLanguages()).aliases;
-        if (aliases) {
-            languages = languages.map((lang) => aliases[lang] || lang);
+    const { rawLanguages, autodetected } = await getRawLanguages(languagesInput, repository, sourceRoot, logger);
+    const languageMap = await getSupportedLanguageMap(codeql);
+    const languagesSet = new Set();
+    const unknownLanguages = [];
+    // Make sure they are supported
+    for (const language of rawLanguages) {
+        const extractorName = languageMap[language];
+        if (extractorName === undefined) {
+            unknownLanguages.push(language);
         }
-        logger.info(`Languages from configuration: ${languages.join(", ")}`);
+        else {
+            languagesSet.add(extractorName);
+        }
+    }
+    const languages = Array.from(languagesSet);
+    if (!autodetected && unknownLanguages.length > 0) {
+        throw new util_1.ConfigurationError(getUnknownLanguagesError(unknownLanguages));
     }
     // If the languages parameter was not given and no languages were
     // detected then fail here as this is a workflow configuration error.
     if (languages.length === 0) {
         throw new util_1.ConfigurationError(getNoLanguagesError());
     }
-    // Make sure they are supported
-    const parsedLanguages = [];
-    const unknownLanguages = [];
-    for (const language of languages) {
-        const parsedLanguage = (0, languages_1.parseLanguage)(language);
-        if (parsedLanguage === undefined) {
-            unknownLanguages.push(language);
-        }
-        else if (!parsedLanguages.includes(parsedLanguage)) {
-            parsedLanguages.push(parsedLanguage);
-        }
+    if (autodetected) {
+        logger.info(`Autodetected languages: ${languages.join(", ")}`);
     }
-    // Any unknown languages here would have come directly from the input
-    // since we filter unknown languages coming from the GitHub API.
-    if (unknownLanguages.length > 0) {
-        throw new util_1.ConfigurationError(getUnknownLanguagesError(unknownLanguages));
+    else {
+        logger.info(`Languages from configuration: ${languages.join(", ")}`);
     }
-    return parsedLanguages;
+    return languages;
+}
+function getRawLanguagesNoAutodetect(languagesInput) {
+    return (languagesInput || "")
+        .split(",")
+        .map((x) => x.trim().toLowerCase())
+        .filter((x) => x.length > 0);
 }
 /**
  * Gets the set of languages in the current repository without checking to
@@ -206,30 +241,25 @@ async function getLanguages(codeQL, languagesInput, repository, logger) {
  * @returns A tuple containing a list of languages in this repository that might be
  * analyzable and whether or not this list was determined automatically.
  */
-async function getRawLanguages(languagesInput, repository, logger) {
-    // Obtain from action input 'languages' if set
-    let rawLanguages = (languagesInput || "")
-        .split(",")
-        .map((x) => x.trim().toLowerCase())
-        .filter((x) => x.length > 0);
-    let autodetected;
-    if (rawLanguages.length) {
-        autodetected = false;
+async function getRawLanguages(languagesInput, repository, sourceRoot, logger) {
+    // If the user has specified languages, use those.
+    const languagesFromInput = getRawLanguagesNoAutodetect(languagesInput);
+    if (languagesFromInput.length > 0) {
+        return { rawLanguages: languagesFromInput, autodetected: false };
     }
-    else {
-        autodetected = true;
-        // Obtain all languages in the repo that can be analysed
-        rawLanguages = (await getLanguagesInRepo(repository, logger));
-    }
-    return { rawLanguages, autodetected };
+    // Otherwise, autodetect languages in the repository.
+    return {
+        rawLanguages: await getRawLanguagesInRepo(repository, sourceRoot, logger),
+        autodetected: true,
+    };
 }
 /**
- * Get the default config for when the user has not supplied one.
+ * Get the default config, populated without user configuration file.
  */
-async function getDefaultConfig({ languagesInput, queriesInput, packsInput, buildModeInput, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, githubVersion, features, logger, }) {
-    const languages = await getLanguages(codeql, languagesInput, repository, logger);
+async function getDefaultConfig({ languagesInput, queriesInput, qualityQueriesInput, packsInput, buildModeInput, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, sourceRoot, githubVersion, features, logger, }) {
+    const languages = await getLanguages(codeql, languagesInput, repository, sourceRoot, logger);
     const buildMode = await parseBuildModeInput(buildModeInput, languages, features, logger);
-    const augmentationProperties = await calculateAugmentation(codeql, features, packsInput, queriesInput, languages, logger);
+    const augmentationProperties = await calculateAugmentation(packsInput, queriesInput, qualityQueriesInput, languages);
     const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(trapCachingEnabled, codeql, languages, logger);
     return {
         languages,
@@ -258,11 +288,7 @@ async function downloadCacheWithTime(trapCachingEnabled, codeQL, languages, logg
     }
     return { trapCaches, trapCacheDownloadTime };
 }
-/**
- * Load the config from the given file.
- */
-async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeInput, configFile, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, workspacePath, githubVersion, apiDetails, features, logger, }) {
-    let parsedYAML;
+async function loadUserConfig(configFile, workspacePath, apiDetails, tempDir) {
     if (isLocal(configFile)) {
         if (configFile !== userConfigFromActionPath(tempDir)) {
             // If the config file is not generated by the Action, it should be relative to the workspace.
@@ -272,31 +298,11 @@ async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeI
                 throw new util_1.ConfigurationError(getConfigFileOutsideWorkspaceErrorMessage(configFile));
             }
         }
-        parsedYAML = getLocalConfig(configFile);
+        return getLocalConfig(configFile);
     }
     else {
-        parsedYAML = await getRemoteConfig(configFile, apiDetails);
+        return await getRemoteConfig(configFile, apiDetails);
     }
-    const languages = await getLanguages(codeql, languagesInput, repository, logger);
-    const buildMode = await parseBuildModeInput(buildModeInput, languages, features, logger);
-    const augmentationProperties = await calculateAugmentation(codeql, features, packsInput, queriesInput, languages, logger);
-    const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(trapCachingEnabled, codeql, languages, logger);
-    return {
-        languages,
-        buildMode,
-        originalUserInput: parsedYAML,
-        tempDir,
-        codeQLCmd: codeql.getPath(),
-        gitHubVersion: githubVersion,
-        dbLocation: dbLocationOrDefault(dbLocation, tempDir),
-        debugMode,
-        debugArtifactName,
-        debugDatabaseName,
-        augmentationProperties,
-        trapCaches,
-        trapCacheDownloadTime,
-        dependencyCachingEnabled: (0, caching_utils_1.getCachingKind)(dependencyCachingEnabled),
-    };
 }
 /**
  * Calculates how the codeql config file needs to be augmented before passing
@@ -305,14 +311,11 @@ async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeI
  * and the CLI does not know about these inputs so we need to inject them into
  * the config file sent to the CLI.
  *
- * @param codeql The CodeQL object.
- * @param features The feature enablement object.
  * @param rawPacksInput The packs input from the action configuration.
  * @param rawQueriesInput The queries input from the action configuration.
  * @param languages The languages that the config file is for. If the packs input
  *    is non-empty, then there must be exactly one language. Otherwise, an
  *    error is thrown.
- * @param logger The logger to use for logging.
  *
  * @returns The properties that need to be augmented in the config file.
  *
@@ -320,21 +323,21 @@ async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeI
  *     not have exactly one language.
  */
 // exported for testing.
-async function calculateAugmentation(codeql, features, rawPacksInput, rawQueriesInput, languages, logger) {
+async function calculateAugmentation(rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages) {
     const packsInputCombines = shouldCombine(rawPacksInput);
     const packsInput = parsePacksFromInput(rawPacksInput, languages, packsInputCombines);
     const queriesInputCombines = shouldCombine(rawQueriesInput);
     const queriesInput = parseQueriesFromInput(rawQueriesInput, queriesInputCombines);
-    const defaultQueryFilters = [];
-    if (await (0, diff_informed_analysis_utils_1.shouldPerformDiffInformedAnalysis)(codeql, features, logger)) {
-        defaultQueryFilters.push({ exclude: { tags: "exclude-from-incremental" } });
-    }
+    const qualityQueriesInput = parseQueriesFromInput(rawQualityQueriesInput, false);
     return {
         packsInputCombines,
         packsInput: packsInput?.[languages[0]],
         queriesInput,
         queriesInputCombines,
-        defaultQueryFilters,
+        qualityQueriesInput,
+        extraQueryExclusions: [],
+        overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+        useOverlayDatabaseCaching: false,
     };
 }
 function parseQueriesFromInput(rawQueriesInput, queriesInputCombines) {
@@ -349,6 +352,143 @@ function parseQueriesFromInput(rawQueriesInput, queriesInputCombines) {
     }
     return trimmedInput.split(",").map((query) => ({ uses: query.trim() }));
 }
+const OVERLAY_ANALYSIS_FEATURES = {
+    actions: feature_flags_1.Feature.OverlayAnalysisActions,
+    cpp: feature_flags_1.Feature.OverlayAnalysisCpp,
+    csharp: feature_flags_1.Feature.OverlayAnalysisCsharp,
+    go: feature_flags_1.Feature.OverlayAnalysisGo,
+    java: feature_flags_1.Feature.OverlayAnalysisJava,
+    javascript: feature_flags_1.Feature.OverlayAnalysisJavascript,
+    python: feature_flags_1.Feature.OverlayAnalysisPython,
+    ruby: feature_flags_1.Feature.OverlayAnalysisRuby,
+    rust: feature_flags_1.Feature.OverlayAnalysisRust,
+    swift: feature_flags_1.Feature.OverlayAnalysisSwift,
+};
+const OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES = {
+    actions: feature_flags_1.Feature.OverlayAnalysisCodeScanningActions,
+    cpp: feature_flags_1.Feature.OverlayAnalysisCodeScanningCpp,
+    csharp: feature_flags_1.Feature.OverlayAnalysisCodeScanningCsharp,
+    go: feature_flags_1.Feature.OverlayAnalysisCodeScanningGo,
+    java: feature_flags_1.Feature.OverlayAnalysisCodeScanningJava,
+    javascript: feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    python: feature_flags_1.Feature.OverlayAnalysisCodeScanningPython,
+    ruby: feature_flags_1.Feature.OverlayAnalysisCodeScanningRuby,
+    rust: feature_flags_1.Feature.OverlayAnalysisCodeScanningRust,
+    swift: feature_flags_1.Feature.OverlayAnalysisCodeScanningSwift,
+};
+async function isOverlayAnalysisFeatureEnabled(repository, features, codeql, languages, codeScanningConfig) {
+    // TODO: Remove the repository owner check once support for overlay analysis
+    // stabilizes, and no more backward-incompatible changes are expected.
+    if (!["github", "dsp-testing"].includes(repository.owner)) {
+        return false;
+    }
+    if (!(await features.getValue(feature_flags_1.Feature.OverlayAnalysis, codeql))) {
+        return false;
+    }
+    let enableForCodeScanningOnly = false;
+    for (const language of languages) {
+        const feature = OVERLAY_ANALYSIS_FEATURES[language];
+        if (feature && (await features.getValue(feature, codeql))) {
+            continue;
+        }
+        const codeScanningFeature = OVERLAY_ANALYSIS_CODE_SCANNING_FEATURES[language];
+        if (codeScanningFeature &&
+            (await features.getValue(codeScanningFeature, codeql))) {
+            enableForCodeScanningOnly = true;
+            continue;
+        }
+        return false;
+    }
+    if (enableForCodeScanningOnly) {
+        // A code-scanning configuration runs only the (default) code-scanning suite
+        // if the default queries are not disabled, and no packs, queries, or
+        // query-filters are specified.
+        return (codeScanningConfig["disable-default-queries"] !== true &&
+            codeScanningConfig.packs === undefined &&
+            codeScanningConfig.queries === undefined &&
+            codeScanningConfig["query-filters"] === undefined);
+    }
+    return true;
+}
+/**
+ * Calculate and validate the overlay database mode and caching to use.
+ *
+ * - If the environment variable `CODEQL_OVERLAY_DATABASE_MODE` is set, use it.
+ *   In this case, the workflow is responsible for managing database storage and
+ *   retrieval, and the action will not perform overlay database caching. Think
+ *   of it as a "manual control" mode where the calling workflow is responsible
+ *   for making sure that everything is set up correctly.
+ * - Otherwise, if `Feature.OverlayAnalysis` is enabled, calculate the mode
+ *   based on what we are analyzing. Think of it as a "automatic control" mode
+ *   where the action will do the right thing by itself.
+ *   - If we are analyzing a pull request, use `Overlay` with caching.
+ *   - If we are analyzing the default branch, use `OverlayBase` with caching.
+ * - Otherwise, use `None`.
+ *
+ * For `Overlay` and `OverlayBase`, the function performs further checks and
+ * reverts to `None` if any check should fail.
+ *
+ * @returns An object containing the overlay database mode and whether the
+ * action should perform overlay-base database caching.
+ */
+async function getOverlayDatabaseMode(codeql, repository, features, languages, sourceRoot, buildMode, codeScanningConfig, logger) {
+    let overlayDatabaseMode = overlay_database_utils_1.OverlayDatabaseMode.None;
+    let useOverlayDatabaseCaching = false;
+    const modeEnv = process.env.CODEQL_OVERLAY_DATABASE_MODE;
+    // Any unrecognized CODEQL_OVERLAY_DATABASE_MODE value will be ignored and
+    // treated as if the environment variable was not set.
+    if (modeEnv === overlay_database_utils_1.OverlayDatabaseMode.Overlay ||
+        modeEnv === overlay_database_utils_1.OverlayDatabaseMode.OverlayBase ||
+        modeEnv === overlay_database_utils_1.OverlayDatabaseMode.None) {
+        overlayDatabaseMode = modeEnv;
+        logger.info(`Setting overlay database mode to ${overlayDatabaseMode} ` +
+            "from the CODEQL_OVERLAY_DATABASE_MODE environment variable.");
+    }
+    else if (await isOverlayAnalysisFeatureEnabled(repository, features, codeql, languages, codeScanningConfig)) {
+        if ((0, actions_util_1.isAnalyzingPullRequest)()) {
+            overlayDatabaseMode = overlay_database_utils_1.OverlayDatabaseMode.Overlay;
+            useOverlayDatabaseCaching = true;
+            logger.info(`Setting overlay database mode to ${overlayDatabaseMode} ` +
+                "with caching because we are analyzing a pull request.");
+        }
+        else if (await (0, git_utils_1.isAnalyzingDefaultBranch)()) {
+            overlayDatabaseMode = overlay_database_utils_1.OverlayDatabaseMode.OverlayBase;
+            useOverlayDatabaseCaching = true;
+            logger.info(`Setting overlay database mode to ${overlayDatabaseMode} ` +
+                "with caching because we are analyzing the default branch.");
+        }
+    }
+    const nonOverlayAnalysis = {
+        overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+        useOverlayDatabaseCaching: false,
+    };
+    if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.None) {
+        return nonOverlayAnalysis;
+    }
+    if (buildMode !== util_1.BuildMode.None &&
+        (await Promise.all(languages.map(async (l) => await codeql.isTracedLanguage(l)))).some(Boolean)) {
+        logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
+            `build-mode is set to "${buildMode}" instead of "none". ` +
+            "Falling back to creating a normal full database instead.");
+        return nonOverlayAnalysis;
+    }
+    if (!(await (0, util_1.codeQlVersionAtLeast)(codeql, overlay_database_utils_1.CODEQL_OVERLAY_MINIMUM_VERSION))) {
+        logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
+            `the CodeQL CLI is older than ${overlay_database_utils_1.CODEQL_OVERLAY_MINIMUM_VERSION}. ` +
+            "Falling back to creating a normal full database instead.");
+        return nonOverlayAnalysis;
+    }
+    if ((await (0, git_utils_1.getGitRoot)(sourceRoot)) === undefined) {
+        logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
+            `the source root "${sourceRoot}" is not inside a git repository. ` +
+            "Falling back to creating a normal full database instead.");
+        return nonOverlayAnalysis;
+    }
+    return {
+        overlayDatabaseMode,
+        useOverlayDatabaseCaching,
+    };
+}
 /**
  * Pack names must be in the form of `scope/name`, with only alpha-numeric characters,
  * and `-` allowed as long as not the first or last char.
@@ -485,7 +625,6 @@ function userConfigFromActionPath(tempDir) {
  * a default config. The parsed config is then stored to a known location.
  */
 async function initConfig(inputs) {
-    let config;
     const { logger, tempDir } = inputs;
     // if configInput is set, it takes precedence over configFile
     if (inputs.configInput) {
@@ -496,14 +635,31 @@ async function initConfig(inputs) {
         fs.writeFileSync(inputs.configFile, inputs.configInput);
         logger.debug(`Using config from action input: ${inputs.configFile}`);
     }
-    // If no config file was provided create an empty one
+    let userConfig = {};
     if (!inputs.configFile) {
         logger.debug("No configuration file was provided");
-        config = await getDefaultConfig(inputs);
     }
     else {
-        // Convince the type checker that inputs.configFile is defined.
-        config = await loadConfig({ ...inputs, configFile: inputs.configFile });
+        logger.debug(`Using configuration file: ${inputs.configFile}`);
+        userConfig = await loadUserConfig(inputs.configFile, inputs.workspacePath, inputs.apiDetails, tempDir);
+    }
+    const config = await getDefaultConfig(inputs);
+    const augmentationProperties = config.augmentationProperties;
+    config.originalUserInput = userConfig;
+    // The choice of overlay database mode depends on the selection of languages
+    // and queries, which in turn depends on the user config and the augmentation
+    // properties. So we need to calculate the overlay database mode after the
+    // rest of the config has been populated.
+    const { overlayDatabaseMode, useOverlayDatabaseCaching } = await getOverlayDatabaseMode(inputs.codeql, inputs.repository, inputs.features, config.languages, inputs.sourceRoot, config.buildMode, generateCodeScanningConfig(userConfig, augmentationProperties), logger);
+    logger.info(`Using overlay database mode: ${overlayDatabaseMode} ` +
+        `${useOverlayDatabaseCaching ? "with" : "without"} caching.`);
+    augmentationProperties.overlayDatabaseMode = overlayDatabaseMode;
+    augmentationProperties.useOverlayDatabaseCaching = useOverlayDatabaseCaching;
+    if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.Overlay ||
+        (await (0, diff_informed_analysis_utils_1.shouldPerformDiffInformedAnalysis)(inputs.codeql, inputs.features, logger))) {
+        augmentationProperties.extraQueryExclusions.push({
+            exclude: { tags: "exclude-from-incremental" },
+        });
     }
     // Save the config so we can easily access it again in the future
     await saveConfig(config, logger);
@@ -694,16 +850,68 @@ async function parseBuildModeInput(input, languages, features, logger) {
     if (!Object.values(util_1.BuildMode).includes(input)) {
         throw new util_1.ConfigurationError(`Invalid build mode: '${input}'. Supported build modes are: ${Object.values(util_1.BuildMode).join(", ")}.`);
     }
-    if (languages.includes(languages_1.Language.csharp) &&
+    if (languages.includes(languages_1.KnownLanguage.csharp) &&
         (await features.getValue(feature_flags_1.Feature.DisableCsharpBuildless))) {
         logger.warning("Scanning C# code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.");
         return util_1.BuildMode.Autobuild;
     }
-    if (languages.includes(languages_1.Language.java) &&
+    if (languages.includes(languages_1.KnownLanguage.java) &&
         (await features.getValue(feature_flags_1.Feature.DisableJavaBuildlessEnabled))) {
         logger.warning("Scanning Java code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.");
         return util_1.BuildMode.Autobuild;
     }
     return input;
 }
+function generateCodeScanningConfig(originalUserInput, augmentationProperties) {
+    // make a copy so we can modify it
+    const augmentedConfig = (0, util_1.cloneObject)(originalUserInput);
+    // Inject the queries from the input
+    if (augmentationProperties.queriesInput) {
+        if (augmentationProperties.queriesInputCombines) {
+            augmentedConfig.queries = (augmentedConfig.queries || []).concat(augmentationProperties.queriesInput);
+        }
+        else {
+            augmentedConfig.queries = augmentationProperties.queriesInput;
+        }
+    }
+    if (augmentedConfig.queries?.length === 0) {
+        delete augmentedConfig.queries;
+    }
+    // Inject the packs from the input
+    if (augmentationProperties.packsInput) {
+        if (augmentationProperties.packsInputCombines) {
+            // At this point, we already know that this is a single-language analysis
+            if (Array.isArray(augmentedConfig.packs)) {
+                augmentedConfig.packs = (augmentedConfig.packs || []).concat(augmentationProperties.packsInput);
+            }
+            else if (!augmentedConfig.packs) {
+                augmentedConfig.packs = augmentationProperties.packsInput;
+            }
+            else {
+                // At this point, we know there is only one language.
+                // If there were more than one language, an error would already have been thrown.
+                const language = Object.keys(augmentedConfig.packs)[0];
+                augmentedConfig.packs[language] = augmentedConfig.packs[language].concat(augmentationProperties.packsInput);
+            }
+        }
+        else {
+            augmentedConfig.packs = augmentationProperties.packsInput;
+        }
+    }
+    if (Array.isArray(augmentedConfig.packs) && !augmentedConfig.packs.length) {
+        delete augmentedConfig.packs;
+    }
+    augmentedConfig["query-filters"] = [
+        // Ordering matters. If the first filter is an inclusion, it implicitly
+        // excludes all queries that are not included. If it is an exclusion,
+        // it implicitly includes all queries that are not excluded. So user
+        // filters (if any) should always be first to preserve intent.
+        ...(augmentedConfig["query-filters"] || []),
+        ...augmentationProperties.extraQueryExclusions,
+    ];
+    if (augmentedConfig["query-filters"]?.length === 0) {
+        delete augmentedConfig["query-filters"];
+    }
+    return augmentedConfig;
+}
 //# sourceMappingURL=config-utils.js.map

lib/config-utils.test.js

@@ -42,13 +42,16 @@ const github = __importStar(require("@actions/github"));
 const ava_1 = __importDefault(require("ava"));
 const yaml = __importStar(require("js-yaml"));
 const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
 const api = __importStar(require("./api-client"));
 const caching_utils_1 = require("./caching-utils");
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
 const feature_flags_1 = require("./feature-flags");
+const gitUtils = __importStar(require("./git-utils"));
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
+const overlay_database_utils_1 = require("./overlay-database-utils");
 const repository_1 = require("./repository");
 const testing_utils_1 = require("./testing-utils");
 const util_1 = require("./util");
@@ -58,6 +61,7 @@ function createTestInitConfigInputs(overrides) {
     return Object.assign({}, {
         languagesInput: undefined,
         queriesInput: undefined,
+        qualityQueriesInput: undefined,
         packsInput: undefined,
         configFile: undefined,
         dbLocation: undefined,
@@ -72,6 +76,7 @@ function createTestInitConfigInputs(overrides) {
         tempDir: "",
         codeql: {},
         workspacePath: "",
+        sourceRoot: "",
         githubVersion,
         apiDetails: {
             auth: "token",
@@ -122,6 +127,14 @@ function mockListLanguages(languages) {
         const logger = (0, logging_1.getRunnerLogger)(true);
         const languages = "javascript,python";
         const codeql = (0, codeql_1.setCodeQL)({
+            async betterResolveLanguages() {
+                return {
+                    extractors: {
+                        javascript: [{ extractor_root: "" }],
+                        python: [{ extractor_root: "" }],
+                    },
+                };
+            },
             async resolveQueries() {
                 return {
                     byLanguage: {
@@ -155,6 +168,14 @@ function mockListLanguages(languages) {
     return await (0, util_1.withTmpDir)(async (tempDir) => {
         const logger = (0, logging_1.getRunnerLogger)(true);
         const codeql = (0, codeql_1.setCodeQL)({
+            async betterResolveLanguages() {
+                return {
+                    extractors: {
+                        javascript: [{ extractor_root: "" }],
+                        python: [{ extractor_root: "" }],
+                    },
+                };
+            },
             async resolveQueries() {
                 return {
                     byLanguage: {
@@ -249,6 +270,13 @@ function mockListLanguages(languages) {
 (0, ava_1.default)("load non-empty input", async (t) => {
     return await (0, util_1.withTmpDir)(async (tempDir) => {
         const codeql = (0, codeql_1.setCodeQL)({
+            async betterResolveLanguages() {
+                return {
+                    extractors: {
+                        javascript: [{ extractor_root: "" }],
+                    },
+                };
+            },
             async resolveQueries() {
                 return {
                     byLanguage: {
@@ -279,7 +307,7 @@ function mockListLanguages(languages) {
         fs.mkdirSync(path.join(tempDir, "foo"));
         // And the config we expect it to parse to
         const expectedConfig = {
-            languages: [languages_1.Language.javascript],
+            languages: [languages_1.KnownLanguage.javascript],
             buildMode: util_1.BuildMode.None,
             originalUserInput: {
                 name: "my config",
@@ -356,6 +384,14 @@ function queriesToResolvedQueryForm(queries) {
         fs.mkdirSync(path.join(tempDir, "foo"));
         const resolveQueriesArgs = [];
         const codeql = (0, codeql_1.setCodeQL)({
+            async betterResolveLanguages() {
+                return {
+                    extractors: {
+                        javascript: [{ extractor_root: "" }],
+                        python: [{ extractor_root: "" }],
+                    },
+                };
+            },
             async resolveQueries(queries, extraSearchPath) {
                 resolveQueriesArgs.push({ queries, extraSearchPath });
                 return queriesToResolvedQueryForm(queries);
@@ -380,6 +416,13 @@ function queriesToResolvedQueryForm(queries) {
 (0, ava_1.default)("API client used when reading remote config", async (t) => {
     return await (0, util_1.withTmpDir)(async (tempDir) => {
         const codeql = (0, codeql_1.setCodeQL)({
+            async betterResolveLanguages() {
+                return {
+                    extractors: {
+                        javascript: [{ extractor_root: "" }],
+                    },
+                };
+            },
             async resolveQueries() {
                 return {
                     byLanguage: {
@@ -526,17 +569,17 @@ const parsePacksErrorMacro = ava_1.default.macro({
  * Test macro for testing when the packs block is invalid
  */
 const invalidPackNameMacro = ava_1.default.macro({
-    exec: (t, name) => parsePacksErrorMacro.exec(t, name, [languages_1.Language.cpp], new RegExp(`^"${name}" is not a valid pack$`)),
+    exec: (t, name) => parsePacksErrorMacro.exec(t, name, [languages_1.KnownLanguage.cpp], new RegExp(`^"${name}" is not a valid pack$`)),
     title: (_providedTitle, arg) => `Invalid pack string: ${arg}`,
 });
 (0, ava_1.default)("no packs", parsePacksMacro, "", [], undefined);
-(0, ava_1.default)("two packs", parsePacksMacro, "a/b,c/d@1.2.3", [languages_1.Language.cpp], {
-    [languages_1.Language.cpp]: ["a/b", "c/d@1.2.3"],
+(0, ava_1.default)("two packs", parsePacksMacro, "a/b,c/d@1.2.3", [languages_1.KnownLanguage.cpp], {
+    [languages_1.KnownLanguage.cpp]: ["a/b", "c/d@1.2.3"],
 });
-(0, ava_1.default)("two packs with spaces", parsePacksMacro, " a/b , c/d@1.2.3 ", [languages_1.Language.cpp], {
-    [languages_1.Language.cpp]: ["a/b", "c/d@1.2.3"],
+(0, ava_1.default)("two packs with spaces", parsePacksMacro, " a/b , c/d@1.2.3 ", [languages_1.KnownLanguage.cpp], {
+    [languages_1.KnownLanguage.cpp]: ["a/b", "c/d@1.2.3"],
 });
-(0, ava_1.default)("two packs with language", parsePacksErrorMacro, "a/b,c/d@1.2.3", [languages_1.Language.cpp, languages_1.Language.java], new RegExp("Cannot specify a 'packs' input in a multi-language analysis. " +
+(0, ava_1.default)("two packs with language", parsePacksErrorMacro, "a/b,c/d@1.2.3", [languages_1.KnownLanguage.cpp, languages_1.KnownLanguage.java], new RegExp("Cannot specify a 'packs' input in a multi-language analysis. " +
     "Use a codeql-config.yml file instead and specify packs by language."));
 (0, ava_1.default)("packs with other valid names", parsePacksMacro, [
     // ranges are ok
@@ -555,8 +598,8 @@ const invalidPackNameMacro = ava_1.default.macro({
     // this is valid, too. It will fail if it doesn't match a path
     // (globbing is not done)
     "c/d@1.2.3:+*)_(",
-].join(","), [languages_1.Language.cpp], {
-    [languages_1.Language.cpp]: [
+].join(","), [languages_1.KnownLanguage.cpp], {
+    [languages_1.KnownLanguage.cpp]: [
         "c/d@1.0",
         "c/d@~1.0.0",
         "c/d@~1.0.0:a/b",
@@ -623,58 +666,63 @@ const packSpecPrettyPrintingMacro = ava_1.default.macro({
 });
 const mockLogger = (0, logging_1.getRunnerLogger)(true);
 const calculateAugmentationMacro = ava_1.default.macro({
-    exec: async (t, _title, rawPacksInput, rawQueriesInput, languages, expectedAugmentationProperties) => {
-        const actualAugmentationProperties = await configUtils.calculateAugmentation((0, codeql_1.getCachedCodeQL)(), (0, testing_utils_1.createFeatures)([]), rawPacksInput, rawQueriesInput, languages, mockLogger);
+    exec: async (t, _title, rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages, expectedAugmentationProperties) => {
+        const actualAugmentationProperties = await configUtils.calculateAugmentation(rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages);
         t.deepEqual(actualAugmentationProperties, expectedAugmentationProperties);
     },
     title: (_, title) => `Calculate Augmentation: ${title}`,
 });
-(0, ava_1.default)(calculateAugmentationMacro, "All empty", undefined, undefined, [languages_1.Language.javascript], {
-    queriesInputCombines: false,
-    queriesInput: undefined,
-    packsInputCombines: false,
-    packsInput: undefined,
-    defaultQueryFilters: [],
+(0, ava_1.default)(calculateAugmentationMacro, "All empty", undefined, undefined, undefined, [languages_1.KnownLanguage.javascript], {
+    ...configUtils.defaultAugmentationProperties,
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With queries", undefined, " a, b , c, d", [languages_1.Language.javascript], {
-    queriesInputCombines: false,
+(0, ava_1.default)(calculateAugmentationMacro, "With queries", undefined, " a, b , c, d", undefined, [languages_1.KnownLanguage.javascript], {
+    ...configUtils.defaultAugmentationProperties,
     queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
-    packsInputCombines: false,
-    packsInput: undefined,
-    defaultQueryFilters: [],
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With queries combining", undefined, "   +   a, b , c, d ", [languages_1.Language.javascript], {
+(0, ava_1.default)(calculateAugmentationMacro, "With queries combining", undefined, "   +   a, b , c, d ", undefined, [languages_1.KnownLanguage.javascript], {
+    ...configUtils.defaultAugmentationProperties,
     queriesInputCombines: true,
     queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
-    packsInputCombines: false,
-    packsInput: undefined,
-    defaultQueryFilters: [],
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With packs", "   codeql/a , codeql/b   , codeql/c  , codeql/d  ", undefined, [languages_1.Language.javascript], {
-    queriesInputCombines: false,
-    queriesInput: undefined,
-    packsInputCombines: false,
+(0, ava_1.default)(calculateAugmentationMacro, "With quality queries", undefined, undefined, " a, b , c, d", [languages_1.KnownLanguage.javascript], {
+    ...configUtils.defaultAugmentationProperties,
+    qualityQueriesInput: [
+        { uses: "a" },
+        { uses: "b" },
+        { uses: "c" },
+        { uses: "d" },
+    ],
+});
+(0, ava_1.default)(calculateAugmentationMacro, "With security and quality queries", undefined, " a, b , c, d", "e, f , g,h", [languages_1.KnownLanguage.javascript], {
+    ...configUtils.defaultAugmentationProperties,
+    queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
+    qualityQueriesInput: [
+        { uses: "e" },
+        { uses: "f" },
+        { uses: "g" },
+        { uses: "h" },
+    ],
+});
+(0, ava_1.default)(calculateAugmentationMacro, "With packs", "   codeql/a , codeql/b   , codeql/c  , codeql/d  ", undefined, undefined, [languages_1.KnownLanguage.javascript], {
+    ...configUtils.defaultAugmentationProperties,
     packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
-    defaultQueryFilters: [],
 });
-(0, ava_1.default)(calculateAugmentationMacro, "With packs combining", "   +   codeql/a, codeql/b, codeql/c, codeql/d", undefined, [languages_1.Language.javascript], {
-    queriesInputCombines: false,
-    queriesInput: undefined,
+(0, ava_1.default)(calculateAugmentationMacro, "With packs combining", "   +   codeql/a, codeql/b, codeql/c, codeql/d", undefined, undefined, [languages_1.KnownLanguage.javascript], {
+    ...configUtils.defaultAugmentationProperties,
     packsInputCombines: true,
     packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
-    defaultQueryFilters: [],
 });
 const calculateAugmentationErrorMacro = ava_1.default.macro({
-    exec: async (t, _title, rawPacksInput, rawQueriesInput, languages, expectedError) => {
-        await t.throwsAsync(() => configUtils.calculateAugmentation((0, codeql_1.getCachedCodeQL)(), (0, testing_utils_1.createFeatures)([]), rawPacksInput, rawQueriesInput, languages, mockLogger), { message: expectedError });
+    exec: async (t, _title, rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages, expectedError) => {
+        await t.throwsAsync(() => configUtils.calculateAugmentation(rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages), { message: expectedError });
     },
     title: (_, title) => `Calculate Augmentation Error: ${title}`,
 });
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (queries)", undefined, "   +   ", [languages_1.Language.javascript], /The workflow property "queries" is invalid/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (packs)", "   +   ", undefined, [languages_1.Language.javascript], /The workflow property "packs" is invalid/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with multiple languages", "   +  a/b, c/d ", undefined, [languages_1.Language.javascript, languages_1.Language.java], /Cannot specify a 'packs' input in a multi-language analysis/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with no languages", "   +  a/b, c/d ", undefined, [], /No languages specified/);
-(0, ava_1.default)(calculateAugmentationErrorMacro, "Invalid packs", " a-pack-without-a-scope ", undefined, [languages_1.Language.javascript], /"a-pack-without-a-scope" is not a valid pack/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (queries)", undefined, "   +   ", undefined, [languages_1.KnownLanguage.javascript], /The workflow property "queries" is invalid/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (packs)", "   +   ", undefined, undefined, [languages_1.KnownLanguage.javascript], /The workflow property "packs" is invalid/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with multiple languages", "   +  a/b, c/d ", undefined, undefined, [languages_1.KnownLanguage.javascript, languages_1.KnownLanguage.java], /Cannot specify a 'packs' input in a multi-language analysis/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with no languages", "   +  a/b, c/d ", undefined, undefined, [], /No languages specified/);
+(0, ava_1.default)(calculateAugmentationErrorMacro, "Invalid packs", " a-pack-without-a-scope ", undefined, undefined, [languages_1.KnownLanguage.javascript], /"a-pack-without-a-scope" is not a valid pack/);
 (0, ava_1.default)("no generateRegistries when registries is undefined", async (t) => {
     return await (0, util_1.withTmpDir)(async (tmpDir) => {
         const registriesInput = undefined;
@@ -706,7 +754,6 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
 [
     {
         name: "languages from input",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
         languagesInput: "jAvAscript, \n jaVa",
         languagesInRepository: ["SwiFt", "other"],
         expectedLanguages: ["javascript", "java"],
@@ -714,7 +761,6 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
     },
     {
         name: "languages from github api",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
         languagesInput: "",
         languagesInRepository: ["  jAvAscript\n \t", " jaVa", "SwiFt", "other"],
         expectedLanguages: ["javascript", "java"],
@@ -722,7 +768,6 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
     },
     {
         name: "aliases from input",
-        codeqlResolvedLanguages: ["javascript", "csharp", "cpp", "java", "python"],
         languagesInput: "  typEscript\n \t, C#, c , KoTlin",
         languagesInRepository: ["SwiFt", "other"],
         expectedLanguages: ["javascript", "csharp", "cpp", "java"],
@@ -730,7 +775,6 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
     },
     {
         name: "duplicate languages from input",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
         languagesInput: "jAvAscript, \n jaVa, kotlin, typescript",
         languagesInRepository: ["SwiFt", "other"],
         expectedLanguages: ["javascript", "java"],
@@ -738,7 +782,6 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
     },
     {
         name: "aliases from github api",
-        codeqlResolvedLanguages: ["javascript", "csharp", "cpp", "java", "python"],
         languagesInput: "",
         languagesInRepository: ["  typEscript\n \t", " C#", "c", "other"],
         expectedLanguages: ["javascript", "csharp", "cpp"],
@@ -746,7 +789,6 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
     },
     {
         name: "no languages",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
         languagesInput: "",
         languagesInRepository: [],
         expectedApiCall: true,
@@ -754,7 +796,6 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
     },
     {
         name: "unrecognized languages from input",
-        codeqlResolvedLanguages: ["javascript", "java", "python"],
         languagesInput: "a, b, c, javascript",
         languagesInRepository: [],
         expectedApiCall: false,
@@ -763,21 +804,34 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
 ].forEach((args) => {
     (0, ava_1.default)(`getLanguages: ${args.name}`, async (t) => {
         const mockRequest = (0, testing_utils_1.mockLanguagesInRepo)(args.languagesInRepository);
-        const languages = args.codeqlResolvedLanguages.reduce((acc, lang) => ({
-            ...acc,
-            [lang]: true,
-        }), {});
+        const stubExtractorEntry = {
+            extractor_root: "",
+        };
         const codeQL = (0, codeql_1.setCodeQL)({
-            resolveLanguages: () => Promise.resolve(languages),
+            betterResolveLanguages: () => Promise.resolve({
+                aliases: {
+                    "c#": languages_1.KnownLanguage.csharp,
+                    c: languages_1.KnownLanguage.cpp,
+                    kotlin: languages_1.KnownLanguage.java,
+                    typescript: languages_1.KnownLanguage.javascript,
+                },
+                extractors: {
+                    cpp: [stubExtractorEntry],
+                    csharp: [stubExtractorEntry],
+                    java: [stubExtractorEntry],
+                    javascript: [stubExtractorEntry],
+                    python: [stubExtractorEntry],
+                },
+            }),
         });
         if (args.expectedLanguages) {
             // happy path
-            const actualLanguages = await configUtils.getLanguages(codeQL, args.languagesInput, mockRepositoryNwo, mockLogger);
+            const actualLanguages = await configUtils.getLanguages(codeQL, args.languagesInput, mockRepositoryNwo, ".", mockLogger);
             t.deepEqual(actualLanguages.sort(), args.expectedLanguages.sort());
         }
         else {
             // there is an error
-            await t.throwsAsync(async () => await configUtils.getLanguages(codeQL, args.languagesInput, mockRepositoryNwo, mockLogger), { message: args.expectedError });
+            await t.throwsAsync(async () => await configUtils.getLanguages(codeQL, args.languagesInput, mockRepositoryNwo, ".", mockLogger), { message: args.expectedError });
         }
         t.deepEqual(mockRequest.called, args.expectedApiCall);
     });
@@ -785,12 +839,12 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
 for (const { displayName, language, feature } of [
     {
         displayName: "Java",
-        language: languages_1.Language.java,
+        language: languages_1.KnownLanguage.java,
         feature: feature_flags_1.Feature.DisableJavaBuildlessEnabled,
     },
     {
         displayName: "C#",
-        language: languages_1.Language.csharp,
+        language: languages_1.KnownLanguage.csharp,
         feature: feature_flags_1.Feature.DisableCsharpBuildless,
     },
 ]) {
@@ -802,7 +856,7 @@ for (const { displayName, language, feature } of [
     });
     (0, ava_1.default)(`Build mode not overridden for other languages when disable ${displayName} buildless feature flag enabled`, async (t) => {
         const messages = [];
-        const buildMode = await configUtils.parseBuildModeInput("none", [languages_1.Language.python], (0, testing_utils_1.createFeatures)([feature]), (0, testing_utils_1.getRecordingLogger)(messages));
+        const buildMode = await configUtils.parseBuildModeInput("none", [languages_1.KnownLanguage.python], (0, testing_utils_1.createFeatures)([feature]), (0, testing_utils_1.getRecordingLogger)(messages));
         t.is(buildMode, util_1.BuildMode.None);
         t.deepEqual(messages, []);
     });
@@ -818,4 +872,397 @@ for (const { displayName, language, feature } of [
         ]);
     });
 }
+const defaultOverlayDatabaseModeTestSetup = {
+    overlayDatabaseEnvVar: undefined,
+    features: [],
+    isPullRequest: false,
+    isDefaultBranch: false,
+    repositoryOwner: "github",
+    buildMode: util_1.BuildMode.None,
+    languages: [languages_1.KnownLanguage.javascript],
+    codeqlVersion: "2.21.0",
+    gitRoot: "/some/git/root",
+    codeScanningConfig: {},
+};
+const getOverlayDatabaseModeMacro = ava_1.default.macro({
+    exec: async (t, _title, setupOverrides, expected) => {
+        return await (0, util_1.withTmpDir)(async (tempDir) => {
+            const messages = [];
+            const logger = (0, testing_utils_1.getRecordingLogger)(messages);
+            // Save the original environment
+            const originalEnv = { ...process.env };
+            try {
+                const setup = {
+                    ...defaultOverlayDatabaseModeTestSetup,
+                    ...setupOverrides,
+                };
+                // Set up environment variable if specified
+                delete process.env.CODEQL_OVERLAY_DATABASE_MODE;
+                if (setup.overlayDatabaseEnvVar !== undefined) {
+                    process.env.CODEQL_OVERLAY_DATABASE_MODE =
+                        setup.overlayDatabaseEnvVar;
+                }
+                // Mock feature flags
+                const features = (0, testing_utils_1.createFeatures)(setup.features);
+                // Mock isAnalyzingPullRequest function
+                sinon
+                    .stub(actionsUtil, "isAnalyzingPullRequest")
+                    .returns(setup.isPullRequest);
+                // Mock repository owner
+                const repository = {
+                    owner: setup.repositoryOwner,
+                    repo: "test-repo",
+                };
+                // Set up CodeQL mock
+                const codeql = (0, testing_utils_1.mockCodeQLVersion)(setup.codeqlVersion);
+                // Mock traced languages
+                sinon
+                    .stub(codeql, "isTracedLanguage")
+                    .callsFake(async (lang) => {
+                    return [languages_1.KnownLanguage.java].includes(lang);
+                });
+                // Mock git root detection
+                if (setup.gitRoot !== undefined) {
+                    sinon.stub(gitUtils, "getGitRoot").resolves(setup.gitRoot);
+                }
+                // Mock default branch detection
+                sinon
+                    .stub(gitUtils, "isAnalyzingDefaultBranch")
+                    .resolves(setup.isDefaultBranch);
+                const result = await configUtils.getOverlayDatabaseMode(codeql, repository, features, setup.languages, tempDir, // sourceRoot
+                setup.buildMode, setup.codeScanningConfig, logger);
+                t.deepEqual(result, expected);
+            }
+            finally {
+                // Restore the original environment
+                process.env = originalEnv;
+            }
+        });
+    },
+    title: (_, title) => `getOverlayDatabaseMode: ${title}`,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Environment variable override - Overlay", {
+    overlayDatabaseEnvVar: "overlay",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Environment variable override - OverlayBase", {
+    overlayDatabaseEnvVar: "overlay-base",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.OverlayBase,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Environment variable override - None", {
+    overlayDatabaseEnvVar: "none",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Ignore invalid environment variable", {
+    overlayDatabaseEnvVar: "invalid-mode",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Ignore feature flag when analyzing non-default branch", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis, feature_flags_1.Feature.OverlayAnalysisJavascript],
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay-base database on default branch when feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis, feature_flags_1.Feature.OverlayAnalysisJavascript],
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.OverlayBase,
+    useOverlayDatabaseCaching: true,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay-base database on default branch when feature enabled with custom analysis", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis, feature_flags_1.Feature.OverlayAnalysisJavascript],
+    codeScanningConfig: {
+        packs: ["some-custom-pack@1.0.0"],
+    },
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.OverlayBase,
+    useOverlayDatabaseCaching: true,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay-base database on default branch when code-scanning feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.OverlayBase,
+    useOverlayDatabaseCaching: true,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay-base database on default branch when code-scanning feature enabled with disable-default-queries", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        "disable-default-queries": true,
+    },
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay-base database on default branch when code-scanning feature enabled with packs", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        packs: ["some-custom-pack@1.0.0"],
+    },
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay-base database on default branch when code-scanning feature enabled with queries", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        queries: [{ uses: "some-query.ql" }],
+    },
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay-base database on default branch when code-scanning feature enabled with query-filters", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        "query-filters": [{ include: { "security-severity": "high" } }],
+    },
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay-base database on default branch when only language-specific feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysisJavascript],
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay-base database on default branch when only code-scanning feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript],
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay-base database on default branch when language-specific feature disabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis],
+    isDefaultBranch: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay analysis on PR when feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis, feature_flags_1.Feature.OverlayAnalysisJavascript],
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: true,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay analysis on PR when feature enabled with custom analysis", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis, feature_flags_1.Feature.OverlayAnalysisJavascript],
+    codeScanningConfig: {
+        packs: ["some-custom-pack@1.0.0"],
+    },
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: true,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay analysis on PR when code-scanning feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: true,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay analysis on PR when code-scanning feature enabled with disable-default-queries", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        "disable-default-queries": true,
+    },
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay analysis on PR when code-scanning feature enabled with packs", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        packs: ["some-custom-pack@1.0.0"],
+    },
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay analysis on PR when code-scanning feature enabled with queries", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        queries: [{ uses: "some-query.ql" }],
+    },
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay analysis on PR when code-scanning feature enabled with query-filters", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [
+        feature_flags_1.Feature.OverlayAnalysis,
+        feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript,
+    ],
+    codeScanningConfig: {
+        "query-filters": [{ include: { "security-severity": "high" } }],
+    },
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay analysis on PR when only language-specific feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysisJavascript],
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay analysis on PR when only code-scanning feature enabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysisCodeScanningJavascript],
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay analysis on PR when language-specific feature disabled", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis],
+    isPullRequest: true,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay PR analysis by env for dsp-testing", {
+    overlayDatabaseEnvVar: "overlay",
+    repositoryOwner: "dsp-testing",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay PR analysis by env for other-org", {
+    overlayDatabaseEnvVar: "overlay",
+    repositoryOwner: "other-org",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Overlay PR analysis by feature flag for dsp-testing", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis, feature_flags_1.Feature.OverlayAnalysisJavascript],
+    isPullRequest: true,
+    repositoryOwner: "dsp-testing",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: true,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "No overlay PR analysis by feature flag for other-org", {
+    languages: [languages_1.KnownLanguage.javascript],
+    features: [feature_flags_1.Feature.OverlayAnalysis, feature_flags_1.Feature.OverlayAnalysisJavascript],
+    isPullRequest: true,
+    repositoryOwner: "other-org",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Fallback due to autobuild with traced language", {
+    overlayDatabaseEnvVar: "overlay",
+    buildMode: util_1.BuildMode.Autobuild,
+    languages: [languages_1.KnownLanguage.java],
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Fallback due to no build mode with traced language", {
+    overlayDatabaseEnvVar: "overlay",
+    buildMode: undefined,
+    languages: [languages_1.KnownLanguage.java],
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Fallback due to old CodeQL version", {
+    overlayDatabaseEnvVar: "overlay",
+    codeqlVersion: "2.14.0",
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+(0, ava_1.default)(getOverlayDatabaseModeMacro, "Fallback due to missing git root", {
+    overlayDatabaseEnvVar: "overlay",
+    gitRoot: undefined,
+}, {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+    useOverlayDatabaseCaching: false,
+});
+// Exercise language-specific overlay analysis features code paths
+for (const language in languages_1.KnownLanguage) {
+    (0, ava_1.default)(getOverlayDatabaseModeMacro, `Check default overlay analysis feature for ${language}`, {
+        languages: [language],
+        features: [feature_flags_1.Feature.OverlayAnalysis],
+        isPullRequest: true,
+    }, {
+        overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+        useOverlayDatabaseCaching: false,
+    });
+}
 //# sourceMappingURL=config-utils.test.js.map

lib/database-upload.js

@@ -37,11 +37,11 @@ exports.uploadDatabases = uploadDatabases;
 const fs = __importStar(require("fs"));
 const actionsUtil = __importStar(require("./actions-util"));
 const api_client_1 = require("./api-client");
-const codeql_1 = require("./codeql");
 const gitUtils = __importStar(require("./git-utils"));
+const logging_1 = require("./logging");
 const util = __importStar(require("./util"));
 const util_1 = require("./util");
-async function uploadDatabases(repositoryNwo, config, apiDetails, logger) {
+async function uploadDatabases(repositoryNwo, codeql, config, apiDetails, logger) {
     if (actionsUtil.getRequiredInput("upload-database") !== "true") {
         logger.debug("Database upload disabled in workflow. Skipping upload.");
         return;
@@ -61,8 +61,12 @@ async function uploadDatabases(repositoryNwo, config, apiDetails, logger) {
         logger.debug("Not analyzing default branch. Skipping upload.");
         return;
     }
+    // Clean up the database, since intermediate results may still be written to the
+    // database if there is high RAM pressure.
+    await (0, logging_1.withGroupAsync)("Cleaning up databases", async () => {
+        await codeql.databaseCleanupCluster(config, "clear");
+    });
     const client = (0, api_client_1.getApiClient)();
-    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     const uploadsUrl = new URL((0, util_1.parseGitHubUrl)(apiDetails.url));
     uploadsUrl.hostname = `uploads.${uploadsUrl.hostname}`;
     // Octokit expects the baseUrl to not have a trailing slash,

lib/database-upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,0CAmFC;AA/FD,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAErC,sDAAwC;AAGxC,6CAA+B;AAC/B,iCAAkD;AAE3C,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,iDAAiD;IACjD,IACE,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,UAAU,EAC3D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,wBAAwB,EAAE,CAAC,EAAE,CAAC;QACjD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,UAAU,CAAC,QAAQ,GAAG,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEvD,4DAA4D;IAC5D,0CAA0C;IAC1C,IAAI,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAC3C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAC9C,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qGAAqG,EACrG;oBACE,OAAO,EAAE,cAAc;oBACvB,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;oBAAS,CAAC;gBACT,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,0CAyFC;AArGD,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAG9D,sDAAwC;AACxC,uCAAmD;AAEnD,6CAA+B;AAC/B,iCAAkD;AAE3C,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,iDAAiD;IACjD,IACE,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,UAAU,EAC3D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,wBAAwB,EAAE,CAAC,EAAE,CAAC;QACjD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,gFAAgF;IAChF,0CAA0C;IAC1C,MAAM,IAAA,wBAAc,EAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,UAAU,CAAC,QAAQ,GAAG,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEvD,4DAA4D;IAC5D,0CAA0C;IAC1C,IAAI,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,YAAY,CAC3C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAC9C,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qGAAqG,EACrG;oBACE,OAAO,EAAE,cAAc;oBACvB,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;oBAAS,CAAC;gBACT,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC"}

lib/database-upload.test.js

@@ -60,7 +60,7 @@ const testApiDetails = {
 };
 function getTestConfig(tmpDir) {
     return (0, testing_utils_1.createTestConfig)({
-        languages: [languages_1.Language.javascript],
+        languages: [languages_1.KnownLanguage.javascript],
         dbLocation: tmpDir,
     });
 }
@@ -79,6 +79,16 @@ async function mockHttpRequests(databaseUploadStatusCode) {
     sinon.stub(apiClient, "getApiClient").value(() => client);
     return databaseUploadSpy;
 }
+function getCodeQL() {
+    return (0, codeql_1.setCodeQL)({
+        async databaseBundle(_, outputFilePath) {
+            fs.writeFileSync(outputFilePath, "");
+        },
+        async databaseCleanupCluster() {
+            // Do nothing, as we are not testing cleanup here.
+        },
+    });
+}
 (0, ava_1.default)("Abort database upload if 'upload-database' input set to false", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
@@ -88,7 +98,7 @@ async function mockHttpRequests(databaseUploadStatusCode) {
             .returns("false");
         sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
         const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
         t.assert(loggedMessages.find((v) => v.type === "debug" &&
             v.message ===
                 "Database upload disabled in workflow. Skipping upload.") !== undefined);
@@ -105,7 +115,7 @@ async function mockHttpRequests(databaseUploadStatusCode) {
         const config = getTestConfig(tmpDir);
         config.gitHubVersion = { type: util_1.GitHubVariant.GHES, version: "3.0" };
         const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, config, testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), config, testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
         t.assert(loggedMessages.find((v) => v.type === "debug" &&
             v.message ===
                 "Not running against github.com or GHEC-DR. Skipping upload.") !== undefined);
@@ -120,7 +130,7 @@ async function mockHttpRequests(databaseUploadStatusCode) {
             .returns("true");
         sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(false);
         const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
         t.assert(loggedMessages.find((v) => v.type === "debug" &&
             v.message === "Not analyzing default branch. Skipping upload.") !== undefined);
     });
@@ -134,13 +144,8 @@ async function mockHttpRequests(databaseUploadStatusCode) {
             .returns("true");
         sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
         await mockHttpRequests(500);
-        (0, codeql_1.setCodeQL)({
-            async databaseBundle(_, outputFilePath) {
-                fs.writeFileSync(outputFilePath, "");
-            },
-        });
         const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
         t.assert(loggedMessages.find((v) => v.type === "warning" &&
             v.message ===
                 "Failed to upload database for javascript: Error: some error message") !== undefined);
@@ -155,13 +160,8 @@ async function mockHttpRequests(databaseUploadStatusCode) {
             .returns("true");
         sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
         await mockHttpRequests(201);
-        (0, codeql_1.setCodeQL)({
-            async databaseBundle(_, outputFilePath) {
-                fs.writeFileSync(outputFilePath, "");
-            },
-        });
         const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), testApiDetails, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
         t.assert(loggedMessages.find((v) => v.type === "debug" &&
             v.message === "Successfully uploaded database for javascript") !== undefined);
     });
@@ -175,13 +175,8 @@ async function mockHttpRequests(databaseUploadStatusCode) {
             .returns("true");
         sinon.stub(gitUtils, "isAnalyzingDefaultBranch").resolves(true);
         const databaseUploadSpy = await mockHttpRequests(201);
-        (0, codeql_1.setCodeQL)({
-            async databaseBundle(_, outputFilePath) {
-                fs.writeFileSync(outputFilePath, "");
-            },
-        });
         const loggedMessages = [];
-        await (0, database_upload_1.uploadDatabases)(testRepoName, getTestConfig(tmpDir), {
+        await (0, database_upload_1.uploadDatabases)(testRepoName, getCodeQL(), getTestConfig(tmpDir), {
             auth: "1234",
             url: "https://tenant.ghe.com",
             apiURL: undefined,

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-    "bundleVersion": "codeql-bundle-v2.22.0",
-    "cliVersion": "2.22.0",
-    "priorBundleVersion": "codeql-bundle-v2.21.4",
-    "priorCliVersion": "2.21.4"
+    "bundleVersion": "codeql-bundle-v2.22.3",
+    "cliVersion": "2.22.3",
+    "priorBundleVersion": "codeql-bundle-v2.22.2",
+    "priorCliVersion": "2.22.2"
 }

lib/diff-informed-analysis-utils.js

@@ -39,34 +39,10 @@ exports.writeDiffRangesJsonFile = writeDiffRangesJsonFile;
 exports.readDiffRangesJsonFile = readDiffRangesJsonFile;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const github = __importStar(require("@actions/github"));
 const actionsUtil = __importStar(require("./actions-util"));
+const api_client_1 = require("./api-client");
 const feature_flags_1 = require("./feature-flags");
-function getPullRequestBranches() {
-    const pullRequest = github.context.payload.pull_request;
-    if (pullRequest) {
-        return {
-            base: pullRequest.base.ref,
-            // We use the head label instead of the head ref here, because the head
-            // ref lacks owner information and by itself does not uniquely identify
-            // the head branch (which may be in a forked repository).
-            head: pullRequest.head.label,
-        };
-    }
-    // PR analysis under Default Setup does not have the pull_request context,
-    // but it should set CODE_SCANNING_REF and CODE_SCANNING_BASE_BRANCH.
-    const codeScanningRef = process.env.CODE_SCANNING_REF;
-    const codeScanningBaseBranch = process.env.CODE_SCANNING_BASE_BRANCH;
-    if (codeScanningRef && codeScanningBaseBranch) {
-        return {
-            base: codeScanningBaseBranch,
-            // PR analysis under Default Setup analyzes the PR head commit instead of
-            // the merge commit, so we can use the provided ref directly.
-            head: codeScanningRef,
-        };
-    }
-    return undefined;
-}
+const util_1 = require("./util");
 /**
  * Check if the action should perform diff-informed analysis.
  */
@@ -85,7 +61,12 @@ async function getDiffInformedAnalysisBranches(codeql, features, logger) {
     if (!(await features.getValue(feature_flags_1.Feature.DiffInformedQueries, codeql))) {
         return undefined;
     }
-    const branches = getPullRequestBranches();
+    const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
+    if (gitHubVersion.type === util_1.GitHubVariant.GHES &&
+        (0, util_1.satisfiesGHESVersion)(gitHubVersion.version, "<3.19", true)) {
+        return undefined;
+    }
+    const branches = actionsUtil.getPullRequestBranches();
     if (!branches) {
         logger.info("Not performing diff-informed analysis " +
             "because we are not analyzing a pull request.");

lib/diff-informed-analysis-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"diff-informed-analysis-utils.js","sourceRoot":"","sources":["../src/diff-informed-analysis-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,8EASC;AASD,0EAiBC;AAYD,0DAUC;AAED,wDAaC;AArHD,uCAAyB;AACzB,2CAA6B;AAE7B,wDAA0C;AAE1C,4DAA8C;AAE9C,mDAA6D;AAQ7D,SAAS,sBAAsB;IAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG;YAC1B,uEAAuE;YACvE,uEAAuE;YACvE,yDAAyD;YACzD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK;SAC7B,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACtD,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IACrE,IAAI,eAAe,IAAI,sBAAsB,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,yEAAyE;YACzE,6DAA6D;YAC7D,IAAI,EAAE,eAAe;SACtB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,QAA2B,EAC3B,MAAc;IAEd,OAAO,CACL,CAAC,MAAM,+BAA+B,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjE,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,+BAA+B,CACnD,MAAc,EACd,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,EAAE,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CACT,wCAAwC;YACtC,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD,SAAS,yBAAyB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,uBAAuB,CACrC,MAAc,EACd,MAAwB;IAExB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CACV,oCAAoC,YAAY,MAAM,YAAY,EAAE,CACrE,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAc;IAEd,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,2CAA2C,YAAY,EAAE,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CACV,qCAAqC,YAAY,MAAM,YAAY,EAAE,CACtE,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAqB,CAAC;AACtD,CAAC"}
+{"version":3,"file":"diff-informed-analysis-utils.js","sourceRoot":"","sources":["../src/diff-informed-analysis-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,8EASC;AASD,0EAyBC;AAYD,0DAUC;AAED,wDAaC;AA9FD,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAE9C,6CAAgD;AAEhD,mDAA6D;AAE7D,iCAA6D;AAE7D;;GAEG;AACI,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,QAA2B,EAC3B,MAAc;IAEd,OAAO,CACL,CAAC,MAAM,+BAA+B,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjE,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,+BAA+B,CACnD,MAAc,EACd,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;IAC/C,IACE,aAAa,CAAC,IAAI,KAAK,oBAAa,CAAC,IAAI;QACzC,IAAA,2BAAoB,EAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAC1D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,sBAAsB,EAAE,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CACT,wCAAwC;YACtC,8CAA8C,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD,SAAS,yBAAyB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,uBAAuB,CACrC,MAAc,EACd,MAAwB;IAExB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CACV,oCAAoC,YAAY,MAAM,YAAY,EAAE,CACrE,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CACpC,MAAc;IAEd,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,2CAA2C,YAAY,EAAE,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CACV,qCAAqC,YAAY,MAAM,YAAY,EAAE,CACtE,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAqB,CAAC;AACtD,CAAC"}

lib/diff-informed-analysis-utils.test.js

@@ -0,0 +1,130 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ava_1 = __importDefault(require("ava"));
+const sinon = __importStar(require("sinon"));
+const actionsUtil = __importStar(require("./actions-util"));
+const apiClient = __importStar(require("./api-client"));
+const diff_informed_analysis_utils_1 = require("./diff-informed-analysis-utils");
+const feature_flags_1 = require("./feature-flags");
+const logging_1 = require("./logging");
+const repository_1 = require("./repository");
+const testing_utils_1 = require("./testing-utils");
+const util_1 = require("./util");
+(0, testing_utils_1.setupTests)(ava_1.default);
+const defaultTestCase = {
+    featureEnabled: true,
+    gitHubVersion: {
+        type: util_1.GitHubVariant.DOTCOM,
+    },
+    pullRequestBranches: {
+        base: "main",
+        head: "feature-branch",
+    },
+    codeQLVersion: "2.21.0",
+};
+const testShouldPerformDiffInformedAnalysis = ava_1.default.macro({
+    exec: async (t, _title, partialTestCase, expectedResult) => {
+        return await (0, util_1.withTmpDir)(async (tmpDir) => {
+            (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
+            const testCase = { ...defaultTestCase, ...partialTestCase };
+            const logger = (0, logging_1.getRunnerLogger)(true);
+            const codeql = (0, testing_utils_1.mockCodeQLVersion)(testCase.codeQLVersion);
+            if (testCase.diffInformedQueriesEnvVar !== undefined) {
+                process.env.CODEQL_ACTION_DIFF_INFORMED_QUERIES =
+                    testCase.diffInformedQueriesEnvVar.toString();
+            }
+            else {
+                delete process.env.CODEQL_ACTION_DIFF_INFORMED_QUERIES;
+            }
+            const features = new feature_flags_1.Features(testCase.gitHubVersion, (0, repository_1.parseRepositoryNwo)("github/example"), tmpDir, logger);
+            (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, {
+                [feature_flags_1.Feature.DiffInformedQueries]: testCase.featureEnabled,
+            });
+            const getGitHubVersionStub = sinon
+                .stub(apiClient, "getGitHubVersion")
+                .resolves(testCase.gitHubVersion);
+            const getPullRequestBranchesStub = sinon
+                .stub(actionsUtil, "getPullRequestBranches")
+                .returns(testCase.pullRequestBranches);
+            const result = await (0, diff_informed_analysis_utils_1.shouldPerformDiffInformedAnalysis)(codeql, features, logger);
+            t.is(result, expectedResult);
+            delete process.env.CODEQL_ACTION_DIFF_INFORMED_QUERIES;
+            getGitHubVersionStub.restore();
+            getPullRequestBranchesStub.restore();
+        });
+    },
+    title: (_, title) => `shouldPerformDiffInformedAnalysis: ${title}`,
+});
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns true in the default test case", {}, true);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns false when feature flag is disabled from the API", {
+    featureEnabled: false,
+}, false);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns false when CODEQL_ACTION_DIFF_INFORMED_QUERIES is set to false", {
+    featureEnabled: true,
+    diffInformedQueriesEnvVar: false,
+}, false);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns true when CODEQL_ACTION_DIFF_INFORMED_QUERIES is set to true", {
+    featureEnabled: false,
+    diffInformedQueriesEnvVar: true,
+}, true);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns false for CodeQL version 2.20.0", {
+    codeQLVersion: "2.20.0",
+}, false);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns false for invalid GHES version", {
+    gitHubVersion: {
+        type: util_1.GitHubVariant.GHES,
+        version: "invalid-version",
+    },
+}, false);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns false for GHES version 3.18.5", {
+    gitHubVersion: {
+        type: util_1.GitHubVariant.GHES,
+        version: "3.18.5",
+    },
+}, false);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns true for GHES version 3.19.0", {
+    gitHubVersion: {
+        type: util_1.GitHubVariant.GHES,
+        version: "3.19.0",
+    },
+}, true);
+(0, ava_1.default)(testShouldPerformDiffInformedAnalysis, "returns false when not a pull request", {
+    pullRequestBranches: undefined,
+}, false);
+//# sourceMappingURL=diff-informed-analysis-utils.test.js.map

lib/diff-informed-analysis-utils.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-informed-analysis-utils.test.js","sourceRoot":"","sources":["../src/diff-informed-analysis-utils.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAA6C;AAC7C,6CAA+B;AAE/B,4DAA8C;AAE9C,wDAA0C;AAC1C,iFAAmF;AACnF,mDAAoD;AACpD,uCAA4C;AAC5C,6CAAkD;AAClD,mDAKyB;AACzB,iCAAmD;AAGnD,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAUjB,MAAM,eAAe,GAAiC;IACpD,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE;QACb,IAAI,EAAE,oBAAa,CAAC,MAAM;KAC3B;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,gBAAgB;KACvB;IACD,aAAa,EAAE,QAAQ;CACxB,CAAC;AAEF,MAAM,qCAAqC,GAAG,aAAI,CAAC,KAAK,CAAC;IACvD,IAAI,EAAE,KAAK,EACT,CAAmB,EACnB,MAAc,EACd,eAAsD,EACtD,cAAuB,EACvB,EAAE;QACF,OAAO,MAAM,IAAA,iBAAU,EAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAEjC,MAAM,QAAQ,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,IAAA,iCAAiB,EAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,QAAQ,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,mCAAmC;oBAC7C,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,OAAO,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;YACzD,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,wBAAQ,CAC3B,QAAQ,CAAC,aAAa,EACtB,IAAA,+BAAkB,EAAC,gBAAgB,CAAC,EACpC,MAAM,EACN,MAAM,CACP,CAAC;YACF,IAAA,0CAA0B,EAAC,GAAG,EAAE;gBAC9B,CAAC,uBAAO,CAAC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,cAAc;aACvD,CAAC,CAAC;YAEH,MAAM,oBAAoB,GAAG,KAAK;iBAC/B,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC;iBACnC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACpC,MAAM,0BAA0B,GAAG,KAAK;iBACrC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC;iBAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAEzC,MAAM,MAAM,GAAG,MAAM,IAAA,gEAAiC,EACpD,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;YAEF,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YAE7B,OAAO,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;YAEvD,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAC/B,0BAA0B,CAAC,OAAO,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,sCAAsC,KAAK,EAAE;CACnE,CAAC,CAAC;AAEH,IAAA,aAAI,EACF,qCAAqC,EACrC,uCAAuC,EACvC,EAAE,EACF,IAAI,CACL,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,0DAA0D,EAC1D;IACE,cAAc,EAAE,KAAK;CACtB,EACD,KAAK,CACN,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,wEAAwE,EACxE;IACE,cAAc,EAAE,IAAI;IACpB,yBAAyB,EAAE,KAAK;CACjC,EACD,KAAK,CACN,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,sEAAsE,EACtE;IACE,cAAc,EAAE,KAAK;IACrB,yBAAyB,EAAE,IAAI;CAChC,EACD,IAAI,CACL,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,yCAAyC,EACzC;IACE,aAAa,EAAE,QAAQ;CACxB,EACD,KAAK,CACN,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,wCAAwC,EACxC;IACE,aAAa,EAAE;QACb,IAAI,EAAE,oBAAa,CAAC,IAAI;QACxB,OAAO,EAAE,iBAAiB;KAC3B;CACF,EACD,KAAK,CACN,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,uCAAuC,EACvC;IACE,aAAa,EAAE;QACb,IAAI,EAAE,oBAAa,CAAC,IAAI;QACxB,OAAO,EAAE,QAAQ;KAClB;CACF,EACD,KAAK,CACN,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,sCAAsC,EACtC;IACE,aAAa,EAAE;QACb,IAAI,EAAE,oBAAa,CAAC,IAAI;QACxB,OAAO,EAAE,QAAQ;KAClB;CACF,EACD,IAAI,CACL,CAAC;AAEF,IAAA,aAAI,EACF,qCAAqC,EACrC,uCAAuC,EACvC;IACE,mBAAmB,EAAE,SAAS;CAC/B,EACD,KAAK,CACN,CAAC"}

lib/doc-url.js

@@ -13,5 +13,6 @@ var DocUrl;
     DocUrl["SPECIFY_BUILD_STEPS_MANUALLY"] = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#about-specifying-build-steps-manually";
     DocUrl["TRACK_CODE_SCANNING_ALERTS_ACROSS_RUNS"] = "https://docs.github.com/en/enterprise-cloud@latest/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#providing-data-to-track-code-scanning-alerts-across-runs";
     DocUrl["CODEQL_BUILD_MODES"] = "https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#codeql-build-modes";
+    DocUrl["SYSTEM_REQUIREMENTS"] = "https://codeql.github.com/docs/codeql-overview/system-requirements/";
 })(DocUrl || (exports.DocUrl = DocUrl = {}));
 //# sourceMappingURL=doc-url.js.map

lib/doc-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"doc-url.js","sourceRoot":"","sources":["../src/doc-url.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,IAAY,MAQX;AARD,WAAY,MAAM;IAChB,uHAA6G,CAAA;IAC7G,gJAAsI,CAAA;IACtI,yJAA+I,CAAA;IAC/I,qMAA2L,CAAA;IAC3L,gOAAsN,CAAA;IACtN,2PAAiP,CAAA;IACjP,mMAAyL,CAAA;AAC3L,CAAC,EARW,MAAM,sBAAN,MAAM,QAQjB"}
+{"version":3,"file":"doc-url.js","sourceRoot":"","sources":["../src/doc-url.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,IAAY,MASX;AATD,WAAY,MAAM;IAChB,uHAA6G,CAAA;IAC7G,gJAAsI,CAAA;IACtI,yJAA+I,CAAA;IAC/I,qMAA2L,CAAA;IAC3L,gOAAsN,CAAA;IACtN,2PAAiP,CAAA;IACjP,mMAAyL,CAAA;IACzL,qGAA2F,CAAA;AAC7F,CAAC,EATW,MAAM,sBAAN,MAAM,QASjB"}

lib/feature-flags.js

@@ -39,6 +39,7 @@ const path = __importStar(require("path"));
 const semver = __importStar(require("semver"));
 const api_client_1 = require("./api-client");
 const defaults = __importStar(require("./defaults.json"));
+const overlay_database_utils_1 = require("./overlay-database-utils");
 const tools_features_1 = require("./tools-features");
 const util = __importStar(require("./util"));
 const DEFAULT_VERSION_FEATURE_FLAG_PREFIX = "default_codeql_version_";
@@ -66,6 +67,27 @@ var Feature;
     Feature["DisableKotlinAnalysisEnabled"] = "disable_kotlin_analysis_enabled";
     Feature["ExportDiagnosticsEnabled"] = "export_diagnostics_enabled";
     Feature["ExtractToToolcache"] = "extract_to_toolcache";
+    Feature["OverlayAnalysis"] = "overlay_analysis";
+    Feature["OverlayAnalysisActions"] = "overlay_analysis_actions";
+    Feature["OverlayAnalysisCodeScanningActions"] = "overlay_analysis_code_scanning_actions";
+    Feature["OverlayAnalysisCodeScanningCpp"] = "overlay_analysis_code_scanning_cpp";
+    Feature["OverlayAnalysisCodeScanningCsharp"] = "overlay_analysis_code_scanning_csharp";
+    Feature["OverlayAnalysisCodeScanningGo"] = "overlay_analysis_code_scanning_go";
+    Feature["OverlayAnalysisCodeScanningJava"] = "overlay_analysis_code_scanning_java";
+    Feature["OverlayAnalysisCodeScanningJavascript"] = "overlay_analysis_code_scanning_javascript";
+    Feature["OverlayAnalysisCodeScanningPython"] = "overlay_analysis_code_scanning_python";
+    Feature["OverlayAnalysisCodeScanningRuby"] = "overlay_analysis_code_scanning_ruby";
+    Feature["OverlayAnalysisCodeScanningRust"] = "overlay_analysis_code_scanning_rust";
+    Feature["OverlayAnalysisCodeScanningSwift"] = "overlay_analysis_code_scanning_swift";
+    Feature["OverlayAnalysisCpp"] = "overlay_analysis_cpp";
+    Feature["OverlayAnalysisCsharp"] = "overlay_analysis_csharp";
+    Feature["OverlayAnalysisGo"] = "overlay_analysis_go";
+    Feature["OverlayAnalysisJava"] = "overlay_analysis_java";
+    Feature["OverlayAnalysisJavascript"] = "overlay_analysis_javascript";
+    Feature["OverlayAnalysisPython"] = "overlay_analysis_python";
+    Feature["OverlayAnalysisRuby"] = "overlay_analysis_ruby";
+    Feature["OverlayAnalysisRust"] = "overlay_analysis_rust";
+    Feature["OverlayAnalysisSwift"] = "overlay_analysis_swift";
     Feature["PythonDefaultIsToNotExtractStdlib"] = "python_default_is_to_not_extract_stdlib";
     Feature["QaTelemetryEnabled"] = "qa_telemetry_enabled";
     Feature["RustAnalysis"] = "rust_analysis";
@@ -94,7 +116,7 @@ exports.featureConfig = {
         minimumVersion: "2.15.0",
     },
     [Feature.DiffInformedQueries]: {
-        defaultValue: false,
+        defaultValue: true,
         envVar: "CODEQL_ACTION_DIFF_INFORMED_QUERIES",
         minimumVersion: "2.21.0",
     },
@@ -126,6 +148,111 @@ exports.featureConfig = {
         envVar: "CODEQL_ACTION_EXTRACT_TOOLCACHE",
         minimumVersion: undefined,
     },
+    [Feature.OverlayAnalysis]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
+        minimumVersion: overlay_database_utils_1.CODEQL_OVERLAY_MINIMUM_VERSION,
+    },
+    [Feature.OverlayAnalysisActions]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_ACTIONS",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningActions]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_ACTIONS",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningCpp]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CPP",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningCsharp]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_CSHARP",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningGo]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_GO",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningJava]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVA",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningJavascript]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningPython]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_PYTHON",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningRuby]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUBY",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningRust]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_RUST",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCodeScanningSwift]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_SWIFT",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCpp]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CPP",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisCsharp]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_CSHARP",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisGo]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_GO",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisJava]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVA",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisJavascript]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_JAVASCRIPT",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisPython]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_PYTHON",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisRuby]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUBY",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisRust]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RUST",
+        minimumVersion: undefined,
+    },
+    [Feature.OverlayAnalysisSwift]: {
+        defaultValue: false,
+        envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_SWIFT",
+        minimumVersion: undefined,
+    },
     [Feature.PythonDefaultIsToNotExtractStdlib]: {
         defaultValue: false,
         envVar: "CODEQL_ACTION_DISABLE_PYTHON_STANDARD_LIBRARY_EXTRACTION",
@@ -357,14 +484,22 @@ class GitHubFeatureFlags {
         try {
             const featuresToRequest = Object.entries(exports.featureConfig)
                 .filter(([, config]) => !config.legacyApi)
-                .map(([f]) => f)
-                .join(",");
-            const response = await (0, api_client_1.getApiClient)().request("GET /repos/:owner/:repo/code-scanning/codeql-action/features", {
-                owner: this.repositoryNwo.owner,
-                repo: this.repositoryNwo.repo,
-                features: featuresToRequest,
-            });
-            const remoteFlags = response.data;
+                .map(([f]) => f);
+            const FEATURES_PER_REQUEST = 25;
+            const featureChunks = [];
+            while (featuresToRequest.length > 0) {
+                featureChunks.push(featuresToRequest.splice(0, FEATURES_PER_REQUEST));
+            }
+            let remoteFlags = {};
+            for (const chunk of featureChunks) {
+                const response = await (0, api_client_1.getApiClient)().request("GET /repos/:owner/:repo/code-scanning/codeql-action/features", {
+                    owner: this.repositoryNwo.owner,
+                    repo: this.repositoryNwo.repo,
+                    features: chunk.join(","),
+                });
+                const chunkFlags = response.data;
+                remoteFlags = { ...remoteFlags, ...chunkFlags };
+            }
             this.logger.debug("Loaded the following default values for the feature flags from the Code Scanning API:");
             for (const [feature, value] of Object.entries(remoteFlags).sort(([nameA], [nameB]) => nameA.localeCompare(nameB))) {
                 this.logger.debug(`  ${feature}: ${value}`);

lib/feature-flags.test.js

@@ -36,7 +36,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.initializeFeatures = initializeFeatures;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
@@ -68,7 +67,7 @@ const testRepositoryNwo = (0, repository_1.parseRepositoryNwo)("github/example")
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const loggedMessages = [];
         const features = setUpFeatureFlagTests(tmpDir, (0, testing_utils_1.getRecordingLogger)(loggedMessages), { type: util_1.GitHubVariant.GHE_DOTCOM });
-        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, initializeFeatures(true));
+        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, (0, testing_utils_1.initializeFeatures)(true));
         for (const feature of Object.values(feature_flags_1.Feature)) {
             // Ensure we have gotten a response value back from the Mock API
             t.assert(await features.getValue(feature, includeCodeQlIfRequired(feature)));
@@ -103,6 +102,24 @@ const testRepositoryNwo = (0, repository_1.parseRepositoryNwo)("github/example")
         assertAllFeaturesUndefinedInApi(t, loggedMessages);
     });
 });
+(0, ava_1.default)("Include no more than 25 features in each API request", async (t) => {
+    await (0, util_1.withTmpDir)(async (tmpDir) => {
+        const features = setUpFeatureFlagTests(tmpDir);
+        (0, testing_utils_1.stubFeatureFlagApiEndpoint)((request) => {
+            const requestedFeatures = request.features.split(",");
+            return {
+                status: requestedFeatures.length <= 25 ? 200 : 400,
+                messageIfError: "Can request a maximum of 25 features.",
+                data: {},
+            };
+        });
+        // We only need to call getValue once, and it does not matter which feature
+        // we ask for. Under the hood, the features library will request all features
+        // from the API.
+        const feature = Object.values(feature_flags_1.Feature)[0];
+        await t.notThrowsAsync(async () => features.getValue(feature, includeCodeQlIfRequired(feature)));
+    });
+});
 (0, ava_1.default)("Feature flags exception is propagated if the API request errors", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const features = setUpFeatureFlagTests(tmpDir);
@@ -135,7 +152,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
     (0, ava_1.default)(`Only feature '${feature}' is enabled if the associated environment variable is true. Others disabled.`, async (t) => {
         await (0, util_1.withTmpDir)(async (tmpDir) => {
             const features = setUpFeatureFlagTests(tmpDir);
-            const expectedFeatureEnablement = initializeFeatures(false);
+            const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(false);
             (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
             // feature should be disabled initially
             t.assert(!(await features.getValue(feature, includeCodeQlIfRequired(feature))));
@@ -147,7 +164,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
     (0, ava_1.default)(`Feature '${feature}' is disabled if the associated environment variable is false, even if enabled in API`, async (t) => {
         await (0, util_1.withTmpDir)(async (tmpDir) => {
             const features = setUpFeatureFlagTests(tmpDir);
-            const expectedFeatureEnablement = initializeFeatures(true);
+            const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
             (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
             // feature should be enabled initially
             t.assert(await features.getValue(feature, includeCodeQlIfRequired(feature)));
@@ -161,7 +178,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
         (0, ava_1.default)(`Getting feature '${feature} should throw if no codeql is provided`, async (t) => {
             await (0, util_1.withTmpDir)(async (tmpDir) => {
                 const features = setUpFeatureFlagTests(tmpDir);
-                const expectedFeatureEnablement = initializeFeatures(true);
+                const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
                 (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
                 await t.throwsAsync(async () => features.getValue(feature), {
                     message: `Internal error: A ${feature_flags_1.featureConfig[feature].minimumVersion !== undefined
@@ -175,7 +192,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
         (0, ava_1.default)(`Feature '${feature}' is disabled if the minimum CLI version is below ${feature_flags_1.featureConfig[feature].minimumVersion}`, async (t) => {
             await (0, util_1.withTmpDir)(async (tmpDir) => {
                 const features = setUpFeatureFlagTests(tmpDir);
-                const expectedFeatureEnablement = initializeFeatures(true);
+                const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
                 (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
                 // feature should be disabled when an old CLI version is set
                 let codeql = (0, testing_utils_1.mockCodeQLVersion)("2.0.0");
@@ -199,7 +216,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
         (0, ava_1.default)(`Feature '${feature}' is disabled if the required tools feature is not enabled`, async (t) => {
             await (0, util_1.withTmpDir)(async (tmpDir) => {
                 const features = setUpFeatureFlagTests(tmpDir);
-                const expectedFeatureEnablement = initializeFeatures(true);
+                const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
                 (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
                 // feature should be disabled when the required tools feature is not enabled
                 let codeql = (0, testing_utils_1.mockCodeQLVersion)("2.0.0");
@@ -225,7 +242,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
 (0, ava_1.default)("Feature flags are saved to disk", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const features = setUpFeatureFlagTests(tmpDir);
-        const expectedFeatureEnablement = initializeFeatures(true);
+        const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
         (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
         const cachedFeatureFlags = path.join(tmpDir, feature_flags_1.FEATURE_FLAGS_FILE_NAME);
         t.false(fs.existsSync(cachedFeatureFlags), "Feature flag cached file should not exist before getting feature flags");
@@ -244,7 +261,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
 (0, ava_1.default)("Environment variable can override feature flag cache", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const features = setUpFeatureFlagTests(tmpDir);
-        const expectedFeatureEnablement = initializeFeatures(true);
+        const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
         (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
         const cachedFeatureFlags = path.join(tmpDir, feature_flags_1.FEATURE_FLAGS_FILE_NAME);
         t.true(await features.getValue(feature_flags_1.Feature.QaTelemetryEnabled, includeCodeQlIfRequired(feature_flags_1.Feature.QaTelemetryEnabled)), "Feature flag should be enabled initially");
@@ -266,7 +283,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
 (0, ava_1.default)("selects CLI v2.20.1 on Dotcom when feature flags enable v2.20.0 and v2.20.1", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const features = setUpFeatureFlagTests(tmpDir);
-        const expectedFeatureEnablement = initializeFeatures(true);
+        const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
         expectedFeatureEnablement["default_codeql_version_2_20_0_enabled"] = true;
         expectedFeatureEnablement["default_codeql_version_2_20_1_enabled"] = true;
         expectedFeatureEnablement["default_codeql_version_2_20_2_enabled"] = false;
@@ -285,7 +302,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
 (0, ava_1.default)("includes tag name", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const features = setUpFeatureFlagTests(tmpDir);
-        const expectedFeatureEnablement = initializeFeatures(true);
+        const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
         expectedFeatureEnablement["default_codeql_version_2_20_0_enabled"] = true;
         (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
         const defaultCliVersion = await features.getDefaultCliVersion(util_1.GitHubVariant.DOTCOM);
@@ -299,7 +316,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
 (0, ava_1.default)(`selects CLI from defaults.json on Dotcom when no default version feature flags are enabled`, async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const features = setUpFeatureFlagTests(tmpDir);
-        const expectedFeatureEnablement = initializeFeatures(true);
+        const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
         (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
         const defaultCliVersion = await features.getDefaultCliVersion(util_1.GitHubVariant.DOTCOM);
         t.deepEqual(defaultCliVersion, {
@@ -313,7 +330,7 @@ for (const feature of Object.keys(feature_flags_1.featureConfig)) {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const loggedMessages = [];
         const features = setUpFeatureFlagTests(tmpDir, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
-        const expectedFeatureEnablement = initializeFeatures(true);
+        const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
         expectedFeatureEnablement["default_codeql_version_2_20_0_enabled"] = true;
         expectedFeatureEnablement["default_codeql_version_2_20_1_enabled"] = true;
         expectedFeatureEnablement["default_codeql_version_2_20_invalid_enabled"] =
@@ -358,12 +375,6 @@ function assertAllFeaturesUndefinedInApi(t, loggedMessages) {
             v.message.includes("undefined in API response")) !== undefined);
     }
 }
-function initializeFeatures(initialValue) {
-    return Object.keys(feature_flags_1.featureConfig).reduce((features, key) => {
-        features[key] = initialValue;
-        return features;
-    }, {});
-}
 function setUpFeatureFlagTests(tmpDir, logger = (0, logging_1.getRunnerLogger)(true), gitHubVersion = { type: util_1.GitHubVariant.DOTCOM }) {
     (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
     return new feature_flags_1.Features(gitHubVersion, testRepositoryNwo, tmpDir, logger);

lib/init-action-post-helper.js

@@ -87,7 +87,7 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
         await codeql.databaseExportDiagnostics(databasePath, sarifFile, category);
     }
     logger.info(`Uploading failed SARIF file ${sarifFile}`);
-    const uploadResult = await uploadLib.uploadFiles(sarifFile, checkoutPath, category, features, logger);
+    const uploadResult = await uploadLib.uploadFiles(sarifFile, checkoutPath, category, features, logger, uploadLib.CodeScanningTarget);
     await uploadLib.waitForProcessing(repositoryNwo, uploadResult.sarifID, logger, { isUnsuccessfulExecution: true });
     return uploadResult
         ? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID }

lib/init-action.js

@@ -57,7 +57,7 @@ const status_report_1 = require("./status-report");
 const tools_features_1 = require("./tools-features");
 const util_1 = require("./util");
 const workflow_1 = require("./workflow");
-async function sendCompletedStatusReport(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error) {
+async function sendCompletedStatusReport(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, logger, error) {
     const statusReportBase = await (0, status_report_1.createStatusReportBase)(status_report_1.ActionName.Init, (0, status_report_1.getActionsStatus)(error), startedAt, config, await (0, util_1.checkDiskUsage)(logger), logger, error?.message, error?.stack);
     if (statusReportBase === undefined) {
         return;
@@ -126,6 +126,8 @@ async function sendCompletedStatusReport(startedAt, config, configFile, toolsDow
             trap_cache_languages: Object.keys(config.trapCaches).join(","),
             trap_cache_download_size_bytes: Math.round(await (0, caching_utils_1.getTotalCacheSize)(Object.values(config.trapCaches), logger)),
             trap_cache_download_duration_ms: Math.round(config.trapCacheDownloadTime),
+            overlay_base_database_download_size_bytes: overlayBaseDatabaseStats?.databaseSizeBytes,
+            overlay_base_database_download_duration_ms: overlayBaseDatabaseStats?.databaseDownloadDurationMs,
             query_filters: JSON.stringify(config.originalUserInput["query-filters"] ?? []),
             registries: JSON.stringify(configUtils.parseRegistriesWithoutCredentials((0, actions_util_1.getOptionalInput)("registries")) ?? []),
         };
@@ -167,6 +169,10 @@ async function run() {
     core.exportVariable(environment_1.EnvVar.JOB_RUN_UUID, jobRunUuid);
     core.exportVariable(environment_1.EnvVar.INIT_ACTION_HAS_RUN, "true");
     const configFile = (0, actions_util_1.getOptionalInput)("config-file");
+    // path.resolve() respects the intended semantics of source-root. If
+    // source-root is relative, it is relative to the GITHUB_WORKSPACE. If
+    // source-root is absolute, it is used as given.
+    const sourceRoot = path.resolve((0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), (0, actions_util_1.getOptionalInput)("source-root") || "");
     try {
         const statusReportBase = await (0, status_report_1.createStatusReportBase)(status_report_1.ActionName.Init, "starting", startedAt, config, await (0, util_1.checkDiskUsage)(logger), logger);
         if (statusReportBase !== undefined) {
@@ -189,9 +195,37 @@ async function run() {
             logger.warning(`Unable to validate code scanning workflow: ${validateWorkflowResult}`);
         }
         core.endGroup();
+        // Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for Rust. We need to set this environment
+        // variable before initializing the config, otherwise Rust analysis will not be
+        // enabled.
+        if (
+        // Only enable Rust analysis if the user has explicitly requested it - don't
+        // enable it via language autodetection.
+        configUtils
+            .getRawLanguagesNoAutodetect((0, actions_util_1.getOptionalInput)("languages"))
+            .includes(languages_1.KnownLanguage.rust)) {
+            const feat = feature_flags_1.Feature.RustAnalysis;
+            const minVer = feature_flags_1.featureConfig[feat].minimumVersion;
+            const envVar = "CODEQL_ENABLE_EXPERIMENTAL_FEATURES";
+            // if in default setup, it means the feature flag was on when rust was enabled
+            // if the feature flag gets turned off, let's not have rust analysis throwing a configuration error
+            // in that case rust analysis will be disabled only when default setup is refreshed
+            if ((0, actions_util_1.isDefaultSetup)() || (await features.getValue(feat, codeql))) {
+                core.exportVariable(envVar, "true");
+            }
+            if (process.env[envVar] !== "true") {
+                throw new util_1.ConfigurationError(`Experimental and not officially supported Rust analysis requires setting ${envVar}=true in the environment`);
+            }
+            const actualVer = (await codeql.getVersion()).version;
+            if (semver.lt(actualVer, minVer)) {
+                throw new util_1.ConfigurationError(`Experimental rust analysis is supported by CodeQL CLI version ${minVer} or higher, but found version ${actualVer}`);
+            }
+            logger.info("Experimental rust analysis enabled");
+        }
         config = await (0, init_1.initConfig)({
             languagesInput: (0, actions_util_1.getOptionalInput)("languages"),
             queriesInput: (0, actions_util_1.getOptionalInput)("queries"),
+            qualityQueriesInput: (0, actions_util_1.getOptionalInput)("quality-queries"),
             packsInput: (0, actions_util_1.getOptionalInput)("packs"),
             buildModeInput: (0, actions_util_1.getOptionalInput)("build-mode"),
             configFile,
@@ -210,6 +244,7 @@ async function run() {
             tempDir: (0, actions_util_1.getTemporaryDirectory)(),
             codeql,
             workspacePath: (0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"),
+            sourceRoot,
             githubVersion: gitHubVersion,
             apiDetails,
             features,
@@ -226,11 +261,32 @@ async function run() {
         }
         return;
     }
+    let overlayBaseDatabaseStats;
     try {
-        const sourceRoot = path.resolve((0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), (0, actions_util_1.getOptionalInput)("source-root") || "");
-        const overlayDatabaseMode = await (0, init_1.getOverlayDatabaseMode)((await codeql.getVersion()).version, config, sourceRoot, logger);
-        logger.info(`Using overlay database mode: ${overlayDatabaseMode}`);
-        if (overlayDatabaseMode !== overlay_database_utils_1.OverlayDatabaseMode.Overlay) {
+        if (config.augmentationProperties.overlayDatabaseMode ===
+            overlay_database_utils_1.OverlayDatabaseMode.Overlay &&
+            config.augmentationProperties.useOverlayDatabaseCaching) {
+            // OverlayDatabaseMode.Overlay comes in two flavors: with database
+            // caching, or without. The flavor with database caching is intended to be
+            // an "automatic control" mode, which is supposed to be fail-safe. If we
+            // cannot download an overlay-base database, we revert to
+            // OverlayDatabaseMode.None so that the workflow can continue to run.
+            //
+            // The flavor without database caching is intended to be a "manual
+            // control" mode, where the workflow is supposed to make all the
+            // necessary preparations. So, in that mode, we would assume that
+            // everything is in order and let the analysis fail if that turns out not
+            // to be the case.
+            overlayBaseDatabaseStats = await (0, overlay_database_utils_1.downloadOverlayBaseDatabaseFromCache)(codeql, config, logger);
+            if (!overlayBaseDatabaseStats) {
+                config.augmentationProperties.overlayDatabaseMode =
+                    overlay_database_utils_1.OverlayDatabaseMode.None;
+                logger.info("No overlay-base database found in cache, " +
+                    `reverting overlay database mode to ${overlay_database_utils_1.OverlayDatabaseMode.None}.`);
+            }
+        }
+        if (config.augmentationProperties.overlayDatabaseMode !==
+            overlay_database_utils_1.OverlayDatabaseMode.Overlay) {
             (0, init_1.cleanupDatabaseClusterDirectory)(config, logger);
         }
         if (zstdAvailability) {
@@ -256,11 +312,11 @@ async function run() {
             core.exportVariable("GOFLAGS", goFlags);
             core.warning("Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.");
         }
-        if (config.languages.includes(languages_1.Language.swift) &&
+        if (config.languages.includes(languages_1.KnownLanguage.swift) &&
             process.platform === "linux") {
             logger.warning(`Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you.`);
         }
-        if (config.languages.includes(languages_1.Language.go) &&
+        if (config.languages.includes(languages_1.KnownLanguage.go) &&
             process.platform === "linux") {
             try {
                 const goBinaryPath = await io.which("go", true);
@@ -298,7 +354,7 @@ async function run() {
             catch (e) {
                 logger.warning(`Failed to determine the location of the Go binary: ${e}`);
                 if (e instanceof actions_util_1.FileCmdNotFoundError) {
-                    (0, diagnostics_1.addDiagnostic)(config, languages_1.Language.go, (0, diagnostics_1.makeDiagnostic)("go/workflow/file-program-unavailable", "The `file` program is required on Linux, but does not appear to be installed", {
+                    (0, diagnostics_1.addDiagnostic)(config, languages_1.KnownLanguage.go, (0, diagnostics_1.makeDiagnostic)("go/workflow/file-program-unavailable", "The `file` program is required on Linux, but does not appear to be installed", {
                         markdownMessage: "CodeQL was unable to find the `file` program on this system. Ensure that the `file` program is installed on Linux runners and accessible.",
                         visibility: {
                             statusPage: true,
@@ -328,7 +384,7 @@ async function run() {
             !(await (0, util_1.codeQlVersionAtLeast)(codeql, "2.20.4"))) {
             core.exportVariable(kotlinLimitVar, "2.1.20");
         }
-        if (config.languages.includes(languages_1.Language.cpp)) {
+        if (config.languages.includes(languages_1.KnownLanguage.cpp)) {
             const envVar = "CODEQL_EXTRACTOR_CPP_TRAP_CACHING";
             if (process.env[envVar]) {
                 logger.info(`Environment variable ${envVar} already set. Not en/disabling CodeQL C++ TRAP caching support`);
@@ -344,15 +400,16 @@ async function run() {
             }
         }
         // Set CODEQL_EXTRACTOR_CPP_BUILD_MODE_NONE
-        if (config.languages.includes(languages_1.Language.cpp)) {
+        if (config.languages.includes(languages_1.KnownLanguage.cpp)) {
             const bmnVar = "CODEQL_EXTRACTOR_CPP_BUILD_MODE_NONE";
             const value = process.env[bmnVar] ||
                 (await features.getValue(feature_flags_1.Feature.CppBuildModeNone, codeql));
             logger.info(`Setting C++ build-mode: none to ${value}`);
             core.exportVariable(bmnVar, value);
         }
-        // Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for rust
-        if (config.languages.includes(languages_1.Language.rust)) {
+        // For rust: set CODEQL_ENABLE_EXPERIMENTAL_FEATURES, unless codeql already supports rust without it
+        if (config.languages.includes(languages_1.KnownLanguage.rust) &&
+            !(await codeql.resolveLanguages()).rust) {
             const feat = feature_flags_1.Feature.RustAnalysis;
             const minVer = feature_flags_1.featureConfig[feat].minimumVersion;
             const envVar = "CODEQL_ENABLE_EXPERIMENTAL_FEATURES";
@@ -400,7 +457,7 @@ async function run() {
                 core.exportVariable("CODEQL_EXTRACTOR_PYTHON_EXTRACT_STDLIB", "true");
             }
         }
-        const tracerConfig = await (0, init_1.runInit)(codeql, config, sourceRoot, "Runner.Worker.exe", (0, actions_util_1.getOptionalInput)("registries"), apiDetails, overlayDatabaseMode, logger);
+        const tracerConfig = await (0, init_1.runInit)(codeql, config, sourceRoot, "Runner.Worker.exe", (0, actions_util_1.getOptionalInput)("registries"), apiDetails, logger);
         if (tracerConfig !== undefined) {
             for (const [key, value] of Object.entries(tracerConfig.env)) {
                 core.exportVariable(key, value);
@@ -416,13 +473,13 @@ async function run() {
         const error = (0, util_1.wrapError)(unwrappedError);
         core.setFailed(error.message);
         await sendCompletedStatusReport(startedAt, config, undefined, // We only report config info on success.
-        toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error);
+        toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, logger, error);
         return;
     }
     finally {
         (0, diagnostics_1.logUnwrittenDiagnostics)();
     }
-    await sendCompletedStatusReport(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger);
+    await sendCompletedStatusReport(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, logger);
 }
 function getTrapCachingEnabled() {
     // If the workflow specified something always respect that

lib/init.js

@@ -35,7 +35,6 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.initCodeQL = initCodeQL;
 exports.initConfig = initConfig;
-exports.getOverlayDatabaseMode = getOverlayDatabaseMode;
 exports.runInit = runInit;
 exports.checkInstallPython311 = checkInstallPython311;
 exports.cleanupDatabaseClusterDirectory = cleanupDatabaseClusterDirectory;
@@ -43,14 +42,11 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const io = __importStar(require("@actions/io"));
-const semver = __importStar(require("semver"));
 const actions_util_1 = require("./actions-util");
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
-const git_utils_1 = require("./git-utils");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
-const overlay_database_utils_1 = require("./overlay-database-utils");
 const tracer_config_1 = require("./tracer-config");
 const util = __importStar(require("./util"));
 async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, features, logger) {
@@ -71,33 +67,7 @@ async function initConfig(inputs) {
         return await configUtils.initConfig(inputs);
     });
 }
-async function getOverlayDatabaseMode(codeqlVersion, config, sourceRoot, logger) {
-    const overlayDatabaseMode = process.env.CODEQL_OVERLAY_DATABASE_MODE;
-    if (overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.Overlay ||
-        overlayDatabaseMode === overlay_database_utils_1.OverlayDatabaseMode.OverlayBase) {
-        if (config.buildMode !== util.BuildMode.None) {
-            logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
-                `build-mode is set to "${config.buildMode}" instead of "none". ` +
-                "Falling back to creating a normal full database instead.");
-            return overlay_database_utils_1.OverlayDatabaseMode.None;
-        }
-        if (semver.lt(codeqlVersion, overlay_database_utils_1.CODEQL_OVERLAY_MINIMUM_VERSION)) {
-            logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
-                `the CodeQL CLI is older than ${overlay_database_utils_1.CODEQL_OVERLAY_MINIMUM_VERSION}. ` +
-                "Falling back to creating a normal full database instead.");
-            return overlay_database_utils_1.OverlayDatabaseMode.None;
-        }
-        if ((await (0, git_utils_1.getGitRoot)(sourceRoot)) === undefined) {
-            logger.warning(`Cannot build an ${overlayDatabaseMode} database because ` +
-                `the source root "${sourceRoot}" is not inside a git repository. ` +
-                "Falling back to creating a normal full database instead.");
-            return overlay_database_utils_1.OverlayDatabaseMode.None;
-        }
-        return overlayDatabaseMode;
-    }
-    return overlay_database_utils_1.OverlayDatabaseMode.None;
-}
-async function runInit(codeql, config, sourceRoot, processName, registriesInput, apiDetails, overlayDatabaseMode, logger) {
+async function runInit(codeql, config, sourceRoot, processName, registriesInput, apiDetails, logger) {
     fs.mkdirSync(config.dbLocation, { recursive: true });
     const { registriesAuthTokens, qlconfigFile } = await configUtils.generateRegistries(registriesInput, config.tempDir, logger);
     await configUtils.wrapEnvironment({
@@ -105,7 +75,7 @@ async function runInit(codeql, config, sourceRoot, processName, registriesInput,
         CODEQL_REGISTRIES_AUTH: registriesAuthTokens,
     }, 
     // Init a database cluster
-    async () => await codeql.databaseInitCluster(config, sourceRoot, processName, qlconfigFile, overlayDatabaseMode, logger));
+    async () => await codeql.databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger));
     return await (0, tracer_config_1.getCombinedTracerConfig)(codeql, config);
 }
 /**
@@ -113,7 +83,7 @@ async function runInit(codeql, config, sourceRoot, processName, registriesInput,
  * This check happens in a powershell script.
  */
 async function checkInstallPython311(languages, codeql) {
-    if (languages.includes(languages_1.Language.python) &&
+    if (languages.includes(languages_1.KnownLanguage.python) &&
         process.platform === "win32" &&
         !(await codeql.getVersion()).features?.supportsPython312) {
         const script = path.resolve(__dirname, "../python-setup", "check_python12.ps1");
@@ -128,7 +98,7 @@ function cleanupDatabaseClusterDirectory(config, logger,
 rmSync = fs.rmSync) {
     if (fs.existsSync(config.dbLocation) &&
         (fs.statSync(config.dbLocation).isFile() ||
-            fs.readdirSync(config.dbLocation).length)) {
+            fs.readdirSync(config.dbLocation).length > 0)) {
         logger.warning(`The database cluster directory ${config.dbLocation} must be empty. Attempting to clean it up.`);
         try {
             rmSync(config.dbLocation, {

lib/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,gCAyCC;AAED,gCAMC;AAED,wDAuCC;AAED,0BAoCC;AAMD,sDAkBC;AAED,0EAkDC;AArOD,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,gDAAkC;AAClC,+CAAiC;AAEjC,iDAAsE;AAEtE,qCAA+C;AAC/C,4DAA8C;AAE9C,2CAAyC;AACzC,2CAAuC;AACvC,uCAAmD;AACnD,qEAGkC;AAIlC,mDAAwE;AACxE,6CAA+B;AAExB,KAAK,UAAU,UAAU,CAC9B,UAA8B,EAC9B,UAA4B,EAC5B,OAAe,EACf,OAA2B,EAC3B,iBAA2C,EAC3C,QAA2B,EAC3B,MAAc;IAQd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EACJ,MAAM,EACN,yBAAyB,EACzB,WAAW,EACX,YAAY,EACZ,gBAAgB,GACjB,GAAG,MAAM,IAAA,oBAAW,EACnB,UAAU,EACV,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,EACjB,MAAM,EACN,QAAQ,EACR,IAAI,CACL,CAAC;IACF,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO;QACL,MAAM;QACN,yBAAyB;QACzB,WAAW;QACX,YAAY;QACZ,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAoC;IAEpC,OAAO,MAAM,IAAA,wBAAc,EAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QACpE,OAAO,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,MAA0B,EAC1B,UAAkB,EAClB,MAAc;IAEd,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAErE,IACE,mBAAmB,KAAK,4CAAmB,CAAC,OAAO;QACnD,mBAAmB,KAAK,4CAAmB,CAAC,WAAW,EACvD,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,CAAC,OAAO,CACZ,mBAAmB,mBAAmB,oBAAoB;gBACxD,yBAAyB,MAAM,CAAC,SAAS,uBAAuB;gBAChE,0DAA0D,CAC7D,CAAC;YACF,OAAO,4CAAmB,CAAC,IAAI,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,EAAE,CAAC,aAAa,EAAE,uDAA8B,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,OAAO,CACZ,mBAAmB,mBAAmB,oBAAoB;gBACxD,gCAAgC,uDAA8B,IAAI;gBAClE,0DAA0D,CAC7D,CAAC;YACF,OAAO,4CAAmB,CAAC,IAAI,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,MAAM,IAAA,sBAAU,EAAC,UAAU,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACjD,MAAM,CAAC,OAAO,CACZ,mBAAmB,mBAAmB,oBAAoB;gBACxD,oBAAoB,UAAU,oCAAoC;gBAClE,0DAA0D,CAC7D,CAAC;YACF,OAAO,4CAAmB,CAAC,IAAI,CAAC;QAClC,CAAC;QACD,OAAO,mBAA0C,CAAC;IACpD,CAAC;IACD,OAAO,4CAAmB,CAAC,IAAI,CAAC;AAClC,CAAC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B,EAC1B,UAAkB,EAClB,WAA+B,EAC/B,eAAmC,EACnC,UAAoC,EACpC,mBAAwC,EACxC,MAAc;IAEd,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErD,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAC1C,MAAM,WAAW,CAAC,kBAAkB,CAClC,eAAe,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;IACJ,MAAM,WAAW,CAAC,eAAe,CAC/B;QACE,YAAY,EAAE,UAAU,CAAC,IAAI;QAC7B,sBAAsB,EAAE,oBAAoB;KAC7C;IAED,0BAA0B;IAC1B,KAAK,IAAI,EAAE,CACT,MAAM,MAAM,CAAC,mBAAmB,CAC9B,MAAM,EACN,UAAU,EACV,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,MAAM,CACP,CACJ,CAAC;IACF,OAAO,MAAM,IAAA,uCAAuB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CACzC,SAAqB,EACrB,MAAc;IAEd,IACE,SAAS,CAAC,QAAQ,CAAC,oBAAQ,CAAC,MAAM,CAAC;QACnC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,iBAAiB,EACxD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CACzB,SAAS,EACT,iBAAiB,EACjB,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE;YAClE,MAAM;SACP,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,+BAA+B,CAC7C,MAA0B,EAC1B,MAAc;AACd,+FAA+F;AAC/F,eAAe;AACf,MAAM,GAAG,EAAE,CAAC,MAAM;IAElB,IACE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QAChC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE;YACtC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAC3C,CAAC;QACD,MAAM,CAAC,OAAO,CACZ,kCAAkC,MAAM,CAAC,UAAU,4CAA4C,CAChG,CAAC;QACF,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;gBACxB,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;gBACb,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,UAAU,GAAG,CAC9D,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,mEACZ,IAAA,+BAAgB,EAAC,aAAa,CAAC;gBAC7B,CAAC,CAAC,sCAAsC,MAAM,CAAC,UAAU,IAAI;gBAC7D,CAAC,CAAC,kCAAkC,MAAM,CAAC,UAAU,IAAI;oBACvD,yEACN,iEAAiE,CAAC;YAElE,kGAAkG;YAClG,IAAI,IAAA,iCAAkB,GAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAC/B,GAAG,KAAK,4GAA4G;oBAClH,sEAAsE,IAAI,CAAC,eAAe,CACxF,CAAC,CACF,EAAE,CACN,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,sDAAsD;oBAC5D,+EAA+E;oBAC/E,yCAAyC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,gCAyCC;AAED,gCAMC;AAED,0BAkCC;AAMD,sDAkBC;AAED,0EAkDC;AApLD,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,gDAAkC;AAElC,iDAAsE;AAEtE,qCAA+C;AAC/C,4DAA8C;AAE9C,2CAAsD;AACtD,uCAAmD;AAInD,mDAAwE;AACxE,6CAA+B;AAExB,KAAK,UAAU,UAAU,CAC9B,UAA8B,EAC9B,UAA4B,EAC5B,OAAe,EACf,OAA2B,EAC3B,iBAA2C,EAC3C,QAA2B,EAC3B,MAAc;IAQd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EACJ,MAAM,EACN,yBAAyB,EACzB,WAAW,EACX,YAAY,EACZ,gBAAgB,GACjB,GAAG,MAAM,IAAA,oBAAW,EACnB,UAAU,EACV,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,EACjB,MAAM,EACN,QAAQ,EACR,IAAI,CACL,CAAC;IACF,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO;QACL,MAAM;QACN,yBAAyB;QACzB,WAAW;QACX,YAAY;QACZ,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAoC;IAEpC,OAAO,MAAM,IAAA,wBAAc,EAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QACpE,OAAO,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B,EAC1B,UAAkB,EAClB,WAA+B,EAC/B,eAAmC,EACnC,UAAoC,EACpC,MAAc;IAEd,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErD,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAC1C,MAAM,WAAW,CAAC,kBAAkB,CAClC,eAAe,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;IACJ,MAAM,WAAW,CAAC,eAAe,CAC/B;QACE,YAAY,EAAE,UAAU,CAAC,IAAI;QAC7B,sBAAsB,EAAE,oBAAoB;KAC7C;IAED,0BAA0B;IAC1B,KAAK,IAAI,EAAE,CACT,MAAM,MAAM,CAAC,mBAAmB,CAC9B,MAAM,EACN,UAAU,EACV,WAAW,EACX,YAAY,EACZ,MAAM,CACP,CACJ,CAAC;IACF,OAAO,MAAM,IAAA,uCAAuB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CACzC,SAAqB,EACrB,MAAc;IAEd,IACE,SAAS,CAAC,QAAQ,CAAC,yBAAa,CAAC,MAAM,CAAC;QACxC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,iBAAiB,EACxD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CACzB,SAAS,EACT,iBAAiB,EACjB,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE;YAClE,MAAM;SACP,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,+BAA+B,CAC7C,MAA0B,EAC1B,MAAc;AACd,+FAA+F;AAC/F,eAAe;AACf,MAAM,GAAG,EAAE,CAAC,MAAM;IAElB,IACE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QAChC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE;YACtC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAC/C,CAAC;QACD,MAAM,CAAC,OAAO,CACZ,kCAAkC,MAAM,CAAC,UAAU,4CAA4C,CAChG,CAAC;QACF,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE;gBACxB,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,CAAC;gBACb,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,UAAU,GAAG,CAC9D,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,mEACZ,IAAA,+BAAgB,EAAC,aAAa,CAAC;gBAC7B,CAAC,CAAC,sCAAsC,MAAM,CAAC,UAAU,IAAI;gBAC7D,CAAC,CAAC,kCAAkC,MAAM,CAAC,UAAU,IAAI;oBACvD,yEACN,iEAAiE,CAAC;YAElE,kGAAkG;YAClG,IAAI,IAAA,iCAAkB,GAAE,EAAE,CAAC;gBACzB,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAC/B,GAAG,KAAK,4GAA4G;oBAClH,sEAAsE,IAAI,CAAC,eAAe,CACxF,CAAC,CACF,EAAE,CACN,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,sDAAsD;oBAC5D,+EAA+E;oBAC/E,yCAAyC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

lib/languages.js

@@ -1,66 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LANGUAGE_ALIASES = exports.Language = void 0;
-exports.parseLanguage = parseLanguage;
-exports.isTracedLanguage = isTracedLanguage;
-exports.isScannedLanguage = isScannedLanguage;
-// All the languages supported by CodeQL
-var Language;
-(function (Language) {
-    Language["actions"] = "actions";
-    Language["csharp"] = "csharp";
-    Language["cpp"] = "cpp";
-    Language["go"] = "go";
-    Language["java"] = "java";
-    Language["javascript"] = "javascript";
-    Language["python"] = "python";
-    Language["ruby"] = "ruby";
-    Language["rust"] = "rust";
-    Language["swift"] = "swift";
-})(Language || (exports.Language = Language = {}));
-// Additional names for languages
-exports.LANGUAGE_ALIASES = {
-    c: Language.cpp,
-    "c++": Language.cpp,
-    "c#": Language.csharp,
-    kotlin: Language.java,
-    typescript: Language.javascript,
-    "javascript-typescript": Language.javascript,
-    "java-kotlin": Language.java,
-};
+exports.KnownLanguage = void 0;
 /**
- * Translate from user input or GitHub's API names for languages to CodeQL's
- * names for languages.
+ * A language supported by CodeQL that is treated specially by the Action.
  *
- * @param language The language to translate.
- * @returns A language supported by CodeQL, an alias for a language, or
- * `undefined` if the input language cannot be parsed into a language supported
- * by CodeQL.
+ * This is not an exhaustive list of languages supported by CodeQL and new
+ * languages do not need to be added here.
  */
-function parseLanguage(language) {
-    // Normalise to lower case
-    language = language.trim().toLowerCase();
-    // See if it's an exact match
-    if (language in Language) {
-        return language;
-    }
-    // Check language aliases, but return the original language name,
-    // the alias will be resolved later.
-    if (language in exports.LANGUAGE_ALIASES) {
-        return exports.LANGUAGE_ALIASES[language];
-    }
-    return undefined;
-}
-function isTracedLanguage(language) {
-    return [
-        Language.cpp,
-        Language.csharp,
-        Language.go,
-        Language.java,
-        Language.swift,
-    ].includes(language);
-}
-function isScannedLanguage(language) {
-    return !isTracedLanguage(language);
-}
+var KnownLanguage;
+(function (KnownLanguage) {
+    KnownLanguage["csharp"] = "csharp";
+    KnownLanguage["cpp"] = "cpp";
+    KnownLanguage["go"] = "go";
+    KnownLanguage["java"] = "java";
+    KnownLanguage["javascript"] = "javascript";
+    KnownLanguage["python"] = "python";
+    KnownLanguage["ruby"] = "ruby";
+    KnownLanguage["rust"] = "rust";
+    KnownLanguage["swift"] = "swift";
+})(KnownLanguage || (exports.KnownLanguage = KnownLanguage = {}));
 //# sourceMappingURL=languages.js.map

lib/languages.js.map

@@ -1 +1 @@
-{"version":3,"file":"languages.js","sourceRoot":"","sources":["../src/languages.ts"],"names":[],"mappings":";;;AAkCA,sCAgBC;AAED,4CAQC;AAED,8CAEC;AAhED,wCAAwC;AACxC,IAAY,QAWX;AAXD,WAAY,QAAQ;IAClB,+BAAmB,CAAA;IACnB,6BAAiB,CAAA;IACjB,uBAAW,CAAA;IACX,qBAAS,CAAA;IACT,yBAAa,CAAA;IACb,qCAAyB,CAAA;IACzB,6BAAiB,CAAA;IACjB,yBAAa,CAAA;IACb,yBAAa,CAAA;IACb,2BAAe,CAAA;AACjB,CAAC,EAXW,QAAQ,wBAAR,QAAQ,QAWnB;AAED,iCAAiC;AACpB,QAAA,gBAAgB,GAAiC;IAC5D,CAAC,EAAE,QAAQ,CAAC,GAAG;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG;IACnB,IAAI,EAAE,QAAQ,CAAC,MAAM;IACrB,MAAM,EAAE,QAAQ,CAAC,IAAI;IACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;IAC/B,uBAAuB,EAAE,QAAQ,CAAC,UAAU;IAC5C,aAAa,EAAE,QAAQ,CAAC,IAAI;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAgB,aAAa,CAAC,QAAgB;IAC5C,0BAA0B;IAC1B,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzC,6BAA6B;IAC7B,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,QAAoB,CAAC;IAC9B,CAAC;IAED,iEAAiE;IACjE,oCAAoC;IACpC,IAAI,QAAQ,IAAI,wBAAgB,EAAE,CAAC;QACjC,OAAO,wBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,gBAAgB,CAAC,QAAkB;IACjD,OAAO;QACL,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,EAAE;QACX,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,KAAK;KACf,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAkB;IAClD,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"languages.js","sourceRoot":"","sources":["../src/languages.ts"],"names":[],"mappings":";;;AAGA;;;;;GAKG;AACH,IAAY,aAUX;AAVD,WAAY,aAAa;IACvB,kCAAiB,CAAA;IACjB,4BAAW,CAAA;IACX,0BAAS,CAAA;IACT,8BAAa,CAAA;IACb,0CAAyB,CAAA;IACzB,kCAAiB,CAAA;IACjB,8BAAa,CAAA;IACb,8BAAa,CAAA;IACb,gCAAe,CAAA;AACjB,CAAC,EAVW,aAAa,6BAAb,aAAa,QAUxB"}

lib/languages.test.js

@@ -1,55 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const ava_1 = __importDefault(require("ava"));
-const languages_1 = require("./languages");
-const testing_utils_1 = require("./testing-utils");
-(0, testing_utils_1.setupTests)(ava_1.default);
-(0, ava_1.default)("parseLanguage", async (t) => {
-    // Exact matches
-    t.deepEqual((0, languages_1.parseLanguage)("csharp"), languages_1.Language.csharp);
-    t.deepEqual((0, languages_1.parseLanguage)("cpp"), languages_1.Language.cpp);
-    t.deepEqual((0, languages_1.parseLanguage)("go"), languages_1.Language.go);
-    t.deepEqual((0, languages_1.parseLanguage)("java"), languages_1.Language.java);
-    t.deepEqual((0, languages_1.parseLanguage)("javascript"), languages_1.Language.javascript);
-    t.deepEqual((0, languages_1.parseLanguage)("python"), languages_1.Language.python);
-    t.deepEqual((0, languages_1.parseLanguage)("rust"), languages_1.Language.rust);
-    // Aliases
-    t.deepEqual((0, languages_1.parseLanguage)("c"), languages_1.Language.cpp);
-    t.deepEqual((0, languages_1.parseLanguage)("c++"), languages_1.Language.cpp);
-    t.deepEqual((0, languages_1.parseLanguage)("c#"), languages_1.Language.csharp);
-    t.deepEqual((0, languages_1.parseLanguage)("kotlin"), languages_1.Language.java);
-    t.deepEqual((0, languages_1.parseLanguage)("typescript"), languages_1.Language.javascript);
-    // spaces and case-insensitivity
-    t.deepEqual((0, languages_1.parseLanguage)("  \t\nCsHaRp\t\t"), languages_1.Language.csharp);
-    t.deepEqual((0, languages_1.parseLanguage)("  \t\nkOtLin\t\t"), languages_1.Language.java);
-    // Not matches
-    t.deepEqual((0, languages_1.parseLanguage)("foo"), undefined);
-    t.deepEqual((0, languages_1.parseLanguage)(" "), undefined);
-    t.deepEqual((0, languages_1.parseLanguage)(""), undefined);
-});
-(0, ava_1.default)("isTracedLanguage", async (t) => {
-    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.cpp));
-    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.csharp));
-    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.go));
-    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.java));
-    t.true((0, languages_1.isTracedLanguage)(languages_1.Language.swift));
-    t.false((0, languages_1.isTracedLanguage)(languages_1.Language.javascript));
-    t.false((0, languages_1.isTracedLanguage)(languages_1.Language.python));
-    t.false((0, languages_1.isTracedLanguage)(languages_1.Language.ruby));
-    t.false((0, languages_1.isTracedLanguage)(languages_1.Language.rust));
-});
-(0, ava_1.default)("isScannedLanguage", async (t) => {
-    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.cpp));
-    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.csharp));
-    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.go));
-    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.java));
-    t.false((0, languages_1.isScannedLanguage)(languages_1.Language.swift));
-    t.true((0, languages_1.isScannedLanguage)(languages_1.Language.javascript));
-    t.true((0, languages_1.isScannedLanguage)(languages_1.Language.python));
-    t.true((0, languages_1.isScannedLanguage)(languages_1.Language.ruby));
-    t.true((0, languages_1.isScannedLanguage)(languages_1.Language.rust));
-});
-//# sourceMappingURL=languages.test.js.map

lib/languages.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"languages.test.js","sourceRoot":"","sources":["../src/languages.test.ts"],"names":[],"mappings":";;;;;AAAA,8CAAuB;AAEvB,2CAKqB;AACrB,mDAA6C;AAE7C,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,IAAA,aAAI,EAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,gBAAgB;IAChB,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,QAAQ,CAAC,EAAE,oBAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,KAAK,CAAC,EAAE,oBAAQ,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,IAAI,CAAC,EAAE,oBAAQ,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,MAAM,CAAC,EAAE,oBAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,YAAY,CAAC,EAAE,oBAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,QAAQ,CAAC,EAAE,oBAAQ,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,MAAM,CAAC,EAAE,oBAAQ,CAAC,IAAI,CAAC,CAAC;IAElD,UAAU;IACV,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,oBAAQ,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,KAAK,CAAC,EAAE,oBAAQ,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,IAAI,CAAC,EAAE,oBAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,QAAQ,CAAC,EAAE,oBAAQ,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,YAAY,CAAC,EAAE,oBAAQ,CAAC,UAAU,CAAC,CAAC;IAE9D,gCAAgC;IAChC,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,kBAAkB,CAAC,EAAE,oBAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,kBAAkB,CAAC,EAAE,oBAAQ,CAAC,IAAI,CAAC,CAAC;IAE9D,cAAc;IACd,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,SAAS,CAAC,IAAA,yBAAa,EAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEzC,CAAC,CAAC,KAAK,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,KAAK,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,KAAK,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,IAAA,4BAAgB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpC,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,KAAK,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3C,CAAC,CAAC,IAAI,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,IAAA,6BAAiB,EAAC,oBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC"}

lib/overlay-database-utils.js

@@ -36,10 +36,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CODEQL_OVERLAY_MINIMUM_VERSION = exports.OverlayDatabaseMode = void 0;
 exports.writeBaseDatabaseOidsFile = writeBaseDatabaseOidsFile;
 exports.writeOverlayChangesFile = writeOverlayChangesFile;
+exports.checkOverlayBaseDatabase = checkOverlayBaseDatabase;
+exports.uploadOverlayBaseDatabaseToCache = uploadOverlayBaseDatabaseToCache;
+exports.downloadOverlayBaseDatabaseFromCache = downloadOverlayBaseDatabaseFromCache;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const actionsCache = __importStar(require("@actions/cache"));
 const actions_util_1 = require("./actions-util");
 const git_utils_1 = require("./git-utils");
+const logging_1 = require("./logging");
+const util_1 = require("./util");
 var OverlayDatabaseMode;
 (function (OverlayDatabaseMode) {
     OverlayDatabaseMode["Overlay"] = "overlay";
@@ -126,4 +132,169 @@ function computeChangedFiles(baseFileOids, overlayFileOids) {
     }
     return changes;
 }
+// Constants for database caching
+const CACHE_VERSION = 1;
+const CACHE_PREFIX = "codeql-overlay-base-database";
+const MAX_CACHE_OPERATION_MS = 120_000; // Two minutes
+/**
+ * Checks that the overlay-base database is valid by checking for the
+ * existence of the base database OIDs file.
+ *
+ * @param config The configuration object
+ * @param logger The logger instance
+ * @param warningPrefix Prefix for the check failure warning message
+ * @returns True if the verification succeeded, false otherwise
+ */
+function checkOverlayBaseDatabase(config, logger, warningPrefix) {
+    // An overlay-base database should contain the base database OIDs file.
+    const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config);
+    if (!fs.existsSync(baseDatabaseOidsFilePath)) {
+        logger.warning(`${warningPrefix}: ${baseDatabaseOidsFilePath} does not exist`);
+        return false;
+    }
+    return true;
+}
+/**
+ * Uploads the overlay-base database to the GitHub Actions cache. If conditions
+ * for uploading are not met, the function does nothing and returns false.
+ *
+ * This function uses the `checkout_path` input to determine the repository path
+ * and works only when called from `analyze` or `upload-sarif`.
+ *
+ * @param codeql The CodeQL instance
+ * @param config The configuration object
+ * @param logger The logger instance
+ * @returns A promise that resolves to true if the upload was performed and
+ * successfully completed, or false otherwise
+ */
+async function uploadOverlayBaseDatabaseToCache(codeql, config, logger) {
+    const overlayDatabaseMode = config.augmentationProperties.overlayDatabaseMode;
+    if (overlayDatabaseMode !== OverlayDatabaseMode.OverlayBase) {
+        logger.debug(`Overlay database mode is ${overlayDatabaseMode}. ` +
+            "Skip uploading overlay-base database to cache.");
+        return false;
+    }
+    if (!config.augmentationProperties.useOverlayDatabaseCaching) {
+        logger.debug("Overlay database caching is disabled. " +
+            "Skip uploading overlay-base database to cache.");
+        return false;
+    }
+    if ((0, util_1.isInTestMode)()) {
+        logger.debug("In test mode. Skip uploading overlay-base database to cache.");
+        return false;
+    }
+    const databaseIsValid = checkOverlayBaseDatabase(config, logger, "Abort uploading overlay-base database to cache");
+    if (!databaseIsValid) {
+        return false;
+    }
+    // Clean up the database using the overlay cleanup level.
+    await (0, logging_1.withGroupAsync)("Cleaning up databases", async () => {
+        await codeql.databaseCleanupCluster(config, "overlay");
+    });
+    const dbLocation = config.dbLocation;
+    const codeQlVersion = (await codeql.getVersion()).version;
+    const checkoutPath = (0, actions_util_1.getRequiredInput)("checkout_path");
+    const cacheKey = await generateCacheKey(config, codeQlVersion, checkoutPath);
+    logger.info(`Uploading overlay-base database to Actions cache with key ${cacheKey}`);
+    try {
+        const cacheId = await (0, util_1.withTimeout)(MAX_CACHE_OPERATION_MS, actionsCache.saveCache([dbLocation], cacheKey), () => { });
+        if (cacheId === undefined) {
+            logger.warning("Timed out while uploading overlay-base database");
+            return false;
+        }
+    }
+    catch (error) {
+        logger.warning("Failed to upload overlay-base database to cache: " +
+            `${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+    logger.info(`Successfully uploaded overlay-base database from ${dbLocation}`);
+    return true;
+}
+/**
+ * Downloads the overlay-base database from the GitHub Actions cache. If conditions
+ * for downloading are not met, the function does nothing and returns false.
+ *
+ * @param codeql The CodeQL instance
+ * @param config The configuration object
+ * @param logger The logger instance
+ * @returns A promise that resolves to download statistics if an overlay-base
+ * database was successfully downloaded, or undefined if the download was
+ * either not performed or failed.
+ */
+async function downloadOverlayBaseDatabaseFromCache(codeql, config, logger) {
+    const overlayDatabaseMode = config.augmentationProperties.overlayDatabaseMode;
+    if (overlayDatabaseMode !== OverlayDatabaseMode.Overlay) {
+        logger.debug(`Overlay database mode is ${overlayDatabaseMode}. ` +
+            "Skip downloading overlay-base database from cache.");
+        return undefined;
+    }
+    if (!config.augmentationProperties.useOverlayDatabaseCaching) {
+        logger.debug("Overlay database caching is disabled. " +
+            "Skip downloading overlay-base database from cache.");
+        return undefined;
+    }
+    if ((0, util_1.isInTestMode)()) {
+        logger.debug("In test mode. Skip downloading overlay-base database from cache.");
+        return undefined;
+    }
+    const dbLocation = config.dbLocation;
+    const codeQlVersion = (await codeql.getVersion()).version;
+    const restoreKey = getCacheRestoreKey(config, codeQlVersion);
+    logger.info(`Looking in Actions cache for overlay-base database with restore key ${restoreKey}`);
+    let databaseDownloadDurationMs = 0;
+    try {
+        const databaseDownloadStart = performance.now();
+        const foundKey = await (0, util_1.withTimeout)(MAX_CACHE_OPERATION_MS, actionsCache.restoreCache([dbLocation], restoreKey), () => {
+            logger.info("Timed out downloading overlay-base database from cache");
+        });
+        databaseDownloadDurationMs = Math.round(performance.now() - databaseDownloadStart);
+        if (foundKey === undefined) {
+            logger.info("No overlay-base database found in Actions cache");
+            return undefined;
+        }
+        logger.info(`Downloaded overlay-base database in cache with key ${foundKey}`);
+    }
+    catch (error) {
+        logger.warning("Failed to download overlay-base database from cache: " +
+            `${error instanceof Error ? error.message : String(error)}`);
+        return undefined;
+    }
+    const databaseIsValid = checkOverlayBaseDatabase(config, logger, "Downloaded overlay-base database is invalid");
+    if (!databaseIsValid) {
+        logger.warning("Downloaded overlay-base database failed validation");
+        return undefined;
+    }
+    const databaseSizeBytes = await (0, util_1.tryGetFolderBytes)(dbLocation, logger);
+    if (databaseSizeBytes === undefined) {
+        logger.info("Filesystem error while accessing downloaded overlay-base database");
+        // The problem that warrants reporting download failure is not that we are
+        // unable to determine the size of the database. Rather, it is that we
+        // encountered a filesystem error while accessing the database, which
+        // indicates that an overlay analysis will likely fail.
+        return undefined;
+    }
+    logger.info(`Successfully downloaded overlay-base database to ${dbLocation}`);
+    return {
+        databaseSizeBytes: Math.round(databaseSizeBytes),
+        databaseDownloadDurationMs,
+    };
+}
+async function generateCacheKey(config, codeQlVersion, checkoutPath) {
+    const sha = await (0, git_utils_1.getCommitOid)(checkoutPath);
+    return `${getCacheRestoreKey(config, codeQlVersion)}${sha}`;
+}
+function getCacheRestoreKey(config, codeQlVersion) {
+    // The restore key (prefix) specifies which cached overlay-base databases are
+    // compatible with the current analysis: the cached database must have the
+    // same cache version and the same CodeQL bundle version.
+    //
+    // Actions cache supports using multiple restore keys to indicate preference.
+    // Technically we prefer a cached overlay-base database with the same SHA as
+    // we are analyzing. However, since overlay-base databases are built from the
+    // default branch and used in PR analysis, it is exceedingly unlikely that
+    // the commit SHA will ever be the same, so we can just leave it out.
+    const languages = [...config.languages].sort().join("_");
+    return `${CACHE_PREFIX}-${CACHE_VERSION}-${languages}-${codeQlVersion}-`;
+}
 //# sourceMappingURL=overlay-database-utils.js.map

lib/overlay-database-utils.test.js

@@ -38,6 +38,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const actionsCache = __importStar(require("@actions/cache"));
 const ava_1 = __importDefault(require("ava"));
 const sinon = __importStar(require("sinon"));
 const actionsUtil = __importStar(require("./actions-util"));
@@ -45,6 +46,7 @@ const gitUtils = __importStar(require("./git-utils"));
 const logging_1 = require("./logging");
 const overlay_database_utils_1 = require("./overlay-database-utils");
 const testing_utils_1 = require("./testing-utils");
+const utils = __importStar(require("./util"));
 const util_1 = require("./util");
 (0, testing_utils_1.setupTests)(ava_1.default);
 (0, ava_1.default)("writeOverlayChangesFile generates correct changes file", async (t) => {
@@ -91,4 +93,93 @@ const util_1 = require("./util");
         t.deepEqual(parsedContent.changes.sort(), ["added.js", "deleted.js", "modified.js"], "Should identify added, deleted, and modified files");
     });
 });
+const defaultDownloadTestCase = {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.Overlay,
+    useOverlayDatabaseCaching: true,
+    isInTestMode: false,
+    restoreCacheResult: "cache-key",
+    hasBaseDatabaseOidsFile: true,
+    tryGetFolderBytesSucceeds: true,
+    codeQLVersion: "2.20.5",
+};
+const testDownloadOverlayBaseDatabaseFromCache = ava_1.default.macro({
+    exec: async (t, _title, partialTestCase, expectDownloadSuccess) => {
+        await (0, util_1.withTmpDir)(async (tmpDir) => {
+            const dbLocation = path.join(tmpDir, "db");
+            await fs.promises.mkdir(dbLocation, { recursive: true });
+            const logger = (0, logging_1.getRunnerLogger)(true);
+            const config = (0, testing_utils_1.createTestConfig)({ dbLocation });
+            const testCase = { ...defaultDownloadTestCase, ...partialTestCase };
+            config.augmentationProperties.overlayDatabaseMode =
+                testCase.overlayDatabaseMode;
+            config.augmentationProperties.useOverlayDatabaseCaching =
+                testCase.useOverlayDatabaseCaching;
+            if (testCase.hasBaseDatabaseOidsFile) {
+                const baseDatabaseOidsFile = path.join(dbLocation, "base-database-oids.json");
+                await fs.promises.writeFile(baseDatabaseOidsFile, JSON.stringify({}));
+            }
+            const stubs = [];
+            const isInTestModeStub = sinon
+                .stub(utils, "isInTestMode")
+                .returns(testCase.isInTestMode);
+            stubs.push(isInTestModeStub);
+            if (testCase.restoreCacheResult instanceof Error) {
+                const restoreCacheStub = sinon
+                    .stub(actionsCache, "restoreCache")
+                    .rejects(testCase.restoreCacheResult);
+                stubs.push(restoreCacheStub);
+            }
+            else {
+                const restoreCacheStub = sinon
+                    .stub(actionsCache, "restoreCache")
+                    .resolves(testCase.restoreCacheResult);
+                stubs.push(restoreCacheStub);
+            }
+            const tryGetFolderBytesStub = sinon
+                .stub(utils, "tryGetFolderBytes")
+                .resolves(testCase.tryGetFolderBytesSucceeds ? 1024 * 1024 : undefined);
+            stubs.push(tryGetFolderBytesStub);
+            try {
+                const result = await (0, overlay_database_utils_1.downloadOverlayBaseDatabaseFromCache)((0, testing_utils_1.mockCodeQLVersion)(testCase.codeQLVersion), config, logger);
+                if (expectDownloadSuccess) {
+                    t.truthy(result);
+                }
+                else {
+                    t.is(result, undefined);
+                }
+            }
+            finally {
+                for (const stub of stubs) {
+                    stub.restore();
+                }
+            }
+        });
+    },
+    title: (_, title) => `downloadOverlayBaseDatabaseFromCache: ${title}`,
+});
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns stats when successful", {}, true);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined when mode is OverlayDatabaseMode.OverlayBase", {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.OverlayBase,
+}, false);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined when mode is OverlayDatabaseMode.None", {
+    overlayDatabaseMode: overlay_database_utils_1.OverlayDatabaseMode.None,
+}, false);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined when caching is disabled", {
+    useOverlayDatabaseCaching: false,
+}, false);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined in test mode", {
+    isInTestMode: true,
+}, false);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined when cache miss", {
+    restoreCacheResult: undefined,
+}, false);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined when download fails", {
+    restoreCacheResult: new Error("Download failed"),
+}, false);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined when downloaded database is invalid", {
+    hasBaseDatabaseOidsFile: false,
+}, false);
+(0, ava_1.default)(testDownloadOverlayBaseDatabaseFromCache, "returns undefined when filesystem error occurs", {
+    tryGetFolderBytesSucceeds: false,
+}, false);
 //# sourceMappingURL=overlay-database-utils.test.js.map

lib/setup-codeql.js

@@ -160,7 +160,7 @@ function tryGetBundleVersionFromTagName(tagName, logger) {
 }
 function tryGetTagNameFromUrl(url, logger) {
     const matches = [...url.matchAll(/\/(codeql-bundle-[^/]*)\//g)];
-    if (!matches.length) {
+    if (matches.length === 0) {
         logger.debug(`Could not determine tag name for URL ${url}.`);
         return undefined;
     }

lib/setup-codeql.test.js

@@ -40,14 +40,13 @@ const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
 const sinon = __importStar(require("sinon"));
 const actionsUtil = __importStar(require("./actions-util"));
-const feature_flags_test_1 = require("./feature-flags.test");
 const logging_1 = require("./logging");
 const setupCodeql = __importStar(require("./setup-codeql"));
 const testing_utils_1 = require("./testing-utils");
 const util_1 = require("./util");
 (0, testing_utils_1.setupTests)(ava_1.default);
 // TODO: Remove when when we no longer need to pass in features (https://github.com/github/codeql-action/issues/2600)
-const expectedFeatureEnablement = (0, feature_flags_test_1.initializeFeatures)(true);
+const expectedFeatureEnablement = (0, testing_utils_1.initializeFeatures)(true);
 expectedFeatureEnablement.getValue = function (feature) {
     // eslint-disable-next-line @typescript-eslint/no-unsafe-return
     return expectedFeatureEnablement[feature];

lib/start-proxy-action.js

@@ -43,8 +43,8 @@ const logging_1 = require("./logging");
 const start_proxy_1 = require("./start-proxy");
 const util = __importStar(require("./util"));
 const UPDATEJOB_PROXY = "update-job-proxy";
-const UPDATEJOB_PROXY_VERSION = "v2.0.20250424171100";
-const UPDATEJOB_PROXY_URL_PREFIX = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.21.1/";
+const UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901";
+const UPDATEJOB_PROXY_URL_PREFIX = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/";
 const KEY_SIZE = 2048;
 const KEY_EXPIRY_YEARS = 2;
 const CERT_SUBJECT = [

lib/start-proxy.js

@@ -1,8 +1,80 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseLanguage = parseLanguage;
 exports.getCredentials = getCredentials;
+const core = __importStar(require("@actions/core"));
 const languages_1 = require("./languages");
 const util_1 = require("./util");
+/*
+ * Language aliases supported by the start-proxy Action.
+ *
+ * In general, the CodeQL CLI is the source of truth for language aliases, and to
+ * allow us to more easily support new languages, we want to avoid hardcoding these
+ * aliases in the Action itself.  However this is difficult to do in the start-proxy
+ * Action since this Action does not use CodeQL, so we're accepting some hardcoding
+ * for this Action.
+ */
+const LANGUAGE_ALIASES = {
+    c: languages_1.KnownLanguage.cpp,
+    "c++": languages_1.KnownLanguage.cpp,
+    "c#": languages_1.KnownLanguage.csharp,
+    kotlin: languages_1.KnownLanguage.java,
+    typescript: languages_1.KnownLanguage.javascript,
+    "javascript-typescript": languages_1.KnownLanguage.javascript,
+    "java-kotlin": languages_1.KnownLanguage.java,
+};
+/**
+ * Parse the start-proxy language input into its canonical CodeQL language name.
+ *
+ * Exported for testing. Do not use this outside of the start-proxy Action
+ * to avoid complicating the process of adding new CodeQL languages.
+ */
+function parseLanguage(language) {
+    // Normalize to lower case
+    language = language.trim().toLowerCase();
+    // See if it's an exact match
+    if (language in languages_1.KnownLanguage) {
+        return language;
+    }
+    // Check language aliases
+    if (language in LANGUAGE_ALIASES) {
+        return LANGUAGE_ALIASES[language];
+    }
+    return undefined;
+}
 const LANGUAGE_TO_REGISTRY_TYPE = {
     java: "maven_repository",
     csharp: "nuget_feed",
@@ -11,16 +83,20 @@ const LANGUAGE_TO_REGISTRY_TYPE = {
     ruby: "rubygems_server",
     rust: "cargo_registry",
     go: "goproxy_server",
-    // We do not have an established proxy type for these languages, thus leaving empty.
-    actions: "",
-    cpp: "",
-    swift: "",
 };
+/**
+ * Checks that `value` is neither `undefined` nor `null`.
+ * @param value The value to test.
+ * @returns Narrows the type of `value` to exclude `undefined` and `null`.
+ */
+function isDefined(value) {
+    return value !== undefined && value !== null;
+}
 // getCredentials returns registry credentials from action inputs.
 // It prefers `registries_credentials` over `registry_secrets`.
 // If neither is set, it returns an empty array.
 function getCredentials(logger, registrySecrets, registriesCredentials, languageString) {
-    const language = languageString ? (0, languages_1.parseLanguage)(languageString) : undefined;
+    const language = languageString ? parseLanguage(languageString) : undefined;
     const registryTypeForLanguage = language
         ? LANGUAGE_TO_REGISTRY_TYPE[language]
         : undefined;
@@ -47,9 +123,23 @@ function getCredentials(logger, registrySecrets, registriesCredentials, language
         logger.error("Failed to parse the credentials data.");
         throw new util_1.ConfigurationError("Invalid credentials format.");
     }
+    // Check that the parsed data is indeed an array.
+    if (!Array.isArray(parsed)) {
+        throw new util_1.ConfigurationError("Expected credentials data to be an array of configurations, but it is not.");
+    }
     const out = [];
     for (const e of parsed) {
-        if (e.url === undefined && e.host === undefined) {
+        if (e === null || typeof e !== "object") {
+            throw new util_1.ConfigurationError("Invalid credentials - must be an object");
+        }
+        // Mask credentials to reduce chance of accidental leakage in logs.
+        if (isDefined(e.password)) {
+            core.setSecret(e.password);
+        }
+        if (isDefined(e.token)) {
+            core.setSecret(e.token);
+        }
+        if (!isDefined(e.url) && !isDefined(e.host)) {
             // The proxy needs one of these to work. If both are defined, the url has the precedence.
             throw new util_1.ConfigurationError("Invalid credentials - must specify host or url");
         }

lib/start-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"start-proxy.js","sourceRoot":"","sources":["../src/start-proxy.ts"],"names":[],"mappings":";;AA8BA,wCA2EC;AAzGD,2CAAsD;AAEtD,iCAA4C;AAW5C,MAAM,yBAAyB,GAA6B;IAC1D,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,cAAc;IAC1B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,gBAAgB;IACpB,oFAAoF;IACpF,OAAO,EAAE,EAAE;IACX,GAAG,EAAE,EAAE;IACP,KAAK,EAAE,EAAE;CACD,CAAC;AAEX,kEAAkE;AAClE,+DAA+D;AAC/D,gDAAgD;AAChD,SAAgB,cAAc,CAC5B,MAAc,EACd,eAAmC,EACnC,qBAAyC,EACzC,cAAkC;IAElC,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,uBAAuB,GAAG,QAAQ;QACtC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,cAAsB,CAAC;IAC3B,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC;SAAM,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7C,cAAc,GAAG,eAAe,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAiB,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACtD,MAAM,IAAI,yBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,yFAAyF;YACzF,MAAM,IAAI,yBAAkB,CAC1B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,iEAAiE;QACjE,IAAI,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAClE,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAuB,EAAW,EAAE;YACvD,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC;QAEF,IACE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;YACnB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,yBAAkB,CAC1B,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"start-proxy.js","sourceRoot":"","sources":["../src/start-proxy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,sCAeC;AAwBD,wCA8FC;AA7KD,oDAAsC;AAEtC,2CAA4C;AAE5C,iCAA4C;AAW5C;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAsC;IAC1D,CAAC,EAAE,yBAAa,CAAC,GAAG;IACpB,KAAK,EAAE,yBAAa,CAAC,GAAG;IACxB,IAAI,EAAE,yBAAa,CAAC,MAAM;IAC1B,MAAM,EAAE,yBAAa,CAAC,IAAI;IAC1B,UAAU,EAAE,yBAAa,CAAC,UAAU;IACpC,uBAAuB,EAAE,yBAAa,CAAC,UAAU;IACjD,aAAa,EAAE,yBAAa,CAAC,IAAI;CAClC,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,QAAgB;IAC5C,0BAA0B;IAC1B,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEzC,6BAA6B;IAC7B,IAAI,QAAQ,IAAI,yBAAa,EAAE,CAAC;QAC9B,OAAO,QAAyB,CAAC;IACnC,CAAC;IAED,yBAAyB;IACzB,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,yBAAyB,GAA2C;IACxE,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,cAAc;IAC1B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,gBAAgB;CACZ,CAAC;AAEX;;;;GAIG;AACH,SAAS,SAAS,CAAI,KAA2B;IAC/C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,kEAAkE;AAClE,+DAA+D;AAC/D,gDAAgD;AAChD,SAAgB,cAAc,CAC5B,MAAc,EACd,eAAmC,EACnC,qBAAyC,EACzC,cAAkC;IAElC,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,uBAAuB,GAAG,QAAQ;QACtC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,cAAsB,CAAC;IAC3B,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC;SAAM,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7C,cAAc,GAAG,eAAe,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAiB,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACtD,MAAM,IAAI,yBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IAED,iDAAiD;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAkB,CAC1B,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAkB,CAAC,yCAAyC,CAAC,CAAC;QAC1E,CAAC;QAED,mEAAmE;QACnE,IAAI,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,yFAAyF;YACzF,MAAM,IAAI,yBAAkB,CAC1B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,iEAAiE;QACjE,IAAI,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAClE,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAuB,EAAW,EAAE;YACvD,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC;QAEF,IACE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;YACnB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,yBAAkB,CAC1B,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

lib/start-proxy.test.js

@@ -37,10 +37,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const ava_1 = __importDefault(require("ava"));
+const languages_1 = require("./languages");
 const logging_1 = require("./logging");
 const startProxyExports = __importStar(require("./start-proxy"));
+const start_proxy_1 = require("./start-proxy");
 const testing_utils_1 = require("./testing-utils");
 (0, testing_utils_1.setupTests)(ava_1.default);
+const toEncodedJSON = (data) => Buffer.from(JSON.stringify(data)).toString("base64");
 (0, ava_1.default)("getCredentials prefers registriesCredentials over registrySecrets", async (t) => {
     const registryCredentials = Buffer.from(JSON.stringify([
         { type: "npm_registry", host: "npm.pkg.github.com", token: "abc" },
@@ -52,19 +55,40 @@ const testing_utils_1 = require("./testing-utils");
     t.is(credentials.length, 1);
     t.is(credentials[0].host, "npm.pkg.github.com");
 });
-(0, ava_1.default)("getCredentials throws error when credential missing host and url", async (t) => {
-    const registryCredentials = Buffer.from(JSON.stringify([{ type: "npm_registry", token: "abc" }])).toString("base64");
+(0, ava_1.default)("getCredentials throws an error when configurations are not an array", async (t) => {
+    const registryCredentials = Buffer.from(JSON.stringify({ type: "npm_registry", token: "abc" })).toString("base64");
     t.throws(() => startProxyExports.getCredentials((0, logging_1.getRunnerLogger)(true), undefined, registryCredentials, undefined), {
-        message: "Invalid credentials - must specify host or url",
+        message: "Expected credentials data to be an array of configurations, but it is not.",
     });
 });
+(0, ava_1.default)("getCredentials throws error when credential is not an object", async (t) => {
+    const testCredentials = [["foo"], [null]].map(toEncodedJSON);
+    for (const testCredential of testCredentials) {
+        t.throws(() => startProxyExports.getCredentials((0, logging_1.getRunnerLogger)(true), undefined, testCredential, undefined), {
+            message: "Invalid credentials - must be an object",
+        });
+    }
+});
+(0, ava_1.default)("getCredentials throws error when credential missing host and url", async (t) => {
+    const testCredentials = [
+        [{ type: "npm_registry", token: "abc" }],
+        [{ type: "npm_registry", token: "abc", host: null }],
+        [{ type: "npm_registry", token: "abc", url: null }],
+    ].map(toEncodedJSON);
+    for (const testCredential of testCredentials) {
+        t.throws(() => startProxyExports.getCredentials((0, logging_1.getRunnerLogger)(true), undefined, testCredential, undefined), {
+            message: "Invalid credentials - must specify host or url",
+        });
+    }
+});
 (0, ava_1.default)("getCredentials filters by language when specified", async (t) => {
     const mixedCredentials = [
         { type: "npm_registry", host: "npm.pkg.github.com", token: "abc" },
         { type: "maven_repository", host: "maven.pkg.github.com", token: "def" },
         { type: "nuget_feed", host: "nuget.pkg.github.com", token: "ghi" },
+        { type: "goproxy_server", host: "goproxy.example.com", token: "jkl" },
     ];
-    const credentials = startProxyExports.getCredentials((0, logging_1.getRunnerLogger)(true), undefined, Buffer.from(JSON.stringify(mixedCredentials)).toString("base64"), "java");
+    const credentials = startProxyExports.getCredentials((0, logging_1.getRunnerLogger)(true), undefined, toEncodedJSON(mixedCredentials), "java");
     t.is(credentials.length, 1);
     t.is(credentials[0].type, "maven_repository");
 });
@@ -73,10 +97,11 @@ const testing_utils_1 = require("./testing-utils");
         { type: "npm_registry", host: "npm.pkg.github.com", token: "abc" },
         { type: "maven_repository", host: "maven.pkg.github.com", token: "def" },
         { type: "nuget_feed", host: "nuget.pkg.github.com", token: "ghi" },
+        { type: "goproxy_server", host: "goproxy.example.com", token: "jkl" },
     ];
-    const credentialsInput = Buffer.from(JSON.stringify(mixedCredentials)).toString("base64");
+    const credentialsInput = toEncodedJSON(mixedCredentials);
     const credentials = startProxyExports.getCredentials((0, logging_1.getRunnerLogger)(true), undefined, credentialsInput, undefined);
-    t.is(credentials.length, 3);
+    t.is(credentials.length, mixedCredentials.length);
 });
 (0, ava_1.default)("getCredentials throws an error when non-printable characters are used", async (t) => {
     const invalidCredentials = [
@@ -96,4 +121,27 @@ const testing_utils_1 = require("./testing-utils");
         });
     }
 });
+(0, ava_1.default)("parseLanguage", async (t) => {
+    // Exact matches
+    t.deepEqual((0, start_proxy_1.parseLanguage)("csharp"), languages_1.KnownLanguage.csharp);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("cpp"), languages_1.KnownLanguage.cpp);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("go"), languages_1.KnownLanguage.go);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("java"), languages_1.KnownLanguage.java);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("javascript"), languages_1.KnownLanguage.javascript);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("python"), languages_1.KnownLanguage.python);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("rust"), languages_1.KnownLanguage.rust);
+    // Aliases
+    t.deepEqual((0, start_proxy_1.parseLanguage)("c"), languages_1.KnownLanguage.cpp);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("c++"), languages_1.KnownLanguage.cpp);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("c#"), languages_1.KnownLanguage.csharp);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("kotlin"), languages_1.KnownLanguage.java);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("typescript"), languages_1.KnownLanguage.javascript);
+    // spaces and case-insensitivity
+    t.deepEqual((0, start_proxy_1.parseLanguage)("  \t\nCsHaRp\t\t"), languages_1.KnownLanguage.csharp);
+    t.deepEqual((0, start_proxy_1.parseLanguage)("  \t\nkOtLin\t\t"), languages_1.KnownLanguage.java);
+    // Not matches
+    t.deepEqual((0, start_proxy_1.parseLanguage)("foo"), undefined);
+    t.deepEqual((0, start_proxy_1.parseLanguage)(" "), undefined);
+    t.deepEqual((0, start_proxy_1.parseLanguage)(""), undefined);
+});
 //# sourceMappingURL=start-proxy.test.js.map