diff --git a/.github/actions/release-initialise/action.yml b/.github/actions/release-initialise/action.yml index be16f03950..239dfa9428 100644 --- a/.github/actions/release-initialise/action.yml +++ b/.github/actions/release-initialise/action.yml @@ -25,17 +25,6 @@ runs: shell: bash run: npm ci - - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 - with: - python-version: '3.12' - - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install PyGithub==2.3.0 requests - shell: bash - - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..c3cf8d63f3 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml index 53c8834eea..5d0576e2f6 100644 --- a/.github/workflows/__analysis-kinds.yml +++ b/.github/workflows/__analysis-kinds.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..7341a41740 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index 2d655b2eef..730a387f90 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -59,9 +59,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Prepare test diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index 13918e5395..f3bc58c691 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml index 71dd9d1df8..fac4ef9f54 100644 --- a/.github/workflows/__autobuild-working-dir.yml +++ b/.github/workflows/__autobuild-working-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 74881301cf..280dbf569c 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..bfe92c55ea 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml index dc97aa3d99..da7aa76383 100644 --- a/.github/workflows/__build-mode-none.yml +++ b/.github/workflows/__build-mode-none.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml index 4383024f3b..fcc77ea36e 100644 --- a/.github/workflows/__build-mode-rollback.yml +++ b/.github/workflows/__build-mode-rollback.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml index 9ccb507866..6c414fb67e 100644 --- a/.github/workflows/__bundle-from-nightly.yml +++ b/.github/workflows/__bundle-from-nightly.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml index 036262395e..a1c1fade09 100644 --- a/.github/workflows/__bundle-from-toolcache.yml +++ b/.github/workflows/__bundle-from-toolcache.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 0bdfd45082..9cc983a843 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml deleted file mode 100644 index 7c1f89cfbd..0000000000 --- a/.github/workflows/__bundle-zstd.yml +++ /dev/null @@ -1,120 +0,0 @@ -# Warning: This file is generated automatically, and should not be modified. -# Instead, please modify the template in the pr-checks directory and run: -# pr-checks/sync.sh -# to regenerate this file. - -name: 'PR Check - Bundle: Zstandard checks' -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: {} - merge_group: - types: - - checks_requested - schedule: - - cron: '0 5 * * *' - workflow_dispatch: - inputs: {} - workflow_call: - inputs: {} -defaults: - run: - shell: bash -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: bundle-zstd-${{github.ref}} -jobs: - bundle-zstd: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-latest - version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - name: 'Bundle: Zstandard checks' - if: github.triggering_actor != 'dependabot[bot]' - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } - env: - CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml index 921228910e..3153041401 100644 --- a/.github/workflows/__cleanup-db-cluster-dir.yml +++ b/.github/workflows/__cleanup-db-cluster-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index dedf559719..0c7a2cc151 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index 7dbaed852e..4267e00584 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml index 5eba27ed63..e2434f4256 100644 --- a/.github/workflows/__cpp-deptrace-disabled.yml +++ b/.github/workflows/__cpp-deptrace-disabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml index d26cd7dca7..344ed8d1ea 100644 --- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml +++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml index d3b04db26d..ab1a70584b 100644 --- a/.github/workflows/__cpp-deptrace-enabled.yml +++ b/.github/workflows/__cpp-deptrace-enabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index 7f788ef0a2..c55f3de9b8 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..4ce8b40285 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml index 28487388df..5bd5c8b940 100644 --- a/.github/workflows/__extractor-ram-threads.yml +++ b/.github/workflows/__extractor-ram-threads.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index e3ba6ff101..9244d1fc8f 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -55,17 +55,45 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'false' + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true CODEQL_ACTION_TEST_MODE: true container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..7b4cd1305b 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -67,13 +67,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index ced2df5982..968caf1e69 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -55,9 +55,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -73,7 +73,7 @@ jobs: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.20' - name: Build code diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 32ebaee34a..0f13b1e663 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -55,9 +55,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 8696063265..915835c2ab 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -55,9 +55,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index d8ef15b5a9..ccbb1b5a6e 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -75,9 +75,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index 077382459f..2acc617cb1 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -75,9 +75,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 2c4031b388..a43705b703 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -75,9 +75,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index 623afdee97..9293dcc196 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml index 622156ce4d..1dcbd38a85 100644 --- a/.github/workflows/__javascript-source-root.yml +++ b/.github/workflows/__javascript-source-root.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index 989b28fc53..cd47fb577e 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml index 3a1656eef7..731d975ce3 100644 --- a/.github/workflows/__language-aliases.yml +++ b/.github/workflows/__language-aliases.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..8e448080f3 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..55023cd916 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -99,13 +99,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -120,7 +120,7 @@ jobs: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml index 9a4ffa71f2..b6c99efcef 100644 --- a/.github/workflows/__overlay-init-fallback.yml +++ b/.github/workflows/__overlay-init-fallback.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..409e0a1a65 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..34d4ae1bca 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..88426cd684 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..2461944dbd 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..e1c3785f6a 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -67,13 +67,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index 29a042ae2b..11a31fdabc 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 7ee8f1fdc7..4809b680ab 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -54,7 +54,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml index 3558be85e4..98f8ec6a2a 100644 --- a/.github/workflows/__ruby.yml +++ b/.github/workflows/__ruby.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index e74daa4e4a..b3638ca6df 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -53,7 +53,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..512058a598 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -75,13 +75,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml index 51751680c3..edc6aa1cc5 100644 --- a/.github/workflows/__start-proxy.yml +++ b/.github/workflows/__start-proxy.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml index 339d6a07cb..099e93001f 100644 --- a/.github/workflows/__submit-sarif-failure.yml +++ b/.github/workflows/__submit-sarif-failure.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -57,7 +57,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'true' - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml index e59a87e3aa..52c189f3a8 100644 --- a/.github/workflows/__swift-autobuild.yml +++ b/.github/workflows/__swift-autobuild.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..99fbf7a897 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..8a8796d9a7 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -67,13 +67,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..76e8f4e3c0 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..77fa0264e5 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -72,13 +72,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..59a8edc9d1 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -66,13 +66,13 @@ jobs: steps: # This ensures we don't accidentally use the original checkout for any part of the test. - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -91,7 +91,7 @@ jobs: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/.github/workflows/check-expected-release-files.yml b/.github/workflows/check-expected-release-files.yml index 670f146566..6cabd0454b 100644 --- a/.github/workflows/check-expected-release-files.yml +++ b/.github/workflows/check-expected-release-files.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check Expected Release Files run: | bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c5efa1731a..f27de17fd8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,7 +32,7 @@ jobs: security-events: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up default CodeQL bundle id: setup-default uses: ./setup-codeql @@ -84,7 +84,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init id: init @@ -113,7 +113,6 @@ jobs: matrix: include: - language: actions - - language: python permissions: contents: read @@ -121,7 +120,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init with: diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index ee1ecea3d1..7bc6718e35 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -54,7 +54,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..f67cef5c75 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -48,17 +48,17 @@ jobs: - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..c27f195113 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -44,17 +44,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 0050c5da85..c493c2a382 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -44,16 +44,16 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "${GITHUB_CONTEXT}" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # ensure we have all tags and can push commits - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: 'npm' - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - with: - python-version: '3.12' + + - name: Install JavaScript dependencies + run: npm ci - name: Update git config run: | @@ -127,7 +127,7 @@ jobs: env: PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py CHANGELOG.md > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index ae21707826..ac61475d62 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -39,7 +39,7 @@ jobs: if: runner.os == 'Windows' run: git config --global core.autocrlf false - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -88,7 +88,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -161,7 +161,7 @@ jobs: - name: 'Backport: Check out base ref' id: checkout-base if: ${{ startsWith(github.head_ref, 'backport-') }} - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.base_ref }} diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 8bab54557a..4eb300704d 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -44,7 +44,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs diff --git a/.github/workflows/publish-immutable-action.yml b/.github/workflows/publish-immutable-action.yml index ec9a6518aa..5e5623bb07 100644 --- a/.github/workflows/publish-immutable-action.yml +++ b/.github/workflows/publish-immutable-action.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Publish immutable release id: publish diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 5722289fad..ab169499e2 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -32,11 +32,11 @@ jobs: runs-on: windows-latest steps: - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.12 - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 182b64b9c1..87b934eb6b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -30,7 +30,7 @@ jobs: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index f1d2a1a4f4..faa32c65d9 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -24,7 +24,7 @@ jobs: pull-requests: write # needed to comment on the PR steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ env.HEAD_REF }} diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index b830a827dd..c37f8a79ae 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -52,7 +52,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs @@ -93,7 +93,7 @@ jobs: LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }} VERSION: "${{ needs.prepare.outputs.version }}" run: | - python .github/workflows/script/rollback_changelog.py \ + npx tsx pr-checks/rollback-changelog.ts \ --target-version "${ROLLBACK_TAG:1}" \ --rollback-version "${LATEST_TAG:1}" \ --new-version "$VERSION" > $NEW_CHANGELOG @@ -128,7 +128,9 @@ jobs: NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md" PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts \ + --changelog="$NEW_CHANGELOG" \ + --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG diff --git a/.github/workflows/script/bundle_changelog.py b/.github/workflows/script/bundle_changelog.py deleted file mode 100755 index d8ced87d8d..0000000000 --- a/.github/workflows/script/bundle_changelog.py +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/env python3 -import os -import re - -cli_version = os.environ['CLI_VERSION'] - -# The GitHub Release for the new bundle version. -bundle_release_url = f"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v{cli_version}" -# Get the PR number from the PR URL. -pr_number = os.environ['PR_URL'].split('/')[-1] -changelog_note = f"- Update default CodeQL bundle version to [{cli_version}]({bundle_release_url}). [#{pr_number}]({os.environ['PR_URL']})" - -# If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. -with open('CHANGELOG.md', 'r') as f: - changelog = f.read() - -changelog = changelog.replace('## [UNRELEASED]\n\nNo user facing changes.', '## [UNRELEASED]\n') - -# Add the changelog note to the bottom of the "[UNRELEASED]" section. -changelog = re.sub(r'\n## (\d+\.\d+\.\d+)', f'{changelog_note}\n\n## \\1', changelog, count=1) - -with open('CHANGELOG.md', 'w') as f: - f.write(changelog) diff --git a/.github/workflows/script/prepare_changelog.py b/.github/workflows/script/prepare_changelog.py deleted file mode 100755 index dafb84b39c..0000000000 --- a/.github/workflows/script/prepare_changelog.py +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/env python3 -import os -import sys - -EMPTY_CHANGELOG = 'No changes.\n\n' - -# Prepare the changelog for the new release -# This function will extract the part of the changelog that -# we want to include in the new release. -def extract_changelog_snippet(changelog_file): - output = '' - if (not os.path.exists(changelog_file)): - output = EMPTY_CHANGELOG - - else: - with open(changelog_file, 'r') as f: - lines = f.readlines() - - # Include only the contents of the first section - found_first_section = False - for line in lines: - if line.startswith('## '): - if found_first_section: - break - found_first_section = True - elif found_first_section: - output += line - - return output.strip() - - -if len(sys.argv) < 2: - raise Exception('Expecting argument: changelog_file') -changelog_file = sys.argv[1] -print(extract_changelog_snippet(changelog_file)) diff --git a/.github/workflows/script/rollback_changelog.py b/.github/workflows/script/rollback_changelog.py deleted file mode 100644 index 5e06f83455..0000000000 --- a/.github/workflows/script/rollback_changelog.py +++ /dev/null @@ -1,62 +0,0 @@ -import datetime -import os -import argparse - -EMPTY_CHANGELOG = """# CodeQL Action Changelog - -""" - -def get_today_string(): - today = datetime.datetime.today() - return '{:%d %b %Y}'.format(today) - -# Include everything up to and after the first heading, -# but not the first heading and body. -def drop_unreleased_section(lines: list[str]): - before_first_section = '' - after_first_section = '' - found_first_section = False - skipped_first_section = False - - for i, line in enumerate(lines): - if line.startswith('## ') and not found_first_section: - found_first_section = True - elif line.startswith('## ') and found_first_section: - skipped_first_section = True - - if not found_first_section: - before_first_section += line - if skipped_first_section: - after_first_section += line - - return (before_first_section, after_first_section) - -def update_changelog(target_version, rollback_version, new_version): - before_first_section = EMPTY_CHANGELOG - after_first_section = '' - - if (os.path.exists('CHANGELOG.md')): - with open('CHANGELOG.md', 'r') as f: - (before_first_section, after_first_section) = drop_unreleased_section(f.readlines()) - - newHeader = f'## {new_version} - {get_today_string()}\n' - - print(before_first_section, end="") - print(newHeader) - print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n") - print(after_first_section) - -# We expect three version strings as input: -# -# - target_version: the version that we are re-releasing as `new_version` -# - rollback_version: the version that we are rolling back, typically the one that followed `target_version` -# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version` -# -# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5" -parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.") -parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.") -parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.") -parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.") -args = parser.parse_args() - -update_changelog(args.target_version, args.rollback_version, args.new_version) diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index e7cd9aab15..477fdf0524 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -38,7 +38,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -46,7 +46,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: true - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - id: init diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index f5e79075e6..d3ee924e59 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -33,18 +33,13 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "$GITHUB_CONTEXT" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" git config --global user.name "github-actions[bot]" - - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - with: - python-version: '3.12' - - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -120,7 +115,7 @@ jobs: - name: Create changelog note run: | - python .github/workflows/script/bundle_changelog.py + npx tsx pr-checks/bundle-changelog.ts - name: Push changelog note run: | diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index f690c3847e..9f38f0f0b4 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,7 +38,7 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs - uses: ./.github/actions/release-initialise @@ -101,7 +101,7 @@ jobs: private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }} - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 30f926d7a6..01cd6ab8fb 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -22,13 +22,8 @@ jobs: pull-requests: write # needed to create pull request steps: - - name: Setup Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - with: - python-version: "3.13" - - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -40,7 +35,7 @@ jobs: run: npm ci - name: Checkout Enterprise Releases - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: github/enterprise-releases token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }} diff --git a/CHANGELOG.md b/CHANGELOG.md index d465802f5e..67e18fd0e2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## 3.37.4 - 29 Jul 2026 + +- This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) +- Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) + ## 3.37.3 - 22 Jul 2026 No user facing changes. @@ -90,6 +95,7 @@ No user facing changes. ## 3.33.0 - 16 Mar 2026 - Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. [#3562](https://github.com/github/codeql-action/pull/3562) + To opt out of this change: - **Repositories owned by an organization:** Create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository's settings. For more information, see [Managing custom properties for repositories in your organization](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). Alternatively, if you are using an advanced setup workflow, you can set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow. - **User-owned repositories using default setup:** Switch to an advanced setup workflow and set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true` in your workflow. @@ -203,8 +209,8 @@ No user facing changes. ## 3.30.7 - 06 Oct 2025 -No user facing changes. +No user facing changes. ## 3.30.6 - 02 Oct 2025 - Update default CodeQL bundle version to 2.23.2. [#3168](https://github.com/github/codeql-action/pull/3168) @@ -439,13 +445,17 @@ No user facing changes. ## 3.26.12 - 07 Oct 2024 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. [#2520](https://github.com/github/codeql-action/pull/2520) + - If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version. + - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.26.11` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.26.11` in your code scanning workflow to ensure you continue using this version of the CodeQL Action. ## 3.26.11 - 03 Oct 2024 - _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts. + Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then. + This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES. - Update default CodeQL bundle version to 2.19.1. [#2519](https://github.com/github/codeql-action/pull/2519) @@ -568,9 +578,12 @@ No user facing changes. ## 3.25.0 - 15 Apr 2024 - The deprecated feature for extracting dependencies for a Python analysis has been removed. [#2224](https://github.com/github/codeql-action/pull/2224) + As a result, the following inputs and environment variables are now ignored: + - The `setup-python-dependencies` input to the `init` Action - The `CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION` environment variable + We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0. - Automatically overwrite an existing database if found on the filesystem. [#2229](https://github.com/github/codeql-action/pull/2229) - Bump the minimum CodeQL bundle version to 2.12.6. [#2232](https://github.com/github/codeql-action/pull/2232) diff --git a/lib/defaults.json b/lib/defaults.json index 39ecfc35fa..558dce6e24 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.2", + "cliVersion": "2.26.2", + "priorBundleVersion": "codeql-bundle-v2.26.1", + "priorCliVersion": "2.26.1" } diff --git a/lib/entry-points.js b/lib/entry-points.js index a6e55e176e..bdfda1701c 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -31280,84 +31280,87 @@ var require_brace_expansion = __commonJS({ } function expand3(str, max, isTop) { var expansions = []; - var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; - var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - var isSequence = isNumericSequence || isAlphaSequence; - var isOptions = m.body.indexOf(",") >= 0; - if (!isSequence && !isOptions) { - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); - } - return [str]; - } - var n; - if (isSequence) { - n = m.body.split(/\.\./); - } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + for (; ; ) { + var m = balanced2("{", "}", str); + if (!m || /\$$/.test(m.pre)) return [str]; + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(",") >= 0; + if (!isSequence && !isOptions) { + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + "{" + m.body + escClose2 + m.post; + isTop = true; + continue; + } + return [str]; + } + var n; + if (isSequence) { + n = m.body.split(/\.\./); + } else { + n = parseCommaParts2(m.body); if (n.length === 1) { - var post = m.post.length ? expand3(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); + n = expand3(n[0], max, false).map(embrace2); + if (n.length === 1) { + var post = m.post.length ? expand3(m.post, max, false) : [""]; + return post.map(function(p) { + return m.pre + n[0] + p; + }); + } } } - } - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y); i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; + var pre = m.pre; + var post = m.post.length ? expand3(m.post, max, false) : [""]; + var N; + if (isSequence) { + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + N = []; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") + c = ""; + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) + c = "-" + z + c.slice(1); + else + c = z + c; + } } } + N.push(c); } - N.push(c); + } else { + N = concatMap(n, function(el) { + return expand3(el, max, false); + }); } - } else { - N = concatMap(n, function(el) { - return expand3(el, max, false); - }); - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + for (var j = 0; j < N.length; j++) { + for (var k = 0; k < post.length && expansions.length < max; k++) { + var expansion = pre + N[j] + post[k]; + if (!isTop || isSequence || expansion) + expansions.push(expansion); + } } + return expansions; } - return expansions; } } }); @@ -34030,7 +34033,7 @@ var require_constants7 = __commonJS({ "node_modules/@actions/cache/lib/internal/constants.js"(exports2) { "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; + exports2.CacheReadDeniedMessagePrefix = exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; var CacheFilename; (function(CacheFilename2) { CacheFilename2["Gzip"] = "cache.tgz"; @@ -34055,6 +34058,7 @@ var require_constants7 = __commonJS({ exports2.TarFilename = "cache.tar"; exports2.ManifestFilename = "manifest.txt"; exports2.CacheFileSizeLimit = 10 * Math.pow(1024, 3); + exports2.CacheReadDeniedMessagePrefix = "cache read denied:"; } }); @@ -75482,6 +75486,9 @@ var require_config = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.isGhes = isGhes; exports2.getCacheServiceVersion = getCacheServiceVersion; + exports2.getCacheMode = getCacheMode; + exports2.isCacheReadable = isCacheReadable; + exports2.isCacheWritable = isCacheWritable; exports2.getCacheServiceURL = getCacheServiceURL; function isGhes() { const ghUrl = new URL(process.env["GITHUB_SERVER_URL"] || "https://github.com"); @@ -75496,6 +75503,20 @@ var require_config = __commonJS({ return "v1"; return process.env["ACTIONS_CACHE_SERVICE_V2"] ? "v2" : "v1"; } + var KNOWN_CACHE_MODES = ["none", "read", "write", "write-only"]; + function getCacheMode() { + return (process.env["ACTIONS_CACHE_MODE"] || "").trim().toLowerCase(); + } + function isCacheReadable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "read" || mode === "write"; + } + function isCacheWritable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "write" || mode === "write-only"; + } function getCacheServiceURL() { const version = getCacheServiceVersion(); switch (version) { @@ -75515,7 +75536,7 @@ var require_package = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "5.1.0", + version: "5.2.0", preview: true, description: "Actions cache lib", keywords: [ @@ -75674,6 +75695,7 @@ var require_cacheHttpClient = __commonJS({ var options_1 = require_options(); var requestUtils_1 = require_requestUtils(); var config_1 = require_config(); + var constants_1 = require_constants7(); var user_agent_1 = require_user_agent(); function getCacheApiUrl(resource) { const baseUrl = (0, config_1.getCacheServiceURL)(); @@ -75702,6 +75724,7 @@ var require_cacheHttpClient = __commonJS({ } function getCacheEntry(keys, paths, options) { return __awaiter2(this, void 0, void 0, function* () { + var _a2; const httpClient = createHttpClient(); const version = utils.getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive); const resource = `cache?keys=${encodeURIComponent(keys.join(","))}&version=${version}`; @@ -75715,6 +75738,10 @@ var require_cacheHttpClient = __commonJS({ return null; } if (!(0, requestUtils_1.isSuccessStatusCode)(response.statusCode)) { + const errorMessage = (_a2 = response.error) === null || _a2 === void 0 ? void 0 : _a2.message; + if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(constants_1.CacheReadDeniedMessagePrefix)) { + throw new Error(errorMessage); + } throw new Error(`Cache service responded with ${response.statusCode}`); } const cacheResult = response.result; @@ -81337,7 +81364,7 @@ var require_cache4 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.FinalizeCacheError = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.FinalizeCacheError = exports2.CacheReadDeniedError = exports2.CACHE_READ_DENIED_PREFIX = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; exports2.isFeatureAvailable = isFeatureAvailable; exports2.restoreCache = restoreCache5; exports2.saveCache = saveCache5; @@ -81349,6 +81376,7 @@ var require_cache4 = __commonJS({ var config_1 = require_config(); var tar_1 = require_tar(); var http_client_1 = require_lib(); + var constants_1 = require_constants7(); var ValidationError = class _ValidationError extends Error { constructor(message) { super(message); @@ -81374,6 +81402,15 @@ var require_cache4 = __commonJS({ } }; exports2.CacheWriteDeniedError = CacheWriteDeniedError; + exports2.CACHE_READ_DENIED_PREFIX = constants_1.CacheReadDeniedMessagePrefix; + var CacheReadDeniedError = class _CacheReadDeniedError extends Error { + constructor(message) { + super(message); + this.name = "CacheReadDeniedError"; + Object.setPrototypeOf(this, _CacheReadDeniedError.prototype); + } + }; + exports2.CacheReadDeniedError = CacheReadDeniedError; var FinalizeCacheError = class _FinalizeCacheError extends Error { constructor(message) { super(message); @@ -81411,6 +81448,12 @@ var require_cache4 = __commonJS({ const cacheServiceVersion = (0, config_1.getCacheServiceVersion)(); core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheReadable)(cacheMode)) { + core31.info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`); + core31.debug(`Skipped restore for paths [${paths.join(", ")}] with primary key '${primaryKey}'.`); + return void 0; + } switch (cacheServiceVersion) { case "v2": return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive); @@ -81422,6 +81465,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; core31.debug("Resolved Keys:"); @@ -81435,10 +81479,19 @@ var require_cache4 = __commonJS({ const compressionMethod = yield utils.getCompressionMethod(); let archivePath = ""; try { - const cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { - compressionMethod, - enableCrossOsArchive - }); + let cacheEntry; + try { + cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { + compressionMethod, + enableCrossOsArchive + }); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) { return void 0; } @@ -81480,6 +81533,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; options = Object.assign(Object.assign({}, options), { useAzureSdk: true }); restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; @@ -81500,7 +81554,16 @@ var require_cache4 = __commonJS({ restoreKeys, version: utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive) }; - const response = yield twirpClient.GetCacheEntryDownloadURL(request3); + let response; + try { + response = yield twirpClient.GetCacheEntryDownloadURL(request3); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!response.ok) { core31.debug(`Cache not found for version ${request3.version} of keys: ${keys.join(", ")}`); return void 0; @@ -81556,6 +81619,12 @@ var require_cache4 = __commonJS({ core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); checkKey(key); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheWritable)(cacheMode)) { + core31.info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`); + core31.debug(`Skipped save for paths [${paths.join(", ")}] with key '${key}'.`); + return -1; + } switch (cacheServiceVersion) { case "v2": return yield saveCacheV2(paths, key, options, enableCrossOsArchive); @@ -88996,16 +89065,18 @@ var require_brace_expansion2 = __commonJS({ } function expand3(str, max, isTop) { var expansions = []; - var m = balanced2("{", "}", str); - if (!m) return [str]; - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (var k = 0; k < post.length && k < max; k++) { - var expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); + for (; ; ) { + const m = balanced2("{", "}", str); + if (!m) return [str]; + const pre = m.pre; + if (/\$$/.test(m.pre)) { + const post2 = m.post.length ? expand3(m.post, max, false) : [""]; + for (let k2 = 0; k2 < post2.length && k2 < max; k2++) { + const expansion2 = pre + "{" + m.body + "}" + post2[k2]; + expansions.push(expansion2); + } + return expansions; } - } else { var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -89013,10 +89084,12 @@ var require_brace_expansion2 = __commonJS({ if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); + isTop = true; + continue; } return [str]; } + const post = m.post.length ? expand3(m.post, max, false) : [""]; var n; if (isSequence) { n = m.body.split(/\.\./); @@ -89079,8 +89152,8 @@ var require_brace_expansion2 = __commonJS({ expansions.push(expansion); } } + return expansions; } - return expansions; } } }); @@ -145331,7 +145404,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "3.37.3"; + return "3.37.4"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); @@ -145788,7 +145861,11 @@ function getRegistryProxy(action) { return void 0; } function makeProxyRequestOptions(dispatcher) { + if (dispatcher === void 0) { + return githubUtils.defaults.request; + } return { + ...githubUtils.defaults.request, fetch: (req, init2) => { return (0, import_undici.fetch)(req, { ...init2, dispatcher }); } @@ -145797,7 +145874,7 @@ function makeProxyRequestOptions(dispatcher) { function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) { const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry); - const requestOptions = proxy === void 0 ? githubUtils.defaults.request : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth2, { baseUrl: apiDetails.apiURL, @@ -146353,6 +146430,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, @@ -146571,8 +146649,8 @@ var path5 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.26.1"; -var cliVersion = "2.26.1"; +var bundleVersion = "codeql-bundle-v2.26.2"; +var cliVersion = "2.26.2"; // src/overlay/index.ts var fs4 = __toESM(require("fs")); @@ -146716,11 +146794,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: void 0 }, - ["allow_toolcache_input" /* AllowToolcacheInput */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: void 0 - }, ["cleanup_trap_caches" /* CleanupTrapCaches */]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", @@ -146931,6 +147004,11 @@ var featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: void 0 }, + ["tools_repository_property" /* ToolsRepositoryProperty */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: void 0 + }, ["upload_overlay_db_to_api" /* UploadOverlayDbToApi */]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", @@ -147896,12 +147974,14 @@ function getUnknownLanguagesError(languages) { } // src/feature-flags/properties.ts +var github2 = __toESM(require_github()); var GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => { RepositoryPropertyName2["CONFIG_FILE"] = "github-codeql-config-file"; RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay"; RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries"; RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs"; + RepositoryPropertyName2["TOOLS"] = "github-codeql-tools"; return RepositoryPropertyName2; })(RepositoryPropertyName || {}); function isString2(value) { @@ -147920,7 +148000,8 @@ var repositoryPropertyParsers = { ["github-codeql-config-file" /* CONFIG_FILE */]: stringProperty, ["github-codeql-disable-overlay" /* DISABLE_OVERLAY */]: booleanProperty, ["github-codeql-extra-queries" /* EXTRA_QUERIES */]: stringProperty, - ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty + ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty, + ["github-codeql-tools" /* TOOLS */]: stringProperty }; async function loadPropertiesFromApi(logger, repositoryNwo) { try { @@ -148000,6 +148081,26 @@ var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name) { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } +async function loadRepositoryProperties(repositoryNwo, logger) { + const repositoryOwnerType = github2.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." + ); + return new Success({}); + } + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error3) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error3)}` + ); + return new Failure(error3); + } +} // src/config/db-config.ts var ORG_SCHEMA = { @@ -148394,22 +148495,27 @@ async function getConfigFileInput({ logger, actions, features -}, repositoryProperties) { +}, repositoryProperties, analysisKinds) { const input = actions.getOptionalInput("config-file"); if (input !== void 0) { logger.info(`Using configuration file input from workflow: ${input}`); return input; } const propertyValue = repositoryProperties["github-codeql-config-file" /* CONFIG_FILE */]; + const analysisKindSupported = analysisKinds === void 0 || analysisKinds.includes("code-scanning" /* CodeScanning */) && analysisKinds.length === 1; if (propertyValue !== void 0 && propertyValue.trim().length > 0) { const useRepositoryProperty = await features.getValue( "config_file_repository_property" /* ConfigFileRepositoryProperty */ ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}` ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind." + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled." @@ -149663,7 +149769,6 @@ async function initConfig(actionState, inputs) { try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); if (isInTestMode() && process.env["CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION" /* TOLERATE_MISSING_GIT_VERSION */] !== "true") { @@ -149939,21 +150044,6 @@ function getPrimaryAnalysisKind(config) { function getPrimaryAnalysisConfig(config) { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -async function logGitVersionTelemetry(config, gitVersion) { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion - } - ) - ); - } -} async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount) { if (config.languages.length < 1) { return; @@ -150490,22 +150580,6 @@ var import_follow_redirects = __toESM(require_follow_redirects()); var semver8 = __toESM(require_semver2()); var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; var TOOLCACHE_TOOL_NAME = "CodeQL"; -function makeDownloadFirstToolsDownloadDurations(downloadDurationMs, extractionDurationMs) { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false - }; -} -function makeStreamedToolsDownloadDurations(combinedDurationMs) { - return { - combinedDurationMs, - downloadDurationMs: void 0, - extractionDurationMs: void 0, - streamExtraction: true - }; -} async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorization, headers, tarVersion, logger) { logger.info( `Downloading CodeQL tools from ${codeqlURL} . This may take a while.` @@ -150530,11 +150604,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat combinedDurationMs )}).` ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs) - }; + return {}; } } catch (e) { core11.warning( @@ -150576,14 +150646,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat } finally { await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs - ) - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger) { fs12.mkdirSync(dest, { recursive: true }); @@ -150626,11 +150689,6 @@ function writeToolcacheMarkerFile(extractedPath, logger) { fs12.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } -function sanitizeUrlForStatusReport(url2) { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url2.startsWith(`https://github.com/${repo}/releases/download/`) - ) ? url2 : "sanitized-value"; -} // src/setup-codeql.ts var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; @@ -150922,10 +150980,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO } } else if (toolsInput !== void 0 && toolsInput === CODEQL_TOOLCACHE_INPUT) { let latestToolcacheVersion; - const allowToolcacheValueFF = await features.getValue( - "allow_toolcache_input" /* AllowToolcacheInput */ - ); - const allowToolcacheValue = allowToolcacheValueFF && (isDynamicWorkflow() || isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || isInTestMode(); if (allowToolcacheValue) { logger.info( `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.` @@ -150941,15 +150996,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...` ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.` - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` + ); } const version = await resolveDefaultCliVersion( defaultCliVersion, @@ -151239,8 +151288,7 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function useZstdBundle(cliVersion2, tarSupportsZstd) { @@ -151374,8 +151422,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion } = await setupCodeQLBundle( toolsInput, apiDetails, @@ -151387,11 +151434,6 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV features, logger ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport - )}` - ); let codeqlCmd = path14.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; @@ -151405,8 +151447,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV codeql: cachedCodeQL, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } catch (rawError) { const e = wrapApiConfigurationError(rawError); @@ -154014,17 +154055,11 @@ var fs19 = __toESM(require("fs")); var path17 = __toESM(require("path")); var core14 = __toESM(require_core()); var toolrunner4 = __toESM(require_toolrunner()); -var github2 = __toESM(require_github()); +var github3 = __toESM(require_github()); var io6 = __toESM(require_io()); async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion, - zstdAvailability - } = await setupCodeQL( + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = await setupCodeQL( toolsInput, apiDetails, tempDir, @@ -154042,8 +154077,7 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe codeql, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function initConfig2(actionState, inputs) { @@ -154218,7 +154252,7 @@ function logFileCoverageOnPrsDeprecationWarning(logger) { if (process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION" /* DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION */]) { return; } - const repositoryOwnerType = github2.context.payload.repository?.owner.type; + const repositoryOwnerType = github3.context.payload.repository?.owner.type; let message = "Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses."; const envVarOptOut = "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`."; const repoPropertyOptOut = 'create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository\'s settings.'; @@ -155466,17 +155500,19 @@ function gte6(i, y) { } function expand_(str, max, isTop) { const expansions = []; - const m = balanced("{", "}", str); - if (!m) - return [str]; - const pre = m.pre; - const post = m.post.length ? expand_(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (let k = 0; k < post.length && k < max; k++) { - const expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); + for (; ; ) { + const m = balanced("{", "}", str); + if (!m) + return [str]; + const pre = m.pre; + if (/\$$/.test(m.pre)) { + const post2 = m.post.length ? expand_(m.post, max, false) : [""]; + for (let k = 0; k < post2.length && k < max; k++) { + const expansion = pre + "{" + m.body + "}" + post2[k]; + expansions.push(expansion); + } + return expansions; } - } else { const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); const isSequence = isNumericSequence || isAlphaSequence; @@ -155484,10 +155520,12 @@ function expand_(str, max, isTop) { if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose + m.post; - return expand_(str, max, true); + isTop = true; + continue; } return [str]; } + const post = m.post.length ? expand_(m.post, max, false) : [""]; let n; if (isSequence) { n = m.body.split(/\.\./); @@ -155551,8 +155589,8 @@ function expand_(str, max, isTop) { } } } + return expansions; } - return expansions; } // node_modules/readdir-glob/node_modules/minimatch/dist/esm/assert-valid-pattern.js @@ -157341,7 +157379,7 @@ var import_async = __toESM(require_async(), 1); var import_path6 = require("path"); // node_modules/archiver/lib/error.js -var import_util32 = __toESM(require("util"), 1); +var import_util33 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157366,7 +157404,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util32.default.inherits(ArchiverError, Error); +import_util33.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -160297,10 +160335,43 @@ async function runWrapper3() { var fs28 = __toESM(require("fs")); var path24 = __toESM(require("path")); var core21 = __toESM(require_core()); -var github3 = __toESM(require_github()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); +// src/config/inputs.ts +async function getToolsInput(action, repositoryProperties) { + const name = "tools" /* Tools */; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties["github-codeql-tools" /* TOOLS */]; + const allowRepositoryProperty = await action.features.getValue( + "tools_repository_property" /* ToolsRepositoryProperty */ + ); + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}` + ); + return { + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: "repository-property" /* RepositoryProperty */ + }; + } + if (input !== void 0) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { value: input, source: "workflow" /* Workflow */ }; + } + if (allowRepositoryProperty && propertyValue !== void 0) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}` + ); + return { + value: propertyValue, + source: "repository-property" /* RepositoryProperty */ + }; + } + return void 0; +} + // src/workflow.ts var fs27 = __toESM(require("fs")); var path23 = __toESM(require("path")); @@ -160591,7 +160662,7 @@ async function sendStartingStatusReport(startedAt, config, logger) { await sendStatusReport(statusReportBase); } } -async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { +async function sendCompletedStatusReport2(startedAt, config, configFile, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { const statusReportBase = await createStatusReportBase( "init" /* Init */, getActionsStatus(error3), @@ -160608,11 +160679,14 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDo const workflowLanguages = getOptionalInput("languages"); const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: workflowLanguages || "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -160648,11 +160722,11 @@ async function run3(actionState) { let codeql; let features; let sourceRoot; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; let toolsVersion; - let zstdAvailability; try { initializeEnvironment(getActionVersion()); persistInputs(); @@ -160681,11 +160755,6 @@ async function run3(actionState) { logger.info(`Job run UUID is ${jobRunUuid}.`); core21.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties - ); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), getOptionalInput("source-root") || "" @@ -160698,12 +160767,22 @@ async function run3(actionState) { `Failed to parse analysis kinds for 'starting' status report: ${getErrorMessage(err)}` ); } + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties, + analysisKinds + ); await sendStartingStatusReport(startedAt, { analysisKinds }, logger); if (process.env["CODEQL_ACTION_SETUP_CODEQL_HAS_RUN" /* SETUP_CODEQL_ACTION_HAS_RUN */] === "true") { throw new ConfigurationError( `The 'init' action should not be run in the same workflow as 'setup-codeql'.` ); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -160711,7 +160790,7 @@ async function run3(actionState) { ); const useOverlayAwareDefaultCliVersion = analysisKinds?.length === 1 && analysisKinds[0] === "code-scanning" /* CodeScanning */; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -160725,7 +160804,6 @@ async function run3(actionState) { toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; await checkWorkflow(logger, codeql); if ( // Only enable the experimental features env variable for Rust analysis if the user has explicitly @@ -160856,19 +160934,6 @@ async function run3(actionState) { if (config.overlayDatabaseMode !== "overlay" /* Overlay */) { cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport - ) - ); - } const goFlags = process.env["GOFLAGS"]; if (goFlags) { core21.exportVariable("GOFLAGS", goFlags); @@ -161043,6 +161108,7 @@ exec ${goBinaryPath} "$@"` config, void 0, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161060,6 +161126,7 @@ exec ${goBinaryPath} "$@"` startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161069,36 +161136,6 @@ exec ${goBinaryPath} "$@"` logger ); } -async function loadRepositoryProperties(repositoryNwo, logger) { - const repositoryOwnerType = github3.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." - ); - return new Success({}); - } - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error3) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error3)}` - ); - return new Failure(error3); - } -} -async function recordZstdAvailability(config, zstdAvailability) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability - ) - ); -} var init = { name: "init" /* Init */, run: run3 @@ -161649,7 +161686,7 @@ async function runWrapper6() { // src/setup-codeql-action.ts var core24 = __toESM(require_core()); -async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { +async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, getActionsStatus(error3), @@ -161665,11 +161702,14 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -161679,11 +161719,10 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } await sendStatusReport({ ...initStatusReport, ...initToolsDownloadFields }); } -async function run6({ - startedAt, - logger -}) { +async function run6(actionState) { + const { logger, startedAt } = actionState; let codeql; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -161706,6 +161745,12 @@ async function run6({ getTemporaryDirectory(), logger ); + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + const actionStateWithFeatures = { ...actionState, features }; const jobRunUuid = v4_default(); logger.info(`Job run UUID is ${jobRunUuid}.`); core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); @@ -161720,6 +161765,10 @@ async function run6({ if (statusReportBase !== void 0) { await sendStatusReport(statusReportBase); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -161727,7 +161776,7 @@ async function run6({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161764,6 +161813,7 @@ async function run6({ } await sendCompletedStatusReport3( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/package-lock.json b/package-lock.json index 9cbc0de589..297b558485 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "3.37.3", + "version": "3.37.4", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "3.37.3", + "version": "3.37.4", "license": "MIT", "workspaces": [ "pr-checks" @@ -14,7 +14,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -54,9 +54,9 @@ "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.1", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", @@ -65,7 +65,7 @@ "nock": "^14.0.16", "sinon": "^22.0.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.64.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -374,9 +374,9 @@ "license": "Apache-2.0" }, "node_modules/@actions/artifact/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -459,9 +459,9 @@ } }, "node_modules/@actions/cache": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.1.0.tgz", - "integrity": "sha512-kTIj4YPrjjRPKSGlj7f8eq+Pijoy/SKBEbJcAwNsQTFGEF29NGqj1mqD02/PmhV6r4bRAixycexAWpmUJ2aCwg==", + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz", + "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==", "license": "MIT", "dependencies": { "@actions/core": "^2.0.0", @@ -1534,9 +1534,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -1557,9 +1557,9 @@ } }, "node_modules/@eslint/js": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz", - "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz", + "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==", "dev": true, "license": "MIT", "engines": { @@ -1979,9 +1979,9 @@ } }, "node_modules/@microsoft/eslint-formatter-sarif/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -2591,17 +2591,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.63.0.tgz", - "integrity": "sha512-rvwSgqT+DHpWdzfSzPatRLm02a0GlESt++9iy3hLCDY4BgkaLcl8LBi9Yh7XGFBpwcBE/K3024QuXWTpbz4FfQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.64.0.tgz", + "integrity": "sha512-CGvQPBxN3wZLu6Rz2kFUpZeoCm78xUic92ck39KPePkO1NPOwjCqdQnm5Q87tpWw9vcBvW8XLrDXjH9PWYtJ3Q==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/type-utils": "8.63.0", - "@typescript-eslint/utils": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/type-utils": "8.64.0", + "@typescript-eslint/utils": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2614,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.63.0", + "@typescript-eslint/parser": "^8.64.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2630,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.63.0.tgz", - "integrity": "sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.64.0.tgz", + "integrity": "sha512-KA0OshtlcCCXmbfqyZkM5pV3/WNraJf7DkJRLpyrmwPtud57H5BDX7C3k0LPSPxpprfRL+cJDGabF10mvNCoCw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2673,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.63.0.tgz", - "integrity": "sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.64.0.tgz", + "integrity": "sha512-tk4WpOJ6IEbGrVHaNmM0YRrwAD3exZlIK3iadQNAxh4YKk6jvUQ4ecq18n+v7+meh+cJ3j+D8nbk8sRKhlwLQg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.63.0", - "@typescript-eslint/types": "^8.63.0", + "@typescript-eslint/tsconfig-utils": "^8.64.0", + "@typescript-eslint/types": "^8.64.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2713,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.63.0.tgz", - "integrity": "sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.64.0.tgz", + "integrity": "sha512-CXEaFdYXjSTgKhisNkwCcJwTP8Pl+fmRrEQrri4nm3vU743bALrxzLmq7fHG/7e6a5xO0lDYeURpZmBuhHk54w==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0" + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2731,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.63.0.tgz", - "integrity": "sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.64.0.tgz", + "integrity": "sha512-2yo8rRNKuzbVWQp5kslhANqZ2uDAeROQHBRZNPu8JDsHmeFNj/XJJhX/FhNUWmkHHvoNsKa6+tHJiig87EzsQw==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2748,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.63.0.tgz", - "integrity": "sha512-Nzzh/OGxVCOjObjaj1CQF2RUasyYy2Jfuh+zZ3PjLzG2fYRriAiZLib9UKtO+CpQAS3YHiAS+ckZDclwqI1TPA==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.64.0.tgz", + "integrity": "sha512-XWG4Fmmv/6SvyS9nH8jWrKs6terwJvE8cyRt1CzYYqzp9OrPhCT4cMc/f7C6RZCwG+qMmiffJS1/qJP8G1URtg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/utils": "8.64.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2791,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz", - "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.64.0.tgz", + "integrity": "sha512-qjhfuTfLXjA4IOzXvz0rTjT01BqEiIgPoUeMwiEjnaHKJMTNo8rH5pYW1a2L/0Dnux2fPC85AeyJoWaGa8WxTA==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2805,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.63.0.tgz", - "integrity": "sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.64.0.tgz", + "integrity": "sha512-Pztpsn1aCE1oWDvDEfUk31nngvvF7vUB5SwHFEaZIFpvw7WJtqUHHL4plBZDA9HfWJJjL13BdG0YrJInTUvoVA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.63.0", - "@typescript-eslint/tsconfig-utils": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/project-service": "8.64.0", + "@typescript-eslint/tsconfig-utils": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2890,16 +2890,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.63.0.tgz", - "integrity": "sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.64.0.tgz", + "integrity": "sha512-aJUGVB3+U0htrrCjoA8qukw8cm8fNCGAxK/tVoS70k8aeb7DETKeFozRiVFIwEeN9WJLsjaP3ph8I60tY2XZoQ==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0" + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +2914,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.63.0.tgz", - "integrity": "sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.64.0.tgz", + "integrity": "sha512-mrtuL8Nsn6gi2H4mo5KMTp823M+3Q19Ew/i+Zlikq20tIMm99C3Ez0dCmkWWnxut20esQvTg8aUSEhMcAOXhEw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", + "@typescript-eslint/types": "8.64.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -3864,9 +3864,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -4766,9 +4766,9 @@ } }, "node_modules/eslint": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz", - "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz", + "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==", "dev": true, "license": "MIT", "dependencies": { @@ -4777,8 +4777,8 @@ "@eslint/config-array": "^0.21.2", "@eslint/config-helpers": "^0.4.2", "@eslint/core": "^0.17.0", - "@eslint/eslintrc": "^3.3.5", - "@eslint/js": "9.39.4", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "9.39.5", "@eslint/plugin-kit": "^0.4.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", @@ -4988,9 +4988,9 @@ } }, "node_modules/eslint-plugin-github": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.0.tgz", - "integrity": "sha512-+mA0K1/I1JSE9AOiJ4ifMDGu7NplRZX0e3Uy0SjbwyXb2rsDfo5yfT0UCUO+TiOJ/99R1YxFRltizP/PZuB4PQ==", + "version": "6.1.1", + "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.1.tgz", + "integrity": "sha512-xCqu1S/s/CCvoRLafaXNvwiVrxhroNOFLGyG9Dhi4i1PWZgPHlipjXysH6wccPFQyhSKE7gAjSLqdSdM204bZQ==", "dev": true, "license": "MIT", "dependencies": { @@ -5115,9 +5115,9 @@ } }, "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "dev": true, "license": "MIT", "dependencies": { @@ -5391,6 +5391,30 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, + "node_modules/eslint/node_modules/@eslint/eslintrc": { + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", + "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", + "dev": true, + "license": "MIT", + "dependencies": { + "ajv": "^6.14.0", + "debug": "^4.3.2", + "espree": "^10.0.1", + "globals": "^14.0.0", + "ignore": "^5.2.0", + "import-fresh": "^3.2.1", + "js-yaml": "^4.3.0", + "minimatch": "^3.1.5", + "strip-json-comments": "^3.1.1" + }, + "engines": { + "node": "^18.18.0 || ^20.9.0 || >=21.1.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, "node_modules/eslint/node_modules/ansi-styles": { "version": "4.2.1", "dev": true, @@ -5456,6 +5480,42 @@ "node": ">=10.13.0" } }, + "node_modules/eslint/node_modules/globals": { + "version": "14.0.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", + "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/eslint/node_modules/js-yaml": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", @@ -6051,9 +6111,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -8030,9 +8090,9 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -9108,9 +9168,9 @@ "license": "0BSD" }, "node_modules/tsx": { - "version": "4.23.0", - "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.0.tgz", - "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==", + "version": "4.23.1", + "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz", + "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==", "dev": true, "license": "MIT", "dependencies": { @@ -9260,16 +9320,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.63.0.tgz", - "integrity": "sha512-xgwXyzG4sK9ALkBxbyGkTMMOS+imnW65iPhxCQMK83KhxyoDNW7l+IDqEf9vMdoUidHpOoS967RCq4eMiTexwQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.64.0.tgz", + "integrity": "sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.63.0", - "@typescript-eslint/parser": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0" + "@typescript-eslint/eslint-plugin": "8.64.0", + "@typescript-eslint/parser": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/utils": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -9757,7 +9817,7 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.1" } } } diff --git a/package.json b/package.json index bc959d1ae8..7a844edacf 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "3.37.3", + "version": "3.37.4", "private": true, "description": "CodeQL action", "scripts": { @@ -22,7 +22,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -62,9 +62,9 @@ "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.1", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", @@ -73,7 +73,7 @@ "nock": "^14.0.16", "sinon": "^22.0.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.64.0" }, "overrides": { "@actions/tool-cache": { diff --git a/pr-checks/bundle-changelog.test.ts b/pr-checks/bundle-changelog.test.ts new file mode 100644 index 0000000000..6cc4d096ba --- /dev/null +++ b/pr-checks/bundle-changelog.test.ts @@ -0,0 +1,142 @@ +/** + * Tests for `bundle-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { + CLI_VERSION_ENV_VAR, + getCLIVersion, + getPRNumber, + getPRUrl, + PR_URL_ENV_VAR, + updateChangelog, +} from "./bundle-changelog"; +import { + EMPTY_CHANGELOG, + NO_CHANGES_STR, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "bundle-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +describe("getCLIVersion", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[CLI_VERSION_ENV_VAR]; + assert.throws(() => getCLIVersion()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[CLI_VERSION_ENV_VAR] = " "; + assert.throws(() => getCLIVersion()); + }); + + await it("returns value of the environment variable if set", async () => { + const testValue = "1.2.3"; + process.env[CLI_VERSION_ENV_VAR] = testValue; + assert.deepEqual(getCLIVersion(), testValue); + }); +}); + +const testPrUrl = "https://github.com/github/codeql-action/pulls/42"; + +describe("getPRUrl", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[PR_URL_ENV_VAR]; + assert.throws(() => getPRUrl()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[PR_URL_ENV_VAR] = " "; + assert.throws(() => getPRUrl()); + }); + + await it("returns value of the environment variable if set", async () => { + process.env[PR_URL_ENV_VAR] = testPrUrl; + assert.deepEqual(getPRUrl(), testPrUrl); + }); +}); + +describe("getPRNumber", async () => { + await it("throws if the last part of the input is not a number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/foo`)); + }); + + await it("throws if the last part of the input is not a positive number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/-100`)); + }); + + await it("returns the PR number from an URL", async () => { + assert.equal(getPRNumber(testPrUrl), 42); + }); +}); + +const testChangelog = `${EMPTY_CHANGELOG.trimEnd()} + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +const expectedChangelog = `# CodeQL Action Changelog + +## ${UNRELEASED_PLACEHOLDER} + +- Update default CodeQL bundle version to + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +describe("updateChangelog", async () => { + await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => { + const result = updateChangelog(EMPTY_CHANGELOG, ""); + assert.ok(!result.includes(NO_CHANGES_STR.trim())); + }); + + await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => { + const result = updateChangelog( + EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"), + "", + ); + assert.ok(result.includes(NO_CHANGES_STR.trim())); + }); + + await it("throws if there are no sections", async () => { + assert.throws(() => { + updateChangelog( + "# CodeQL Action Changelog", + "- Update default CodeQL bundle version to", + ); + }); + }); + + await it("adds note at the end of the first section", async () => { + const result = updateChangelog( + testChangelog, + "- Update default CodeQL bundle version to", + ); + assert.deepEqual(result, expectedChangelog); + }); +}); diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts new file mode 100755 index 0000000000..557a8556c1 --- /dev/null +++ b/pr-checks/bundle-changelog.ts @@ -0,0 +1,127 @@ +#!/usr/bin/env npx tsx + +/** + * Updates the changelog with a change note for an updated CodeQL CLI bundle. + */ + +import * as fs from "node:fs"; + +import { + parseChangelog, + renderChangelog, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; +import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; +import { getErrorMessage } from "./util"; + +export const CLI_VERSION_ENV_VAR = "CLI_VERSION"; +export const PR_URL_ENV_VAR = "PR_URL"; + +/** Gets the CLI version from the environment. */ +export function getCLIVersion() { + const cliVersion = process.env[CLI_VERSION_ENV_VAR]; + + if (cliVersion === undefined || cliVersion.trim() === "") { + throw new Error(`No CLI version was set in '${CLI_VERSION_ENV_VAR}'.`); + } + + return cliVersion; +} + +/** Gets the PR URL from the environment. */ +export function getPRUrl() { + const prUrl = process.env[PR_URL_ENV_VAR]; + + if (prUrl === undefined || prUrl.trim() === "") { + throw new Error(`No PR URL was set in '${PR_URL_ENV_VAR}'.`); + } + + return prUrl; +} + +/** + * Gets the PR number from something like a PR URL. + */ +export function getPRNumber(prUrl: string) { + const prUrlParts = prUrl.split("/"); + const prNumberStr = prUrlParts[prUrlParts.length - 1]; + + const prNumber = Number.parseInt(prNumberStr, 10); + + if (!Number.isInteger(prNumber) || prNumber <= 0) { + throw new Error( + `Invalid PR URL '${prUrl}': last part is not a positive number`, + ); + } + + return prNumber; +} + +/** + * Updates `changelog` by adding `changelogNote` to the first section. + * + * @param contents The existing changelog contents. + * @param changelogNote The note to add to the first section. + */ +export function updateChangelog(contents: string, changelogNote: string) { + // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. + contents = contents.replace( + `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`, + `## ${UNRELEASED_PLACEHOLDER}\n`, + ); + + const changelog = parseChangelog(contents); + + if (changelog.sections.length === 0) { + throw new Error("The changelog contains no existing sections."); + } + + // Add the changelog note to the bottom of the first section. + const firstSection = changelog.sections[0]; + const lastLine = firstSection.bodyLines.pop(); + + if (lastLine !== undefined && lastLine.trim() !== "") { + // We expect the last line to be empty. If it isn't for some reason, + // add it back. + firstSection.bodyLines.push(lastLine); + } + + firstSection.bodyLines.push(changelogNote); + + // If the last line is empty as expected, then add it back in after the new note. + if (lastLine?.trim() === "") { + firstSection.bodyLines.push(lastLine); + } + + return renderChangelog(changelog); +} + +function main() { + try { + const cliVersion = getCLIVersion(); + const prUrl = getPRUrl(); + + // The GitHub Release for the new bundle version. + const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`; + + // Get the PR number from the PR URL. + const prNumber = getPRNumber(prUrl); + const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`; + + let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + + changelog = updateChangelog(changelog, changelogNote); + + fs.writeFileSync(CHANGELOG_FILE, changelog); + + return 0; + } catch (err) { + console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/changelog.test.ts b/pr-checks/changelog.test.ts index 3eddc14591..817852e3e1 100755 --- a/pr-checks/changelog.test.ts +++ b/pr-checks/changelog.test.ts @@ -5,14 +5,18 @@ */ import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; import { describe, it } from "node:test"; import { EMPTY_CHANGELOG, getReleaseDateString, + parseChangelog, processChangelogForBackports, + renderChangelog, setVersionAndDate, } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; const testDate = new Date(2026, 7, 14); @@ -37,6 +41,14 @@ describe("setVersionAndDate", async () => { }); }); +describe("parseChangelog + renderChangelog", async () => { + await it("renderChangelog(parseChangelog(c)) == c", async () => { + const actualChangelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + const roundtrip = renderChangelog(parseChangelog(actualChangelog)); + assert.deepEqual(roundtrip.split("\n"), actualChangelog.split("\n")); + }); +}); + const testChangelog = `# CodeQL Action Changelog ## 4.12.3 - 14 Aug 2026 diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 49011b0361..4cf1e75494 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -2,14 +2,34 @@ import * as fs from "node:fs"; import { CHANGELOG_FILE, DryRunOption } from "./config"; +/** The placeholder in the header for unreleased changes. */ +export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]"; + +/** The default contents for a section in the changelog. */ +export const NO_CHANGES_STR = "No user facing changes.\n\n"; + /** Placeholder changelog content for a new release. */ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog -## [UNRELEASED] +## ${UNRELEASED_PLACEHOLDER} -No user facing changes. +${NO_CHANGES_STR}`; + +/** + * Represents sections in a changelog. + */ +export interface ChangelogSection { + headerLine: string; + bodyLines: string[]; +} -`; +/** + * Represents a changelog. + */ +export interface Changelog { + preamble: string[]; + sections: ChangelogSection[]; +} /** Returns `date` formatted as `DD Mon YYYY`. */ export function getReleaseDateString(today: Date = new Date()): string { @@ -53,7 +73,76 @@ export function setVersionAndDate( date: Date = new Date(), ): string { const versionAndDate = `${version} - ${getReleaseDateString(date)}`; - return content.replace("[UNRELEASED]", versionAndDate); + return content.replace(UNRELEASED_PLACEHOLDER, versionAndDate); +} + +/** + * Parses `content` into a structured representation of a changelog. + * + * @param content The contents of the changelog file. + */ +export function parseChangelog(content: string): Changelog { + const lines = content.split("\n"); + let i = 0; + + const preamble: string[] = []; + const sections: ChangelogSection[] = []; + let currentSection: ChangelogSection | undefined = undefined; + + // Process all lines of the input file. + while (i < lines.length) { + const line = lines[i]; + + // Sections of the changelog start with `## `. + if (line.startsWith("## ")) { + // We have discovered a new section. If `currentSection` is already defined, + // then this marks the end of that section. Push it to the array of sections + // in the changelog. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + // Initialise the new section. + currentSection = { headerLine: line, bodyLines: [] }; + } else if (currentSection !== undefined) { + // Add lines between the section header and the next to the current section. + currentSection.bodyLines.push(line); + } else { + // This is neither a section header nor are we in a section already, + // so this line is part of the preamble. + preamble.push(line); + } + + i++; + } + + // Push the current section to the array of completed sections, if there is + // still one unfinished. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + return { preamble, sections }; +} + +/** + * Combines an array of lines into a single string by adding line breaks. + */ +export function unlines(lines: string[]): string { + return `${lines.join("\n")}`; +} + +/** + * Renders a given changelog to a string. + */ +export function renderChangelog(changelog: Changelog): string { + let result = unlines(changelog.preamble); + + for (const section of changelog.sections) { + result += `\n${section.headerLine}\n${unlines(section.bodyLines)}`; + } + + return result; } /** @@ -66,70 +155,58 @@ export function processChangelogForBackports( targetBranchMajorVersion: string, content: string, ): string { - const lines = content.split("\n"); - // Changelog entries can use the following format to indicate // that they only apply to newer versions const someVersionsOnlyRegex = /\[v(\d+)\+ only\]/; - let output = ""; - let i = 0; - - // Copy lines until we find the first section heading. - let foundFirstSection = false; - while (!foundFirstSection && i < lines.length) { - let line = lines[i]; - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - foundFirstSection = true; - } - output += `${line}\n`; - i++; - } + // Parse the changelog. + const changelog = parseChangelog(content); - if (!foundFirstSection) { + if (changelog.sections.length === 0) { throw new Error("Could not find any change sections in CHANGELOG.md"); } - // Process remaining lines. - // `foundContent` tracks whether we hit two headings in a row - let foundContent = false; - output += "\n"; - - while (i < lines.length) { - let line = lines[i]; - i++; - - // Filter out changelog entries that only apply to newer versions. - const match = someVersionsOnlyRegex.exec(line); - if (match) { + // Filter out changelog entries that only apply to newer versions and + // update the section headings with the backport major version for + // sections we keep. + for (const section of changelog.sections) { + // Update the section headings with the backport major version. + section.headerLine = section.headerLine.replace( + `## ${sourceBranchMajorVersion}`, + `## ${targetBranchMajorVersion}`, + ); + + const filteredEntries: string[] = []; + let foundContent = false; + + for (const line of section.bodyLines) { + // Skip the entry if `someVersionsOnlyRegex` matches and the major version + // of the target branch is smaller than the required version. + const match = someVersionsOnlyRegex.exec(line); if ( + match && Number.parseInt(targetBranchMajorVersion) < Number.parseInt(match[1]) ) { continue; } - } - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - if (!foundContent) { - output += "No user facing changes.\n"; - } - foundContent = false; - output += `\n${line}\n\n`; - } else { + // Keep the line. + filteredEntries.push(line); + + // Set `foundContent` to `true` if the line is not empty. if (line.trim() !== "") { foundContent = true; - output += `${line}\n`; } } + + // Update the section with the retained entries. + section.bodyLines = filteredEntries; + + // Add an entry if we didn't keep any. + if (!foundContent) { + section.bodyLines.push(NO_CHANGES_STR.trim()); + } } - return output; + return renderChangelog(changelog); } diff --git a/pr-checks/checks/bundle-zstd.yml b/pr-checks/checks/bundle-zstd.yml deleted file mode 100644 index a961af3c36..0000000000 --- a/pr-checks/checks/bundle-zstd.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: "Bundle: Zstandard checks" -description: "A Zstandard CodeQL bundle should be extracted on supported operating systems" -versions: - - linked -operatingSystems: - - ubuntu - - macos - - windows -steps: - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 5f90022c04..9d9653c13c 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -5,17 +5,45 @@ versions: - nightly-latest container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest ports: - 3128:3128 env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml index 895dba2b6c..f0b4097d7b 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml @@ -12,7 +12,7 @@ steps: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "1.20" - name: Build code diff --git a/pr-checks/checks/multi-language-autodetect.yml b/pr-checks/checks/multi-language-autodetect.yml index 801f4521a4..b57e90ab4c 100644 --- a/pr-checks/checks/multi-language-autodetect.yml +++ b/pr-checks/checks/multi-language-autodetect.yml @@ -23,7 +23,7 @@ steps: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index 4128c446d9..7879653f38 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ versions: - default steps: - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/pr-checks/checks/submit-sarif-failure.yml b/pr-checks/checks/submit-sarif-failure.yml index 9212a5dc79..c33e1322f7 100644 --- a/pr-checks/checks/submit-sarif-failure.yml +++ b/pr-checks/checks/submit-sarif-failure.yml @@ -21,7 +21,7 @@ permissions: security-events: write # needed to upload the SARIF file steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/pr-checks/checks/with-checkout-path.yml b/pr-checks/checks/with-checkout-path.yml index 7a5866b783..a6cde895b6 100644 --- a/pr-checks/checks/with-checkout-path.yml +++ b/pr-checks/checks/with-checkout-path.yml @@ -14,7 +14,7 @@ steps: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/pr-checks/config.ts b/pr-checks/config.ts index 94d34a931d..356fe665f9 100644 --- a/pr-checks/config.ts +++ b/pr-checks/config.ts @@ -37,6 +37,10 @@ export const API_COMPATIBILITY_FILE = path.join( "api-compatibility.json", ); +/** The prefix of CodeQL CLI bundle release URLs. */ +export const CLI_BUNDLE_RELEASE_URL_PREFIX = + "https://github.com/github/codeql-action/releases/tag/codeql-bundle-v"; + /** A common interface for operations that support dry runs. */ export interface DryRunOption { /** A value indicating whether to perform operations with side effects. */ diff --git a/pr-checks/excluded.yml b/pr-checks/excluded.yml index d8d643d107..1a5262fc0b 100644 --- a/pr-checks/excluded.yml +++ b/pr-checks/excluded.yml @@ -10,6 +10,7 @@ is: - "check-expected-release-files" - "Cleanup artifacts" - "CodeQL" + - "copilot-pull-request-reviewer" - "Dependabot" - "Label PR with size" - "Post repo size comment" diff --git a/pr-checks/package.json b/pr-checks/package.json index 63bfa3ddf5..07d599bb68 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -12,6 +12,6 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.1" } } diff --git a/pr-checks/prepare-changelog.test.ts b/pr-checks/prepare-changelog.test.ts new file mode 100644 index 0000000000..13a302c8f6 --- /dev/null +++ b/pr-checks/prepare-changelog.test.ts @@ -0,0 +1,54 @@ +/** + * Tests for `prepare-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { EMPTY_CHANGELOG, NO_CHANGES_STR } from "./changelog"; +import { extractChangelogSnippet } from "./prepare-changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "prepare-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +const testBody = `- Test change`; +const testChangelog = `${EMPTY_CHANGELOG.replace(NO_CHANGES_STR, testBody)} + +## Another section + +- Other change`; + +describe("extractChangelogSnippet", async () => { + await it("returns the default body if the input doesn't exist", async () => { + const result = extractChangelogSnippet(path.join(testDir, "not-here.md")); + assert.deepEqual(result, NO_CHANGES_STR); + }); + + await it("returns the first section if the input exists", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, testChangelog); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, testBody); + }); + + await it("returns an empty string if there is no first section", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, "# CodeQL Action Changelog\n"); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, ""); + }); +}); diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts new file mode 100755 index 0000000000..0c89699fc8 --- /dev/null +++ b/pr-checks/prepare-changelog.ts @@ -0,0 +1,82 @@ +#!/usr/bin/env npx tsx + +/** + * Extracts the body of the first changelog section and outputs it to either + * stdout or a file. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { NO_CHANGES_STR, parseChangelog } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; + +/** + * Prepare the changelog for the new release + * This function will extract the part of the changelog that + * we want to include in the new release. + * + * @param changelogPath The path to the changelog file. + */ +export function extractChangelogSnippet(changelogPath: string) { + try { + const content = fs.readFileSync(changelogPath, "utf-8"); + const changelog = parseChangelog(content); + + // Return an empty string if we couldn't find the first section. + if (changelog.sections.length === 0) { + return ""; + } + + return changelog.sections[0].bodyLines.join("\n").trim(); + } catch (err) { + if (err instanceof Error && "code" in err && err.code === "ENOENT") { + console.error(`Changelog file at '${changelogPath}' does not exist.`); + return NO_CHANGES_STR; + } else { + throw Error( + `Failed to open changelog file at '${changelogPath}': ${getErrorMessage(err)}`, + ); + } + } +} + +function main() { + try { + const { values } = parseArgs({ + options: { + changelog: { + type: "string", + short: "f", + default: CHANGELOG_FILE, + }, + output: { + type: "string", + short: "o", + }, + }, + strict: true, + }); + + const body = extractChangelogSnippet(values.changelog); + + // If no `output` argument was provided, output to stdout. Otherwise, + // write a file to the specified path. + if (values.output === undefined) { + console.info(body); + } else { + fs.writeFileSync(values.output, body); + } + + return 0; + } catch (err) { + console.error(`Failed to prepare changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/rollback-changelog.test.ts b/pr-checks/rollback-changelog.test.ts new file mode 100644 index 0000000000..5264755a69 --- /dev/null +++ b/pr-checks/rollback-changelog.test.ts @@ -0,0 +1,45 @@ +/** + * Tests for `rollback-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import { describe, it } from "node:test"; + +import { getReleaseDateString, parseChangelog } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { updateChangelog } from "./rollback-changelog"; + +describe("updateChangelog", async () => { + await it("replaces the first section with one for the rollback release", async () => { + const actualChangelog = parseChangelog( + fs.readFileSync(CHANGELOG_FILE, "utf-8"), + ); + const existingFirstSection = actualChangelog.sections[0]; + + const today = new Date(); + updateChangelog(actualChangelog, { + "new-version": "Test.1.3", + "rollback-version": "Test.1.2", + "target-version": "Test.1.1", + today, + }); + + // Check that the old, first section is gone. + for (const section of actualChangelog.sections) { + assert.notDeepEqual(section, existingFirstSection); + } + + // Check that the new, first section matches our expectations. + const newFirstSection = actualChangelog.sections[0]; + assert.deepEqual( + newFirstSection.headerLine, + `## Test.1.3 - ${getReleaseDateString(today)}`, + ); + assert.equal(newFirstSection.bodyLines.length, 3); + assert.deepEqual( + newFirstSection.bodyLines[1], + `This release rolls back Test.1.2 due to issues with that release. It is identical to Test.1.1.`, + ); + }); +}); diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts new file mode 100755 index 0000000000..15a37b1b7c --- /dev/null +++ b/pr-checks/rollback-changelog.ts @@ -0,0 +1,84 @@ +#!/usr/bin/env npx tsx + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { + Changelog, + ChangelogSection, + getReleaseDateString, + parseChangelog, + renderChangelog, +} from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; + +export interface RollbackChangelogInputs { + "target-version": string; + "rollback-version": string; + "new-version": string; + today?: Date; +} + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ +export function updateChangelog( + changelog: Changelog, + versions: RollbackChangelogInputs, +) { + // Drop the existing first section. + changelog.sections.shift(); + + // Construct the section for the rollback version. + const newSection: ChangelogSection = { + headerLine: `## ${versions["new-version"]} - ${getReleaseDateString(versions.today)}`, + bodyLines: [ + "", + `This release rolls back ${versions["rollback-version"]} due to issues with that release. It is identical to ${versions["target-version"]}.`, + "", + ], + }; + + // Add the new section at the top of the changelog. + changelog.sections.unshift(newSection); +} + +function main() { + try { + const options = { + "target-version": { type: "string", short: "t" }, + "rollback-version": { type: "string", short: "r" }, + "new-version": { type: "string", short: "n" }, + } as const; + + const { values } = parseArgs({ options, strict: true }); + + for (const key of Object.keys(options)) { + const val = values[key as keyof typeof values]; + if (val === undefined || val.trim() === "") { + throw new Error(`Argument '--${key}' is required.`); + } + } + + const changelog = parseChangelog(fs.readFileSync(CHANGELOG_FILE, "utf-8")); + updateChangelog(changelog, values as RollbackChangelogInputs); + console.info(renderChangelog(changelog)); + + return 0; + } catch (err) { + console.error( + `Failed to prepare rollback changelog: ${getErrorMessage(err)}`, + ); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..0517feddbd 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -233,8 +233,8 @@ const languageSetups: LanguageSetups = { name: "Install Go", uses: pinnedUses( "actions/setup-go", - "924ae3a1cded613372ab5595356fb5720e22ba16", - "v6.5.0", + "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", + "v7.0.0", ), with: { "go-version": `\${{ inputs.go-version || '${defaultLanguageVersions.go}' }}`, @@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = { name: "Install Java", uses: pinnedUses( "actions/setup-java", - "0f481fcb613427c0f801b606911222b5b6f3083a", - "v5.5.0", + "03ad4de0992f5dab5e18fcb136590ce7c4a0ac95", + "v5.6.0", ), with: { "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`, @@ -271,8 +271,8 @@ const languageSetups: LanguageSetups = { name: "Install Python", uses: pinnedUses( "actions/setup-python", - "ece7cb06caefa5fff74198d8649806c4678c61a1", - "v6.3.0", + "5fda3b95a4ea91299a34e894583c3862153e4b97", + "v7.0.0", ), with: { "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`, @@ -288,8 +288,8 @@ const languageSetups: LanguageSetups = { name: "Install .NET", uses: pinnedUses( "actions/setup-dotnet", - "26b0ec14cb23fa6904739307f278c14f94c95bf1", - "v5.4.0", + "a98b56852c35b8e3190ac28c8c2271da59106c68", + "v6.0.0", ), with: { "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`, @@ -529,8 +529,8 @@ function generateJob( name: "Check out repository", uses: pinnedUses( "actions/checkout", - "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", - "v7.0.0", + "3d3c42e5aac5ba805825da76410c181273ba90b1", + "v7.0.1", ), }, ...setupInfo.steps, diff --git a/pr-checks/util.ts b/pr-checks/util.ts new file mode 100644 index 0000000000..353b2a9654 --- /dev/null +++ b/pr-checks/util.ts @@ -0,0 +1,9 @@ +/** + * Returns an appropriate message for the error. + * + * If the error is an `Error` instance, this returns the error message without + * an `Error: ` prefix. + */ +export function getErrorMessage(error: unknown): string { + return error instanceof Error ? error.message : String(error); +} diff --git a/src/api-client.test.ts b/src/api-client.test.ts index e43f16ef29..ae8c6269b1 100644 --- a/src/api-client.test.ts +++ b/src/api-client.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import * as githubUtils from "@actions/github/lib/utils"; import test from "ava"; import * as sinon from "sinon"; +import { ProxyAgent } from "undici"; import * as actionsUtil from "./actions-util"; import * as api from "./api-client"; @@ -251,3 +252,23 @@ test("getRegistryProxyConfig - gets the configuration from the env vars", async ) .passes(t.like, { host, port, ca }); }); + +test("makeProxyRequestOptions - returns defaults without custom proxy", async (t) => { + t.deepEqual( + api.makeProxyRequestOptions(undefined), + githubUtils.defaults.request, + ); +}); + +test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => { + const opts = api.makeProxyRequestOptions( + new ProxyAgent("http://localhost:1080"), + ); + // Fetch should be different from the defaults. + t.notDeepEqual(opts?.fetch, githubUtils.defaults.request?.fetch); + // The options should be the same aside from that. + t.deepEqual( + { ...opts, fetch: githubUtils.defaults.request?.fetch }, + githubUtils.defaults.request, + ); +}); diff --git a/src/api-client.ts b/src/api-client.ts index 7c63b5a6fe..ba800a2587 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -108,12 +108,19 @@ export function getRegistryProxy( * Constructs a `RequestRequestOptions` with a custom `fetch` implementation * that uses `dispatcher` as a proxy for requests. * - * @param dispatcher The proxy to use. + * @param dispatcher The proxy to use, if any. */ export function makeProxyRequestOptions( - dispatcher: ProxyAgent, -): RequestRequestOptions { + dispatcher: ProxyAgent | undefined, +): RequestRequestOptions | undefined { + // If we don't have a custom `ProxyAgent`, return the defaults. + if (dispatcher === undefined) { + return githubUtils.defaults.request; + } + + // Otherwise, construct the custom `fetch` and add it onto the defaults. return { + ...githubUtils.defaults.request, fetch: (req: RequestInfo, init?: RequestInit) => { return undiciFetch(req, { ...init, dispatcher }); }, @@ -136,10 +143,7 @@ function createApiClientWithDetails( const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry.retry); - const requestOptions = - proxy === undefined - ? githubUtils.defaults.request - : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth, { baseUrl: apiDetails.apiURL, diff --git a/src/codeql.test.ts b/src/codeql.test.ts index dea4cf04af..84f48b83c9 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -156,6 +156,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `0.0.0-${version}`)); t.is(result.toolsVersion, `0.0.0-${version}`); t.is(result.toolsSource, ToolsSource.Download); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } t.is(toolcache.findAllVersions("CodeQL").length, 2); @@ -191,9 +192,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `2.15.0`)); t.is(result.toolsVersion, `2.15.0`); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -230,9 +229,7 @@ test.serial( t.assert(toolcache.find("CodeQL", "0.0.0-20200610")); t.deepEqual(result.toolsVersion, "0.0.0-20200610"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -282,11 +279,7 @@ for (const { t.assert(toolcache.find("CodeQL", expectedToolcacheVersion)); t.deepEqual(result.toolsVersion, expectedToolcacheVersion); t.is(result.toolsSource, ToolsSource.Download); - t.assert( - Number.isInteger( - result.toolsDownloadStatusReport?.downloadDurationMs, - ), - ); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -330,9 +323,7 @@ for (const toolcacheVersion of [ SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion, ); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); }); }, ); @@ -373,9 +364,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, "0.0.0-20200601"); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -421,9 +410,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -462,9 +449,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -506,9 +491,7 @@ test.serial( t.is(result.toolsVersion, "0.0.0-20230203"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -519,15 +502,11 @@ test.serial( }, ); -function assertDurationsInteger( +function assertDownloadDurationInteger( t: ExecutionContext, - statusReport: ToolsDownloadStatusReport, + statusReport: ToolsDownloadStatusReport | undefined, ) { - t.assert(Number.isInteger(statusReport?.combinedDurationMs)); - if (statusReport.downloadDurationMs !== undefined) { - t.assert(Number.isInteger(statusReport?.downloadDurationMs)); - t.assert(Number.isInteger(statusReport?.extractionDurationMs)); - } + t.assert(Number.isInteger(statusReport?.downloadDurationMs)); } test.serial("getExtraOptions works for explicit paths", (t) => { diff --git a/src/codeql.ts b/src/codeql.ts index f98130f118..a29df90865 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -27,7 +27,6 @@ import { Logger } from "./logging"; import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import * as setupCodeql from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature, isSupportedToolsFeature } from "./tools-features"; import { shouldEnableIndirectTracing } from "./tracer-config"; @@ -319,7 +318,6 @@ export async function setupCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: setupCodeql.ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { try { const { @@ -327,7 +325,6 @@ export async function setupCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, } = await setupCodeql.setupCodeQLBundle( toolsInput, apiDetails, @@ -340,12 +337,6 @@ export async function setupCodeQL( logger, ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport, - )}`, - ); - let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; @@ -361,7 +352,6 @@ export async function setupCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } catch (rawError) { const e = api.wrapApiConfigurationError(rawError); diff --git a/src/config-utils.ts b/src/config-utils.ts index 040cdc7060..b5a880ba7b 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -1166,7 +1166,6 @@ export async function initConfig( try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); // Throw the error in test mode so it's more visible, unless the environment @@ -1644,26 +1643,6 @@ export function getPrimaryAnalysisConfig(config: Config): AnalysisConfig { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -/** Logs the Git version as a telemetry diagnostic. */ -async function logGitVersionTelemetry( - config: Config, - gitVersion: GitVersionInfo, -): Promise { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion, - }, - ), - ); - } -} - /** * Logs the time it took to identify generated files and how many were discovered as * a telemetry diagnostic. diff --git a/src/config/file.test.ts b/src/config/file.test.ts index 22e2f795f8..0833ad3d06 100644 --- a/src/config/file.test.ts +++ b/src/config/file.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import test from "ava"; import sinon from "sinon"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import { RegistryProxyVars } from "../environment"; import { Feature } from "../feature-flags"; @@ -18,7 +19,7 @@ setupTests(test); test("getConfigFileInput returns undefined by default", async (t) => { await callee(getConfigFileInput) - .withArgs({}) + .withArgs({}, undefined) .withFeatures([Feature.ConfigFileRepositoryProperty]) .passes(t.is, undefined); }); @@ -40,7 +41,7 @@ test("getConfigFileInput returns input value", async (t) => { .withArgs("config-file") .returns(testInput); }) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from workflow") .passes(t.is, testInput); }); @@ -49,16 +50,48 @@ test("getConfigFileInput returns repository property value", async (t) => { // Since there is no direct input, we should use the repository property. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from repository property") .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); }); +test("getConfigFileInput returns repository property value for Code Scanning", async (t) => { + // Since there is no direct input, we should use the repository property. + await callee(getConfigFileInput) + .withFeatures([Feature.ConfigFileRepositoryProperty]) + .withArgs(repositoryProperties, [AnalysisKind.CodeScanning]) + .logs(t, "Using configuration file input from repository property") + .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); +}); + +test("getConfigFileInput ignores repository property for other analysis kinds", async (t) => { + const unsupportedCases = [ + [AnalysisKind.CodeQuality], + [AnalysisKind.RiskAssessment], + [AnalysisKind.CodeScanning, AnalysisKind.CodeQuality], + ]; + + const target = callee(getConfigFileInput).withFeatures([ + Feature.ConfigFileRepositoryProperty, + ]); + + for (const unsupportedCase of unsupportedCases) { + // Since the analysis kind is unsupported, we should ignore the repository property. + await target + .withArgs(repositoryProperties, unsupportedCase) + .logs( + t, + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ) + .passes(t.is, undefined); + } +}); + test("getConfigFileInput ignores empty repository property value", async (t) => { // Since the repository property value is an empty/whitespace string, we should ignore it. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }) + .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }, undefined) .passes(t.is, undefined); }); @@ -66,7 +99,7 @@ test("getConfigFileInput ignores repository property value when FF is off", asyn // Since the FF is off, we should ignore the repository property value. await callee(getConfigFileInput) .withFeatures([]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .notLogs(t, "Using configuration file input from repository property") .logs( t, diff --git a/src/config/file.ts b/src/config/file.ts index 8cb7bc3a11..be0e415a38 100644 --- a/src/config/file.ts +++ b/src/config/file.ts @@ -1,4 +1,5 @@ import { ActionState } from "../action-common"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import * as errorMessages from "../error-messages"; import { Feature } from "../feature-flags"; @@ -34,6 +35,7 @@ export async function getConfigFileInput( features, }: ActionState<["Logger", "Actions", "FeatureFlags"]>, repositoryProperties: Partial, + analysisKinds: AnalysisKind[] | undefined, ): Promise { const input = actions.getOptionalInput("config-file"); @@ -45,17 +47,29 @@ export async function getConfigFileInput( const propertyValue = repositoryProperties[RepositoryPropertyName.CONFIG_FILE]; + // Only allow the repository property to be used for standard Code Scanning analyses, + // since we don't currently support some customisation options for Code Quality. + // We don't expect customisations for Risk Assessments either. + const analysisKindSupported = + analysisKinds === undefined || + (analysisKinds.includes(AnalysisKind.CodeScanning) && + analysisKinds.length === 1); + if (propertyValue !== undefined && propertyValue.trim().length > 0) { // Only use the repository property value if the FF is enabled. const useRepositoryProperty = await features.getValue( Feature.ConfigFileRepositoryProperty, ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}`, ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled.", diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts new file mode 100644 index 0000000000..a91dc258ea --- /dev/null +++ b/src/config/inputs.test.ts @@ -0,0 +1,97 @@ +import test from "ava"; +import sinon from "sinon"; + +import { getActionsEnv } from "../actions-util"; +import { Feature } from "../feature-flags"; +import { RepositoryPropertyName } from "../feature-flags/properties"; +import { callee } from "../testing-utils"; + +import { ComputedInput, getToolsInput, InputName, InputSource } from "./inputs"; + +test("getToolsInput - undefined if there's no input", async (t) => { + await callee(getToolsInput).withArgs({}).passes(t.is, undefined); +}); + +const expectedWorkflowResult: ComputedInput = { + source: InputSource.Workflow, + value: "workflow-input-value", +}; + +const expectedRepositoryPropertyResult: ComputedInput = { + source: InputSource.RepositoryProperty, + value: "repo-property-input-value", +}; + +function stubGetToolsInput() { + const actions = getActionsEnv(); + sinon + .stub(actions, "getOptionalInput") + .withArgs(InputName.Tools) + .returns(expectedWorkflowResult.value); + return actions; +} + +const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`; + +test("getToolsInput - returns workflow input if available", async (t) => { + const actions = stubGetToolsInput(); + + await callee(getToolsInput) + .withActions(actions) + .withArgs({}) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property value if enforced", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`, + }); + + // We expect the repository value if provided and the FF is enabled. + const enforcedLogMessage = `Using ${InputName.Tools} input from repository property (enforced):`; + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, enforcedLogMessage) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target + .notLogs(t, enforcedLogMessage) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - prefers workflow input", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the workflow input regardless of the FF state. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); + await target + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property", async (t) => { + const target = callee(getToolsInput).withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the repository property if the FF is enabled or undefined otherwise. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, `Using ${InputName.Tools} input from repository property:`) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target.passes(t.is, undefined); +}); diff --git a/src/config/inputs.ts b/src/config/inputs.ts new file mode 100644 index 0000000000..32a8dfd6f6 --- /dev/null +++ b/src/config/inputs.ts @@ -0,0 +1,80 @@ +import { ActionState } from "../action-common"; +import { Feature } from "../feature-flags"; +import { + RepositoryProperties, + RepositoryPropertyName, +} from "../feature-flags/properties"; + +/** Enumerates input names. */ +export enum InputName { + Tools = "tools", +} + +/** Enumerates input sources. */ +export enum InputSource { + Workflow = "workflow", + RepositoryProperty = "repository-property", +} + +/** + * Represents an effective input to the CodeQL Action. That is, + * the input value that was computed or selected from multiple sources. + */ +export type ComputedInput = { + /** The value of the property. */ + value: string; + /** The source of the property. */ + source: InputSource; +}; + +/** + * Gets the computed `tools` input. This comes from either the workflow or + * the repository property. + * + * @param action The Action state. + * @param repositoryProperties The values of known repository properties. + * @returns The computed input or `undefined` if there is no input. + */ +export async function getToolsInput( + action: ActionState<["Logger", "Actions", "FeatureFlags"]>, + repositoryProperties: Partial, +): Promise { + const name = InputName.Tools; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS]; + const allowRepositoryProperty = await action.features.getValue( + Feature.ToolsRepositoryProperty, + ); + + // The repository property takes precedence if it starts with an '!'. + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}`, + ); + return { + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: InputSource.RepositoryProperty, + }; + } + + // Otherwise, the input from the workflow takes precedence. + if (input !== undefined) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { value: input, source: InputSource.Workflow }; + } + + // Use the repository property if there's no workflow input. + if (allowRepositoryProperty && propertyValue !== undefined) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}`, + ); + return { + value: propertyValue, + source: InputSource.RepositoryProperty, + }; + } + + // There's no input. + return undefined; +} diff --git a/src/defaults.json b/src/defaults.json index 39ecfc35fa..558dce6e24 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.2", + "cliVersion": "2.26.2", + "priorBundleVersion": "codeql-bundle-v2.26.1", + "priorCliVersion": "2.26.1" } diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 0c92ac69af..b3107af962 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -74,7 +74,6 @@ export enum Feature { AllowMergeConfigFiles = "allow_merge_config_files", /** Controls whether we allow multiple values for the `analysis-kinds` input. */ AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds", - AllowToolcacheInput = "allow_toolcache_input", CleanupTrapCaches = "cleanup_trap_caches", /** Whether to allow the `config-file` input to be specified via a repository property. */ ConfigFileRepositoryProperty = "config_file_repository_property", @@ -141,6 +140,8 @@ export enum Feature { /** Note that this currently only disables baseline file coverage information. */ SkipFileCoverageOnPrs = "skip_file_coverage_on_prs", StartProxyUseFeaturesRelease = "start_proxy_use_features_release", + /** Whether to allow the `tools` input to be specified via a repository property. */ + ToolsRepositoryProperty = "tools_repository_property", UploadOverlayDbToApi = "upload_overlay_db_to_api", ValidateDbConfig = "validate_db_config", } @@ -185,11 +186,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: undefined, }, - [Feature.AllowToolcacheInput]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: undefined, - }, [Feature.CleanupTrapCaches]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", @@ -400,6 +396,11 @@ export const featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: undefined, }, + [Feature.ToolsRepositoryProperty]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: undefined, + }, [Feature.UploadOverlayDbToApi]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", diff --git a/src/feature-flags/properties.test.ts b/src/feature-flags/properties.test.ts index 66526b1fb2..d3094a8d1c 100644 --- a/src/feature-flags/properties.test.ts +++ b/src/feature-flags/properties.test.ts @@ -72,13 +72,17 @@ test.serial( ); test.serial("loadPropertiesFromApi loads known properties", async (t) => { + const knownProperties = [ + { property_name: "github-codeql-config-file", value: "owner/repo" }, + { property_name: "github-codeql-extra-queries", value: "+queries" }, + { property_name: "github-codeql-tools", value: "nightly" }, + ]; sinon.stub(api, "getRepositoryProperties").resolves({ headers: {}, status: 200, url: "", data: [ - { property_name: "github-codeql-config-file", value: "owner/repo" }, - { property_name: "github-codeql-extra-queries", value: "+queries" }, + ...knownProperties, { property_name: "unknown-property", value: "something" }, ] satisfies properties.GitHubPropertiesResponse, }); @@ -88,10 +92,12 @@ test.serial("loadPropertiesFromApi loads known properties", async (t) => { logger, mockRepositoryNwo, ); - t.deepEqual(response, { - "github-codeql-config-file": "owner/repo", - "github-codeql-extra-queries": "+queries", - }); + t.deepEqual( + response, + Object.fromEntries( + knownProperties.map((prop) => [prop.property_name, prop.value]), + ), + ); }); test.serial("loadPropertiesFromApi parses true boolean property", async (t) => { diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts index e239c71947..4c888bd5ec 100644 --- a/src/feature-flags/properties.ts +++ b/src/feature-flags/properties.ts @@ -1,7 +1,10 @@ +import * as github from "@actions/github"; + import { isDynamicWorkflow } from "../actions-util"; import { getRepositoryProperties } from "../api-client"; import { Logger } from "../logging"; import { RepositoryNwo } from "../repository"; +import { Failure, getErrorMessage, Result, Success } from "../util"; /** The common prefix that we expect all of our repository properties to have. */ export const GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; @@ -14,6 +17,7 @@ export enum RepositoryPropertyName { DISABLE_OVERLAY = "github-codeql-disable-overlay", EXTRA_QUERIES = "github-codeql-extra-queries", FILE_COVERAGE_ON_PRS = "github-codeql-file-coverage-on-prs", + TOOLS = "github-codeql-tools", } /** Parsed types of the known repository properties. */ @@ -22,6 +26,7 @@ export type AllRepositoryProperties = { [RepositoryPropertyName.DISABLE_OVERLAY]: boolean; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: boolean; + [RepositoryPropertyName.TOOLS]: string; }; /** Parsed repository properties. */ @@ -33,6 +38,7 @@ export type RepositoryPropertyApiType = { [RepositoryPropertyName.DISABLE_OVERLAY]: string; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: string; + [RepositoryPropertyName.TOOLS]: string; }; /** The type of functions which take the `value` from the API and try to convert it to the type we want. */ @@ -81,6 +87,7 @@ const repositoryPropertyParsers: { [RepositoryPropertyName.DISABLE_OVERLAY]: booleanProperty, [RepositoryPropertyName.EXTRA_QUERIES]: stringProperty, [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: booleanProperty, + [RepositoryPropertyName.TOOLS]: stringProperty, }; /** @@ -230,3 +237,35 @@ const KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name: string): name is RepositoryPropertyName { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } + +/** + * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. + */ +export async function loadRepositoryProperties( + repositoryNwo: RepositoryNwo, + logger: Logger, +): Promise> { + // See if we can skip loading repository properties early. In particular, + // repositories owned by users cannot have repository properties, so we can + // skip the API call entirely in that case. + const repositoryOwnerType = github.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and " + + "therefore cannot have repository properties.", + ); + return new Success({}); + } + + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error)}`, + ); + return new Failure(error); + } +} diff --git a/src/init-action.ts b/src/init-action.ts index 8d0434160b..4b52ba6ec6 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -2,7 +2,6 @@ import * as fs from "fs"; import * as path from "path"; import * as core from "@actions/core"; -import * as github from "@actions/github"; import * as io from "@actions/io"; import * as semver from "semver"; import { v4 as uuidV4 } from "uuid"; @@ -26,6 +25,7 @@ import { } from "./caching-utils"; import { CodeQL } from "./codeql"; import { getConfigFileInput } from "./config/file"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import * as configUtils from "./config-utils"; import { DependencyCacheRestoreStatusReport, @@ -41,10 +41,7 @@ import { } from "./diagnostics"; import { EnvVar } from "./environment"; import { Feature, FeatureEnablement, initFeatures } from "./feature-flags"; -import { - loadPropertiesFromApi, - RepositoryProperties, -} from "./feature-flags/properties"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { checkInstallPython311, checkPacksForOverlayCompatibility, @@ -62,7 +59,7 @@ import { OverlayBaseDatabaseDownloadStats, } from "./overlay/caching"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; -import { getRepositoryNwo, RepositoryNwo } from "./repository"; +import { getRepositoryNwo } from "./repository"; import { ToolsSource } from "./setup-codeql"; import { ActionName, @@ -74,7 +71,6 @@ import { getActionsStatus, sendStatusReport, } from "./status-report"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature } from "./tools-features"; import { getCombinedTracerConfig } from "./tracer-config"; @@ -94,10 +90,7 @@ import { checkActionVersion, getErrorMessage, BuildMode, - Result, getOptionalEnvVar, - Success, - Failure, } from "./util"; import { checkWorkflow } from "./workflow"; @@ -137,6 +130,7 @@ async function sendCompletedStatusReport( startedAt: Date, config: configUtils.Config | undefined, configFile: string | undefined, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -165,12 +159,16 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: workflowLanguages || "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { @@ -218,11 +216,11 @@ async function run( let codeql: CodeQL; let features: FeatureEnablement; let sourceRoot: string; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; let toolsVersion: string; - let zstdAvailability: ZstdAvailability | undefined; try { initializeEnvironment(getActionVersion()); @@ -264,12 +262,6 @@ async function run( core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties, - ); - // path.resolve() respects the intended semantics of source-root. If // source-root is relative, it is relative to the GITHUB_WORKSPACE. If // source-root is absolute, it is used as given. @@ -292,6 +284,14 @@ async function run( ); } + // Compute the value of the `config-file` input. + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties, + analysisKinds, + ); + // Send a status report indicating that an analysis is starting. await sendStartingStatusReport(startedAt, { analysisKinds }, logger); @@ -302,6 +302,12 @@ async function run( ); } + // Get the computed `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -312,7 +318,7 @@ async function run( analysisKinds?.length === 1 && analysisKinds[0] === AnalysisKind.CodeScanning; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -326,7 +332,6 @@ async function run( toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; // Check the workflow for problems. If there are any problems, they are reported // to the workflow log. No exceptions are thrown. @@ -497,22 +502,6 @@ async function run( cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } - - // Log CodeQL download telemetry, if appropriate - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport, - ), - ); - } - // Forward Go flags const goFlags = process.env["GOFLAGS"]; if (goFlags) { @@ -778,6 +767,7 @@ async function run( startedAt, config, undefined, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -795,6 +785,7 @@ async function run( startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -805,52 +796,6 @@ async function run( ); } -/** - * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. - */ -async function loadRepositoryProperties( - repositoryNwo: RepositoryNwo, - logger: Logger, -): Promise> { - // See if we can skip loading repository properties early. In particular, - // repositories owned by users cannot have repository properties, so we can - // skip the API call entirely in that case. - const repositoryOwnerType = github.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and " + - "therefore cannot have repository properties.", - ); - return new Success({}); - } - - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error)}`, - ); - return new Failure(error); - } -} - -async function recordZstdAvailability( - config: configUtils.Config, - zstdAvailability: ZstdAvailability, -) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability, - ), - ); -} - /** Defines the `init` Action. */ const init: Action = { name: ActionName.Init, diff --git a/src/init.ts b/src/init.ts index 53efbe99a3..dee62913c2 100644 --- a/src/init.ts +++ b/src/init.ts @@ -30,7 +30,6 @@ import { import { BuiltInLanguage, Language } from "./languages"; import { Logger, withGroupAsync } from "./logging"; import { ToolsSource } from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import * as util from "./util"; @@ -49,27 +48,21 @@ export async function initCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion, - zstdAvailability, - } = await setupCodeQL( - toolsInput, - apiDetails, - tempDir, - variant, - defaultCliVersion, - rawLanguages, - useOverlayAwareDefaultCliVersion, - features, - logger, - true, - ); + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = + await setupCodeQL( + toolsInput, + apiDetails, + tempDir, + variant, + defaultCliVersion, + rawLanguages, + useOverlayAwareDefaultCliVersion, + features, + logger, + true, + ); await codeql.printVersion(); logger.endGroup(); return { @@ -77,7 +70,6 @@ export async function initCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 3336afc1a2..b2a9e90f36 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -11,9 +11,11 @@ import { import { AnalysisKind, getAnalysisKinds } from "./analyses"; import { getGitHubVersion } from "./api-client"; import { CodeQL } from "./codeql"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { initCodeQL } from "./init"; import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; @@ -43,6 +45,7 @@ import { */ async function sendCompletedStatusReport( startedAt: Date, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -67,12 +70,16 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { @@ -87,14 +94,15 @@ async function sendCompletedStatusReport( } /** The main behaviour of this action. */ -async function run({ - startedAt, - logger, -}: ActionState<["Base", "Logger"]>): Promise { +async function run( + actionState: ActionState<["Base", "Logger", "Actions"]>, +): Promise { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. + const { logger, startedAt } = actionState; let codeql: CodeQL; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -123,6 +131,15 @@ async function run({ logger, ); + // Fetch the values of known repository properties that affect us. + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger, + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + + const actionStateWithFeatures = { ...actionState, features }; + const jobRunUuid = uuidV4(); logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); @@ -138,6 +155,13 @@ async function run({ if (statusReportBase !== undefined) { await sendStatusReport(statusReportBase); } + + // Get the computed `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -146,7 +170,7 @@ async function run({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -187,6 +211,7 @@ async function run({ await sendCompletedStatusReport( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index f2ba43c101..219e39984c 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -117,30 +117,69 @@ test.serial( }, ); -test.serial( - "getCodeQLSource correctly returns bundled CLI version when tools == linked", - async (t) => { - const features = createFeatures([]); - - await withTmpDir(async (tmpDir) => { - setupActionsVars(tmpDir, tmpDir); - const source = await setupCodeql.getCodeQLSource( - "linked", - SAMPLE_DEFAULT_CLI_VERSION, - undefined, // rawLanguages - false, // useOverlayAwareDefaultCliVersion - SAMPLE_DOTCOM_API_DETAILS, - GitHubVariant.DOTCOM, - false, - features, - getRunnerLogger(true), - ); - - t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); - t.is(source.sourceType, "download"); - }); +const LINKED_BUNDLE_TEST_CASES = [ + { + platform: "linux", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-linux64.tar.zst", + expectedCompressionMethod: "zstd", }, -); + { + platform: "darwin", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-osx64.tar.zst", + expectedCompressionMethod: "zstd", + }, + { + platform: "win32", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-win64.tar.gz", + expectedCompressionMethod: "gzip", + }, + { + platform: "linux", + tarSupportsZstd: false, + expectedBundleName: "codeql-bundle-linux64.tar.gz", + expectedCompressionMethod: "gzip", + }, +] as const; + +for (const { + platform, + tarSupportsZstd, + expectedBundleName, + expectedCompressionMethod, +} of LINKED_BUNDLE_TEST_CASES) { + test.serial( + `getCodeQLSource selects ${expectedBundleName} for linked tools`, + async (t) => { + const features = createFeatures([]); + sinon.stub(process, "platform").value(platform); + + await withTmpDir(async (tmpDir) => { + setupActionsVars(tmpDir, tmpDir); + const source = await setupCodeql.getCodeQLSource( + "linked", + SAMPLE_DEFAULT_CLI_VERSION, + undefined, // rawLanguages + false, // useOverlayAwareDefaultCliVersion + SAMPLE_DOTCOM_API_DETAILS, + GitHubVariant.DOTCOM, + tarSupportsZstd, + features, + getRunnerLogger(true), + ); + + t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); + t.is(source.sourceType, "download"); + if (source.sourceType === "download") { + t.is(source.compressionMethod, expectedCompressionMethod); + t.true(source.codeqlURL.endsWith(`/${expectedBundleName}`)); + } + }); + }, + ); +} test.serial( "getCodeQLSource correctly returns bundled CLI version when tools == latest", @@ -194,12 +233,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: "toolsUrl", }, toolsVersion: LINKED_CLI_VERSION.cliVersion, }); @@ -251,12 +285,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: bundleUrl, }, toolsVersion: expectedVersion, }); @@ -422,7 +451,7 @@ test.serial( async (t) => { const loggedMessages: LoggedMessage[] = []; const logger = getRecordingLogger(loggedMessages); - const features = createFeatures([Feature.AllowToolcacheInput]); + const features = createFeatures([]); const latestToolcacheVersion = "3.2.1"; const latestVersionPath = "/path/to/latest"; @@ -551,7 +580,7 @@ const toolcacheInputFallbackMacro = makeMacro({ toolcacheInputFallbackMacro.serial( "the toolcache doesn't have a CodeQL CLI when tools == toolcache", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "dynamic" }, [], [ @@ -562,7 +591,7 @@ toolcacheInputFallbackMacro.serial( toolcacheInputFallbackMacro.serial( "the workflow trigger is not `dynamic`", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "pull_request" }, [], [ @@ -570,14 +599,6 @@ toolcacheInputFallbackMacro.serial( ], ); -toolcacheInputFallbackMacro.serial( - "the feature flag is not enabled", - [], - { GITHUB_EVENT_NAME: "dynamic" }, - [], - [`Ignoring 'tools: toolcache' because the feature is not enabled.`], -); - test.serial( 'tryGetTagNameFromUrl extracts the right tag name for a repo name containing "codeql-bundle"', (t) => { diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 3db0b6ca4d..8d374585aa 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -533,11 +533,7 @@ export async function getCodeQLSource( // We only allow `toolsInput === "toolcache"` for `dynamic` events. In general, using `toolsInput === "toolcache"` // can lead to alert wobble and so it shouldn't be used for an analysis where results are intended to be uploaded. // We also allow this in test mode. - const allowToolcacheValueFF = await features.getValue( - Feature.AllowToolcacheInput, - ); - const allowToolcacheValue = - allowToolcacheValueFF && (isDynamicWorkflow() || util.isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || util.isInTestMode(); if (allowToolcacheValue) { // If `toolsInput === "toolcache"`, try to find the latest version of the CLI that's available in the toolcache // and use that. We perform this check here since we can set `cliVersion` directly and don't want to default to @@ -558,15 +554,9 @@ export async function getCodeQLSource( `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`, ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.`, - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, + ); } const version = await resolveDefaultCliVersion( @@ -921,7 +911,6 @@ interface SetupCodeQLResult { toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: tar.ZstdAvailability; } /** @@ -1005,7 +994,6 @@ export async function setupCodeQLBundle( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 52132b7649..9086dd34ef 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -71,6 +71,7 @@ test.serial("createStatusReportBase", async (t) => { t.is(statusReport.build_mode, BuildMode.None); t.is(statusReport.cause, "failure cause"); t.is(statusReport.commit_oid, process.env["GITHUB_SHA"]!); + t.deepEqual(statusReport.computed_inputs, {}); t.is(statusReport.exception, "exception stack trace"); t.is(statusReport.job_name, process.env["GITHUB_JOB"] || ""); t.is(typeof statusReport.job_run_uuid, "string"); diff --git a/src/status-report.ts b/src/status-report.ts index a0c0b3ab40..d9d2a7ba4c 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -13,6 +13,7 @@ import { } from "./actions-util"; import { getAnalysisKey, getApiClient } from "./api-client"; import type { Config } from "./config/action-config"; +import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; @@ -122,6 +123,8 @@ export interface StatusReportBase { commit_oid: string; /** Time this action completed, or undefined if not yet completed. */ completed_at?: string; + /** A mapping of input names to their computed values. */ + computed_inputs: Partial>; /** Stack trace of the failure (or undefined if status is not failure). */ exception?: string; /** Whether this is a first-party (CodeQL) run of the action. */ @@ -316,6 +319,7 @@ export async function createStatusReportBase( analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts new file mode 100644 index 0000000000..e17d38c5be --- /dev/null +++ b/src/tools-download.test.ts @@ -0,0 +1,78 @@ +import { once } from "events"; +import * as path from "path"; + +import * as toolcache from "@actions/tool-cache"; +import test from "ava"; +import nock from "nock"; +import * as sinon from "sinon"; + +import { getRunnerLogger } from "./logging"; +import * as tar from "./tar"; +import { setupTests } from "./testing-utils"; +import { downloadAndExtract } from "./tools-download"; +import { withTmpDir } from "./util"; + +setupTests(test); + +test.serial( + "downloadAndExtract reports the duration when downloading before extracting", + async (t) => { + await withTmpDir(async (tmpDir) => { + const archivePath = path.join(tmpDir, "codeql-bundle.tar.gz"); + const destination = path.join(tmpDir, "codeql"); + sinon.stub(toolcache, "downloadTool").resolves(archivePath); + sinon.stub(tar, "extract").resolves(destination); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.gz", + "gzip", + destination, + undefined, + {}, + undefined, + getRunnerLogger(true), + ); + + t.assert(Number.isInteger(statusReport.downloadDurationMs)); + }); + }, +); + +test.serial( + "downloadAndExtract omits the download duration when streaming extraction", + async (t) => { + await withTmpDir(async (tmpDir) => { + sinon.stub(process, "platform").value("linux"); + const downloadTool = sinon.stub(toolcache, "downloadTool"); + const extractTarZst = sinon + .stub(tar, "extractTarZst") + .callsFake(async (archive) => { + if (typeof archive === "string") { + t.fail("Expected the Zstandard archive to be streamed."); + return; + } + const end = once(archive, "end"); + archive.resume(); + await end; + }); + const request = nock("https://example.com") + .get("/codeql-bundle.tar.zst") + .reply(200, "archive"); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.zst", + "zstd", + path.join(tmpDir, "codeql"), + undefined, + {}, + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + t.deepEqual(statusReport, {}); + t.false(downloadTool.called); + t.true(extractTarZst.calledOnce); + t.true(request.isDone()); + }); + }, +); diff --git a/src/tools-download.ts b/src/tools-download.ts index 5d8a4c5fb9..c19cedb13e 100644 --- a/src/tools-download.ts +++ b/src/tools-download.ts @@ -24,61 +24,9 @@ const STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; // 4 MiB */ const TOOLCACHE_TOOL_NAME = "CodeQL"; -/** - * Timing information for the download and extraction of the CodeQL tools when - * we fully download the bundle before extracting. - */ -type DownloadFirstToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: number; - extractionDurationMs: number; - streamExtraction: false; -}; - -function makeDownloadFirstToolsDownloadDurations( - downloadDurationMs: number, - extractionDurationMs: number, -): DownloadFirstToolsDownloadDurations { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false, - }; -} - -/** - * Timing information for the download and extraction of the CodeQL tools when - * we stream the download and extraction of the bundle. - */ -type StreamedToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: undefined; - extractionDurationMs: undefined; - streamExtraction: true; -}; - -function makeStreamedToolsDownloadDurations( - combinedDurationMs: number, -): StreamedToolsDownloadDurations { - return { - combinedDurationMs, - downloadDurationMs: undefined, - extractionDurationMs: undefined, - streamExtraction: true, - }; -} - -type ToolsDownloadDurations = - | DownloadFirstToolsDownloadDurations - | StreamedToolsDownloadDurations; - export type ToolsDownloadStatusReport = { - cacheDurationMs?: number; - compressionMethod: tar.CompressionMethod; - toolsUrl: string; - zstdFailureReason?: string; -} & ToolsDownloadDurations; + downloadDurationMs?: number; +}; export async function downloadAndExtract( codeqlURL: string, @@ -116,11 +64,7 @@ export async function downloadAndExtract( )}).`, ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs), - }; + return {}; } } catch (e) { core.warning( @@ -170,14 +114,7 @@ export async function downloadAndExtract( await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs, - ), - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming( @@ -241,11 +178,3 @@ export function writeToolcacheMarkerFile( fs.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } - -function sanitizeUrlForStatusReport(url: string): string { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url.startsWith(`https://github.com/${repo}/releases/download/`), - ) - ? url - : "sanitized-value"; -}