Merge pull request #1947 from github/update-v2.22.3-82ba90b1d

Merge main into releases/v2

.github/workflows/__export-file-baseline-information.yml

@@ -59,8 +59,6 @@ jobs:
       with:
         languages: javascript
         tools: ${{ steps.prepare-test.outputs.tools-url }}
-      env:
-        CODEQL_FILE_BASELINE_INFORMATION: true
     - uses: ./../action/.github/actions/setup-swift
       with:
         codeql-path: ${{ steps.init.outputs.codeql-path }}
@@ -70,8 +68,6 @@ jobs:
     - uses: ./../action/analyze
       with:
         output: ${{ runner.temp }}/results
-      env:
-        CODEQL_FILE_BASELINE_INFORMATION: true
     - name: Upload SARIF
       uses: actions/upload-artifact@v3
       with:
@@ -82,13 +78,13 @@ jobs:
       shell: bash
       run: |
         cd "$RUNNER_TEMP/results"
-        expected_baseline_languages="cpp cs go java js py rb"
+        expected_baseline_languages="c csharp go java kotlin javascript python ruby"
         if [[ $RUNNER_OS != "Windows" ]]; then
           expected_baseline_languages+=" swift"
         fi
 
         for lang in ${expected_baseline_languages}; do
-          rule_name="${lang}/baseline/expected-extracted-files"
+          rule_name="cli/expected-extracted-files/${lang}"
           found_notification=$(jq --arg rule_name "${rule_name}" '[.runs[0].tool.driver.notifications |
             select(. != null) | flatten | .[].id] | any(. == $rule_name)' javascript.sarif)
           if [[ "${found_notification}" != "true" ]]; then
@@ -99,4 +95,5 @@ jobs:
           fi
         done
     env:
+      CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
       CODEQL_ACTION_TEST_MODE: true

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
 
+## 2.22.3 - 13 Oct 2023
+
+- Provide an authentication token when downloading the CodeQL Bundle from the API of a GitHub Enterprise Server instance. [#1945](https://github.com/github/codeql-action/pull/1945)
+
 ## 2.22.2 - 12 Oct 2023
 
 - Update default CodeQL bundle version to 2.15.0. [#1938](https://github.com/github/codeql-action/pull/1938)

lib/codeql.js

@@ -506,6 +506,12 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (await util.codeQlVersionAbove(this, CODEQL_VERSION_FILE_BASELINE_INFORMATION)) {
                 codeqlArgs.push("--sarif-add-baseline-file-info");
             }
+            if (await features.getValue(feature_flags_1.Feature.SublanguageFileCoverageEnabled, this)) {
+                codeqlArgs.push("--sublanguage-file-coverage");
+            }
+            else if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
+                codeqlArgs.push("--no-sublanguage-file-coverage");
+            }
             if (shouldExportDiagnostics) {
                 codeqlArgs.push("--sarif-include-diagnostics");
             }

lib/database-upload.js

@@ -56,12 +56,14 @@ async function uploadDatabases(repositoryNwo, config, apiDetails, logger) {
             const bundledDb = await (0, util_1.bundleDb)(config, language, codeql, language);
             const bundledDbSize = fs.statSync(bundledDb).size;
             const bundledDbReadStream = fs.createReadStream(bundledDb);
+            const commitOid = await actionsUtil.getCommitOid(actionsUtil.getRequiredInput("checkout_path"));
             try {
-                await client.request(`POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name`, {
+                await client.request(`POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name&commit_oid=:commit_oid`, {
                     owner: repositoryNwo.owner,
                     repo: repositoryNwo.repo,
                     language,
                     name: `${language}-database`,
+                    commit_oid: commitOid,
                     data: bundledDbReadStream,
                     headers: {
                         authorization: `token ${apiDetails.auth}`,

lib/database-upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAIrC,6CAA+B;AAC/B,iCAAkC;AAE3B,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE;QAC9D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;KACR;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;QAC3D,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO;KACR;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACnD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;KACR;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI;gBACF,MAAM,MAAM,CAAC,OAAO,CAClB,wGAAwG,EACxG;oBACE,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;aAChE;oBAAS;gBACR,mBAAmB,CAAC,KAAK,EAAE,CAAC;aAC7B;SACF;QAAC,OAAO,CAAC,EAAE;YACV,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;SACnE;KACF;AACH,CAAC;AA7DD,0CA6DC"}
+{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAIrC,6CAA+B;AAC/B,iCAAkC;AAE3B,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE;QAC9D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;KACR;IAED,iDAAiD;IACjD,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;QAC3D,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjE,OAAO;KACR;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,wBAAwB,EAAE,CAAC,EAAE;QACnD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;KACR;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAC9C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAC9C,CAAC;YACF,IAAI;gBACF,MAAM,MAAM,CAAC,OAAO,CAClB,+HAA+H,EAC/H;oBACE,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;aAChE;oBAAS;gBACR,mBAAmB,CAAC,KAAK,EAAE,CAAC;aAC7B;SACF;QAAC,OAAO,CAAC,EAAE;YACV,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;SACnE;KACF;AACH,CAAC;AAjED,0CAiEC"}

lib/database-upload.test.js

@@ -72,7 +72,7 @@ async function mockHttpRequests(databaseUploadStatusCode) {
     // Passing an auth token is required, so we just use a dummy value
     const client = github.getOctokit("123");
     const requestSpy = sinon.stub(client, "request");
-    const url = "POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name";
+    const url = "POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name&commit_oid=:commit_oid";
     const databaseUploadSpy = requestSpy.withArgs(url);
     if (databaseUploadStatusCode < 300) {
         databaseUploadSpy.resolves(undefined);

lib/setup-codeql.js

@@ -411,7 +411,8 @@ async function downloadCodeQL(codeqlURL, maybeBundleVersion, maybeCliVersion, ap
     if (searchParams.has("token")) {
         logger.debug("CodeQL tools URL contains an authorization token.");
     }
-    else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
+    else if (codeqlURL.startsWith(`${apiDetails.url}/`) ||
+        (apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`))) {
         logger.debug("Providing an authorization token to download CodeQL tools.");
         authorization = `token ${apiDetails.auth}`;
     }

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.22.2",
+  "version": "2.22.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.22.2",
+  "version": "2.22.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.22.2",
+      "version": "2.22.3",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.1.2",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.22.2",
+  "version": "2.22.3",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

pr-checks/checks/export-file-baseline-information.yml

@@ -1,14 +1,14 @@
 name: "Export file baseline information"
 description: "Tests that file baseline information is exported when the feature is enabled"
 versions: ["nightly-latest"]
+env:
+  CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
 steps:
   - uses: ./../action/init
     id: init
     with:
       languages: javascript
       tools: ${{ steps.prepare-test.outputs.tools-url }}
-    env:
-      CODEQL_FILE_BASELINE_INFORMATION: true
   - uses: ./../action/.github/actions/setup-swift
     with:
       codeql-path: ${{ steps.init.outputs.codeql-path }}
@@ -18,8 +18,6 @@ steps:
   - uses: ./../action/analyze
     with:
       output: "${{ runner.temp }}/results"
-    env:
-      CODEQL_FILE_BASELINE_INFORMATION: true
   - name: Upload SARIF
     uses: actions/upload-artifact@v3
     with:
@@ -30,13 +28,13 @@ steps:
     shell: bash
     run: |
       cd "$RUNNER_TEMP/results"
-      expected_baseline_languages="cpp cs go java js py rb"
+      expected_baseline_languages="c csharp go java kotlin javascript python ruby"
       if [[ $RUNNER_OS != "Windows" ]]; then
         expected_baseline_languages+=" swift"
       fi
 
       for lang in ${expected_baseline_languages}; do
-        rule_name="${lang}/baseline/expected-extracted-files"
+        rule_name="cli/expected-extracted-files/${lang}"
         found_notification=$(jq --arg rule_name "${rule_name}" '[.runs[0].tool.driver.notifications |
           select(. != null) | flatten | .[].id] | any(. == $rule_name)' javascript.sarif)
         if [[ "${found_notification}" != "true" ]]; then

src/codeql.ts

@@ -908,6 +908,18 @@ export async function getCodeQLForCmd(
       ) {
         codeqlArgs.push("--sarif-add-baseline-file-info");
       }
+      if (
+        await features.getValue(Feature.SublanguageFileCoverageEnabled, this)
+      ) {
+        codeqlArgs.push("--sublanguage-file-coverage");
+      } else if (
+        await util.codeQlVersionAbove(
+          this,
+          CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
+        )
+      ) {
+        codeqlArgs.push("--no-sublanguage-file-coverage");
+      }
       if (shouldExportDiagnostics) {
         codeqlArgs.push("--sarif-include-diagnostics");
       } else if (await util.codeQlVersionAbove(this, "2.12.4")) {

src/database-upload.test.ts

@@ -68,7 +68,7 @@ async function mockHttpRequests(databaseUploadStatusCode: number) {
   const requestSpy = sinon.stub(client, "request");
 
   const url =
-    "POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name";
+    "POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name&commit_oid=:commit_oid";
   const databaseUploadSpy = requestSpy.withArgs(url);
   if (databaseUploadStatusCode < 300) {
     databaseUploadSpy.resolves(undefined);

src/database-upload.ts

@@ -44,14 +44,18 @@ export async function uploadDatabases(
       const bundledDb = await bundleDb(config, language, codeql, language);
       const bundledDbSize = fs.statSync(bundledDb).size;
       const bundledDbReadStream = fs.createReadStream(bundledDb);
+      const commitOid = await actionsUtil.getCommitOid(
+        actionsUtil.getRequiredInput("checkout_path"),
+      );
       try {
         await client.request(
-          `POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name`,
+          `POST https://uploads.github.com/repos/:owner/:repo/code-scanning/codeql/databases/:language?name=:name&commit_oid=:commit_oid`,
           {
             owner: repositoryNwo.owner,
             repo: repositoryNwo.repo,
             language,
             name: `${language}-database`,
+            commit_oid: commitOid,
             data: bundledDbReadStream,
             headers: {
               authorization: `token ${apiDetails.auth}`,

src/setup-codeql.ts

@@ -546,7 +546,10 @@ export async function downloadCodeQL(
   let authorization: string | undefined = undefined;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
-  } else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
+  } else if (
+    codeqlURL.startsWith(`${apiDetails.url}/`) ||
+    (apiDetails.apiURL && codeqlURL.startsWith(`${apiDetails.apiURL}/`))
+  ) {
     logger.debug("Providing an authorization token to download CodeQL tools.");
     authorization = `token ${apiDetails.auth}`;
   } else {