robojerk/codeql-action

Stop checking disk usage for MacOS ARM with SIP disabled (#2434)

Browse source 
* Stop checking disk usage for MacOS ARM with SIP disabled

On MacOS ARM machines where SIP is disabled, after the build tracer is initialized in the `init` Action, we receive warnings when we run send status reports due to the `df` binary. This change will make it so that we no longer run `df` for those machines.
This commit is contained in:
Angela P Wen 2024-08-20 16:04:03 -07:00 • committed by GitHub
parent 512e3066dd
commit 202b3b97bf
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
22 changed files with 107 additions and 96 deletions
Download patch file Download diff file Expand all files Collapse all files

22
lib/init.js generated
View file

@ -28,11 +28,9 @@ exports.initConfig = initConfig;
exports.runInit = runInit;
exports.printPathFiltersWarning = printPathFiltersWarning;
exports.checkInstallPython311 = checkInstallPython311;
exports.isSipEnabled = isSipEnabled;
exports.cleanupDatabaseClusterDirectory = cleanupDatabaseClusterDirectory;
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
const exec = __importStar(require("@actions/exec/lib/exec"));
const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
const safeWhich = __importStar(require("@chrisgavin/safe-which"));
const actions_util_1 = require("./actions-util");
@ -93,26 +91,6 @@ async function checkInstallPython311(languages, codeql) {
]).exec();
}
}
// For MacOS runners: runs `csrutil status` to determine whether System
// Integrity Protection is enabled.
async function isSipEnabled(logger) {
try {
const sipStatusOutput = await exec.getExecOutput("csrutil status");
if (sipStatusOutput.exitCode === 0) {
if (sipStatusOutput.stdout.includes("System Integrity Protection status: enabled.")) {
return true;
}
if (sipStatusOutput.stdout.includes("System Integrity Protection status: disabled.")) {
return false;
}
}
return undefined;
}
catch (e) {
logger.warning(`Failed to determine if System Integrity Protection was enabled: ${e}`);
return undefined;
}
}
function cleanupDatabaseClusterDirectory(config, logger,
// We can't stub the fs module in tests, so we allow the caller to override the rmSync function
// for testing.