robojerk/codeql-action

Stop checking disk usage for MacOS ARM with SIP disabled (#2434)

Browse source 
* Stop checking disk usage for MacOS ARM with SIP disabled

On MacOS ARM machines where SIP is disabled, after the build tracer is initialized in the `init` Action, we receive warnings when we run send status reports due to the `df` binary. This change will make it so that we no longer run `df` for those machines.
This commit is contained in:
Angela P Wen 2024-08-20 16:04:03 -07:00 • committed by GitHub
parent 512e3066dd
commit 202b3b97bf
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
22 changed files with 107 additions and 96 deletions
Download patch file Download diff file Expand all files Collapse all files

34
lib/util.js generated
View file

@ -67,11 +67,13 @@ exports.prettyPrintPack = prettyPrintPack;
exports.checkDiskUsage = checkDiskUsage;
exports.checkActionVersion = checkActionVersion;
exports.cloneObject = cloneObject;
exports.isSipEnabled = isSipEnabled;
const fs = __importStar(require("fs"));
const os = __importStar(require("os"));
const path = __importStar(require("path"));
const util_1 = require("util");
const core = __importStar(require("@actions/core"));
const exec = __importStar(require("@actions/exec/lib/exec"));
const check_disk_space_1 = __importDefault(require("check-disk-space"));
const del_1 = __importDefault(require("del"));
const get_folder_size_1 = __importDefault(require("get-folder-size"));
@ -790,9 +792,15 @@ function prettyPrintPack(pack) {
}
async function checkDiskUsage(logger) {
try {
// We avoid running the `df` binary under the hood for macOS ARM runners with SIP disabled.
if (process.platform === "darwin" &&
(process.arch === "arm" || process.arch === "arm64") &&
!(await isSipEnabled(logger))) {
return undefined;
}
const diskUsage = await (0, check_disk_space_1.default)(getRequiredEnvParam("GITHUB_WORKSPACE"));
const gbInBytes = 1024 * 1024 * 1024;
if (logger && diskUsage.free < 2 * gbInBytes) {
if (diskUsage.free < 2 * gbInBytes) {
const message = "The Actions runner is running low on disk space " +
`(${(diskUsage.free / gbInBytes).toPrecision(4)} GB available).`;
if (process.env[environment_1.EnvVar.HAS_WARNED_ABOUT_DISK_SPACE] !== "true") {
@ -809,9 +817,7 @@ async function checkDiskUsage(logger) {
};
}
catch (error) {
if (logger) {
logger.warning(`Failed to check available disk space: ${getErrorMessage(error)}`);
}
logger.warning(`Failed to check available disk space: ${getErrorMessage(error)}`);
return undefined;
}
}
@ -862,4 +868,24 @@ var BuildMode;
function cloneObject(obj) {
return JSON.parse(JSON.stringify(obj));
}
// For MacOS runners: runs `csrutil status` to determine whether System
// Integrity Protection is enabled.
async function isSipEnabled(logger) {
try {
const sipStatusOutput = await exec.getExecOutput("csrutil status");
if (sipStatusOutput.exitCode === 0) {
if (sipStatusOutput.stdout.includes("System Integrity Protection status: enabled.")) {
return true;
}
if (sipStatusOutput.stdout.includes("System Integrity Protection status: disabled.")) {
return false;
}
}
return undefined;
}
catch (e) {
logger.warning(`Failed to determine if System Integrity Protection was enabled: ${e}`);
return undefined;
}
}
//# sourceMappingURL=util.js.map