Stop checking disk usage for MacOS ARM with SIP disabled (#2434)

* Stop checking disk usage for MacOS ARM with SIP disabled

On MacOS ARM machines where SIP is disabled, after the build tracer is initialized in the `init` Action, we receive warnings when we run send status reports due to the `df` binary. This change will make it so that we no longer run `df` for those machines.

src/analyze-action.ts

@@ -75,7 +75,7 @@ async function sendStatusReport(
     status,
     startedAt,
     config,
-    await util.checkDiskUsage(),
+    await util.checkDiskUsage(logger),
     logger,
     error?.message,
     error?.stack,

src/init-action-post.ts

@@ -81,7 +81,7 @@ async function runWrapper() {
       getActionsStatus(error),
       startedAt,
       config,
-      await checkDiskUsage(),
+      await checkDiskUsage(logger),
       logger,
       error.message,
       error.stack,
@@ -99,7 +99,7 @@ async function runWrapper() {
     "success",
     startedAt,
     config,
-    await checkDiskUsage(),
+    await checkDiskUsage(logger),
     logger,
   );
   if (statusReportBase !== undefined) {

src/init-action.ts

@@ -29,7 +29,6 @@ import {
   cleanupDatabaseClusterDirectory,
   initCodeQL,
   initConfig,
-  isSipEnabled,
   runInit,
 } from "./init";
 import { Language } from "./languages";
@@ -57,6 +56,7 @@ import {
   getThreadsFlagValue,
   initializeEnvironment,
   isHostedRunner,
+  isSipEnabled,
   ConfigurationError,
   wrapError,
   checkActionVersion,
@@ -355,7 +355,7 @@ async function run() {
       error instanceof ConfigurationError ? "user-error" : "aborted",
       startedAt,
       config,
-      await checkDiskUsage(),
+      await checkDiskUsage(logger),
       logger,
       error.message,
       error.stack,

src/init.ts

@@ -1,7 +1,6 @@
 import * as fs from "fs";
 import * as path from "path";
 
-import * as exec from "@actions/exec/lib/exec";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as safeWhich from "@chrisgavin/safe-which";
 
@@ -141,38 +140,6 @@ export async function checkInstallPython311(
   }
 }
 
-// For MacOS runners: runs `csrutil status` to determine whether System
-// Integrity Protection is enabled.
-export async function isSipEnabled(
-  logger: Logger,
-): Promise<boolean | undefined> {
-  try {
-    const sipStatusOutput = await exec.getExecOutput("csrutil status");
-    if (sipStatusOutput.exitCode === 0) {
-      if (
-        sipStatusOutput.stdout.includes(
-          "System Integrity Protection status: enabled.",
-        )
-      ) {
-        return true;
-      }
-      if (
-        sipStatusOutput.stdout.includes(
-          "System Integrity Protection status: disabled.",
-        )
-      ) {
-        return false;
-      }
-    }
-    return undefined;
-  } catch (e) {
-    logger.warning(
-      `Failed to determine if System Integrity Protection was enabled: ${e}`,
-    );
-    return undefined;
-  }
-}
-
 export function cleanupDatabaseClusterDirectory(
   config: configUtils.Config,
   logger: Logger,

src/resolve-environment-action.ts

@@ -39,7 +39,7 @@ async function run() {
       "starting",
       startedAt,
       config,
-      await checkDiskUsage(),
+      await checkDiskUsage(logger),
       logger,
     );
     if (statusReportBase !== undefined) {
@@ -86,7 +86,7 @@ async function run() {
         getActionsStatus(error),
         startedAt,
         config,
-        await checkDiskUsage(),
+        await checkDiskUsage(logger),
         logger,
         error.message,
         error.stack,
@@ -104,7 +104,7 @@ async function run() {
     "success",
     startedAt,
     config,
-    await checkDiskUsage(),
+    await checkDiskUsage(logger),
     logger,
   );
   if (statusReportBase !== undefined) {

src/upload-sarif-action.ts

@@ -39,7 +39,7 @@ async function sendSuccessStatusReport(
     "success",
     startedAt,
     undefined,
-    await checkDiskUsage(),
+    await checkDiskUsage(logger),
     logger,
   );
   if (statusReportBase !== undefined) {
@@ -74,7 +74,7 @@ async function run() {
     "starting",
     startedAt,
     undefined,
-    await checkDiskUsage(),
+    await checkDiskUsage(logger),
     logger,
   );
   if (startingStatusReportBase !== undefined) {
@@ -116,7 +116,7 @@ async function run() {
       getActionsStatus(error),
       startedAt,
       undefined,
-      await checkDiskUsage(),
+      await checkDiskUsage(logger),
       logger,
       message,
       error.stack,

src/util.ts

@@ -4,6 +4,7 @@ import * as path from "path";
 import { promisify } from "util";
 
 import * as core from "@actions/core";
+import * as exec from "@actions/exec/lib/exec";
 import checkDiskSpace from "check-disk-space";
 import del from "del";
 import getFolderSize from "get-folder-size";
@@ -1013,14 +1014,23 @@ export interface DiskUsage {
 }
 
 export async function checkDiskUsage(
-  logger?: Logger,
+  logger: Logger,
 ): Promise<DiskUsage | undefined> {
   try {
+    // We avoid running the `df` binary under the hood for macOS ARM runners with SIP disabled.
+    if (
+      process.platform === "darwin" &&
+      (process.arch === "arm" || process.arch === "arm64") &&
+      !(await isSipEnabled(logger))
+    ) {
+      return undefined;
+    }
+
     const diskUsage = await checkDiskSpace(
       getRequiredEnvParam("GITHUB_WORKSPACE"),
     );
     const gbInBytes = 1024 * 1024 * 1024;
-    if (logger && diskUsage.free < 2 * gbInBytes) {
+    if (diskUsage.free < 2 * gbInBytes) {
       const message =
         "The Actions runner is running low on disk space " +
         `(${(diskUsage.free / gbInBytes).toPrecision(4)} GB available).`;
@@ -1036,11 +1046,9 @@ export async function checkDiskUsage(
       numTotalBytes: diskUsage.size,
     };
   } catch (error) {
-    if (logger) {
-      logger.warning(
-        `Failed to check available disk space: ${getErrorMessage(error)}`,
-      );
-    }
+    logger.warning(
+      `Failed to check available disk space: ${getErrorMessage(error)}`,
+    );
     return undefined;
   }
 }
@@ -1104,3 +1112,35 @@ export enum BuildMode {
 export function cloneObject<T>(obj: T): T {
   return JSON.parse(JSON.stringify(obj)) as T;
 }
+
+// For MacOS runners: runs `csrutil status` to determine whether System
+// Integrity Protection is enabled.
+export async function isSipEnabled(
+  logger: Logger,
+): Promise<boolean | undefined> {
+  try {
+    const sipStatusOutput = await exec.getExecOutput("csrutil status");
+    if (sipStatusOutput.exitCode === 0) {
+      if (
+        sipStatusOutput.stdout.includes(
+          "System Integrity Protection status: enabled.",
+        )
+      ) {
+        return true;
+      }
+      if (
+        sipStatusOutput.stdout.includes(
+          "System Integrity Protection status: disabled.",
+        )
+      ) {
+        return false;
+      }
+    }
+    return undefined;
+  } catch (e) {
+    logger.warning(
+      `Failed to determine if System Integrity Protection was enabled: ${e}`,
+    );
+    return undefined;
+  }
+}