robojerk/codeql-action

Merge pull request #2337 from github/update-v3.25.10-5bf6dad35

Browse source 
Merge main into releases/v3
This commit is contained in:
Chris Smowton 2024-06-13 15:09:48 +01:00 • committed by GitHub
commit 23acc5c183
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
55 changed files with 280 additions and 153 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.github/actions/query-filter-test/action.yml vendored
View file

@ -48,7 +48,6 @@ runs:
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
upload: never
env:
CODEQL_ACTION_TEST_MODE: "true"

2
.github/workflows/__all-platform-bundle.yml generated vendored
View file

@ -68,7 +68,5 @@ jobs:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
env:
CODEQL_ACTION_TEST_MODE: true

1
.github/workflows/__analyze-ref-input.yml generated vendored
View file

@ -72,7 +72,6 @@ jobs:
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
ref: refs/heads/main
sha: 5e235361806c361d4d3f8859e3c897658025a9a2
env:

2
.github/workflows/__autobuild-action.yml generated vendored
View file

@ -75,8 +75,6 @@ jobs:
CORECLR_PROFILER: ''
CORECLR_PROFILER_PATH_64: ''
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |

92
.github/workflows/__autobuild-direct-tracing-with-working-dir.yml generated vendored Normal file
View file

@ -0,0 +1,92 @@
# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
# (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
# to regenerate this file.
name: PR Check - Autobuild direct tracing (custom working directory)
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
on:
push:
branches:
- main
- releases/v*
pull_request:
types:
- opened
- synchronize
- reopened
- ready_for_review
schedule:
- cron: '0 5 * * *'
workflow_dispatch: {}
jobs:
autobuild-direct-tracing-with-working-dir:
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
version: linked
- os: windows-latest
version: linked
- os: ubuntu-latest
version: nightly-latest
- os: windows-latest
version: nightly-latest
name: Autobuild direct tracing (custom working directory)
permissions:
contents: read
security-events: write
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||
matrix.version == 'stable-v2.13.5' ||
matrix.version == 'stable-v2.14.6')
with:
python-version: '3.11'
- name: Check out repository
uses: actions/checkout@v4
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
- name: Test setup
shell: bash
run: |
# Make sure that Gradle build succeeds in autobuild-dir ...
cp -a ../action/tests/java-repo autobuild-dir
# ... and fails if attempted in the current directory
echo > build.gradle
- uses: ./../action/init
with:
build-mode: autobuild
languages: java
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check that indirect tracing is disabled
shell: bash
run: |
if [[ ! -z "${CODEQL_RUNNER}" ]]; then
echo "Expected indirect tracing to be disabled, but the" \
"CODEQL_RUNNER environment variable is set."
exit 1
fi
- uses: ./../action/autobuild
with:
working-directory: autobuild-dir
- uses: ./../action/analyze
env:
CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__go-custom-queries.yml generated vendored
View file

@ -115,8 +115,6 @@ jobs:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__go-indirect-tracing-workaround.yml generated vendored
View file

@ -69,8 +69,6 @@ jobs:
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then

2
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View file

@ -99,8 +99,6 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/autobuild
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then

2
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View file

@ -101,8 +101,6 @@ jobs:
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
# Once we start running Bash 4.2 in all environments, we can replace the

2
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View file

@ -98,8 +98,6 @@ jobs:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases"

2
.github/workflows/__javascript-source-root.yml generated vendored
View file

@ -73,9 +73,7 @@ jobs:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
skip-queries: true
upload: never
- name: Assert database exists
shell: bash
run: |

2
.github/workflows/__test-autobuild-working-dir.yml generated vendored
View file

@ -72,8 +72,6 @@ jobs:
with:
working-directory: autobuild-dir
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |

2
.github/workflows/__test-local-codeql.yml generated vendored
View file

@ -74,7 +74,5 @@ jobs:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
env:
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__test-proxy.yml generated vendored
View file

@ -62,8 +62,6 @@ jobs:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
env:
https_proxy: http://squid-proxy:3128
CODEQL_ACTION_TEST_MODE: true

2
.github/workflows/__upload-ref-sha-input.yml generated vendored
View file

@ -70,9 +70,9 @@ jobs:
- name: Build code
shell: bash
run: ./build.sh
# Generate some SARIF we can upload with the upload-sarif step
- uses: ./../action/analyze
with:
upload-database: false
ref: refs/heads/main
sha: 5e235361806c361d4d3f8859e3c897658025a9a2
upload: never

8
.github/workflows/__with-checkout-path.yml generated vendored
View file

@ -93,14 +93,6 @@ jobs:
checkout_path: x/y/z/some-path/tests/multi-language-repo
ref: v1.1.0
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
upload: never
upload-database: false
- uses: ./../action/upload-sarif
with:
ref: v1.1.0
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
checkout_path: x/y/z/some-path/tests/multi-language-repo
- name: Verify SARIF after upload
shell: bash

2
.github/workflows/expected-queries-runs.yml vendored
View file

@ -37,8 +37,6 @@ jobs:
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
upload: never
- name: Check Sarif
uses: ./../action/.github/actions/check-sarif

5
.github/workflows/python312-windows.yml vendored
View file

@ -14,6 +14,8 @@ on:
jobs:
test-setup-python-scripts:
env:
CODEQL_ACTION_TEST_MODE: true
timeout-minutes: 45
runs-on: windows-latest
@ -37,6 +39,3 @@ jobs:
- name: Analyze
uses: ./../action/analyze
with:
upload: false
upload-database: false

2
.github/workflows/test-codeql-bundle-all.yml vendored
View file

@ -53,7 +53,5 @@ jobs:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
env:
CODEQL_ACTION_TEST_MODE: true

4
CHANGELOG.md
View file

@ -4,6 +4,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
Note that the only difference between `v2` and `v3` of the CodeQL Action is the node version they support, with `v3` running on node 20 while we continue to release `v2` to support running on node 16. For example `3.22.11` was the first `v3` release and is functionally identical to `2.22.11`. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.
## 3.25.10 - 13 Jun 2024
- Update default CodeQL bundle version to 2.17.5. [#2327](https://github.com/github/codeql-action/pull/2327)
## 3.25.9 - 12 Jun 2024
- Avoid failing database creation if the database folder already exists and contains some unexpected files. Requires CodeQL 2.18.0 or higher. [#2330](https://github.com/github/codeql-action/pull/2330)

2
lib/codeql.js generated
View file

@ -343,6 +343,8 @@ async function getCodeQLForCmd(cmd, checkVersion) {
"database",
"trace-command",
"--use-build-mode",
"--working-dir",
process.cwd(),
...(await getTrapCachingExtractorConfigArgsForLang(config, language)),
...getExtractionVerbosityArguments(config.debugMode),
...getExtraOptionsFromEnv(["database", "trace-command"]),

2
lib/codeql.js.map
View file

File diff suppressed because one or more lines are too long

5
lib/config-utils.js generated
View file

@ -674,6 +674,11 @@ async function parseBuildModeInput(input, languages, features, logger) {
if (!Object.values(util_1.BuildMode).includes(input)) {
throw new util_1.ConfigurationError(`Invalid build mode: '${input}'. Supported build modes are: ${Object.values(util_1.BuildMode).join(", ")}.`);
}
if (languages.includes(languages_1.Language.csharp) &&
(await features.getValue(feature_flags_1.Feature.DisableCsharpBuildless))) {
logger.warning("Scanning C# code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.");
return util_1.BuildMode.Autobuild;
}
if (languages.includes(languages_1.Language.java) &&
(await features.getValue(feature_flags_1.Feature.DisableJavaBuildlessEnabled))) {
logger.warning("Scanning Java code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.");

2
lib/config-utils.js.map
View file

File diff suppressed because one or more lines are too long

59
lib/config-utils.test.js generated
View file

@ -764,27 +764,40 @@ const mockRepositoryNwo = (0, repository_1.parseRepositoryNwo)("owner/repo");
t.deepEqual(mockRequest.called, args.expectedApiCall);
});
});
(0, ava_1.default)("Build mode not overridden when disable Java buildless feature flag disabled", async (t) => {
const messages = [];
const buildMode = await configUtils.parseBuildModeInput("none", [languages_1.Language.java], (0, testing_utils_1.createFeatures)([]), (0, testing_utils_1.getRecordingLogger)(messages));
t.is(buildMode, util_1.BuildMode.None);
t.deepEqual(messages, []);
});
(0, ava_1.default)("Build mode not overridden for other languages", async (t) => {
const messages = [];
const buildMode = await configUtils.parseBuildModeInput("none", [languages_1.Language.python], (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.DisableJavaBuildlessEnabled]), (0, testing_utils_1.getRecordingLogger)(messages));
t.is(buildMode, util_1.BuildMode.None);
t.deepEqual(messages, []);
});
(0, ava_1.default)("Build mode overridden when analyzing Java and disable Java buildless feature flag enabled", async (t) => {
const messages = [];
const buildMode = await configUtils.parseBuildModeInput("none", [languages_1.Language.java], (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.DisableJavaBuildlessEnabled]), (0, testing_utils_1.getRecordingLogger)(messages));
t.is(buildMode, util_1.BuildMode.Autobuild);
t.deepEqual(messages, [
{
message: "Scanning Java code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.",
type: "warning",
},
]);
});
for (const { displayName, language, feature } of [
{
displayName: "Java",
language: languages_1.Language.java,
feature: feature_flags_1.Feature.DisableJavaBuildlessEnabled,
},
{
displayName: "C#",
language: languages_1.Language.csharp,
feature: feature_flags_1.Feature.DisableCsharpBuildless,
},
]) {
(0, ava_1.default)(`Build mode not overridden when disable ${displayName} buildless feature flag disabled`, async (t) => {
const messages = [];
const buildMode = await configUtils.parseBuildModeInput("none", [language], (0, testing_utils_1.createFeatures)([]), (0, testing_utils_1.getRecordingLogger)(messages));
t.is(buildMode, util_1.BuildMode.None);
t.deepEqual(messages, []);
});
(0, ava_1.default)(`Build mode not overridden for other languages when disable ${displayName} buildless feature flag enabled`, async (t) => {
const messages = [];
const buildMode = await configUtils.parseBuildModeInput("none", [languages_1.Language.python], (0, testing_utils_1.createFeatures)([feature]), (0, testing_utils_1.getRecordingLogger)(messages));
t.is(buildMode, util_1.BuildMode.None);
t.deepEqual(messages, []);
});
(0, ava_1.default)(`Build mode overridden when analyzing ${displayName} and disable ${displayName} buildless feature flag enabled`, async (t) => {
const messages = [];
const buildMode = await configUtils.parseBuildModeInput("none", [language], (0, testing_utils_1.createFeatures)([feature]), (0, testing_utils_1.getRecordingLogger)(messages));
t.is(buildMode, util_1.BuildMode.Autobuild);
t.deepEqual(messages, [
{
message: `Scanning ${displayName} code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.`,
type: "warning",
},
]);
});
}
//# sourceMappingURL=config-utils.test.js.map

2
lib/config-utils.test.js.map
View file

File diff suppressed because one or more lines are too long

4
lib/database-upload.js generated
View file

@ -35,6 +35,10 @@ async function uploadDatabases(repositoryNwo, config, apiDetails, logger) {
logger.debug("Database upload disabled in workflow. Skipping upload.");
return;
}
if (util.isInTestMode()) {
logger.debug("In test mode. Skipping database upload.");
return;
}
// Do nothing when not running against github.com
if (config.gitHubVersion.type !== util.GitHubVariant.DOTCOM &&
config.gitHubVersion.type !== util.GitHubVariant.GHE_DOTCOM) {

2
lib/database-upload.js.map
View file

@ -1 +1 @@
{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAIrC,6CAA+B;AAC/B,iCAAkD;AAE3C,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,iDAAiD;IACjD,IACE,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,UAAU,EAC3D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,wBAAwB,EAAE,CAAC,EAAE,CAAC;QACpD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,UAAU,CAAC,QAAQ,GAAG,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEvD,4DAA4D;IAC5D,0CAA0C;IAC1C,IAAI,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAC9C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAC9C,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qGAAqG,EACrG;oBACE,OAAO,EAAE,cAAc;oBACvB,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;oBAAS,CAAC;gBACT,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AA/ED,0CA+EC"}
{"version":3,"file":"database-upload.js","sourceRoot":"","sources":["../src/database-upload.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAEzB,4DAA8C;AAC9C,6CAA8D;AAC9D,qCAAqC;AAIrC,6CAA+B;AAC/B,iCAAkD;AAE3C,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,MAAc,EACd,UAA4B,EAC5B,MAAc;IAEd,IAAI,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,iDAAiD;IACjD,IACE,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC,UAAU,EAC3D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,wBAAwB,EAAE,CAAC,EAAE,CAAC;QACpD,4EAA4E;QAC5E,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,yBAAY,GAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAA,qBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,UAAU,CAAC,QAAQ,GAAG,WAAW,UAAU,CAAC,QAAQ,EAAE,CAAC;IAEvD,4DAA4D;IAC5D,0CAA0C;IAC1C,IAAI,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,8BAA8B;YAC9B,2EAA2E;YAC3E,8EAA8E;YAC9E,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACrE,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YAClD,MAAM,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAC9C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAC9C,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qGAAqG,EACrG;oBACE,OAAO,EAAE,cAAc;oBACvB,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,aAAa,CAAC,IAAI;oBACxB,QAAQ;oBACR,IAAI,EAAE,GAAG,QAAQ,WAAW;oBAC5B,UAAU,EAAE,SAAS;oBACrB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,UAAU,CAAC,IAAI,EAAE;wBACzC,cAAc,EAAE,iBAAiB;wBACjC,gBAAgB,EAAE,aAAa;qBAChC;iBACF,CACF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YACjE,CAAC;oBAAS,CAAC;gBACT,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACf,4CAA4C;YAC5C,MAAM,CAAC,OAAO,CAAC,iCAAiC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AApFD,0CAoFC"}

8
lib/defaults.json
View file

@ -1,6 +1,6 @@
{
"bundleVersion": "codeql-bundle-v2.17.4",
"cliVersion": "2.17.4",
"priorBundleVersion": "codeql-bundle-v2.17.3",
"priorCliVersion": "2.17.3"
"bundleVersion": "codeql-bundle-v2.17.5",
"cliVersion": "2.17.5",
"priorBundleVersion": "codeql-bundle-v2.17.4",
"priorCliVersion": "2.17.4"
}

8
lib/feature-flags.js generated
View file

@ -49,10 +49,11 @@ exports.CODEQL_VERSION_FINE_GRAINED_PARALLELISM = "2.15.1";
*/
var Feature;
(function (Feature) {
Feature["AutobuildDirectTracing"] = "autobuild_direct_tracing";
Feature["AutobuildDirectTracing"] = "autobuild_direct_tracing_v2";
Feature["CleanupTrapCaches"] = "cleanup_trap_caches";
Feature["CppDependencyInstallation"] = "cpp_dependency_installation_enabled";
Feature["CppTrapCachingEnabled"] = "cpp_trap_caching_enabled";
Feature["DisableCsharpBuildless"] = "disable_csharp_buildless";
Feature["DisableJavaBuildlessEnabled"] = "disable_java_buildless_enabled";
Feature["DisableKotlinAnalysisEnabled"] = "disable_kotlin_analysis_enabled";
Feature["ExportDiagnosticsEnabled"] = "export_diagnostics_enabled";
@ -82,6 +83,11 @@ exports.featureConfig = {
legacyApi: true,
minimumVersion: "2.16.1",
},
[Feature.DisableCsharpBuildless]: {
defaultValue: false,
envVar: "CODEQL_ACTION_DISABLE_CSHARP_BUILDLESS",
minimumVersion: undefined,
},
[Feature.DisableJavaBuildlessEnabled]: {
defaultValue: false,
envVar: "CODEQL_ACTION_DISABLE_JAVA_BUILDLESS",

2
lib/feature-flags.js.map
View file

File diff suppressed because one or more lines are too long

2
node_modules/.package-lock.json generated vendored
View file

@ -1,6 +1,6 @@
{
"name": "codeql",
"version": "3.25.9",
"version": "3.25.10",
"lockfileVersion": 3,
"requires": true,
"packages": {

4
package-lock.json generated
View file

@ -1,12 +1,12 @@
{
"name": "codeql",
"version": "3.25.9",
"version": "3.25.10",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "codeql",
"version": "3.25.9",
"version": "3.25.10",
"license": "MIT",
"dependencies": {
"@actions/artifact": "^1.1.2",

2
package.json
View file

@ -1,6 +1,6 @@
{
"name": "codeql",
"version": "3.25.9",
"version": "3.25.10",
"private": true,
"description": "CodeQL action",
"scripts": {

2
pr-checks/checks/all-platform-bundle.yml
View file

@ -15,5 +15,3 @@ steps:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false

1
pr-checks/checks/analyze-ref-input.yml
View file

@ -12,6 +12,5 @@ steps:
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'

2
pr-checks/checks/autobuild-action.yml
View file

@ -16,8 +16,6 @@ steps:
CORECLR_PROFILER: ""
CORECLR_PROFILER_PATH_64: ""
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |

34
pr-checks/checks/autobuild-direct-tracing-with-working-dir.yml Normal file
View file

@ -0,0 +1,34 @@
name: "Autobuild direct tracing (custom working directory)"
description: >
An end-to-end integration test of a Java repository built using 'build-mode: autobuild',
with direct tracing enabled and a custom working directory specified as the input to the
autobuild Action.
operatingSystems: ["ubuntu", "windows"]
versions: ["linked", "nightly-latest"]
env:
CODEQL_ACTION_AUTOBUILD_BUILD_MODE_DIRECT_TRACING: true
steps:
- name: Test setup
shell: bash
run: |
# Make sure that Gradle build succeeds in autobuild-dir ...
cp -a ../action/tests/java-repo autobuild-dir
# ... and fails if attempted in the current directory
echo > build.gradle
- uses: ./../action/init
with:
build-mode: autobuild
languages: java
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Check that indirect tracing is disabled
shell: bash
run: |
if [[ ! -z "${CODEQL_RUNNER}" ]]; then
echo "Expected indirect tracing to be disabled, but the" \
"CODEQL_RUNNER environment variable is set."
exit 1
fi
- uses: ./../action/autobuild
with:
working-directory: autobuild-dir
- uses: ./../action/analyze

2
pr-checks/checks/go-custom-queries.yml
View file

@ -15,5 +15,3 @@ steps:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false

2
pr-checks/checks/go-indirect-tracing-workaround.yml
View file

@ -17,8 +17,6 @@ steps:
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
if [[ -z "${CODEQL_ACTION_GO_BINARY}" ]]; then

2
pr-checks/checks/go-tracing-autobuilder.yml
View file

@ -16,8 +16,6 @@ steps:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/autobuild
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
if [[ "${CODEQL_ACTION_DID_AUTOBUILD_GOLANG}" != true ]]; then

2
pr-checks/checks/go-tracing-custom-build-steps.yml
View file

@ -16,8 +16,6 @@ steps:
shell: bash
run: go build main.go
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
# Once we start running Bash 4.2 in all environments, we can replace the

2
pr-checks/checks/go-tracing-legacy-workflow.yml
View file

@ -15,8 +15,6 @@ steps:
languages: go
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
- shell: bash
run: |
cd "$RUNNER_TEMP/codeql_databases"

2
pr-checks/checks/javascript-source-root.yml
View file

@ -15,9 +15,7 @@ steps:
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false
skip-queries: true
upload: never
- name: Assert database exists
shell: bash
run: |

2
pr-checks/checks/test-autobuild-working-dir.yml
View file

@ -18,8 +18,6 @@ steps:
with:
working-directory: autobuild-dir
- uses: ./../action/analyze
with:
upload-database: false
- name: Check database
shell: bash
run: |

2
pr-checks/checks/test-local-codeql.yml
View file

@ -20,5 +20,3 @@ steps:
shell: bash
run: ./build.sh
- uses: ./../action/analyze
with:
upload-database: false

2
pr-checks/checks/test-proxy.yml
View file

@ -18,5 +18,3 @@ steps:
languages: javascript
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
upload-database: false

2
pr-checks/checks/upload-ref-sha-input.yml
View file

@ -10,9 +10,9 @@ steps:
- name: Build code
shell: bash
run: ./build.sh
# Generate some SARIF we can upload with the upload-sarif step
- uses: ./../action/analyze
with:
upload-database: false
ref: 'refs/heads/main'
sha: '5e235361806c361d4d3f8859e3c897658025a9a2'
upload: never

8
pr-checks/checks/with-checkout-path.yml
View file

@ -35,14 +35,6 @@ steps:
checkout_path: x/y/z/some-path/tests/multi-language-repo
ref: v1.1.0
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
upload: never
upload-database: false
- uses: ./../action/upload-sarif
with:
ref: v1.1.0
sha: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6
checkout_path: x/y/z/some-path/tests/multi-language-repo
- name: Verify SARIF after upload
shell: bash

2
src/codeql.ts
View file

@ -688,6 +688,8 @@ export async function getCodeQLForCmd(
"database",
"trace-command",
"--use-build-mode",
"--working-dir",
process.cwd(),
...(await getTrapCachingExtractorConfigArgsForLang(config, language)),
...getExtractionVerbosityArguments(config.debugMode),
...getExtraOptionsFromEnv(["database", "trace-command"]),

90
src/config-utils.test.ts
View file

@ -1086,44 +1086,56 @@ const mockRepositoryNwo = parseRepositoryNwo("owner/repo");
});
});
test("Build mode not overridden when disable Java buildless feature flag disabled", async (t) => {
const messages: LoggedMessage[] = [];
const buildMode = await configUtils.parseBuildModeInput(
"none",
[Language.java],
createFeatures([]),
getRecordingLogger(messages),
);
t.is(buildMode, BuildMode.None);
t.deepEqual(messages, []);
});
for (const { displayName, language, feature } of [
{
displayName: "Java",
language: Language.java,
feature: Feature.DisableJavaBuildlessEnabled,
},
{
displayName: "C#",
language: Language.csharp,
feature: Feature.DisableCsharpBuildless,
},
]) {
test(`Build mode not overridden when disable ${displayName} buildless feature flag disabled`, async (t) => {
const messages: LoggedMessage[] = [];
const buildMode = await configUtils.parseBuildModeInput(
"none",
[language],
createFeatures([]),
getRecordingLogger(messages),
);
t.is(buildMode, BuildMode.None);
t.deepEqual(messages, []);
});
test("Build mode not overridden for other languages", async (t) => {
const messages: LoggedMessage[] = [];
const buildMode = await configUtils.parseBuildModeInput(
"none",
[Language.python],
createFeatures([Feature.DisableJavaBuildlessEnabled]),
getRecordingLogger(messages),
);
t.is(buildMode, BuildMode.None);
t.deepEqual(messages, []);
});
test(`Build mode not overridden for other languages when disable ${displayName} buildless feature flag enabled`, async (t) => {
const messages: LoggedMessage[] = [];
const buildMode = await configUtils.parseBuildModeInput(
"none",
[Language.python],
createFeatures([feature]),
getRecordingLogger(messages),
);
t.is(buildMode, BuildMode.None);
t.deepEqual(messages, []);
});
test("Build mode overridden when analyzing Java and disable Java buildless feature flag enabled", async (t) => {
const messages: LoggedMessage[] = [];
const buildMode = await configUtils.parseBuildModeInput(
"none",
[Language.java],
createFeatures([Feature.DisableJavaBuildlessEnabled]),
getRecordingLogger(messages),
);
t.is(buildMode, BuildMode.Autobuild);
t.deepEqual(messages, [
{
message:
"Scanning Java code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.",
type: "warning",
},
]);
});
test(`Build mode overridden when analyzing ${displayName} and disable ${displayName} buildless feature flag enabled`, async (t) => {
const messages: LoggedMessage[] = [];
const buildMode = await configUtils.parseBuildModeInput(
"none",
[language],
createFeatures([feature]),
getRecordingLogger(messages),
);
t.is(buildMode, BuildMode.Autobuild);
t.deepEqual(messages, [
{
message: `Scanning ${displayName} code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.`,
type: "warning",
},
]);
});
}

10
src/config-utils.ts
View file

@ -1108,6 +1108,16 @@ export async function parseBuildModeInput(
);
}
if (
languages.includes(Language.csharp) &&
(await features.getValue(Feature.DisableCsharpBuildless))
) {
logger.warning(
"Scanning C# code without a build is temporarily unavailable. Falling back to 'autobuild' build mode.",
);
return BuildMode.Autobuild;
}
if (
languages.includes(Language.java) &&
(await features.getValue(Feature.DisableJavaBuildlessEnabled))

5
src/database-upload.ts
View file

@ -20,6 +20,11 @@ export async function uploadDatabases(
return;
}
if (util.isInTestMode()) {
logger.debug("In test mode. Skipping database upload.");
return;
}
// Do nothing when not running against github.com
if (
config.gitHubVersion.type !== util.GitHubVariant.DOTCOM &&

8
src/defaults.json
View file

@ -1,6 +1,6 @@
{
"bundleVersion": "codeql-bundle-v2.17.4",
"cliVersion": "2.17.4",
"priorBundleVersion": "codeql-bundle-v2.17.3",
"priorCliVersion": "2.17.3"
"bundleVersion": "codeql-bundle-v2.17.5",
"cliVersion": "2.17.5",
"priorBundleVersion": "codeql-bundle-v2.17.4",
"priorCliVersion": "2.17.4"
}

8
src/feature-flags.ts
View file

@ -45,10 +45,11 @@ export interface FeatureEnablement {
* Legacy features should end with `_enabled`.
*/
export enum Feature {
AutobuildDirectTracing = "autobuild_direct_tracing",
AutobuildDirectTracing = "autobuild_direct_tracing_v2",
CleanupTrapCaches = "cleanup_trap_caches",
CppDependencyInstallation = "cpp_dependency_installation_enabled",
CppTrapCachingEnabled = "cpp_trap_caching_enabled",
DisableCsharpBuildless = "disable_csharp_buildless",
DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
ExportDiagnosticsEnabled = "export_diagnostics_enabled",
@ -109,6 +110,11 @@ export const featureConfig: Record<
legacyApi: true,
minimumVersion: "2.16.1",
},
[Feature.DisableCsharpBuildless]: {
defaultValue: false,
envVar: "CODEQL_ACTION_DISABLE_CSHARP_BUILDLESS",
minimumVersion: undefined,
},
[Feature.DisableJavaBuildlessEnabled]: {
defaultValue: false,
envVar: "CODEQL_ACTION_DISABLE_JAVA_BUILDLESS",