Address comments from PR

lib/codeql.js

@@ -537,9 +537,9 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 }
             }
             // A config file is only generated if the CliConfigFileEnabled feature flag is enabled.
-            // Only pass external repository token if a config file is
-            let externalRepositoryToken;
             const configLocation = await generateCodeScanningConfig(codeql, config, featureEnablement);
+            // Only pass external repository token if a config file is going to be parsed by the CLI.
+            let externalRepositoryToken;
             if (configLocation) {
                 extraArgs.push(`--codescanning-config=${configLocation}`);
                 externalRepositoryToken = (0, actions_util_1.getOptionalInput)("external-repository-token");
@@ -555,7 +555,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 `--source-root=${sourceRoot}`,
                 ...extraArgs,
                 ...getExtraOptionsFromEnv(["database", "init"]),
-            ], externalRepositoryToken);
+            ], { stdin: externalRepositoryToken });
         },
         async runAutobuild(language) {
             const cmdName = process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh";
@@ -890,7 +890,7 @@ exports.getExtraOptions = getExtraOptions;
  *     status reports on GitHub.com.
  */
 const maxErrorSize = 20000;
-async function runTool(cmd, args = [], stdin) {
+async function runTool(cmd, args = [], opts = {}) {
     let output = "";
     let error = "";
     const exitCode = await new toolrunner.ToolRunner(cmd, args, {
@@ -909,7 +909,7 @@ async function runTool(cmd, args = [], stdin) {
             },
         },
         ignoreReturnCode: true,
-        input: Buffer.from(stdin || ""),
+        ...(opts.stdin ? { input: Buffer.from(opts.stdin || "") } : {}),
     }).exec();
     if (exitCode !== 0)
         throw new CommandInvocationError(cmd, args, exitCode, error, output);