Initial commit (from f5274cbdce4ae7c9e4b937dcdf95ac70ae436d5f)

lib/analysis-paths.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+function includeAndExcludeAnalysisPaths(config, languages) {
+    if (config.paths.length !== 0) {
+        core.exportVariable('LGTM_INDEX_INCLUDE', config.paths.join('\n'));
+    }
+    if (config.pathsIgnore.length !== 0) {
+        core.exportVariable('LGTM_INDEX_EXCLUDE', config.pathsIgnore.join('\n'));
+    }
+    function isInterpretedLanguage(language) {
+        return language === 'javascript' && language === 'python';
+    }
+    // Index include/exclude only work in javascript and python
+    // If some other language is detected/configured show a warning
+    if ((config.paths.length !== 0 || config.pathsIgnore.length !== 0) && !languages.every(isInterpretedLanguage)) {
+        core.warning('The "paths"/"paths-ignore" fields of the config only have effect for Javascript and Python');
+    }
+}
+exports.includeAndExcludeAnalysisPaths = includeAndExcludeAnalysisPaths;

lib/autobuild.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const path = __importStar(require("path"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util = __importStar(require("./util"));
+async function run() {
+    var _a;
+    try {
+        if (util.should_abort('autobuild', true) || !await util.reportActionStarting('autobuild')) {
+            return;
+        }
+        // Attempt to find a language to autobuild
+        // We want pick the dominant language in the repo from the ones we're able to build
+        // The languages are sorted in order specified by user or by lines of code if we got
+        // them from the GitHub API, so try to build the first language on the list.
+        const language = (_a = process.env[sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES]) === null || _a === void 0 ? void 0 : _a.split(',')[0];
+        if (!language) {
+            core.info("None of the languages in this project require extra build steps");
+            return;
+        }
+        core.debug(`Detected dominant traced language: ${language}`);
+        core.startGroup(`Attempting to automatically build ${language} code`);
+        // TODO: share config accross actions better via env variables
+        const codeqlCmd = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_CMD);
+        const cmdName = process.platform === 'win32' ? 'autobuild.cmd' : 'autobuild.sh';
+        const autobuildCmd = path.join(path.dirname(codeqlCmd), language, 'tools', cmdName);
+        // Update JAVA_TOOL_OPTIONS to contain '-Dhttp.keepAlive=false'
+        // This is because of an issue with Azure pipelines timing out connections after 4 minutes
+        // and Maven not properly handling closed connections
+        // Otherwise long build processes will timeout when pulling down Java packages
+        // https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html
+        let javaToolOptions = process.env['JAVA_TOOL_OPTIONS'] || "";
+        process.env['JAVA_TOOL_OPTIONS'] = [...javaToolOptions.split(/\s+/), '-Dhttp.keepAlive=false', '-Dmaven.wagon.http.pool=false'].join(' ');
+        await exec.exec(autobuildCmd);
+        core.endGroup();
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('autobuild', error.message, error.stack);
+        return;
+    }
+    await util.reportActionSucceeded('autobuild');
+}
+run().catch(e => {
+    core.setFailed("autobuild action failed: " + e);
+    console.log(e);
+});

lib/config-utils.js

@@ -0,0 +1,131 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const io = __importStar(require("@actions/io"));
+const fs = __importStar(require("fs"));
+const yaml = __importStar(require("js-yaml"));
+const path = __importStar(require("path"));
+class ExternalQuery {
+    constructor(repository, ref) {
+        this.path = '';
+        this.repository = repository;
+        this.ref = ref;
+    }
+}
+exports.ExternalQuery = ExternalQuery;
+class Config {
+    constructor() {
+        this.name = "";
+        this.additionalQueries = [];
+        this.externalQueries = [];
+        this.pathsIgnore = [];
+        this.paths = [];
+    }
+    addQuery(queryUses) {
+        // The logic for parsing the string is based on what actions does for
+        // parsing the 'uses' actions in the workflow file
+        if (queryUses === "") {
+            throw '"uses" value for queries cannot be blank';
+        }
+        if (queryUses.startsWith("./")) {
+            this.additionalQueries.push(queryUses.slice(2));
+            return;
+        }
+        let tok = queryUses.split('@');
+        if (tok.length !== 2) {
+            throw '"uses" value for queries must be a path, or owner/repo@ref \n Found: ' + queryUses;
+        }
+        const ref = tok[1];
+        tok = tok[0].split('/');
+        // The first token is the owner
+        // The second token is the repo
+        // The rest is a path, if there is more than one token combine them to form the full path
+        if (tok.length > 3) {
+            tok = [tok[0], tok[1], tok.slice(2).join('/')];
+        }
+        if (tok.length < 2) {
+            throw '"uses" value for queries must be a path, or owner/repo@ref \n Found: ' + queryUses;
+        }
+        let external = new ExternalQuery(tok[0] + '/' + tok[1], ref);
+        if (tok.length === 3) {
+            external.path = tok[2];
+        }
+        this.externalQueries.push(external);
+    }
+}
+exports.Config = Config;
+const configFolder = process.env['RUNNER_WORKSPACE'] || '/tmp/codeql-action';
+function initConfig() {
+    const configFile = core.getInput('config-file');
+    const config = new Config();
+    // If no config file was provided create an empty one
+    if (configFile === '') {
+        core.debug('No configuration file was provided');
+        return config;
+    }
+    try {
+        const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
+        if (parsedYAML.name && typeof parsedYAML.name === "string") {
+            config.name = parsedYAML.name;
+        }
+        const queries = parsedYAML.queries;
+        if (queries && queries instanceof Array) {
+            queries.forEach(query => {
+                if (query.uses && typeof query.uses === "string") {
+                    config.addQuery(query.uses);
+                }
+            });
+        }
+        const pathsIgnore = parsedYAML['paths-ignore'];
+        if (pathsIgnore && queries instanceof Array) {
+            pathsIgnore.forEach(path => {
+                if (typeof path === "string") {
+                    config.pathsIgnore.push(path);
+                }
+            });
+        }
+        const paths = parsedYAML.paths;
+        if (paths && paths instanceof Array) {
+            paths.forEach(path => {
+                if (typeof path === "string") {
+                    config.paths.push(path);
+                }
+            });
+        }
+    }
+    catch (err) {
+        core.setFailed(err);
+    }
+    return config;
+}
+async function saveConfig(config) {
+    const configString = JSON.stringify(config);
+    await io.mkdirP(configFolder);
+    fs.writeFileSync(path.join(configFolder, 'config'), configString, 'utf8');
+    core.debug('Saved config:');
+    core.debug(configString);
+}
+async function loadConfig() {
+    const configFile = path.join(configFolder, 'config');
+    if (fs.existsSync(configFile)) {
+        const configString = fs.readFileSync(configFile, 'utf8');
+        core.debug('Loaded config:');
+        core.debug(configString);
+        return JSON.parse(configString);
+    }
+    else {
+        const config = initConfig();
+        core.debug('Initialized config:');
+        core.debug(JSON.stringify(config));
+        await saveConfig(config);
+        return config;
+    }
+}
+exports.loadConfig = loadConfig;

lib/external-queries.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+async function checkoutExternalQueries(config) {
+    const folder = process.env['RUNNER_WORKSPACE'] || '/tmp/codeql-action';
+    for (const externalQuery of config.externalQueries) {
+        core.info('Checking out ' + externalQuery.repository);
+        const checkoutLocation = path.join(folder, externalQuery.repository);
+        if (!fs.existsSync(checkoutLocation)) {
+            const repoURL = 'https://github.com/' + externalQuery.repository + '.git';
+            await exec.exec('git', ['clone', repoURL, checkoutLocation]);
+            await exec.exec('git', [
+                '--work-tree=' + checkoutLocation,
+                '--git-dir=' + checkoutLocation + '/.git',
+                'checkout', externalQuery.ref,
+            ]);
+        }
+        config.additionalQueries.push(path.join(checkoutLocation, externalQuery.path));
+    }
+}
+exports.checkoutExternalQueries = checkoutExternalQueries;

lib/finalize-db.js

@@ -0,0 +1,138 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const io = __importStar(require("@actions/io"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const configUtils = __importStar(require("./config-utils"));
+const externalQueries = __importStar(require("./external-queries"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const upload_lib = __importStar(require("./upload-lib"));
+const util = __importStar(require("./util"));
+async function createdDBForScannedLanguages(codeqlCmd, databaseFolder) {
+    const scannedLanguages = process.env[sharedEnv.CODEQL_ACTION_SCANNED_LANGUAGES];
+    if (scannedLanguages) {
+        for (const language of scannedLanguages.split(',')) {
+            core.startGroup('Extracting ' + language);
+            // Get extractor location
+            let extractorPath = '';
+            await exec.exec(codeqlCmd, ['resolve', 'extractor', '--format=json', '--language=' + language], {
+                silent: true,
+                listeners: {
+                    stdout: (data) => { extractorPath += data.toString(); },
+                    stderr: (data) => { process.stderr.write(data); }
+                }
+            });
+            // Set trace command
+            const ext = process.platform === 'win32' ? '.cmd' : '.sh';
+            const traceCommand = path.resolve(JSON.parse(extractorPath), 'tools', 'autobuild' + ext);
+            // Run trace command
+            await exec.exec(codeqlCmd, ['database', 'trace-command', path.join(databaseFolder, language), '--', traceCommand]);
+            core.endGroup();
+        }
+    }
+}
+async function finalizeDatabaseCreation(codeqlCmd, databaseFolder) {
+    await createdDBForScannedLanguages(codeqlCmd, databaseFolder);
+    const languages = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES] || '';
+    for (const language of languages.split(',')) {
+        core.startGroup('Finalizing ' + language);
+        await exec.exec(codeqlCmd, ['database', 'finalize', path.join(databaseFolder, language)]);
+        core.endGroup();
+    }
+}
+async function resolveQueryLanguages(codeqlCmd, config) {
+    let res = new Map();
+    if (config.additionalQueries.length !== 0) {
+        let resolveQueriesOutput = '';
+        const options = {
+            listeners: {
+                stdout: (data) => {
+                    resolveQueriesOutput += data.toString();
+                }
+            }
+        };
+        await exec.exec(codeqlCmd, [
+            'resolve',
+            'queries',
+            ...config.additionalQueries,
+            '--format=bylanguage'
+        ], options);
+        const resolveQueriesOutputObject = JSON.parse(resolveQueriesOutput);
+        for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
+            res[language] = Object.keys(queries);
+        }
+        const noDeclaredLanguage = resolveQueriesOutputObject.noDeclaredLanguage;
+        const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
+        if (noDeclaredLanguageQueries.length !== 0) {
+            core.warning('Some queries do not declare a language:\n' + noDeclaredLanguageQueries.join('\n'));
+        }
+        const multipleDeclaredLanguages = resolveQueriesOutputObject.multipleDeclaredLanguages;
+        const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
+        if (multipleDeclaredLanguagesQueries.length !== 0) {
+            core.warning('Some queries declare multiple languages:\n' + multipleDeclaredLanguagesQueries.join('\n'));
+        }
+    }
+    return res;
+}
+// Runs queries and creates sarif files in the given folder
+async function runQueries(codeqlCmd, databaseFolder, sarifFolder, config) {
+    const queriesPerLanguage = await resolveQueryLanguages(codeqlCmd, config);
+    for (let database of fs.readdirSync(databaseFolder)) {
+        core.startGroup('Analyzing ' + database);
+        const additionalQueries = queriesPerLanguage[database] || [];
+        const sarifFile = path.join(sarifFolder, database + '.sarif');
+        await exec.exec(codeqlCmd, [
+            'database',
+            'analyze',
+            path.join(databaseFolder, database),
+            '--format=sarif-latest',
+            '--output=' + sarifFile,
+            '--no-sarif-add-snippets',
+            database + '-code-scanning.qls',
+            ...additionalQueries,
+        ]);
+        core.debug('SARIF results for database ' + database + ' created at "' + sarifFile + '"');
+        core.endGroup();
+    }
+}
+async function run() {
+    try {
+        if (util.should_abort('finish', true) || !await util.reportActionStarting('finish')) {
+            return;
+        }
+        const config = await configUtils.loadConfig();
+        core.exportVariable(sharedEnv.ODASA_TRACER_CONFIGURATION, '');
+        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
+        const codeqlCmd = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_CMD);
+        const databaseFolder = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_DATABASE_DIR);
+        const sarifFolder = core.getInput('output');
+        await io.mkdirP(sarifFolder);
+        core.info('Finalizing database creation');
+        await finalizeDatabaseCreation(codeqlCmd, databaseFolder);
+        await externalQueries.checkoutExternalQueries(config);
+        core.info('Analyzing database');
+        await runQueries(codeqlCmd, databaseFolder, sarifFolder, config);
+        if ('true' === core.getInput('upload')) {
+            await upload_lib.upload(sarifFolder);
+        }
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('finish', error.message, error.stack);
+        return;
+    }
+    await util.reportActionSucceeded('finish');
+}
+run().catch(e => {
+    core.setFailed("analyze action failed: " + e);
+    console.log(e);
+});

lib/fingerprints.js

@@ -0,0 +1,247 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const fs = __importStar(require("fs"));
+const long_1 = __importDefault(require("long"));
+const tab = '\t'.charCodeAt(0);
+const space = ' '.charCodeAt(0);
+const lf = '\n'.charCodeAt(0);
+const cr = '\r'.charCodeAt(0);
+const BLOCK_SIZE = 100;
+const MOD = long_1.default.fromInt(37); // L
+// Compute the starting point for the hash mod
+function computeFirstMod() {
+    let firstMod = long_1.default.ONE; // L
+    for (let i = 0; i < BLOCK_SIZE; i++) {
+        firstMod = firstMod.multiply(MOD);
+    }
+    return firstMod;
+}
+/**
+ * Hash the contents of a file
+ *
+ * The hash method computes a rolling hash for every line in the input. The hash is computed using the first
+ * BLOCK_SIZE non-space/tab characters counted from the start of the line. For the computation of the hash all
+ * line endings (i.e. \r, \n, and \r\n) are normalized to '\n'. A special value (-1) is added at the end of the
+ * file followed by enough '\0' characters to ensure that there are BLOCK_SIZE characters available for computing
+ * the hashes of the lines near the end of the file.
+ *
+ * @param callback function that is called with the line number (1-based) and hash for every line
+ * @param input The file's contents
+ */
+function hash(callback, input) {
+    // A rolling view in to the input
+    const window = Array(BLOCK_SIZE).fill(0);
+    // If the character in the window is the start of a new line
+    // then records the line number, otherwise will be -1.
+    // Indexes match up with those from the window variable.
+    const lineNumbers = Array(BLOCK_SIZE).fill(-1);
+    // The current hash value, updated as we read each character
+    let hash = long_1.default.ZERO;
+    let firstMod = computeFirstMod();
+    // The current index in the window, will wrap around to zero when we reach BLOCK_SIZE
+    let index = 0;
+    // The line number of the character we are currently processing from the input
+    let lineNumber = 0;
+    // Is the next character to be read the start of a new line
+    let lineStart = true;
+    // Was the previous character a CR (carriage return)
+    let prevCR = false;
+    // A map of hashes we've seen before and how many times,
+    // so we can disambiguate identical hashes
+    const hashCounts = {};
+    // Output the current hash and line number to the callback function
+    const outputHash = function () {
+        let hashValue = hash.toUnsigned().toString(16);
+        if (!hashCounts[hashValue]) {
+            hashCounts[hashValue] = 0;
+        }
+        hashCounts[hashValue]++;
+        callback(lineNumbers[index], hashValue + ":" + hashCounts[hashValue]);
+        lineNumbers[index] = -1;
+    };
+    // Update the current hash value and increment the index in the window
+    const updateHash = function (current) {
+        const begin = window[index];
+        window[index] = current;
+        hash = MOD.multiply(hash)
+            .add(long_1.default.fromInt(current))
+            .subtract(firstMod.multiply(long_1.default.fromInt(begin)));
+        index = (index + 1) % BLOCK_SIZE;
+    };
+    // First process every character in the input, updating the hash and lineNumbers
+    // as we go. Once we reach a point in the window again then we've processed
+    // BLOCK_SIZE characters and if the last character at this point in the window
+    // was the start of a line then we should output the hash for that line.
+    for (let i = 0, len = input.length; i <= len; i++) {
+        let current = i === len ? 65535 : input.charCodeAt(i);
+        // skip tabs, spaces, and line feeds that come directly after a carriage return
+        if (current === space || current === tab || (prevCR && current === lf)) {
+            prevCR = false;
+            continue;
+        }
+        // replace CR with LF
+        if (current === cr) {
+            current = lf;
+            prevCR = true;
+        }
+        else {
+            prevCR = false;
+        }
+        if (lineNumbers[index] !== -1) {
+            outputHash();
+        }
+        if (lineStart) {
+            lineStart = false;
+            lineNumber++;
+            lineNumbers[index] = lineNumber;
+        }
+        if (current === lf) {
+            lineStart = true;
+        }
+        updateHash(current);
+    }
+    // Flush the remaining lines
+    for (let i = 0; i < BLOCK_SIZE; i++) {
+        if (lineNumbers[index] !== -1) {
+            outputHash();
+        }
+        updateHash(0);
+    }
+}
+exports.hash = hash;
+// Generate a hash callback function that updates the given result in-place
+// when it recieves a hash for the correct line number. Ignores hashes for other lines.
+function locationUpdateCallback(result, location) {
+    var _a, _b;
+    let locationStartLine = (_b = (_a = location.physicalLocation) === null || _a === void 0 ? void 0 : _a.region) === null || _b === void 0 ? void 0 : _b.startLine;
+    if (locationStartLine === undefined) {
+        // We expect the region section to be present, but it can be absent if the
+        // alert pertains to the entire file. In this case, we compute the fingerprint
+        // using the hash of the first line of the file.
+        locationStartLine = 1;
+    }
+    return function (lineNumber, hash) {
+        // Ignore hashes for lines that don't concern us
+        if (locationStartLine !== lineNumber) {
+            return;
+        }
+        if (!result.partialFingerprints) {
+            result.partialFingerprints = {};
+        }
+        const existingFingerprint = result.partialFingerprints.primaryLocationLineHash;
+        // If the hash doesn't match the existing fingerprint then
+        // output a warning and don't overwrite it.
+        if (!existingFingerprint) {
+            result.partialFingerprints.primaryLocationLineHash = hash;
+        }
+        else if (existingFingerprint !== hash) {
+            core.warning("Calculated fingerprint of " + hash +
+                " for file " + location.physicalLocation.artifactLocation.uri +
+                " line " + lineNumber +
+                ", but found existing inconsistent fingerprint value " + existingFingerprint);
+        }
+    };
+}
+// Can we fingerprint the given location. This requires access to
+// the source file so we can hash it.
+// If possible returns a absolute file path for the source file,
+// or if not possible then returns undefined.
+function resolveUriToFile(location, artifacts) {
+    // This may be referencing an artifact
+    if (!location.uri && location.index !== undefined) {
+        if (typeof location.index !== 'number' ||
+            location.index < 0 ||
+            location.index >= artifacts.length ||
+            typeof artifacts[location.index].location !== 'object') {
+            core.debug('Ignoring location as index "' + location.index + '" is invalid');
+            return undefined;
+        }
+        location = artifacts[location.index].location;
+    }
+    // Get the URI and decode
+    if (typeof location.uri !== 'string') {
+        core.debug('Ignoring location as uri "' + location.uri + '" is invalid');
+        return undefined;
+    }
+    let uri = decodeURIComponent(location.uri);
+    // Remove a file scheme, and abort if the scheme is anything else
+    const fileUriPrefix = 'file://';
+    if (uri.startsWith(fileUriPrefix)) {
+        uri = uri.substring(fileUriPrefix.length);
+    }
+    if (uri.indexOf('://') !== -1) {
+        core.debug('Ignoring location URI "' + uri + "' as the scheme is not recognised");
+        return undefined;
+    }
+    // Discard any absolute paths that aren't in the src root
+    const srcRootPrefix = process.env['GITHUB_WORKSPACE'] + '/';
+    if (uri.startsWith('/') && !uri.startsWith(srcRootPrefix)) {
+        core.debug('Ignoring location URI "' + uri + "' as it is outside of the src root");
+        return undefined;
+    }
+    // Just assume a relative path is relative to the src root.
+    // This is not necessarily true but should be a good approximation
+    // and here we likely want to err on the side of handling more cases.
+    if (!uri.startsWith('/')) {
+        uri = srcRootPrefix + uri;
+    }
+    // Check the file exists
+    if (!fs.existsSync(uri)) {
+        core.debug("Unable to compute fingerprint for non-existent file: " + uri);
+        return undefined;
+    }
+    return uri;
+}
+exports.resolveUriToFile = resolveUriToFile;
+// Compute fingerprints for results in the given sarif file
+// and return an updated sarif file contents.
+function addFingerprints(sarifContents) {
+    let sarif = JSON.parse(sarifContents);
+    // Gather together results for the same file and construct
+    // callbacks to accept hashes for that file and update the location
+    const callbacksByFile = {};
+    for (const run of sarif.runs || []) {
+        // We may need the list of artifacts to resolve against
+        let artifacts = run.artifacts || [];
+        for (const result of run.results || []) {
+            // Check the primary location is defined correctly and is in the src root
+            const primaryLocation = (result.locations || [])[0];
+            if (!primaryLocation ||
+                !primaryLocation.physicalLocation ||
+                !primaryLocation.physicalLocation.artifactLocation) {
+                core.debug("Unable to compute fingerprint for invalid location: " + JSON.stringify(primaryLocation));
+                continue;
+            }
+            const filepath = resolveUriToFile(primaryLocation.physicalLocation.artifactLocation, artifacts);
+            if (!filepath) {
+                continue;
+            }
+            if (!callbacksByFile[filepath]) {
+                callbacksByFile[filepath] = [];
+            }
+            callbacksByFile[filepath].push(locationUpdateCallback(result, primaryLocation));
+        }
+    }
+    // Now hash each file that was found
+    Object.entries(callbacksByFile).forEach(([filepath, callbacks]) => {
+        // A callback that forwards the hash to all other callbacks for that file
+        const teeCallback = function (lineNumber, hash) {
+            Object.values(callbacks).forEach(c => c(lineNumber, hash));
+        };
+        const fileContents = fs.readFileSync(filepath).toString();
+        hash(teeCallback, fileContents);
+    });
+    return JSON.stringify(sarif);
+}
+exports.addFingerprints = addFingerprints;

lib/setup-tools.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const toolcache = __importStar(require("@actions/tool-cache"));
+const path = __importStar(require("path"));
+class CodeQLSetup {
+    constructor(codeqlDist) {
+        this.dist = codeqlDist;
+        this.tools = path.join(this.dist, 'tools');
+        this.cmd = path.join(codeqlDist, 'codeql');
+        // TODO check process.arch ?
+        if (process.platform === 'win32') {
+            this.platform = 'win64';
+            if (this.cmd.endsWith('codeql')) {
+                this.cmd += ".cmd";
+            }
+        }
+        else if (process.platform === 'linux') {
+            this.platform = 'linux64';
+        }
+        else if (process.platform === 'darwin') {
+            this.platform = 'osx64';
+        }
+        else {
+            throw new Error("Unsupported plaform: " + process.platform);
+        }
+    }
+}
+exports.CodeQLSetup = CodeQLSetup;
+async function setupCodeQL() {
+    const version = '1.0.0';
+    const codeqlURL = core.getInput('tools', { required: true });
+    let codeqlFolder = toolcache.find('CodeQL', version);
+    if (codeqlFolder) {
+        core.debug(`CodeQL found in cache ${codeqlFolder}`);
+    }
+    else {
+        const codeqlPath = await toolcache.downloadTool(codeqlURL);
+        const codeqlExtracted = await toolcache.extractTar(codeqlPath);
+        codeqlFolder = await toolcache.cacheDir(codeqlExtracted, 'CodeQL', version);
+    }
+    return new CodeQLSetup(path.join(codeqlFolder, 'codeql'));
+}
+exports.setupCodeQL = setupCodeQL;

lib/setup-tracer.js

@@ -0,0 +1,214 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const io = __importStar(require("@actions/io"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const analysisPaths = __importStar(require("./analysis-paths"));
+const configUtils = __importStar(require("./config-utils"));
+const setuptools = __importStar(require("./setup-tools"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util = __importStar(require("./util"));
+const CRITICAL_TRACER_VARS = new Set(['SEMMLE_PRELOAD_libtrace',
+    ,
+    'SEMMLE_RUNNER',
+    ,
+    'SEMMLE_COPY_EXECUTABLES_ROOT',
+    ,
+    'SEMMLE_DEPTRACE_SOCKET',
+    ,
+    'SEMMLE_JAVA_TOOL_OPTIONS'
+]);
+async function tracerConfig(codeql, database, compilerSpec) {
+    const compilerSpecArg = compilerSpec ? ["--compiler-spec=" + compilerSpec] : [];
+    let envFile = path.resolve(database, 'working', 'env.tmp');
+    await exec.exec(codeql.cmd, ['database', 'trace-command', database,
+        ...compilerSpecArg,
+        process.execPath, path.resolve(__dirname, 'tracer-env.js'), envFile]);
+    const env = JSON.parse(fs.readFileSync(envFile, 'utf-8'));
+    const config = env['ODASA_TRACER_CONFIGURATION'];
+    const info = { spec: config, env: {} };
+    // Extract critical tracer variables from the environment
+    for (let entry of Object.entries(env)) {
+        const key = entry[0];
+        const value = entry[1];
+        // skip ODASA_TRACER_CONFIGURATION as it is handled separately
+        if (key === 'ODASA_TRACER_CONFIGURATION') {
+            continue;
+        }
+        // skip undefined values
+        if (typeof value === 'undefined') {
+            continue;
+        }
+        // Keep variables that do not exist in current environment. In addition always keep
+        // critical and CODEQL_ variables
+        if (typeof process.env[key] === 'undefined' || CRITICAL_TRACER_VARS.has(key) || key.startsWith('CODEQL_')) {
+            info.env[key] = value;
+        }
+    }
+    return info;
+}
+function concatTracerConfigs(configs) {
+    // A tracer config is a map containing additional environment variables and a tracer 'spec' file.
+    // A tracer 'spec' file has the following format [log_file, number_of_blocks, blocks_text]
+    // Merge the environments
+    const env = {};
+    let copyExecutables = false;
+    let envSize = 0;
+    for (let v of Object.values(configs)) {
+        for (let e of Object.entries(v.env)) {
+            const name = e[0];
+            const value = e[1];
+            // skip SEMMLE_COPY_EXECUTABLES_ROOT as it is handled separately
+            if (name === 'SEMMLE_COPY_EXECUTABLES_ROOT') {
+                copyExecutables = true;
+            }
+            else if (name in env) {
+                if (env[name] !== value) {
+                    throw Error('Incompatible values in environment parameter ' +
+                        name + ': ' + env[name] + ' and ' + value);
+                }
+            }
+            else {
+                env[name] = value;
+                envSize += 1;
+            }
+        }
+    }
+    // Concatenate spec files into a new spec file
+    let languages = Object.keys(configs);
+    const cppIndex = languages.indexOf('cpp');
+    // Make sure cpp is the last language, if it's present since it must be concatenated last
+    if (cppIndex !== -1) {
+        let lastLang = languages[languages.length - 1];
+        languages[languages.length - 1] = languages[cppIndex];
+        languages[cppIndex] = lastLang;
+    }
+    let totalLines = [];
+    let totalCount = 0;
+    for (let lang of languages) {
+        const lines = fs.readFileSync(configs[lang].spec, 'utf8').split(/\r?\n/);
+        const count = parseInt(lines[1], 10);
+        totalCount += count;
+        totalLines.push(...lines.slice(2));
+    }
+    const newLogFilePath = path.resolve(util.workspaceFolder(), 'compound-build-tracer.log');
+    const spec = path.resolve(util.workspaceFolder(), 'compound-spec');
+    const tempFolder = path.resolve(util.workspaceFolder(), 'compound-temp');
+    const newSpecContent = [newLogFilePath, totalCount.toString(10), ...totalLines];
+    if (copyExecutables) {
+        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = tempFolder;
+        envSize += 1;
+    }
+    fs.writeFileSync(spec, newSpecContent.join('\n'));
+    // Prepare the content of the compound environment file
+    let buffer = Buffer.alloc(4);
+    buffer.writeInt32LE(envSize, 0);
+    for (let e of Object.entries(env)) {
+        const key = e[0];
+        const value = e[1];
+        const lineBuffer = new Buffer(key + '=' + value + '\0', 'utf8');
+        const sizeBuffer = Buffer.alloc(4);
+        sizeBuffer.writeInt32LE(lineBuffer.length, 0);
+        buffer = Buffer.concat([buffer, sizeBuffer, lineBuffer]);
+    }
+    // Write the compound environment
+    const envPath = spec + '.environment';
+    fs.writeFileSync(envPath, buffer);
+    return { env, spec };
+}
+async function run() {
+    try {
+        if (util.should_abort('init', false) || !await util.reportActionStarting('init')) {
+            return;
+        }
+        // The config file MUST be parsed in the init action
+        const config = await configUtils.loadConfig();
+        core.startGroup('Load language configuration');
+        const languages = await util.getLanguages();
+        // If the languages parameter was not given and no languages were
+        // detected then fail here as this is a workflow configuration error.
+        if (languages.length === 0) {
+            core.setFailed("Did not detect any languages to analyze. Please update input in workflow.");
+            return;
+        }
+        core.endGroup();
+        analysisPaths.includeAndExcludeAnalysisPaths(config, languages);
+        const sourceRoot = path.resolve();
+        core.startGroup('Setup CodeQL tools');
+        const codeqlSetup = await setuptools.setupCodeQL();
+        await exec.exec(codeqlSetup.cmd, ['version', '--format=json']);
+        core.endGroup();
+        // Forward Go flags
+        const goFlags = process.env['GOFLAGS'];
+        if (goFlags) {
+            core.exportVariable('GOFLAGS', goFlags);
+            core.warning("Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.");
+        }
+        // Setup CODEQL_RAM flag (todo improve this https://github.com/github/dsp-code-scanning/issues/935)
+        const codeqlRam = process.env['CODEQL_RAM'] || '6500';
+        core.exportVariable('CODEQL_RAM', codeqlRam);
+        const databaseFolder = path.resolve(util.workspaceFolder(), 'codeql_databases');
+        await io.mkdirP(databaseFolder);
+        let tracedLanguages = {};
+        let scannedLanguages = [];
+        // TODO: replace this code once CodeQL supports multi-language tracing
+        for (let language of languages) {
+            const languageDatabase = path.join(databaseFolder, language);
+            // Init language database
+            await exec.exec(codeqlSetup.cmd, ['database', 'init', languageDatabase, '--language=' + language, '--source-root=' + sourceRoot]);
+            // TODO: add better detection of 'traced languages' instead of using a hard coded list
+            if (['cpp', 'java', 'csharp'].includes(language)) {
+                const config = await tracerConfig(codeqlSetup, languageDatabase);
+                tracedLanguages[language] = config;
+            }
+            else {
+                scannedLanguages.push(language);
+            }
+        }
+        const tracedLanguageKeys = Object.keys(tracedLanguages);
+        if (tracedLanguageKeys.length > 0) {
+            const mainTracerConfig = concatTracerConfigs(tracedLanguages);
+            if (mainTracerConfig.spec) {
+                for (let entry of Object.entries(mainTracerConfig.env)) {
+                    core.exportVariable(entry[0], entry[1]);
+                }
+                core.exportVariable('ODASA_TRACER_CONFIGURATION', mainTracerConfig.spec);
+                if (process.platform === 'darwin') {
+                    core.exportVariable('DYLD_INSERT_LIBRARIES', path.join(codeqlSetup.tools, 'osx64', 'libtrace.dylib'));
+                }
+                else if (process.platform === 'win32') {
+                    await exec.exec('powershell', [path.resolve(__dirname, '..', 'src', 'inject-tracer.ps1'),
+                        path.resolve(codeqlSetup.tools, 'win64', 'tracer.exe')], { env: { 'ODASA_TRACER_CONFIGURATION': mainTracerConfig.spec } });
+                }
+                else {
+                    core.exportVariable('LD_PRELOAD', path.join(codeqlSetup.tools, 'linux64', '${LIB}trace.so'));
+                }
+            }
+        }
+        core.exportVariable(sharedEnv.CODEQL_ACTION_SCANNED_LANGUAGES, scannedLanguages.join(','));
+        core.exportVariable(sharedEnv.CODEQL_ACTION_TRACED_LANGUAGES, tracedLanguageKeys.join(','));
+        // TODO: make this a "private" environment variable of the action
+        core.exportVariable(sharedEnv.CODEQL_ACTION_DATABASE_DIR, databaseFolder);
+        core.exportVariable(sharedEnv.CODEQL_ACTION_CMD, codeqlSetup.cmd);
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('init', error.message, error.stack);
+        return;
+    }
+    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
+    await util.reportActionSucceeded('init');
+}
+run().catch(e => {
+    core.setFailed("init action failed: " + e);
+    console.log(e);
+});

lib/shared-environment.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEQL_ACTION_CMD = 'CODEQL_ACTION_CMD';
+exports.CODEQL_ACTION_DATABASE_DIR = 'CODEQL_ACTION_DATABASE_DIR';
+exports.CODEQL_ACTION_LANGUAGES = 'CODEQL_ACTION_LANGUAGES';
+exports.ODASA_TRACER_CONFIGURATION = 'ODASA_TRACER_CONFIGURATION';
+exports.CODEQL_ACTION_SCANNED_LANGUAGES = 'CODEQL_ACTION_SCANNED_LANGUAGES';
+exports.CODEQL_ACTION_TRACED_LANGUAGES = 'CODEQL_ACTION_TRACED_LANGUAGES';
+// The time at which the first action (normally init) started executing.
+// If a workflow invokes a different action without first invoking the init
+// action (i.e. the upload action is being used by a third-party integrator)
+// then this variable will be assigned the start time of the action invoked
+// rather that the init action.
+exports.CODEQL_ACTION_STARTED_AT = 'CODEQL_ACTION_STARTED_AT';
+// Populated when the init action completes successfully
+exports.CODEQL_ACTION_INIT_COMPLETED = 'CODEQL_ACTION_INIT_COMPLETED';

lib/tracer-env.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const env = {};
+for (let entry of Object.entries(process.env)) {
+    const key = entry[0];
+    const value = entry[1];
+    if (typeof value !== 'undefined' && key !== '_' && !key.startsWith('JAVA_MAIN_CLASS_')) {
+        env[key] = value;
+    }
+}
+process.stdout.write(process.argv[2]);
+fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');

lib/upload-lib.js

@@ -0,0 +1,140 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const http = __importStar(require("@actions/http-client"));
+const auth = __importStar(require("@actions/http-client/auth"));
+const io = __importStar(require("@actions/io"));
+const file_url_1 = __importDefault(require("file-url"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const zlib_1 = __importDefault(require("zlib"));
+const fingerprints = __importStar(require("./fingerprints"));
+const sharedEnv = __importStar(require("./shared-environment"));
+const util = __importStar(require("./util"));
+// Construct the location of the sentinel file for detecting multiple uploads.
+// The returned location should be writable.
+async function getSentinelFilePath() {
+    // Use the temp dir instead of placing next to the sarif file because of
+    // issues with docker actions. The directory containing the sarif file
+    // may not be writable by us.
+    const uploadsTmpDir = path.join(process.env['RUNNER_TEMP'] || '/tmp/codeql-action', 'uploads');
+    await io.mkdirP(uploadsTmpDir);
+    // Hash the absolute path so we'll behave correctly in the unlikely
+    // scenario a file is referenced twice with different paths.
+    return path.join(uploadsTmpDir, 'codeql-action-upload-sentinel');
+}
+// Takes a list of paths to sarif files and combines them together,
+// returning the contents of the combined sarif file.
+function combineSarifFiles(sarifFiles) {
+    let combinedSarif = {
+        version: null,
+        runs: []
+    };
+    for (let sarifFile of sarifFiles) {
+        let sarifObject = JSON.parse(fs.readFileSync(sarifFile, 'utf8'));
+        // Check SARIF version
+        if (combinedSarif.version === null) {
+            combinedSarif.version = sarifObject.version;
+        }
+        else if (combinedSarif.version !== sarifObject.version) {
+            throw "Different SARIF versions encountered: " + combinedSarif.version + " and " + sarifObject.version;
+        }
+        combinedSarif.runs.push(...sarifObject.runs);
+    }
+    return JSON.stringify(combinedSarif);
+}
+exports.combineSarifFiles = combineSarifFiles;
+// Uploads a single sarif file or a directory of sarif files
+// depending on what the path happens to refer to.
+async function upload(input) {
+    if (fs.lstatSync(input).isDirectory()) {
+        const sarifFiles = fs.readdirSync(input)
+            .filter(f => f.endsWith(".sarif"))
+            .map(f => path.resolve(input, f));
+        await uploadFiles(sarifFiles);
+    }
+    else {
+        await uploadFiles([input]);
+    }
+}
+exports.upload = upload;
+// Uploads the given set of sarif files.
+async function uploadFiles(sarifFiles) {
+    core.startGroup("Uploading results");
+    try {
+        // Check if an upload has happened before. If so then abort.
+        // This is intended to catch when the finish and upload-sarif actions
+        // are used together, and then the upload-sarif action is invoked twice.
+        const sentinelFile = await getSentinelFilePath();
+        if (fs.existsSync(sentinelFile)) {
+            core.info("Aborting as an upload has already happened from this job");
+            return;
+        }
+        const commitOid = util.getRequiredEnvParam('GITHUB_SHA');
+        const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
+        const ref = util.getRequiredEnvParam('GITHUB_REF'); // it's in the form "refs/heads/master"
+        const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
+        const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
+        core.debug("Uploading sarif files: " + JSON.stringify(sarifFiles));
+        let sarifPayload = combineSarifFiles(sarifFiles);
+        sarifPayload = fingerprints.addFingerprints(sarifPayload);
+        const zipped_sarif = zlib_1.default.gzipSync(sarifPayload).toString('base64');
+        let checkoutPath = core.getInput('checkout_path');
+        let checkoutURI = file_url_1.default(checkoutPath);
+        const workflowRunID = parseInt(workflowRunIDStr, 10);
+        if (Number.isNaN(workflowRunID)) {
+            core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
+            return;
+        }
+        let matrix = core.getInput('matrix');
+        if (matrix === "null" || matrix === "") {
+            matrix = undefined;
+        }
+        const payload = JSON.stringify({
+            "commit_oid": commitOid,
+            "ref": ref,
+            "analysis_name": analysisName,
+            "sarif": zipped_sarif,
+            "workflow_run_id": workflowRunID,
+            "checkout_uri": checkoutURI,
+            "environment": matrix,
+            "started_at": startedAt
+        });
+        core.info('Uploading results');
+        const githubToken = core.getInput('token');
+        const ph = new auth.BearerCredentialHandler(githubToken);
+        const client = new http.HttpClient('Code Scanning : Upload SARIF', [ph]);
+        const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY'] + '/code-scanning/analysis';
+        const res = await client.put(url, payload);
+        const requestID = res.message.headers["x-github-request-id"];
+        core.debug('response status: ' + res.message.statusCode);
+        if (res.message.statusCode === 500) {
+            // If the upload fails with 500 then we assume it is a temporary problem
+            // with turbo-scan and not an error that the user has caused or can fix.
+            // We avoid marking the job as failed to avoid breaking CI workflows.
+            core.error('Upload failed (' + requestID + '): ' + await res.readBody());
+        }
+        else if (res.message.statusCode !== 202) {
+            core.setFailed('Upload failed (' + requestID + '): ' + await res.readBody());
+        }
+        else {
+            core.info("Successfully uploaded results");
+        }
+        // Mark that we have made an upload
+        fs.writeFileSync(sentinelFile, '');
+    }
+    catch (error) {
+        core.setFailed(error.message);
+    }
+    core.endGroup();
+}

lib/upload-sarif.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const upload_lib = __importStar(require("./upload-lib"));
+const util = __importStar(require("./util"));
+async function run() {
+    if (util.should_abort('upload-sarif', false) || !await util.reportActionStarting('upload-sarif')) {
+        return;
+    }
+    try {
+        await upload_lib.upload(core.getInput('sarif_file'));
+    }
+    catch (error) {
+        core.setFailed(error.message);
+        await util.reportActionFailed('upload-sarif', error.message, error.stack);
+        return;
+    }
+    await util.reportActionSucceeded('upload-sarif');
+}
+run().catch(e => {
+    core.setFailed("upload-sarif action failed: " + e);
+    console.log(e);
+});

lib/util.js

@@ -0,0 +1,264 @@
+"use strict";
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const http = __importStar(require("@actions/http-client"));
+const auth = __importStar(require("@actions/http-client/auth"));
+const octokit = __importStar(require("@octokit/rest"));
+const console_log_level_1 = __importDefault(require("console-log-level"));
+const path = __importStar(require("path"));
+const sharedEnv = __importStar(require("./shared-environment"));
+/**
+ * Should the current action be aborted?
+ *
+ * This method should be called at the start of all CodeQL actions and they
+ * should abort cleanly if this returns true without failing the action.
+ * This method will call `core.setFailed` if necessary.
+ */
+function should_abort(actionName, requireInitActionHasRun) {
+    // Check that required aspects of the environment are present
+    const ref = process.env['GITHUB_REF'];
+    if (ref === undefined) {
+        core.setFailed('GITHUB_REF must be set.');
+        return true;
+    }
+    // Should abort if called on a merge commit for a pull request.
+    if (ref.startsWith('refs/pull/')) {
+        core.warning('The CodeQL ' + actionName + ' action is intended for workflows triggered on `push` events, '
+            + 'but the current workflow is running on a pull request. Aborting.');
+        return true;
+    }
+    // If the init action is required, then check the it completed successfully.
+    if (requireInitActionHasRun && process.env[sharedEnv.CODEQL_ACTION_INIT_COMPLETED] === undefined) {
+        core.setFailed('The CodeQL ' + actionName + ' action cannot be used unless the CodeQL init action is run first. Aborting.');
+        return true;
+    }
+    return false;
+}
+exports.should_abort = should_abort;
+/**
+ * Resolve the path to the workspace folder.
+ */
+function workspaceFolder() {
+    let workspaceFolder = process.env['RUNNER_WORKSPACE'];
+    if (!workspaceFolder)
+        workspaceFolder = path.resolve('..');
+    return workspaceFolder;
+}
+exports.workspaceFolder = workspaceFolder;
+/**
+ * Get an environment parameter, but throw an error if it is not set.
+ */
+function getRequiredEnvParam(paramName) {
+    const value = process.env[paramName];
+    if (value === undefined) {
+        throw new Error(paramName + ' environment variable must be set');
+    }
+    core.debug(paramName + '=' + value);
+    return value;
+}
+exports.getRequiredEnvParam = getRequiredEnvParam;
+/**
+ * Gets the set of languages in the current repository
+ */
+async function getLanguagesInRepo() {
+    var _a;
+    // Translate between GitHub's API names for languages and ours
+    const codeqlLanguages = {
+        'C': 'cpp',
+        'C++': 'cpp',
+        'C#': 'csharp',
+        'Go': 'go',
+        'Java': 'java',
+        'JavaScript': 'javascript',
+        'TypeScript': 'javascript',
+        'Python': 'python',
+    };
+    let repo_nwo = (_a = process.env['GITHUB_REPOSITORY']) === null || _a === void 0 ? void 0 : _a.split("/");
+    if (repo_nwo) {
+        let owner = repo_nwo[0];
+        let repo = repo_nwo[1];
+        core.debug(`GitHub repo ${owner} ${repo}`);
+        let ok = new octokit.Octokit({
+            auth: core.getInput('token'),
+            userAgent: "CodeQL Action",
+            log: console_log_level_1.default({ level: "debug" })
+        });
+        const response = await ok.request("GET /repos/:owner/:repo/languages", ({
+            owner,
+            repo
+        }));
+        core.debug("Languages API response: " + JSON.stringify(response));
+        // The GitHub API is going to return languages in order of popularity,
+        // When we pick a language to autobuild we want to pick the most popular traced language
+        // Since sets in javascript maintain insertion order, using a set here and then splatting it
+        // into an array gives us an array of languages ordered by popularity
+        let languages = new Set();
+        for (let lang in response.data) {
+            if (lang in codeqlLanguages) {
+                languages.add(codeqlLanguages[lang]);
+            }
+        }
+        return [...languages];
+    }
+    else {
+        return [];
+    }
+}
+/**
+ * Get the languages to analyse.
+ *
+ * The result is obtained from the environment parameter CODEQL_ACTION_LANGUAGES
+ * if that has been set, otherwise it is obtained from the action input parameter
+ * 'languages' if that has been set, otherwise it is deduced as all languages in the
+ * repo that can be analysed.
+ *
+ * If the languages are obtained from either of the second choices, the
+ * CODEQL_ACTION_LANGUAGES environment variable will be exported with the
+ * deduced list.
+ */
+async function getLanguages() {
+    // Obtain from CODEQL_ACTION_LANGUAGES if set
+    const langsVar = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES];
+    if (langsVar) {
+        return langsVar.split(',')
+            .map(x => x.trim())
+            .filter(x => x.length > 0);
+    }
+    // Obtain from action input 'languages' if set
+    let languages = core.getInput('languages', { required: false })
+        .split(',')
+        .map(x => x.trim())
+        .filter(x => x.length > 0);
+    core.info("Languages from configuration: " + JSON.stringify(languages));
+    if (languages.length === 0) {
+        // Obtain languages as all languages in the repo that can be analysed
+        languages = await getLanguagesInRepo();
+        core.info("Automatically detected languages: " + JSON.stringify(languages));
+    }
+    core.exportVariable(sharedEnv.CODEQL_ACTION_LANGUAGES, languages.join(','));
+    return languages;
+}
+exports.getLanguages = getLanguages;
+/**
+ * Compose a StatusReport.
+ *
+ * @param actionName The name of the action, e.g. 'init', 'finish', 'upload-sarif'
+ * @param status The status. Must be 'success', 'failure', or 'starting'
+ * @param cause  Cause of failure (only supply if status is 'failure')
+ * @param exception Exception (only supply if status is 'failure')
+ */
+async function createStatusReport(actionName, status, cause, exception) {
+    const commitOid = process.env['GITHUB_SHA'] || '';
+    const workflowRunIDStr = process.env['GITHUB_RUN_ID'];
+    let workflowRunID = -1;
+    if (workflowRunIDStr) {
+        workflowRunID = parseInt(workflowRunIDStr, 10);
+    }
+    const workflowName = process.env['GITHUB_WORKFLOW'] || '';
+    const jobName = process.env['GITHUB_JOB'] || '';
+    const languages = (await getLanguages()).sort().join(',');
+    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT] || new Date().toISOString();
+    core.exportVariable(sharedEnv.CODEQL_ACTION_STARTED_AT, startedAt);
+    let statusReport = {
+        workflow_run_id: workflowRunID,
+        workflow_name: workflowName,
+        job_name: jobName,
+        languages: languages,
+        commit_oid: commitOid,
+        action_name: actionName,
+        action_oid: "unknown",
+        started_at: startedAt,
+        status: status
+    };
+    // Add optional parameters
+    if (cause) {
+        statusReport.cause = cause;
+    }
+    if (exception) {
+        statusReport.exception = exception;
+    }
+    if (status === 'success' || status === 'failure') {
+        statusReport.completed_at = new Date().toISOString();
+    }
+    let matrix = core.getInput('matrix');
+    if (matrix) {
+        statusReport.matrix_vars = matrix;
+    }
+    return statusReport;
+}
+/**
+ * Send a status report to the code_scanning/analysis/status endpoint.
+ *
+ * Returns the status code of the response to the status request, or
+ * undefined if the given statusReport is undefined or no response was
+ * received.
+ */
+async function sendStatusReport(statusReport) {
+    var _a;
+    const statusReportJSON = JSON.stringify(statusReport);
+    core.debug('Sending status report: ' + statusReportJSON);
+    const githubToken = core.getInput('token');
+    const ph = new auth.BearerCredentialHandler(githubToken);
+    const client = new http.HttpClient('Code Scanning : Status Report', [ph]);
+    const url = 'https://api.github.com/repos/' + process.env['GITHUB_REPOSITORY']
+        + '/code-scanning/analysis/status';
+    const res = await client.put(url, statusReportJSON);
+    return (_a = res.message) === null || _a === void 0 ? void 0 : _a.statusCode;
+}
+/**
+ * Send a status report that an action is starting.
+ *
+ * If the action is `init` then this also records the start time in the environment,
+ * and ensures that the analysed languages are also recorded in the envirenment.
+ *
+ * Returns true unless a problem occurred and the action should abort.
+ */
+async function reportActionStarting(action) {
+    const statusCode = await sendStatusReport(await createStatusReport(action, 'starting'));
+    // If the status report request fails with a 403 or a 404, then this is a deliberate
+    // message from the endpoint that the SARIF upload can be expected to fail too,
+    // so the action should fail to avoid wasting actions minutes.
+    //
+    // Other failure responses (or lack thereof) could be transitory and should not
+    // cause the action to fail.
+    if (statusCode === 403) {
+        core.setFailed('The repo on which this action is running is not opted-in to CodeQL code scanning.');
+        return false;
+    }
+    if (statusCode === 404) {
+        core.setFailed('Not authorized to used the CodeQL code scanning feature on this repo.');
+        return false;
+    }
+    return true;
+}
+exports.reportActionStarting = reportActionStarting;
+/**
+ * Report that an action has failed.
+ *
+ * Note that the started_at date is always that of the `init` action, since
+ * this is likely to give a more useful duration when inspecting events.
+ */
+async function reportActionFailed(action, cause, exception) {
+    await sendStatusReport(await createStatusReport(action, 'failure', cause, exception));
+}
+exports.reportActionFailed = reportActionFailed;
+/**
+ * Report that an action has succeeded.
+ *
+ * Note that the started_at date is always that of the `init` action, since
+ * this is likely to give a more useful duration when inspecting events.
+ */
+async function reportActionSucceeded(action) {
+    await sendStatusReport(await createStatusReport(action, 'success'));
+}
+exports.reportActionSucceeded = reportActionSucceeded;