robojerk/codeql-action

Ensure artifacts are only uploaded in safe situations

Browse source 
This commit:

Turns on uploading of artifacts again but only if CLI version is
>= 2.20.3. I implemented the check using our feature flag functionality.
I was on the fence about this since it makes the PR more complex.
However, it does give us more flexibility when controlling artifact
uploads.

Also, I renamed the two workflows that were previously disabled. This
way we will not accidentally enable the old workflows for previous
versions of the action.
This commit is contained in:
Andrew Eisenberg 2025-01-25 15:31:35 -08:00
parent e7c0c9d71b
commit 2bab9f7984
17 changed files with 264 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

26
lib/debug-artifacts.js generated
View file

@ -52,6 +52,7 @@ const actions_util_1 = require("./actions-util");
const analyze_1 = require("./analyze");
const codeql_1 = require("./codeql");
const environment_1 = require("./environment");
const feature_flags_1 = require("./feature-flags");
const logging_1 = require("./logging");
const util_1 = require("./util");
function sanitizeArtifactName(name) {
@ -61,7 +62,7 @@ function sanitizeArtifactName(name) {
* Upload Actions SARIF artifacts for debugging when CODEQL_ACTION_DEBUG_COMBINED_SARIF
* environment variable is set
*/
async function uploadCombinedSarifArtifacts(logger, gitHubVariant) {
async function uploadCombinedSarifArtifacts(logger, gitHubVariant, features) {
const tempDir = (0, actions_util_1.getTemporaryDirectory)();
// Upload Actions SARIF artifacts for debugging when environment variable is set
if (process.env["CODEQL_ACTION_DEBUG_COMBINED_SARIF"] === "true") {
@ -80,7 +81,7 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant) {
}
}
try {
await uploadDebugArtifacts(logger, toUpload, baseTempDir, "combined-sarif-artifacts", gitHubVariant);
await uploadDebugArtifacts(logger, toUpload, baseTempDir, "combined-sarif-artifacts", gitHubVariant, features);
}
catch (e) {
logger.warning(`Failed to upload combined SARIF files as Actions debugging artifact. Reason: ${(0, util_1.getErrorMessage)(e)}`);
@ -140,7 +141,7 @@ async function tryBundleDatabase(config, language, logger) {
*
* Logs and suppresses any errors that occur.
*/
async function tryUploadAllAvailableDebugArtifacts(config, logger) {
async function tryUploadAllAvailableDebugArtifacts(config, logger, features) {
const filesToUpload = [];
try {
for (const language of config.languages) {
@ -180,20 +181,25 @@ async function tryUploadAllAvailableDebugArtifacts(config, logger) {
return;
}
try {
await (0, logging_1.withGroup)("Uploading debug artifacts", async () => uploadDebugArtifacts(logger, filesToUpload, config.dbLocation, config.debugArtifactName, config.gitHubVersion.type));
await (0, logging_1.withGroup)("Uploading debug artifacts", async () => uploadDebugArtifacts(logger, filesToUpload, config.dbLocation, config.debugArtifactName, config.gitHubVersion.type, features));
}
catch (e) {
logger.warning(`Failed to upload debug artifacts. Reason: ${(0, util_1.getErrorMessage)(e)}`);
}
}
async function uploadDebugArtifacts(logger, toUpload, rootDir, artifactName, ghVariant) {
async function uploadDebugArtifacts(logger, toUpload, rootDir, artifactName, ghVariant, features) {
if (toUpload.length === 0) {
return;
return "no-artifacts-to-upload";
}
const uploadSupported = typeof features === "boolean"
? features
: await features.getValue(feature_flags_1.Feature.SafeArtifactUpload);
if (!uploadSupported) {
core.info(`Skipping debug artifact upload because the current CLI does not support safe upload. Please upgrade to CLI v${feature_flags_1.featureConfig.safe_artifact_upload.minimumVersion} or later.`);
return "upload-not-supported";
}
logger.info("Uploading debug artifacts is temporarily disabled");
return;
let suffix = "";
const matrix = (0, actions_util_1.getRequiredInput)("matrix");
const matrix = (0, actions_util_1.getOptionalInput)("matrix");
if (matrix) {
try {
for (const [, matrixVal] of Object.entries(JSON.parse(matrix)).sort())
@ -209,10 +215,12 @@ async function uploadDebugArtifacts(logger, toUpload, rootDir, artifactName, ghV
// ensure we don't keep the debug artifacts around for too long since they can be large.
retentionDays: 7,
});
return "upload-successful";
}
catch (e) {
// A failure to upload debug artifacts should not fail the entire action.
core.warning(`Failed to upload debug artifacts: ${e}`);
return "upload-failed";
}
}
// `@actions/artifact@v2` is not yet supported on GHES so the legacy version of the client will be used on GHES