robojerk/codeql-action

Merge pull request #2953 from github/update-v3.29.1-428aea55f

Browse source 
Merge main into releases/v3
This commit is contained in:
Arthur Baars 2025-06-27 12:44:25 +02:00 • committed by GitHub
commit 39edc492db
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
87 changed files with 698 additions and 220 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.github/copilot-instructions.md vendored Normal file
View file

@ -0,0 +1,5 @@
# CodeQL Action - Copilot Instructions
The CodeQL Action is written in TypeScript and compiled to JavaScript. Both the TypeScript sources and the **generated** JavaScript code are contained in this repository. The TypeScript sources are contained in the `src` directory and the JavaScript code is contained in the `lib` directory. A GitHub Actions workflow checks that the JavaScript code in `lib` is up-to-date. Therefore, you should not review any changes to the contents of the `lib` folder and it is expected that the JavaScript code in `lib` closely mirrors the TypeScript code it is generated from.
GitHub Actions workflows in the `.github/workflows` directory whose filenames start with two underscores (e.g. `__all-platform-bundle.yml`) are automatically generated using the `pr-checks/sync.sh` script from template files in the `pr-checks/checks` directory. Therefore, you do not need to review files in the `.github/workflows` directory that starts with two underscores. However, you should review changes to the `pr-checks` directory as well as workflows in the `.github/workflows` directory that do not start with underscores.

5
.github/workflows/__all-platform-bundle.yml generated vendored
View file

@ -45,6 +45,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'true'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- id: init
uses: ./../action/init
with:

5
.github/workflows/__analyze-ref-input.yml generated vendored
View file

@ -49,6 +49,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}

5
.github/workflows/__build-mode-manual.yml generated vendored
View file

@ -45,6 +45,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
id: init
with:

5
.github/workflows/__export-file-baseline-information.yml generated vendored
View file

@ -49,6 +49,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
id: init
with:

4
.github/workflows/__go-custom-queries.yml generated vendored
View file

@ -47,9 +47,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
languages: go

5
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml generated vendored
View file

@ -45,10 +45,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
# We need a Go version that ships with statically linked binaries on Linux
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
languages: go

5
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml generated vendored
View file

@ -45,10 +45,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
# We need a Go version that ships with statically linked binaries on Linux
go-version: '>=1.21.0'
cache: false
- name: Remove `file` program
run: |
echo $(which file)

5
.github/workflows/__go-indirect-tracing-workaround.yml generated vendored
View file

@ -45,10 +45,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
# We need a Go version that ships with statically linked binaries on Linux
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
languages: go

7
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View file

@ -75,11 +75,10 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: ~1.24.0
# to avoid potentially misleading autobuilder results where we expect it to download
# dependencies successfully, but they actually come from a warm cache
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:

7
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View file

@ -75,11 +75,10 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: ~1.24.0
# to avoid potentially misleading autobuilder results where we expect it to download
# dependencies successfully, but they actually come from a warm cache
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:

7
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View file

@ -75,11 +75,10 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: ~1.24.0
# to avoid potentially misleading autobuilder results where we expect it to download
# dependencies successfully, but they actually come from a warm cache
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:

5
.github/workflows/__multi-language-autodetect.yml generated vendored
View file

@ -75,10 +75,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: actions/setup-go@v5
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
id: init
with:

5
.github/workflows/__packaging-codescanning-config-inputs-js.yml generated vendored
View file

@ -61,6 +61,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
config-file: .github/codeql/codeql-config-packaging3.yml

5
.github/workflows/__packaging-config-inputs-js.yml generated vendored
View file

@ -61,6 +61,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
config-file: .github/codeql/codeql-config-packaging3.yml

5
.github/workflows/__packaging-config-js.yml generated vendored
View file

@ -61,6 +61,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
config-file: .github/codeql/codeql-config-packaging.yml

5
.github/workflows/__packaging-inputs-js.yml generated vendored
View file

@ -61,6 +61,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
config-file: .github/codeql/codeql-config-packaging2.yml

100
.github/workflows/__quality-queries.yml generated vendored Normal file
View file

@ -0,0 +1,100 @@
# Warning: This file is generated automatically, and should not be modified.
# Instead, please modify the template in the pr-checks directory and run:
# (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
# to regenerate this file.
name: PR Check - Quality queries input
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GO111MODULE: auto
on:
push:
branches:
- main
- releases/v*
pull_request:
types:
- opened
- synchronize
- reopened
- ready_for_review
schedule:
- cron: '0 5 * * *'
workflow_dispatch: {}
jobs:
quality-queries:
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-latest
version: linked
- os: macos-latest
version: linked
- os: windows-latest
version: linked
- os: ubuntu-latest
version: nightly-latest
- os: macos-latest
version: nightly-latest
- os: windows-latest
version: nightly-latest
name: Quality queries input
permissions:
contents: read
security-events: read
timeout-minutes: 45
runs-on: ${{ matrix.os }}
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Prepare test
id: prepare-test
uses: ./.github/actions/prepare-test
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- uses: ./../action/init
with:
languages: javascript
quality-queries: code-quality
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
output: ${{ runner.temp }}/results
upload-database: false
- name: Upload SARIF
uses: actions/upload-artifact@v4
with:
name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
path: ${{ runner.temp }}/results/javascript.sarif
retention-days: 7
- name: Check config properties appear in SARIF
uses: actions/github-script@v7
env:
SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif
with:
script: |
const fs = require('fs');
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
const run = sarif.runs[0];
const configSummary = run.properties.codeqlConfigSummary;
if (configSummary === undefined) {
core.setFailed('`codeqlConfigSummary` property not found in the SARIF run property bag.');
}
if (configSummary.disableDefaultQueries !== false) {
core.setFailed('`disableDefaultQueries` property incorrect: expected false, got ' +
`${JSON.stringify(configSummary.disableDefaultQueries)}.`);
}
const expectedQueries = [{ type: 'builtinSuite', uses: 'code-quality' }];
// Use JSON.stringify to deep-equal the arrays.
if (JSON.stringify(configSummary.queries) !== JSON.stringify(expectedQueries)) {
core.setFailed(`\`queries\` property incorrect: expected ${JSON.stringify(expectedQueries)}, got ` +
`${JSON.stringify(configSummary.queries)}.`);
}
core.info('Finished config export tests.');
env:
CODEQL_ACTION_TEST_MODE: true

5
.github/workflows/__remote-config.yml generated vendored
View file

@ -47,6 +47,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}

2
.github/workflows/__rubocop-multi-language.yml generated vendored
View file

@ -46,7 +46,7 @@ jobs:
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Set up Ruby
uses: ruby/setup-ruby@13e7a03dc3ac6c3798f4570bfead2aed4d96abfb # v1.244.0
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
with:
ruby-version: 2.6
- name: Install Code Scanning integration

5
.github/workflows/__split-workflow.yml generated vendored
View file

@ -55,6 +55,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
config-file: .github/codeql/codeql-config-packaging3.yml

5
.github/workflows/__swift-custom-build.yml generated vendored
View file

@ -49,6 +49,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
id: init
with:

5
.github/workflows/__test-local-codeql.yml generated vendored
View file

@ -45,6 +45,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- name: Fetch a CodeQL bundle
shell: bash
env:

8
.github/workflows/__unset-environment.yml generated vendored
View file

@ -47,6 +47,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
id: init
with:
@ -54,9 +59,6 @@ jobs:
# Swift is not supported on Ubuntu so we manually exclude it from the list here
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
- name: Build code
shell: bash
run: env -i PATH="$PATH" HOME="$HOME" ./build.sh

5
.github/workflows/__upload-ref-sha-input.yml generated vendored
View file

@ -49,6 +49,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- uses: ./../action/init
with:
tools: ${{ steps.prepare-test.outputs.tools-url }}

5
.github/workflows/__with-checkout-path.yml generated vendored
View file

@ -49,6 +49,11 @@ jobs:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
setup-kotlin: 'true'
- name: Install Go
uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
cache: false
- name: Delete original checkout
shell: bash
run: |

101
.github/workflows/update-proxy-release.yml vendored Normal file
View file

@ -0,0 +1,101 @@
name: Update dependency proxy release assets
on:
workflow_dispatch:
inputs:
tag:
description: "The tag of CodeQL Bundle release that contains the proxy binaries as release assets"
type: string
required: true
jobs:
update:
name: Update code and create PR
timeout-minutes: 15
runs-on: ubuntu-latest
permissions:
contents: write # needed to push the updated files
pull-requests: write # needed to create the PR
env:
RELEASE_TAG: ${{ inputs.tag }}
steps:
- name: Check release tag format
id: checks
shell: bash
run: |
if ! [[ $RELEASE_TAG =~ ^codeql-bundle-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Invalid release tag: expected a CodeQL bundle tag in the 'codeql-bundle-vM.N.P' format."
exit 1
fi
echo "target_branch=dependency-proxy/$RELEASE_TAG" >> $GITHUB_OUTPUT
- name: Check that the release exists
shell: bash
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
run: |
(gh release view --repo "$GITHUB_REPOSITORY" --json "assets" "$RELEASE_TAG" && echo "Release found.") || exit 1
- name: Install Node
uses: actions/setup-node@v4
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0 # ensure we have all tags and can push commits
ref: main
- name: Update git config
shell: bash
run: |
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config --global user.name "github-actions[bot]"
- name: Update release tag and version
shell: bash
run: |
NOW=$(date +"%Y%m%d%H%M%S") # only used to make sure we don't fetch stale binaries from the toolcache
sed -i "s|https://github.com/github/codeql-action/releases/download/codeql-bundle-v[0-9.]\+/|https://github.com/github/codeql-action/releases/download/$RELEASE_TAG/|g" ./src/start-proxy-action.ts
sed -i "s/\"v2.0.[0-9]\+\"/\"v2.0.$NOW\"/g" ./src/start-proxy-action.ts
- name: Compile TypeScript and commit changes
shell: bash
env:
TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
run: |
set -exu
git checkout -b "$TARGET_BRANCH"
npm run build
git add ./src/start-proxy-action.ts
git add ./lib
git commit -m "Update release used by \`start-proxy\` action"
- name: Push changes and open PR
shell: bash
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
TARGET_BRANCH: ${{ steps.checks.outputs.target_branch }}
PR_FLAG: ${{ (github.event_name == 'workflow_dispatch' && '--draft') || '--dry-run' }}
run: |
set -exu
pr_title="Update release used by \`start-proxy\` to \`$RELEASE_TAG\`"
pr_body=$(cat << EOF
This PR updates the \`start-proxy\` action to use the private registry proxy binaries that
are attached as release assets to the \`$RELEASE_TAG\` release.
Please do the following before merging:
- [ ] Verify that the changes to the code are correct.
- [ ] Mark the PR as ready for review to trigger the CI.
EOF
)
git push origin "$TARGET_BRANCH"
gh pr create \
--head "$TARGET_BRANCH" \
--base "main" \
--title "${pr_title}" \
--body "${pr_body}" \
$PR_FLAG

5
CHANGELOG.md
View file

@ -2,6 +2,11 @@
See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
## 3.29.1 - 27 Jun 2025
- Fix bug in PR analysis where user-provided `include` query filter fails to exclude non-included queries. [#2938](https://github.com/github/codeql-action/pull/2938)
- Update default CodeQL bundle version to 2.22.1. [#2950](https://github.com/github/codeql-action/pull/2950)
## 3.29.0 - 11 Jun 2025
- Update default CodeQL bundle version to 2.22.0. [#2925](https://github.com/github/codeql-action/pull/2925)

2
README.md
View file

@ -55,7 +55,7 @@ For compiled languages:
- `manual` build mode will typically produce the most precise results, but it is more difficult to set up and will cause the analysis to take slightly more time to run.
- `autobuild` build mode is simpler to set up, but will only work for projects with generic build steps that can be guessed by the heuristics of the autobuild scripts. If `autobuild` fails, then you must switch to `manual` or `none`. If `autobuild` succeeds, then the results and run time will be the same as `manual` mode.
- `none` build mode is also simpler to set up and is slightly faster to run, but there is a possibility that some alerts will be missed. This may happen if your repository does any code generation during compilation or if there are any dependencies downloaded from registries that the workflow does not have access to. `none` is not yet supported by C/C++, Swift, Go, or Kotlin.
- `none` build mode is also simpler to set up and is slightly faster to run, but there is a possibility that some alerts will be missed. This may happen if your repository does any code generation during compilation or if there are any dependencies downloaded from registries that the workflow does not have access to. `none` is not yet supported by Swift, Go, or Kotlin. It is in public preview for C/C++.
## Supported versions of the CodeQL Action

3
init/action.yml
View file

@ -83,6 +83,9 @@ inputs:
queries:
description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
required: false
quality-queries:
description: '[Internal] Comma-separated list of code quality queries to run.'
required: false
packs:
description: >-
Comma-separated list of packs to run. Reference a pack in the format `scope/name[@version]`. If `version` is not

2
lib/api-compatibility.json
View file

@ -1 +1 @@
{ "maximumVersion": "3.18", "minimumVersion": "3.13" }
{ "maximumVersion": "3.18", "minimumVersion": "3.14" }

14
lib/codeql.js generated
View file

@ -759,12 +759,14 @@ async function generateCodeScanningConfig(config, logger) {
// make a copy so we can modify it
const augmentedConfig = (0, util_1.cloneObject)(config.originalUserInput);
// Inject the queries from the input
if (config.augmentationProperties.queriesInput) {
if (config.augmentationProperties.queriesInput ||
config.augmentationProperties.qualityQueriesInput) {
const queryInputs = (config.augmentationProperties.queriesInput || []).concat(config.augmentationProperties.qualityQueriesInput || []);
if (config.augmentationProperties.queriesInputCombines) {
augmentedConfig.queries = (augmentedConfig.queries || []).concat(config.augmentationProperties.queriesInput);
augmentedConfig.queries = (augmentedConfig.queries || []).concat(queryInputs);
}
else {
augmentedConfig.queries = config.augmentationProperties.queriesInput;
augmentedConfig.queries = queryInputs;
}
}
if (augmentedConfig.queries?.length === 0) {
@ -795,8 +797,12 @@ async function generateCodeScanningConfig(config, logger) {
delete augmentedConfig.packs;
}
augmentedConfig["query-filters"] = [
...(config.augmentationProperties.defaultQueryFilters || []),
// Ordering matters. If the first filter is an inclusion, it implicitly
// excludes all queries that are not included. If it is an exclusion,
// it implicitly includes all queries that are not excluded. So user
// filters (if any) should always be first to preserve intent.
...(augmentedConfig["query-filters"] || []),
...(config.augmentationProperties.extraQueryExclusions || []),
];
if (augmentedConfig["query-filters"]?.length === 0) {
delete augmentedConfig["query-filters"];

2
lib/codeql.js.map
View file

File diff suppressed because one or more lines are too long

22
lib/codeql.test.js generated
View file

@ -49,6 +49,7 @@ const sinon = __importStar(require("sinon"));
const actionsUtil = __importStar(require("./actions-util"));
const cli_errors_1 = require("./cli-errors");
const codeql = __importStar(require("./codeql"));
const config_utils_1 = require("./config-utils");
const defaults = __importStar(require("./defaults.json"));
const doc_url_1 = require("./doc-url");
const languages_1 = require("./languages");
@ -350,18 +351,16 @@ const injectedConfigMacro = ava_1.default.macro({
title: (providedTitle = "") => `databaseInitCluster() injected config: ${providedTitle}`,
});
(0, ava_1.default)("basic", injectedConfigMacro, {
queriesInputCombines: false,
packsInputCombines: false,
...config_utils_1.defaultAugmentationProperties,
}, {}, {});
(0, ava_1.default)("injected packs from input", injectedConfigMacro, {
queriesInputCombines: false,
packsInputCombines: false,
...config_utils_1.defaultAugmentationProperties,
packsInput: ["xxx", "yyy"],
}, {}, {
packs: ["xxx", "yyy"],
});
(0, ava_1.default)("injected packs from input with existing packs combines", injectedConfigMacro, {
queriesInputCombines: false,
...config_utils_1.defaultAugmentationProperties,
packsInputCombines: true,
packsInput: ["xxx", "yyy"],
}, {
@ -376,8 +375,7 @@ const injectedConfigMacro = ava_1.default.macro({
},
});
(0, ava_1.default)("injected packs from input with existing packs overrides", injectedConfigMacro, {
queriesInputCombines: false,
packsInputCombines: false,
...config_utils_1.defaultAugmentationProperties,
packsInput: ["xxx", "yyy"],
}, {
originalUserInput: {
@ -390,8 +388,7 @@ const injectedConfigMacro = ava_1.default.macro({
});
// similar, but with queries
(0, ava_1.default)("injected queries from input", injectedConfigMacro, {
queriesInputCombines: false,
packsInputCombines: false,
...config_utils_1.defaultAugmentationProperties,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
}, {}, {
queries: [
@ -404,8 +401,7 @@ const injectedConfigMacro = ava_1.default.macro({
],
});
(0, ava_1.default)("injected queries from input overrides", injectedConfigMacro, {
queriesInputCombines: false,
packsInputCombines: false,
...config_utils_1.defaultAugmentationProperties,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
}, {
originalUserInput: {
@ -422,8 +418,8 @@ const injectedConfigMacro = ava_1.default.macro({
],
});
(0, ava_1.default)("injected queries from input combines", injectedConfigMacro, {
...config_utils_1.defaultAugmentationProperties,
queriesInputCombines: true,
packsInputCombines: false,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
}, {
originalUserInput: {
@ -443,6 +439,7 @@ const injectedConfigMacro = ava_1.default.macro({
],
});
(0, ava_1.default)("injected queries from input combines 2", injectedConfigMacro, {
...config_utils_1.defaultAugmentationProperties,
queriesInputCombines: true,
packsInputCombines: true,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
@ -457,6 +454,7 @@ const injectedConfigMacro = ava_1.default.macro({
],
});
(0, ava_1.default)("injected queries and packs, but empty", injectedConfigMacro, {
...config_utils_1.defaultAugmentationProperties,
queriesInputCombines: true,
packsInputCombines: true,
queriesInput: [],

2
lib/codeql.test.js.map
View file

File diff suppressed because one or more lines are too long

23
lib/config-utils.js generated
View file

@ -80,7 +80,8 @@ exports.defaultAugmentationProperties = {
packsInputCombines: false,
packsInput: undefined,
queriesInput: undefined,
defaultQueryFilters: [],
qualityQueriesInput: undefined,
extraQueryExclusions: [],
};
function getPacksStrInvalid(packStr, configFile) {
return configFile
@ -226,10 +227,10 @@ async function getRawLanguages(languagesInput, repository, logger) {
/**
* Get the default config for when the user has not supplied one.
*/
async function getDefaultConfig({ languagesInput, queriesInput, packsInput, buildModeInput, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, githubVersion, features, logger, }) {
async function getDefaultConfig({ languagesInput, queriesInput, qualityQueriesInput, packsInput, buildModeInput, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, githubVersion, features, logger, }) {
const languages = await getLanguages(codeql, languagesInput, repository, logger);
const buildMode = await parseBuildModeInput(buildModeInput, languages, features, logger);
const augmentationProperties = await calculateAugmentation(codeql, features, packsInput, queriesInput, languages, logger);
const augmentationProperties = await calculateAugmentation(codeql, features, packsInput, queriesInput, qualityQueriesInput, languages, logger);
const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(trapCachingEnabled, codeql, languages, logger);
return {
languages,
@ -261,7 +262,7 @@ async function downloadCacheWithTime(trapCachingEnabled, codeQL, languages, logg
/**
* Load the config from the given file.
*/
async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeInput, configFile, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, workspacePath, githubVersion, apiDetails, features, logger, }) {
async function loadConfig({ languagesInput, queriesInput, qualityQueriesInput, packsInput, buildModeInput, configFile, dbLocation, trapCachingEnabled, dependencyCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeql, workspacePath, githubVersion, apiDetails, features, logger, }) {
let parsedYAML;
if (isLocal(configFile)) {
if (configFile !== userConfigFromActionPath(tempDir)) {
@ -279,7 +280,7 @@ async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeI
}
const languages = await getLanguages(codeql, languagesInput, repository, logger);
const buildMode = await parseBuildModeInput(buildModeInput, languages, features, logger);
const augmentationProperties = await calculateAugmentation(codeql, features, packsInput, queriesInput, languages, logger);
const augmentationProperties = await calculateAugmentation(codeql, features, packsInput, queriesInput, qualityQueriesInput, languages, logger);
const { trapCaches, trapCacheDownloadTime } = await downloadCacheWithTime(trapCachingEnabled, codeql, languages, logger);
return {
languages,
@ -320,21 +321,25 @@ async function loadConfig({ languagesInput, queriesInput, packsInput, buildModeI
* not have exactly one language.
*/
// exported for testing.
async function calculateAugmentation(codeql, features, rawPacksInput, rawQueriesInput, languages, logger) {
async function calculateAugmentation(codeql, features, rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages, logger) {
const packsInputCombines = shouldCombine(rawPacksInput);
const packsInput = parsePacksFromInput(rawPacksInput, languages, packsInputCombines);
const queriesInputCombines = shouldCombine(rawQueriesInput);
const queriesInput = parseQueriesFromInput(rawQueriesInput, queriesInputCombines);
const defaultQueryFilters = [];
const qualityQueriesInput = parseQueriesFromInput(rawQualityQueriesInput, false);
const extraQueryExclusions = [];
if (await (0, diff_informed_analysis_utils_1.shouldPerformDiffInformedAnalysis)(codeql, features, logger)) {
defaultQueryFilters.push({ exclude: { tags: "exclude-from-incremental" } });
extraQueryExclusions.push({
exclude: { tags: "exclude-from-incremental" },
});
}
return {
packsInputCombines,
packsInput: packsInput?.[languages[0]],
queriesInput,
queriesInputCombines,
defaultQueryFilters,
qualityQueriesInput,
extraQueryExclusions,
};
}
function parseQueriesFromInput(rawQueriesInput, queriesInputCombines) {

2
lib/config-utils.js.map
View file

File diff suppressed because one or more lines are too long

72
lib/config-utils.test.js generated
View file

@ -58,6 +58,7 @@ function createTestInitConfigInputs(overrides) {
return Object.assign({}, {
languagesInput: undefined,
queriesInput: undefined,
qualityQueriesInput: undefined,
packsInput: undefined,
configFile: undefined,
dbLocation: undefined,
@ -623,58 +624,63 @@ const packSpecPrettyPrintingMacro = ava_1.default.macro({
});
const mockLogger = (0, logging_1.getRunnerLogger)(true);
const calculateAugmentationMacro = ava_1.default.macro({
exec: async (t, _title, rawPacksInput, rawQueriesInput, languages, expectedAugmentationProperties) => {
const actualAugmentationProperties = await configUtils.calculateAugmentation((0, codeql_1.getCachedCodeQL)(), (0, testing_utils_1.createFeatures)([]), rawPacksInput, rawQueriesInput, languages, mockLogger);
exec: async (t, _title, rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages, expectedAugmentationProperties) => {
const actualAugmentationProperties = await configUtils.calculateAugmentation((0, codeql_1.getCachedCodeQL)(), (0, testing_utils_1.createFeatures)([]), rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages, mockLogger);
t.deepEqual(actualAugmentationProperties, expectedAugmentationProperties);
},
title: (_, title) => `Calculate Augmentation: ${title}`,
});
(0, ava_1.default)(calculateAugmentationMacro, "All empty", undefined, undefined, [languages_1.Language.javascript], {
queriesInputCombines: false,
queriesInput: undefined,
packsInputCombines: false,
packsInput: undefined,
defaultQueryFilters: [],
(0, ava_1.default)(calculateAugmentationMacro, "All empty", undefined, undefined, undefined, [languages_1.Language.javascript], {
...configUtils.defaultAugmentationProperties,
});
(0, ava_1.default)(calculateAugmentationMacro, "With queries", undefined, " a, b , c, d", [languages_1.Language.javascript], {
queriesInputCombines: false,
(0, ava_1.default)(calculateAugmentationMacro, "With queries", undefined, " a, b , c, d", undefined, [languages_1.Language.javascript], {
...configUtils.defaultAugmentationProperties,
queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
packsInputCombines: false,
packsInput: undefined,
defaultQueryFilters: [],
});
(0, ava_1.default)(calculateAugmentationMacro, "With queries combining", undefined, " + a, b , c, d ", [languages_1.Language.javascript], {
(0, ava_1.default)(calculateAugmentationMacro, "With queries combining", undefined, " + a, b , c, d ", undefined, [languages_1.Language.javascript], {
...configUtils.defaultAugmentationProperties,
queriesInputCombines: true,
queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
packsInputCombines: false,
packsInput: undefined,
defaultQueryFilters: [],
});
(0, ava_1.default)(calculateAugmentationMacro, "With packs", " codeql/a , codeql/b , codeql/c , codeql/d ", undefined, [languages_1.Language.javascript], {
queriesInputCombines: false,
queriesInput: undefined,
packsInputCombines: false,
(0, ava_1.default)(calculateAugmentationMacro, "With quality queries", undefined, undefined, " a, b , c, d", [languages_1.Language.javascript], {
...configUtils.defaultAugmentationProperties,
qualityQueriesInput: [
{ uses: "a" },
{ uses: "b" },
{ uses: "c" },
{ uses: "d" },
],
});
(0, ava_1.default)(calculateAugmentationMacro, "With security and quality queries", undefined, " a, b , c, d", "e, f , g,h", [languages_1.Language.javascript], {
...configUtils.defaultAugmentationProperties,
queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
qualityQueriesInput: [
{ uses: "e" },
{ uses: "f" },
{ uses: "g" },
{ uses: "h" },
],
});
(0, ava_1.default)(calculateAugmentationMacro, "With packs", " codeql/a , codeql/b , codeql/c , codeql/d ", undefined, undefined, [languages_1.Language.javascript], {
...configUtils.defaultAugmentationProperties,
packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
defaultQueryFilters: [],
});
(0, ava_1.default)(calculateAugmentationMacro, "With packs combining", " + codeql/a, codeql/b, codeql/c, codeql/d", undefined, [languages_1.Language.javascript], {
queriesInputCombines: false,
queriesInput: undefined,
(0, ava_1.default)(calculateAugmentationMacro, "With packs combining", " + codeql/a, codeql/b, codeql/c, codeql/d", undefined, undefined, [languages_1.Language.javascript], {
...configUtils.defaultAugmentationProperties,
packsInputCombines: true,
packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
defaultQueryFilters: [],
});
const calculateAugmentationErrorMacro = ava_1.default.macro({
exec: async (t, _title, rawPacksInput, rawQueriesInput, languages, expectedError) => {
await t.throwsAsync(() => configUtils.calculateAugmentation((0, codeql_1.getCachedCodeQL)(), (0, testing_utils_1.createFeatures)([]), rawPacksInput, rawQueriesInput, languages, mockLogger), { message: expectedError });
exec: async (t, _title, rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages, expectedError) => {
await t.throwsAsync(() => configUtils.calculateAugmentation((0, codeql_1.getCachedCodeQL)(), (0, testing_utils_1.createFeatures)([]), rawPacksInput, rawQueriesInput, rawQualityQueriesInput, languages, mockLogger), { message: expectedError });
},
title: (_, title) => `Calculate Augmentation Error: ${title}`,
});
(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (queries)", undefined, " + ", [languages_1.Language.javascript], /The workflow property "queries" is invalid/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (packs)", " + ", undefined, [languages_1.Language.javascript], /The workflow property "packs" is invalid/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with multiple languages", " + a/b, c/d ", undefined, [languages_1.Language.javascript, languages_1.Language.java], /Cannot specify a 'packs' input in a multi-language analysis/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with no languages", " + a/b, c/d ", undefined, [], /No languages specified/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Invalid packs", " a-pack-without-a-scope ", undefined, [languages_1.Language.javascript], /"a-pack-without-a-scope" is not a valid pack/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (queries)", undefined, " + ", undefined, [languages_1.Language.javascript], /The workflow property "queries" is invalid/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Plus (+) with nothing else (packs)", " + ", undefined, undefined, [languages_1.Language.javascript], /The workflow property "packs" is invalid/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with multiple languages", " + a/b, c/d ", undefined, undefined, [languages_1.Language.javascript, languages_1.Language.java], /Cannot specify a 'packs' input in a multi-language analysis/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Packs input with no languages", " + a/b, c/d ", undefined, undefined, [], /No languages specified/);
(0, ava_1.default)(calculateAugmentationErrorMacro, "Invalid packs", " a-pack-without-a-scope ", undefined, undefined, [languages_1.Language.javascript], /"a-pack-without-a-scope" is not a valid pack/);
(0, ava_1.default)("no generateRegistries when registries is undefined", async (t) => {
return await (0, util_1.withTmpDir)(async (tmpDir) => {
const registriesInput = undefined;

2
lib/config-utils.test.js.map
View file

File diff suppressed because one or more lines are too long

8
lib/defaults.json
View file

@ -1,6 +1,6 @@
{
"bundleVersion": "codeql-bundle-v2.22.0",
"cliVersion": "2.22.0",
"priorBundleVersion": "codeql-bundle-v2.21.4",
"priorCliVersion": "2.21.4"
"bundleVersion": "codeql-bundle-v2.22.1",
"cliVersion": "2.22.1",
"priorBundleVersion": "codeql-bundle-v2.22.0",
"priorCliVersion": "2.22.0"
}

6
lib/init-action.js generated
View file

@ -192,6 +192,7 @@ async function run() {
config = await (0, init_1.initConfig)({
languagesInput: (0, actions_util_1.getOptionalInput)("languages"),
queriesInput: (0, actions_util_1.getOptionalInput)("queries"),
qualityQueriesInput: (0, actions_util_1.getOptionalInput)("quality-queries"),
packsInput: (0, actions_util_1.getOptionalInput)("packs"),
buildModeInput: (0, actions_util_1.getOptionalInput)("build-mode"),
configFile,
@ -351,8 +352,9 @@ async function run() {
logger.info(`Setting C++ build-mode: none to ${value}`);
core.exportVariable(bmnVar, value);
}
// Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for rust
if (config.languages.includes(languages_1.Language.rust)) {
// For rust: set CODEQL_ENABLE_EXPERIMENTAL_FEATURES, unless codeql already supports rust without it
if (config.languages.includes(languages_1.Language.rust) &&
!(await codeql.resolveLanguages()).rust) {
const feat = feature_flags_1.Feature.RustAnalysis;
const minVer = feature_flags_1.featureConfig[feat].minimumVersion;
const envVar = "CODEQL_ENABLE_EXPERIMENTAL_FEATURES";

2
lib/init-action.js.map
View file

File diff suppressed because one or more lines are too long

4
lib/start-proxy-action.js generated
View file

@ -43,8 +43,8 @@ const logging_1 = require("./logging");
const start_proxy_1 = require("./start-proxy");
const util = __importStar(require("./util"));
const UPDATEJOB_PROXY = "update-job-proxy";
const UPDATEJOB_PROXY_VERSION = "v2.0.20250424171100";
const UPDATEJOB_PROXY_URL_PREFIX = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.21.1/";
const UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901";
const UPDATEJOB_PROXY_URL_PREFIX = "https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/";
const KEY_SIZE = 2048;
const KEY_EXPIRY_YEARS = 2;
const CERT_SUBJECT = [

41
lib/start-proxy.js generated
View file

@ -1,6 +1,40 @@
"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.getCredentials = getCredentials;
const core = __importStar(require("@actions/core"));
const languages_1 = require("./languages");
const util_1 = require("./util");
const LANGUAGE_TO_REGISTRY_TYPE = {
@ -49,6 +83,13 @@ function getCredentials(logger, registrySecrets, registriesCredentials, language
}
const out = [];
for (const e of parsed) {
// Mask credentials to reduce chance of accidental leakage in logs.
if (e.password !== undefined) {
core.setSecret(e.password);
}
if (e.token !== undefined) {
core.setSecret(e.token);
}
if (e.url === undefined && e.host === undefined) {
// The proxy needs one of these to work. If both are defined, the url has the precedence.
throw new util_1.ConfigurationError("Invalid credentials - must specify host or url");

2
lib/start-proxy.js.map
View file

@ -1 +1 @@
{"version":3,"file":"start-proxy.js","sourceRoot":"","sources":["../src/start-proxy.ts"],"names":[],"mappings":";;AA8BA,wCA2EC;AAzGD,2CAAsD;AAEtD,iCAA4C;AAW5C,MAAM,yBAAyB,GAA6B;IAC1D,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,cAAc;IAC1B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,gBAAgB;IACpB,oFAAoF;IACpF,OAAO,EAAE,EAAE;IACX,GAAG,EAAE,EAAE;IACP,KAAK,EAAE,EAAE;CACD,CAAC;AAEX,kEAAkE;AAClE,+DAA+D;AAC/D,gDAAgD;AAChD,SAAgB,cAAc,CAC5B,MAAc,EACd,eAAmC,EACnC,qBAAyC,EACzC,cAAkC;IAElC,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,uBAAuB,GAAG,QAAQ;QACtC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,cAAsB,CAAC;IAC3B,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC;SAAM,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7C,cAAc,GAAG,eAAe,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAiB,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACtD,MAAM,IAAI,yBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,yFAAyF;YACzF,MAAM,IAAI,yBAAkB,CAC1B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,iEAAiE;QACjE,IAAI,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAClE,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAuB,EAAW,EAAE;YACvD,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC;QAEF,IACE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;YACnB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,yBAAkB,CAC1B,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
{"version":3,"file":"start-proxy.js","sourceRoot":"","sources":["../src/start-proxy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,wCAmFC;AAnHD,oDAAsC;AAEtC,2CAAsD;AAEtD,iCAA4C;AAW5C,MAAM,yBAAyB,GAA6B;IAC1D,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,cAAc;IAC1B,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,gBAAgB;IACpB,oFAAoF;IACpF,OAAO,EAAE,EAAE;IACX,GAAG,EAAE,EAAE;IACP,KAAK,EAAE,EAAE;CACD,CAAC;AAEX,kEAAkE;AAClE,+DAA+D;AAC/D,gDAAgD;AAChD,SAAgB,cAAc,CAC5B,MAAc,EACd,eAAmC,EACnC,qBAAyC,EACzC,cAAkC;IAElC,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,IAAA,yBAAa,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,uBAAuB,GAAG,QAAQ;QACtC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,cAAsB,CAAC;IAC3B,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACnD,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC;SAAM,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC7C,cAAc,GAAG,eAAe,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qCAAqC;IACrC,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAiB,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACtD,MAAM,IAAI,yBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,mEAAmE;QACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,yFAAyF;YACzF,MAAM,IAAI,yBAAkB,CAC1B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,iEAAiE;QACjE,IAAI,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAClE,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,GAAuB,EAAW,EAAE;YACvD,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC,CAAC;QAEF,IACE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC;YACnB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,yBAAkB,CAC1B,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

2
node_modules/.package-lock.json generated vendored
View file

@ -1,6 +1,6 @@
{
"name": "codeql",
"version": "3.29.0",
"version": "3.29.1",
"lockfileVersion": 3,
"requires": true,
"packages": {

4
package-lock.json generated
View file

@ -1,12 +1,12 @@
{
"name": "codeql",
"version": "3.29.0",
"version": "3.29.1",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "codeql",
"version": "3.29.0",
"version": "3.29.1",
"license": "MIT",
"dependencies": {
"@actions/artifact": "^2.3.1",

2
package.json
View file

@ -1,6 +1,6 @@
{
"name": "codeql",
"version": "3.29.0",
"version": "3.29.1",
"private": true,
"description": "CodeQL action",
"scripts": {

3
pr-checks/checks/all-platform-bundle.yml
View file

@ -3,12 +3,13 @@ description: "Tests using an all-platform CodeQL Bundle"
versions: ["nightly-latest"]
operatingSystems: ["ubuntu"]
useAllPlatformBundle: "true"
installGo: "true"
steps:
- id: init
uses: ./../action/init
with:
# Swift is not supported on Ubuntu so we manually exclude it from the list here
languages: cpp,csharp,go,java,javascript,python,ruby
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Build code
shell: bash

1
pr-checks/checks/analyze-ref-input.yml
View file

@ -1,6 +1,7 @@
name: "Analyze: 'ref' and 'sha' from inputs"
description: "Checks that specifying 'ref' and 'sha' as inputs works"
versions: ["default"]
installGo: "true"
steps:
- uses: ./../action/init
with:

1
pr-checks/checks/build-mode-manual.yml
View file

@ -2,6 +2,7 @@ name: "Build mode manual"
description: "An end-to-end integration test of a Java repository built using 'build-mode: manual'"
operatingSystems: ["ubuntu"]
versions: ["nightly-latest"]
installGo: "true"
steps:
- uses: ./../action/init
id: init

1
pr-checks/checks/export-file-baseline-information.yml
View file

@ -1,6 +1,7 @@
name: "Export file baseline information"
description: "Tests that file baseline information is exported when the feature is enabled"
versions: ["nightly-latest"]
installGo: "true"
env:
CODEQL_ACTION_SUBLANGUAGE_FILE_COVERAGE: true
steps:

4
pr-checks/checks/go-custom-queries.yml
View file

@ -5,12 +5,10 @@ operatingSystems:
versions:
- linked
- nightly-latest
installGo: "true"
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
steps:
- uses: actions/setup-go@v5
with:
go-version: ">=1.21.0"
- uses: ./../action/init
with:
languages: go

5
pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml
View file

@ -4,11 +4,8 @@ description: "Checks that we emit a diagnostic if Go is changed after the init s
operatingSystems: ["ubuntu"]
# pinned to a version which does not support statically linked binaries for indirect tracing
versions: ["default"]
installGo: "true"
steps:
- uses: actions/setup-go@v5
with:
# We need a Go version that ships with statically linked binaries on Linux
go-version: ">=1.21.0"
- uses: ./../action/init
with:
languages: go

5
pr-checks/checks/go-indirect-tracing-workaround-no-file-program.yml
View file

@ -4,11 +4,8 @@ description: "Checks that we emit a diagnostic if the `file` program is not inst
operatingSystems: ["ubuntu"]
# pinned to a version which does not support statically linked binaries for indirect tracing
versions: ["default"]
installGo: "true"
steps:
- uses: actions/setup-go@v5
with:
# We need a Go version that ships with statically linked binaries on Linux
go-version: ">=1.21.0"
- name: Remove `file` program
run: |
echo $(which file)

5
pr-checks/checks/go-indirect-tracing-workaround.yml
View file

@ -4,11 +4,8 @@ description: "Checks that our workaround for indirect tracing for Go 1.21+ on Li
operatingSystems: ["ubuntu"]
# pinned to a version which does not support statically linked binaries for indirect tracing
versions: ["default"]
installGo: "true"
steps:
- uses: actions/setup-go@v5
with:
# We need a Go version that ships with statically linked binaries on Linux
go-version: ">=1.21.0"
- uses: ./../action/init
with:
languages: go

7
pr-checks/checks/go-tracing-autobuilder.yml
View file

@ -3,13 +3,8 @@ description: "Checks that Go tracing works when using an autobuilder step"
operatingSystems: ["ubuntu", "macos"]
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
installGo: "true"
steps:
- uses: actions/setup-go@v5
with:
go-version: "~1.24.0"
# to avoid potentially misleading autobuilder results where we expect it to download
# dependencies successfully, but they actually come from a warm cache
cache: false
- uses: ./../action/init
with:
languages: go

7
pr-checks/checks/go-tracing-custom-build-steps.yml
View file

@ -1,13 +1,8 @@
name: "Go: tracing with custom build steps"
description: "Checks that Go tracing traces the build when using custom build steps"
operatingSystems: ["ubuntu", "macos"]
installGo: "true"
steps:
- uses: actions/setup-go@v5
with:
go-version: "~1.24.0"
# to avoid potentially misleading autobuilder results where we expect it to download
# dependencies successfully, but they actually come from a warm cache
cache: false
- uses: ./../action/init
with:
languages: go

7
pr-checks/checks/go-tracing-legacy-workflow.yml
View file

@ -3,13 +3,8 @@ description: "Checks that we run the autobuilder in legacy workflows with neithe
operatingSystems: ["ubuntu", "macos"]
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
installGo: "true"
steps:
- uses: actions/setup-go@v5
with:
go-version: "~1.24.0"
# to avoid potentially misleading autobuilder results where we expect it to download
# dependencies successfully, but they actually come from a warm cache
cache: false
- uses: ./../action/init
with:
languages: go

5
pr-checks/checks/multi-language-autodetect.yml
View file

@ -1,11 +1,8 @@
name: "Multi-language repository"
description: "An end-to-end integration test of a multi-language repository using automatic language detection for macOS"
operatingSystems: ["macos", "ubuntu"]
installGo: "true"
steps:
- uses: actions/setup-go@v5
with:
go-version: ">=1.21.0"
- uses: ./../action/init
id: init
with:

1
pr-checks/checks/packaging-codescanning-config-inputs-js.yml
View file

@ -1,6 +1,7 @@
name: "Packaging: Config and input passed to the CLI"
description: "Checks that specifying packages using a combination of a config file and input to the Action works"
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
installGo: "true"
steps:
- uses: ./../action/init
with:

1
pr-checks/checks/packaging-config-inputs-js.yml
View file

@ -1,6 +1,7 @@
name: "Packaging: Config and input"
description: "Checks that specifying packages using a combination of a config file and input to the Action works"
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
installGo: "true"
steps:
- uses: ./../action/init
with:

1
pr-checks/checks/packaging-config-js.yml
View file

@ -1,6 +1,7 @@
name: "Packaging: Config file"
description: "Checks that specifying packages using only a config file works"
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
installGo: "true"
steps:
- uses: ./../action/init
with:

1
pr-checks/checks/packaging-inputs-js.yml
View file

@ -1,6 +1,7 @@
name: "Packaging: Action input"
description: "Checks that specifying packages using the input to the Action works"
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
installGo: "true"
steps:
- uses: ./../action/init
with:

45
pr-checks/checks/quality-queries.yml Normal file
View file

@ -0,0 +1,45 @@
name: "Quality queries input"
description: "Tests that queries specified in the quality-queries input are used."
versions: ["linked", "nightly-latest"]
steps:
- uses: ./../action/init
with:
languages: javascript
quality-queries: code-quality
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: ./../action/analyze
with:
output: "${{ runner.temp }}/results"
upload-database: false
- name: Upload SARIF
uses: actions/upload-artifact@v4
with:
name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
path: "${{ runner.temp }}/results/javascript.sarif"
retention-days: 7
- name: Check config properties appear in SARIF
uses: actions/github-script@v7
env:
SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
with:
script: |
const fs = require('fs');
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
const run = sarif.runs[0];
const configSummary = run.properties.codeqlConfigSummary;
if (configSummary === undefined) {
core.setFailed('`codeqlConfigSummary` property not found in the SARIF run property bag.');
}
if (configSummary.disableDefaultQueries !== false) {
core.setFailed('`disableDefaultQueries` property incorrect: expected false, got ' +
`${JSON.stringify(configSummary.disableDefaultQueries)}.`);
}
const expectedQueries = [{ type: 'builtinSuite', uses: 'code-quality' }];
// Use JSON.stringify to deep-equal the arrays.
if (JSON.stringify(configSummary.queries) !== JSON.stringify(expectedQueries)) {
core.setFailed(`\`queries\` property incorrect: expected ${JSON.stringify(expectedQueries)}, got ` +
`${JSON.stringify(configSummary.queries)}.`);
}
core.info('Finished config export tests.');

1
pr-checks/checks/remote-config.yml
View file

@ -5,6 +5,7 @@ operatingSystems:
versions:
- linked
- nightly-latest
installGo: "true"
steps:
- uses: ./../action/init
with:

2
pr-checks/checks/rubocop-multi-language.yml
View file

@ -5,7 +5,7 @@ operatingSystems: ["ubuntu"]
versions: ["default"]
steps:
- name: Set up Ruby
uses: ruby/setup-ruby@13e7a03dc3ac6c3798f4570bfead2aed4d96abfb # v1.244.0
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
with:
ruby-version: 2.6
- name: Install Code Scanning integration

1
pr-checks/checks/split-workflow.yml
View file

@ -2,6 +2,7 @@ name: "Split workflow"
description: "Tests a split-up workflow in which we first build a database and later analyze it"
operatingSystems: ["ubuntu", "macos"]
versions: ["linked", "default", "nightly-latest"] # This feature is not compatible with old CLIs
installGo: "true"
steps:
- uses: ./../action/init
with:

1
pr-checks/checks/swift-custom-build.yml
View file

@ -2,6 +2,7 @@ name: "Swift analysis using a custom build command"
description: "Tests creation of a Swift database using custom build"
versions: ["linked", "default", "nightly-latest"]
operatingSystems: ["macos"]
installGo: "true"
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
steps:

1
pr-checks/checks/test-local-codeql.yml
View file

@ -2,6 +2,7 @@ name: "Local CodeQL bundle"
description: "Tests using a CodeQL bundle from a local file rather than a URL"
versions: ["nightly-latest"]
operatingSystems: ["ubuntu"]
installGo: "true"
steps:
- name: Fetch a CodeQL bundle
shell: bash

6
pr-checks/checks/unset-environment.yml
View file

@ -5,17 +5,15 @@ operatingSystems:
versions:
- linked
- nightly-latest
installGo: "true"
steps:
- uses: ./../action/init
id: init
with:
db-location: ${{ runner.temp }}/customDbLocation
# Swift is not supported on Ubuntu so we manually exclude it from the list here
languages: cpp,csharp,go,java,javascript,python,ruby
languages: cpp,csharp,go,java,javascript,python,ruby
tools: ${{ steps.prepare-test.outputs.tools-url }}
- uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
- name: Build code
shell: bash
run: env -i PATH="$PATH" HOME="$HOME" ./build.sh

1
pr-checks/checks/upload-ref-sha-input.yml
View file

@ -1,6 +1,7 @@
name: "Upload-sarif: 'ref' and 'sha' from inputs"
description: "Checks that specifying 'ref' and 'sha' as inputs works"
versions: ["default"]
installGo: "true"
steps:
- uses: ./../action/init
with:

1
pr-checks/checks/with-checkout-path.yml
View file

@ -1,6 +1,7 @@
name: "Use a custom `checkout_path`"
description: "Checks that a custom `checkout_path` will find the proper commit_oid"
versions: ["linked"]
installGo: "true"
steps:
# This ensures we don't accidentally use the original checkout for any part of the test.
- name: Delete original checkout

16
pr-checks/sync.py
View file

@ -108,6 +108,22 @@ for file in (this_dir / 'checks').glob('*.yml'):
},
]
installGo = False
if checkSpecification.get('installGo'):
installGo = True if checkSpecification['installGo'].lower() == "true" else False
if installGo:
steps.append({
'name': 'Install Go',
'uses': 'actions/setup-go@v5',
'with': {
'go-version': '>=1.21.0',
# to avoid potentially misleading autobuilder results where we expect it to download
# dependencies successfully, but they actually come from a warm cache
'cache': False
}
})
# If container initialisation steps are present in the check specification,
# make sure to execute them first.
if 'container' in checkSpecification and 'container-init-steps' in checkSpecification:

2
src/api-compatibility.json
View file

@ -1 +1 @@
{"maximumVersion": "3.18", "minimumVersion": "3.13"}
{"maximumVersion": "3.18", "minimumVersion": "3.14"}

27
src/codeql.test.ts
View file

@ -14,7 +14,11 @@ import * as actionsUtil from "./actions-util";
import { GitHubApiDetails } from "./api-client";
import { CliError } from "./cli-errors";
import * as codeql from "./codeql";
import { AugmentationProperties, Config } from "./config-utils";
import {
AugmentationProperties,
Config,
defaultAugmentationProperties,
} from "./config-utils";
import * as defaults from "./defaults.json";
import { DocUrl } from "./doc-url";
import { FeatureEnablement } from "./feature-flags";
@ -537,8 +541,7 @@ test(
"basic",
injectedConfigMacro,
{
queriesInputCombines: false,
packsInputCombines: false,
...defaultAugmentationProperties,
},
{},
{},
@ -548,8 +551,7 @@ test(
"injected packs from input",
injectedConfigMacro,
{
queriesInputCombines: false,
packsInputCombines: false,
...defaultAugmentationProperties,
packsInput: ["xxx", "yyy"],
},
{},
@ -562,7 +564,7 @@ test(
"injected packs from input with existing packs combines",
injectedConfigMacro,
{
queriesInputCombines: false,
...defaultAugmentationProperties,
packsInputCombines: true,
packsInput: ["xxx", "yyy"],
},
@ -584,8 +586,7 @@ test(
"injected packs from input with existing packs overrides",
injectedConfigMacro,
{
queriesInputCombines: false,
packsInputCombines: false,
...defaultAugmentationProperties,
packsInput: ["xxx", "yyy"],
},
{
@ -605,8 +606,7 @@ test(
"injected queries from input",
injectedConfigMacro,
{
queriesInputCombines: false,
packsInputCombines: false,
...defaultAugmentationProperties,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
},
{},
@ -626,8 +626,7 @@ test(
"injected queries from input overrides",
injectedConfigMacro,
{
queriesInputCombines: false,
packsInputCombines: false,
...defaultAugmentationProperties,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
},
{
@ -651,8 +650,8 @@ test(
"injected queries from input combines",
injectedConfigMacro,
{
...defaultAugmentationProperties,
queriesInputCombines: true,
packsInputCombines: false,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
},
{
@ -679,6 +678,7 @@ test(
"injected queries from input combines 2",
injectedConfigMacro,
{
...defaultAugmentationProperties,
queriesInputCombines: true,
packsInputCombines: true,
queriesInput: [{ uses: "xxx" }, { uses: "yyy" }],
@ -700,6 +700,7 @@ test(
"injected queries and packs, but empty",
injectedConfigMacro,
{
...defaultAugmentationProperties,
queriesInputCombines: true,
packsInputCombines: true,
queriesInput: [],

19
src/codeql.ts
View file

@ -1219,13 +1219,20 @@ async function generateCodeScanningConfig(
const augmentedConfig = cloneObject(config.originalUserInput);
// Inject the queries from the input
if (config.augmentationProperties.queriesInput) {
if (
config.augmentationProperties.queriesInput ||
config.augmentationProperties.qualityQueriesInput
) {
const queryInputs = (
config.augmentationProperties.queriesInput || []
).concat(config.augmentationProperties.qualityQueriesInput || []);
if (config.augmentationProperties.queriesInputCombines) {
augmentedConfig.queries = (augmentedConfig.queries || []).concat(
config.augmentationProperties.queriesInput,
queryInputs,
);
} else {
augmentedConfig.queries = config.augmentationProperties.queriesInput;
augmentedConfig.queries = queryInputs;
}
}
if (augmentedConfig.queries?.length === 0) {
@ -1259,8 +1266,12 @@ async function generateCodeScanningConfig(
}
augmentedConfig["query-filters"] = [
...(config.augmentationProperties.defaultQueryFilters || []),
// Ordering matters. If the first filter is an inclusion, it implicitly
// excludes all queries that are not included. If it is an exclusion,
// it implicitly includes all queries that are not excluded. So user
// filters (if any) should always be first to preserve intent.
...(augmentedConfig["query-filters"] || []),
...(config.augmentationProperties.extraQueryExclusions || []),
];
if (augmentedConfig["query-filters"]?.length === 0) {
delete augmentedConfig["query-filters"];

86
src/config-utils.test.ts
View file

@ -47,6 +47,7 @@ function createTestInitConfigInputs(
{
languagesInput: undefined,
queriesInput: undefined,
qualityQueriesInput: undefined,
packsInput: undefined,
configFile: undefined,
dbLocation: undefined,
@ -806,6 +807,7 @@ const calculateAugmentationMacro = test.macro({
_title: string,
rawPacksInput: string | undefined,
rawQueriesInput: string | undefined,
rawQualityQueriesInput: string | undefined,
languages: Language[],
expectedAugmentationProperties: configUtils.AugmentationProperties,
) => {
@ -815,6 +817,7 @@ const calculateAugmentationMacro = test.macro({
createFeatures([]),
rawPacksInput,
rawQueriesInput,
rawQualityQueriesInput,
languages,
mockLogger,
);
@ -828,14 +831,11 @@ test(
"All empty",
undefined,
undefined,
undefined,
[Language.javascript],
{
queriesInputCombines: false,
queriesInput: undefined,
packsInputCombines: false,
packsInput: undefined,
defaultQueryFilters: [],
} as configUtils.AugmentationProperties,
...configUtils.defaultAugmentationProperties,
},
);
test(
@ -843,14 +843,12 @@ test(
"With queries",
undefined,
" a, b , c, d",
undefined,
[Language.javascript],
{
queriesInputCombines: false,
...configUtils.defaultAugmentationProperties,
queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
packsInputCombines: false,
packsInput: undefined,
defaultQueryFilters: [],
} as configUtils.AugmentationProperties,
},
);
test(
@ -858,14 +856,50 @@ test(
"With queries combining",
undefined,
" + a, b , c, d ",
undefined,
[Language.javascript],
{
...configUtils.defaultAugmentationProperties,
queriesInputCombines: true,
queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
packsInputCombines: false,
packsInput: undefined,
defaultQueryFilters: [],
} as configUtils.AugmentationProperties,
},
);
test(
calculateAugmentationMacro,
"With quality queries",
undefined,
undefined,
" a, b , c, d",
[Language.javascript],
{
...configUtils.defaultAugmentationProperties,
qualityQueriesInput: [
{ uses: "a" },
{ uses: "b" },
{ uses: "c" },
{ uses: "d" },
],
},
);
test(
calculateAugmentationMacro,
"With security and quality queries",
undefined,
" a, b , c, d",
"e, f , g,h",
[Language.javascript],
{
...configUtils.defaultAugmentationProperties,
queriesInput: [{ uses: "a" }, { uses: "b" }, { uses: "c" }, { uses: "d" }],
qualityQueriesInput: [
{ uses: "e" },
{ uses: "f" },
{ uses: "g" },
{ uses: "h" },
],
},
);
test(
@ -873,14 +907,12 @@ test(
"With packs",
" codeql/a , codeql/b , codeql/c , codeql/d ",
undefined,
undefined,
[Language.javascript],
{
queriesInputCombines: false,
queriesInput: undefined,
packsInputCombines: false,
...configUtils.defaultAugmentationProperties,
packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
defaultQueryFilters: [],
} as configUtils.AugmentationProperties,
},
);
test(
@ -888,14 +920,13 @@ test(
"With packs combining",
" + codeql/a, codeql/b, codeql/c, codeql/d",
undefined,
undefined,
[Language.javascript],
{
queriesInputCombines: false,
queriesInput: undefined,
...configUtils.defaultAugmentationProperties,
packsInputCombines: true,
packsInput: ["codeql/a", "codeql/b", "codeql/c", "codeql/d"],
defaultQueryFilters: [],
} as configUtils.AugmentationProperties,
},
);
const calculateAugmentationErrorMacro = test.macro({
@ -904,6 +935,7 @@ const calculateAugmentationErrorMacro = test.macro({
_title: string,
rawPacksInput: string | undefined,
rawQueriesInput: string | undefined,
rawQualityQueriesInput: string | undefined,
languages: Language[],
expectedError: RegExp | string,
) => {
@ -914,6 +946,7 @@ const calculateAugmentationErrorMacro = test.macro({
createFeatures([]),
rawPacksInput,
rawQueriesInput,
rawQualityQueriesInput,
languages,
mockLogger,
),
@ -928,6 +961,7 @@ test(
"Plus (+) with nothing else (queries)",
undefined,
" + ",
undefined,
[Language.javascript],
/The workflow property "queries" is invalid/,
);
@ -937,6 +971,7 @@ test(
"Plus (+) with nothing else (packs)",
" + ",
undefined,
undefined,
[Language.javascript],
/The workflow property "packs" is invalid/,
);
@ -946,6 +981,7 @@ test(
"Packs input with multiple languages",
" + a/b, c/d ",
undefined,
undefined,
[Language.javascript, Language.java],
/Cannot specify a 'packs' input in a multi-language analysis/,
);
@ -955,6 +991,7 @@ test(
"Packs input with no languages",
" + a/b, c/d ",
undefined,
undefined,
[],
/No languages specified/,
);
@ -964,6 +1001,7 @@ test(
"Invalid packs",
" a-pack-without-a-scope ",
undefined,
undefined,
[Language.javascript],
/"a-pack-without-a-scope" is not a valid pack/,
);

32
src/config-utils.ts
View file

@ -170,6 +170,11 @@ export interface AugmentationProperties {
*/
queriesInput?: Array<{ uses: string }>;
/**
* The quality queries input from the `with` block of the action declaration.
*/
qualityQueriesInput?: Array<{ uses: string }>;
/**
* Whether or not the packs input combines with the packs in the config.
*/
@ -181,9 +186,9 @@ export interface AugmentationProperties {
packsInput?: string[];
/**
* Default query filters to apply to the queries in the config.
* Extra query exclusions to append to the config.
*/
defaultQueryFilters?: QueryFilter[];
extraQueryExclusions?: ExcludeQueryFilter[];
}
/**
@ -195,7 +200,8 @@ export const defaultAugmentationProperties: AugmentationProperties = {
packsInputCombines: false,
packsInput: undefined,
queriesInput: undefined,
defaultQueryFilters: [],
qualityQueriesInput: undefined,
extraQueryExclusions: [],
};
export type Packs = Partial<Record<Language, string[]>>;
@ -405,6 +411,7 @@ export async function getRawLanguages(
export interface InitConfigInputs {
languagesInput: string | undefined;
queriesInput: string | undefined;
qualityQueriesInput: string | undefined;
packsInput: string | undefined;
configFile: string | undefined;
dbLocation: string | undefined;
@ -440,6 +447,7 @@ type LoadConfigInputs = Omit<InitConfigInputs, "configInput"> & {
export async function getDefaultConfig({
languagesInput,
queriesInput,
qualityQueriesInput,
packsInput,
buildModeInput,
dbLocation,
@ -474,6 +482,7 @@ export async function getDefaultConfig({
features,
packsInput,
queriesInput,
qualityQueriesInput,
languages,
logger,
);
@ -528,6 +537,7 @@ async function downloadCacheWithTime(
async function loadConfig({
languagesInput,
queriesInput,
qualityQueriesInput,
packsInput,
buildModeInput,
configFile,
@ -583,6 +593,7 @@ async function loadConfig({
features,
packsInput,
queriesInput,
qualityQueriesInput,
languages,
logger,
);
@ -639,6 +650,7 @@ export async function calculateAugmentation(
features: FeatureEnablement,
rawPacksInput: string | undefined,
rawQueriesInput: string | undefined,
rawQualityQueriesInput: string | undefined,
languages: Language[],
logger: Logger,
): Promise<AugmentationProperties> {
@ -654,9 +666,16 @@ export async function calculateAugmentation(
queriesInputCombines,
);
const defaultQueryFilters: QueryFilter[] = [];
const qualityQueriesInput = parseQueriesFromInput(
rawQualityQueriesInput,
false,
);
const extraQueryExclusions: ExcludeQueryFilter[] = [];
if (await shouldPerformDiffInformedAnalysis(codeql, features, logger)) {
defaultQueryFilters.push({ exclude: { tags: "exclude-from-incremental" } });
extraQueryExclusions.push({
exclude: { tags: "exclude-from-incremental" },
});
}
return {
@ -664,7 +683,8 @@ export async function calculateAugmentation(
packsInput: packsInput?.[languages[0]],
queriesInput,
queriesInputCombines,
defaultQueryFilters,
qualityQueriesInput,
extraQueryExclusions,
};
}

8
src/defaults.json
View file

@ -1,6 +1,6 @@
{
"bundleVersion": "codeql-bundle-v2.22.0",
"cliVersion": "2.22.0",
"priorBundleVersion": "codeql-bundle-v2.21.4",
"priorCliVersion": "2.21.4"
"bundleVersion": "codeql-bundle-v2.22.1",
"cliVersion": "2.22.1",
"priorBundleVersion": "codeql-bundle-v2.22.0",
"priorCliVersion": "2.22.0"
}

8
src/init-action.ts
View file

@ -342,6 +342,7 @@ async function run() {
config = await initConfig({
languagesInput: getOptionalInput("languages"),
queriesInput: getOptionalInput("queries"),
qualityQueriesInput: getOptionalInput("quality-queries"),
packsInput: getOptionalInput("packs"),
buildModeInput: getOptionalInput("build-mode"),
configFile,
@ -587,8 +588,11 @@ async function run() {
core.exportVariable(bmnVar, value);
}
// Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for rust
if (config.languages.includes(Language.rust)) {
// For rust: set CODEQL_ENABLE_EXPERIMENTAL_FEATURES, unless codeql already supports rust without it
if (
config.languages.includes(Language.rust) &&
!(await codeql.resolveLanguages()).rust
) {
const feat = Feature.RustAnalysis;
const minVer = featureConfig[feat].minimumVersion as string;
const envVar = "CODEQL_ENABLE_EXPERIMENTAL_FEATURES";

4
src/start-proxy-action.ts
View file

@ -11,9 +11,9 @@ import { Credential, getCredentials } from "./start-proxy";
import * as util from "./util";
const UPDATEJOB_PROXY = "update-job-proxy";
const UPDATEJOB_PROXY_VERSION = "v2.0.20250424171100";
const UPDATEJOB_PROXY_VERSION = "v2.0.20250624110901";
const UPDATEJOB_PROXY_URL_PREFIX =
"https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.21.1/";
"https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.22.0/";
const KEY_SIZE = 2048;
const KEY_EXPIRY_YEARS = 2;

10
src/start-proxy.ts
View file

@ -1,3 +1,5 @@
import * as core from "@actions/core";
import { parseLanguage, Language } from "./languages";
import { Logger } from "./logging";
import { ConfigurationError } from "./util";
@ -63,6 +65,14 @@ export function getCredentials(
const out: Credential[] = [];
for (const e of parsed) {
// Mask credentials to reduce chance of accidental leakage in logs.
if (e.password !== undefined) {
core.setSecret(e.password);
}
if (e.token !== undefined) {
core.setSecret(e.token);
}
if (e.url === undefined && e.host === undefined) {
// The proxy needs one of these to work. If both are defined, the url has the precedence.
throw new ConfigurationError(

9
tests/multi-language-repo/.gitignore vendored Normal file
View file

@ -0,0 +1,9 @@
.DS_Store
/.build
/Packages
/*.xcodeproj
xcuserdata/
DerivedData/
.swiftpm/config/registries.json
.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata
.netrc

25
tests/multi-language-repo/Package.swift
View file

@ -1,26 +1,15 @@
// swift-tools-version: 5.7
// swift-tools-version: 5.8
// The swift-tools-version declares the minimum version of Swift required to build this package.
import PackageDescription
let package = Package(
name: "helloWorld",
products: [
// Products define the executables and libraries a package produces, and make them visible to other packages.
.library(
name: "helloWorld",
targets: ["helloWorld"]),
],
dependencies: [
// Dependencies declare other packages that this package depends on.
// .package(url: /* package url */, from: "1.0.0"),
],
name: "multi-language-repo",
targets: [
// Targets are the basic building blocks of a package. A target can define a module or a test suite.
// Targets can depend on other targets in this package, and on products in packages this package depends on.
.target(
name: "helloWorld",
path: "swift-custom-build/helloWorld"
)
// Targets are the basic building blocks of a package, defining a module or a test suite.
// Targets can depend on other targets in this package and products from dependencies.
.executableTarget(
name: "multi-language-repo",
path: "Sources"),
]
)

4
tests/multi-language-repo/Sources/main.swift Normal file
View file

@ -0,0 +1,4 @@
// The Swift Programming Language
// https://docs.swift.org/swift-book
print("Hello, world!")

1
tests/multi-language-repo/build.sh
View file

@ -1,4 +1,5 @@
#!/bin/bash
set -eo pipefail
gcc -o main main.c