Refactor PR checks

pr-checks/checks/go-custom-queries.yml

@@ -0,0 +1,17 @@
+name: "Go: Custom queries"
+description: "Checks that Go works in conjunction with a config file specifying custom queries"
+steps:
+  - uses: actions/setup-go@v2
+    with:
+      go-version: "^1.13.1"
+  - uses: ./../action/init
+    with:
+      languages: go
+      config-file: ./.github/codeql/custom-queries.yml
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    env:
+      TEST_MODE: true

pr-checks/checks/go-custom-tracing-autobuild.yml

@@ -0,0 +1,24 @@
+name: "Go: Autobuild custom tracing"
+description: "Checks that Go tracing works in conjunction with the autobuilder"
+os: ["ubuntu-latest", "macos-latest"]
+env:
+  CODEQL_EXTRACTOR_GO_BUILD_TRACING: "true"
+steps:
+  - uses: actions/setup-go@v2
+    with:
+      go-version: "^1.13.1"
+  - uses: ./../action/init
+    with:
+      languages: go
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - uses: ./../action/autobuild
+  - uses: ./../action/analyze
+    env:
+      TEST_MODE: true
+  - shell: bash
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      if [[ ! -d go ]]; then
+        echo "Did not find a Go database"
+        exit 1
+      fi

pr-checks/checks/go-custom-tracing.yml

@@ -0,0 +1,18 @@
+name: "Go: Custom tracing"
+description: "Checks that Go tracing works"
+env:
+  CODEQL_EXTRACTOR_GO_BUILD_TRACING: "true"
+steps:
+  - uses: actions/setup-go@v2
+    with:
+      go-version: "^1.13.1"
+  - uses: ./../action/init
+    with:
+      languages: go
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    shell: bash
+    run: go build main.go
+  - uses: ./../action/analyze
+    env:
+      TEST_MODE: true

pr-checks/checks/javascript-source-root.yml

@@ -0,0 +1,27 @@
+name: "Custom source root"
+description: "Checks that the argument specifying a non-default source root works"
+versions: ["latest", "cached", "nightly-latest"] # This feature is not compatible with old CLIs
+os: ["ubuntu-latest"]
+steps:
+  - name: Move codeql-action
+    shell: bash
+    run: |
+      mkdir ../new-source-root
+      mv * ../new-source-root
+  - uses: ./../action/init
+    with:
+      languages: javascript
+      source-root: ../new-source-root
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - uses: ./../action/analyze
+    with:
+      skip-queries: true
+      upload: false
+  - name: Assert database exists
+    shell: bash
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      if [[ ! -d javascript ]]; then
+        echo "Did not find a JavaScript database"
+        exit 1
+      fi

pr-checks/checks/multi-language-autodetect.yml

@@ -0,0 +1,47 @@
+name: "Multi-language repository"
+description: "An end-to-end integration test of a multi-language repository using automatic language detection"
+os: ["ubuntu-latest", "macos-latest"]
+steps:
+  - uses: ./../action/init
+    with:
+      db-location: "${{ runner.temp }}/customDbLocation"
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    id: analysis
+    env:
+      TEST_MODE: true
+  - shell: bash
+    run: |
+      CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
+      if [[ ! -d $CPP_DB ]] || [[ ! $CPP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
+        echo "Did not create a database for CPP, or created it in the wrong location."
+        exit 1
+      fi
+      CSHARP_DB=${{ fromJson(steps.analysis.outputs.db-locations).csharp }}
+      if [[ ! -d $CSHARP_DB ]] || [[ ! $CSHARP_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
+        echo "Did not create a database for C Sharp, or created it in the wrong location."
+        exit 1
+      fi
+      GO_DB=${{ fromJson(steps.analysis.outputs.db-locations).go }}
+      if [[ ! -d $GO_DB ]] || [[ ! $GO_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
+        echo "Did not create a database for Go, or created it in the wrong location."
+        exit 1
+      fi
+      JAVA_DB=${{ fromJson(steps.analysis.outputs.db-locations).java }}
+      if [[ ! -d $JAVA_DB ]] || [[ ! $JAVA_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
+        echo "Did not create a database for Java, or created it in the wrong location."
+        exit 1
+      fi
+      JAVASCRIPT_DB=${{ fromJson(steps.analysis.outputs.db-locations).javascript }}
+      if [[ ! -d $JAVASCRIPT_DB ]] || [[ ! $JAVASCRIPT_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
+        echo "Did not create a database for Javascript, or created it in the wrong location."
+        exit 1
+      fi
+      PYTHON_DB=${{ fromJson(steps.analysis.outputs.db-locations).python }}
+      if [[ ! -d $PYTHON_DB ]] || [[ ! $PYTHON_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
+        echo "Did not create a database for Python, or created it in the wrong location."
+        exit 1
+      fi

pr-checks/checks/packaging-config-inputs-js.yml

@@ -0,0 +1,33 @@
+name: "Packaging: Config and input"
+description: "Checks that specifying packages using a combination of a config file and input to the Action works"
+versions: ["nightly-20210831"] # This CLI version is known to work with package used in this test
+os: ["ubuntu-latest", "macos-latest"]
+steps:
+  - uses: ./../action/init
+    with:
+      config-file: ".github/codeql/codeql-config-packaging3.yml"
+      packs: +dsp-testing/codeql-pack1@0.1.0
+      languages: javascript
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      output: "${{ runner.temp }}/results"
+    env:
+      TEST_MODE: true
+  - name: Assert Results
+    shell: bash
+    run: |
+      cd "$RUNNER_TEMP/results"
+      # We should have 3 hits from these rules
+      EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/two-block"
+
+      # use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
+      RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n" " " | xargs)"
+      echo "Found matching rules '$RULES'"
+      if [ "$RULES" != "$EXPECTED_RULES" ]; then
+        echo "Did not match expected rules '$EXPECTED_RULES'."
+        exit 1
+      fi

pr-checks/checks/packaging-config-js.yml

@@ -0,0 +1,32 @@
+name: "Packaging: Config file"
+description: "Checks that specifying packages using only a config file works"
+versions: ["nightly-20210831"] # This CLI version is known to work with package used in this test
+os: ["ubuntu-latest", "macos-latest"]
+steps:
+  - uses: ./../action/init
+    with:
+      config-file: ".github/codeql/codeql-config-packaging.yml"
+      languages: javascript
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      output: "${{ runner.temp }}/results"
+    env:
+      TEST_MODE: true
+  - name: Assert Results
+    shell: bash
+    run: |
+      cd "$RUNNER_TEMP/results"
+      # We should have 3 hits from these rules
+      EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/two-block"
+
+      # use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
+      RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n" " " | xargs)"
+      echo "Found matching rules '$RULES'"
+      if [ "$RULES" != "$EXPECTED_RULES" ]; then
+        echo "Did not match expected rules '$EXPECTED_RULES'."
+        exit 1
+      fi

pr-checks/checks/packaging-inputs-js.yml

@@ -0,0 +1,33 @@
+name: "Packaging: Action input"
+description: "Checks that specifying packages using the input to the Action works"
+versions: ["nightly-20210831"] # This CLI version is known to work with package used in this test
+os: ["ubuntu-latest", "macos-latest"]
+steps:
+  - uses: ./../action/init
+    with:
+      config-file: ".github/codeql/codeql-config-packaging2.yml"
+      languages: javascript
+      packs: dsp-testing/codeql-pack1@0.1.0, dsp-testing/codeql-pack2
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      output: "${{ runner.temp }}/results"
+    env:
+      TEST_MODE: true
+  - name: Assert Results
+    shell: bash
+    run: |
+      cd "$RUNNER_TEMP/results"
+      # We should have 3 hits from these rules
+      EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/two-block"
+
+      # use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
+      RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n" " " | xargs)"
+      echo "Found matching rules '$RULES'"
+      if [ "$RULES" != "$EXPECTED_RULES" ]; then
+        echo "Did not match expected rules '$EXPECTED_RULES'."
+        exit 1
+      fi

pr-checks/checks/remote-config.yml

@@ -0,0 +1,14 @@
+name: "Remote config file"
+description: "Checks that specifying packages using only a config file works"
+steps:
+  - uses: ./../action/init
+    with:
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+      languages: cpp,csharp,java,javascript,python
+      config-file: github/codeql-action/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    env:
+      TEST_MODE: true

pr-checks/checks/rubocop-multi-language.yml

@@ -0,0 +1,26 @@
+name: "RuboCop multi-language"
+description: "Tests using RuboCop to analyze a multi-language repository and then using the CodeQL Action to upload the resulting SARIF"
+os: ["ubuntu-latest"]
+steps:
+  - name: Set up Ruby
+    uses: ruby/setup-ruby@v1
+    with:
+      ruby-version: 2.6
+  - name: Install Code Scanning integration
+    shell: bash
+    run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+  - name: Install dependencies
+    shell: bash
+    run: bundle install
+  - name: RuboCop run
+    shell: bash
+    run: |
+      bash -c "
+        bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
+        [[ $? -ne 2 ]]
+      "
+  - uses: ./../action/upload-sarif
+    with:
+      sarif_file: rubocop.sarif
+    env:
+      TEST_MODE: true

pr-checks/checks/split-workflow.yml

@@ -0,0 +1,46 @@
+name: "Split workflow"
+description: "Tests a split-up workflow in which we first build a database and later analyze it"
+versions: ["nightly-20210831"] # This CLI version is known to work with package used in this test
+os: ["ubuntu-latest", "macos-latest"]
+steps:
+  - uses: ./../action/init
+    with:
+      config-file: ".github/codeql/codeql-config-packaging3.yml"
+      packs: +dsp-testing/codeql-pack1@0.1.0
+      languages: javascript
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    with:
+      skip-queries: true
+      output: "${{ runner.temp }}/results"
+    env:
+      TEST_MODE: true
+  - name: Assert No Results
+    shell: bash
+    run: |
+      if [ "$(ls -A $RUNNER_TEMP/results)" ]; then
+        echo "Expected results directory to be empty after skipping query execution!"
+        exit 1
+      fi
+  - uses: ./../action/analyze
+    with:
+      output: "${{ runner.temp }}/results"
+    env:
+      TEST_MODE: true
+  - name: Assert Results
+    shell: bash
+    run: |
+      cd "$RUNNER_TEMP/results"
+      # We should have 3 hits from these rules
+      EXPECTED_RULES="javascript/example/empty-or-one-block javascript/example/empty-or-one-block javascript/example/two-block"
+
+      # use tr to replace newlines with spaces and xargs to trim leading and trailing whitespace
+      RULES="$(cat javascript.sarif | jq -r '.runs[0].results[].ruleId' | sort | tr "\n" " " | xargs)"
+      echo "Found matching rules '$RULES'"
+      if [ "$RULES" != "$EXPECTED_RULES" ]; then
+        echo "Did not match expected rules '$EXPECTED_RULES'."
+        exit 1
+      fi

pr-checks/checks/test-local-codeql.yml

@@ -0,0 +1,20 @@
+name: "Local CodeQL bundle"
+description: "Tests using a CodeQL bundle from a local file rather than a URL"
+versions: ["nightly-latest"]
+os: ["ubuntu-latest"]
+steps:
+  - name: Fetch a CodeQL bundle
+    shell: bash
+    env:
+      CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
+    run: |
+      wget "$CODEQL_URL"
+  - uses: ./../action/init
+    with:
+      tools: ./codeql-bundle.tar.gz
+  - name: Build code
+    shell: bash
+    run: ./build.sh
+  - uses: ./../action/analyze
+    env:
+      TEST_MODE: true

pr-checks/checks/test-proxy.yml

@@ -0,0 +1,22 @@
+name: "Proxy test"
+description: "Tests using a proxy specified by the https_proxy environment variable"
+versions: ["latest"]
+os: ["ubuntu-latest"]
+container:
+  image: ubuntu:18.04
+  options: --dns 127.0.0.1
+services:
+  squid-proxy:
+    image: datadog/squid:latest
+    ports:
+      - 3128:3128
+env:
+  https_proxy: http://squid-proxy:3128
+steps:
+  - uses: ./../action/init
+    with:
+      languages: javascript
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - uses: ./../action/analyze
+    env:
+      TEST_MODE: true

pr-checks/checks/test-ruby.yml

@@ -0,0 +1,23 @@
+name: "Ruby analysis"
+description: "Tests creation of a Ruby database"
+versions: ["latest", "cached", "nightly-latest"]
+os: ["ubuntu-latest", "macos-latest"]
+env:
+  CODEQL_ENABLE_EXPERIMENTAL_FEATURES: "true"
+steps:
+  - uses: ./../action/init
+    with:
+      languages: ruby
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - uses: ./../action/analyze
+    id: analysis
+    env:
+      TEST_MODE: true
+  - name: Check database
+    shell: bash
+    run: |
+      RUBY_DB="${{ fromJson(steps.analysis.outputs.db-locations).ruby }}"
+      if [[ ! -d "$RUBY_DB" ]]; then
+        echo "Did not create a database for Ruby."
+        exit 1
+      fi