Merge branch 'master' into safe-config-parsing

lib/config-utils.js

@@ -218,7 +218,7 @@ function initConfig() {
     return config;
 }
 function getConfigFolder() {
-    return util.getRequiredEnvParam('RUNNER_WORKSPACE');
+    return util.getRequiredEnvParam('RUNNER_TEMP');
 }
 function getConfigFile() {
     return path.join(getConfigFolder(), 'config');

lib/config-utils.test.js

@@ -28,7 +28,7 @@ function setInput(name, value) {
 }
 ava_1.default("load empty config", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
-        process.env['RUNNER_WORKSPACE'] = tmpDir;
+        process.env['RUNNER_TEMP'] = tmpDir;
         process.env['GITHUB_WORKSPACE'] = tmpDir;
         setInput('config-file', undefined);
         const config = await configUtils.loadConfig();
@@ -37,7 +37,7 @@ ava_1.default("load empty config", async (t) => {
 });
 ava_1.default("loading config saves config", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
-        process.env['RUNNER_WORKSPACE'] = tmpDir;
+        process.env['RUNNER_TEMP'] = tmpDir;
         process.env['GITHUB_WORKSPACE'] = tmpDir;
         const configFile = configUtils.getConfigFile();
         // Sanity check the saved config file does not already exist
@@ -51,7 +51,7 @@ ava_1.default("loading config saves config", async (t) => {
 });
 ava_1.default("load input outside of workspace", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
-        process.env['RUNNER_WORKSPACE'] = tmpDir;
+        process.env['RUNNER_TEMP'] = tmpDir;
         process.env['GITHUB_WORKSPACE'] = tmpDir;
         setInput('config-file', '../input');
         try {
@@ -65,7 +65,7 @@ ava_1.default("load input outside of workspace", async (t) => {
 });
 ava_1.default("load non-existent input", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
-        process.env['RUNNER_WORKSPACE'] = tmpDir;
+        process.env['RUNNER_TEMP'] = tmpDir;
         process.env['GITHUB_WORKSPACE'] = tmpDir;
         t.false(fs.existsSync(path.join(tmpDir, 'input')));
         setInput('config-file', 'input');
@@ -80,7 +80,7 @@ ava_1.default("load non-existent input", async (t) => {
 });
 ava_1.default("load non-empty input", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
-        process.env['RUNNER_WORKSPACE'] = tmpDir;
+        process.env['RUNNER_TEMP'] = tmpDir;
         process.env['GITHUB_WORKSPACE'] = tmpDir;
         // Just create a generic config object with non-default values for all fields
         const inputFileContents = `
@@ -115,7 +115,7 @@ ava_1.default("load non-empty input", async (t) => {
 function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGenerator) {
     ava_1.default("load invalid input - " + testName, async (t) => {
         return await util.withTmpDir(async (tmpDir) => {
-            process.env['RUNNER_WORKSPACE'] = tmpDir;
+            process.env['RUNNER_TEMP'] = tmpDir;
             process.env['GITHUB_WORKSPACE'] = tmpDir;
             const inputFile = path.join(tmpDir, 'input');
             fs.writeFileSync(inputFile, inputFileContents, 'utf8');

lib/external-queries.js

@@ -13,7 +13,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const util = __importStar(require("./util"));
 async function checkoutExternalQueries(config) {
-    const folder = util.getRequiredEnvParam('RUNNER_WORKSPACE');
+    const folder = util.getRequiredEnvParam('RUNNER_TEMP');
     for (const externalQuery of config.externalQueries) {
         core.info('Checking out ' + externalQuery.repository);
         const checkoutLocation = path.join(folder, externalQuery.repository);

lib/external-queries.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AACtC,oDAAsC;AACtC,uCAAyB;AACzB,2CAA6B;AAG7B,6CAA+B;AAExB,KAAK,UAAU,uBAAuB,CAAC,MAA0B;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IAE5D,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,eAAe,EAAE;QAClD,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;YACpC,MAAM,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC;YAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;gBACrB,cAAc,GAAG,gBAAgB;gBACjC,YAAY,GAAG,gBAAgB,GAAG,OAAO;gBACzC,UAAU,EAAE,aAAa,CAAC,GAAG;aAC9B,CAAC,CAAC;SACJ;QAED,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;KAChF;AACH,CAAC;AAnBD,0DAmBC"}
+{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AACtC,oDAAsC;AACtC,uCAAyB;AACzB,2CAA6B;AAG7B,6CAA+B;AAExB,KAAK,UAAU,uBAAuB,CAAC,MAA0B;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAEvD,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,eAAe,EAAE;QAClD,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;YACpC,MAAM,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC;YAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;gBACrB,cAAc,GAAG,gBAAgB;gBACjC,YAAY,GAAG,gBAAgB,GAAG,OAAO;gBACzC,UAAU,EAAE,aAAa,CAAC,GAAG;aAC9B,CAAC,CAAC;SACJ;QAED,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;KAChF;AACH,CAAC;AAnBD,0DAmBC"}

lib/external-queries.test.js

@@ -22,7 +22,7 @@ ava_1.default("checkoutExternalQueries", async (t) => {
         new configUtils.ExternalQuery("github/codeql-go", "df4c6869212341b601005567381944ed90906b6b"),
     ];
     await util.withTmpDir(async (tmpDir) => {
-        process.env["RUNNER_WORKSPACE"] = tmpDir;
+        process.env["RUNNER_TEMP"] = tmpDir;
         await externalQueries.checkoutExternalQueries(config);
         // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in master
         t.true(fs.existsSync(path.join(tmpDir, "github", "codeql-go", "COPYRIGHT")));

lib/external-queries.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AACvB,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oEAAsD;AACtD,6CAA+B;AAE/B,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACtC,IAAI,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,CAAC,eAAe,GAAG;QACrB,IAAI,WAAW,CAAC,aAAa,CAAC,kBAAkB,EAAE,0CAA0C,CAAC;KAChG,CAAC;IAEF,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;QACjC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;QACzC,MAAM,eAAe,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtD,uFAAuF;QACvF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}
+{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AACvB,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oEAAsD;AACtD,6CAA+B;AAE/B,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACtC,IAAI,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,CAAC,eAAe,GAAG;QACrB,IAAI,WAAW,CAAC,aAAa,CAAC,kBAAkB,EAAE,0CAA0C,CAAC;KAChG,CAAC;IAEF,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;QACjC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;QACpC,MAAM,eAAe,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtD,uFAAuF;QACvF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

lib/finalize-db.js

@@ -174,7 +174,7 @@ async function run() {
         await runQueries(codeqlCmd, databaseFolder, sarifFolder, config);
         if ('true' === core.getInput('upload')) {
             if (!await upload_lib.upload(sarifFolder)) {
-                await util.reportActionFailed('failed', 'upload');
+                await util.reportActionFailed('finish', 'upload');
                 return;
             }
         }

lib/setup-tracer.js

@@ -100,12 +100,13 @@ function concatTracerConfigs(configs) {
         totalCount += count;
         totalLines.push(...lines.slice(2));
     }
-    const newLogFilePath = path.resolve(util.workspaceFolder(), 'compound-build-tracer.log');
-    const spec = path.resolve(util.workspaceFolder(), 'compound-spec');
-    const tempFolder = path.resolve(util.workspaceFolder(), 'compound-temp');
+    const tempFolder = util.getRequiredEnvParam('RUNNER_TEMP');
+    const newLogFilePath = path.resolve(tempFolder, 'compound-build-tracer.log');
+    const spec = path.resolve(tempFolder, 'compound-spec');
+    const compoundTempFolder = path.resolve(tempFolder, 'compound-temp');
     const newSpecContent = [newLogFilePath, totalCount.toString(10), ...totalLines];
     if (copyExecutables) {
-        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = tempFolder;
+        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = compoundTempFolder;
         envSize += 1;
     }
     fs.writeFileSync(spec, newSpecContent.join('\n'));
@@ -156,7 +157,7 @@ async function run() {
         // Setup CODEQL_RAM flag (todo improve this https://github.com/github/dsp-code-scanning/issues/935)
         const codeqlRam = process.env['CODEQL_RAM'] || '6500';
         core.exportVariable('CODEQL_RAM', codeqlRam);
-        const databaseFolder = path.resolve(util.workspaceFolder(), 'codeql_databases');
+        const databaseFolder = path.resolve(util.getRequiredEnvParam('RUNNER_TEMP'), 'codeql_databases');
         await io.mkdirP(databaseFolder);
         let tracedLanguages = {};
         let scannedLanguages = [];
@@ -205,8 +206,8 @@ async function run() {
         await util.reportActionFailed('init', error.message, error.stack);
         return;
     }
-    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
     await util.reportActionSucceeded('init');
+    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
 }
 run().catch(e => {
     core.setFailed("init action failed: " + e);

lib/upload-lib.js

@@ -125,58 +125,52 @@ exports.countResultsInSarif = countResultsInSarif;
 // Returns true iff the upload occurred and succeeded
 async function uploadFiles(sarifFiles) {
     core.startGroup("Uploading results");
-    let succeeded = false;
-    try {
-        const sentinelEnvVar = "CODEQL_UPLOAD_SARIF";
-        if (process.env[sentinelEnvVar]) {
-            core.error("Aborting upload: only one run of the codeql/analyze or codeql/upload-sarif actions is allowed per job");
-            return false;
-        }
-        core.exportVariable(sentinelEnvVar, sentinelEnvVar);
-        const commitOid = await util.getCommitOid();
-        const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
-        const ref = util.getRef();
-        const analysisKey = await util.getAnalysisKey();
-        const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
-        const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
-        core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
-        let sarifPayload = combineSarifFiles(sarifFiles);
-        sarifPayload = fingerprints.addFingerprints(sarifPayload);
-        const zipped_sarif = zlib_1.default.gzipSync(sarifPayload).toString('base64');
-        let checkoutPath = core.getInput('checkout_path');
-        let checkoutURI = file_url_1.default(checkoutPath);
-        const workflowRunID = parseInt(workflowRunIDStr, 10);
-        if (Number.isNaN(workflowRunID)) {
-            core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
-            return false;
-        }
-        let matrix = core.getInput('matrix');
-        if (matrix === "null" || matrix === "") {
-            matrix = undefined;
-        }
-        const toolNames = util.getToolNames(sarifPayload);
-        const payload = JSON.stringify({
-            "commit_oid": commitOid,
-            "ref": ref,
-            "analysis_key": analysisKey,
-            "analysis_name": analysisName,
-            "sarif": zipped_sarif,
-            "workflow_run_id": workflowRunID,
-            "checkout_uri": checkoutURI,
-            "environment": matrix,
-            "started_at": startedAt,
-            "tool_names": toolNames,
-        });
-        // Log some useful debug info about the info
-        core.debug("Raw upload size: " + sarifPayload.length + " bytes");
-        core.debug("Base64 zipped upload size: " + zipped_sarif.length + " bytes");
-        core.debug("Number of results in upload: " + countResultsInSarif(sarifPayload));
-        // Make the upload
-        succeeded = await uploadPayload(payload);
+    const sentinelEnvVar = "CODEQL_UPLOAD_SARIF";
+    if (process.env[sentinelEnvVar]) {
+        core.error("Aborting upload: only one run of the codeql/analyze or codeql/upload-sarif actions is allowed per job");
+        return false;
     }
-    catch (error) {
-        core.setFailed(error.message);
+    core.exportVariable(sentinelEnvVar, sentinelEnvVar);
+    const commitOid = await util.getCommitOid();
+    const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
+    const ref = util.getRef();
+    const analysisKey = await util.getAnalysisKey();
+    const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
+    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
+    core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
+    let sarifPayload = combineSarifFiles(sarifFiles);
+    sarifPayload = fingerprints.addFingerprints(sarifPayload);
+    const zipped_sarif = zlib_1.default.gzipSync(sarifPayload).toString('base64');
+    let checkoutPath = core.getInput('checkout_path');
+    let checkoutURI = file_url_1.default(checkoutPath);
+    const workflowRunID = parseInt(workflowRunIDStr, 10);
+    if (Number.isNaN(workflowRunID)) {
+        core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
+        return false;
     }
+    let matrix = core.getInput('matrix');
+    if (matrix === "null" || matrix === "") {
+        matrix = undefined;
+    }
+    const toolNames = util.getToolNames(sarifPayload);
+    const payload = JSON.stringify({
+        "commit_oid": commitOid,
+        "ref": ref,
+        "analysis_key": analysisKey,
+        "analysis_name": analysisName,
+        "sarif": zipped_sarif,
+        "workflow_run_id": workflowRunID,
+        "checkout_uri": checkoutURI,
+        "environment": matrix,
+        "started_at": startedAt,
+        "tool_names": toolNames,
+    });
+    // Log some useful debug info about the info
+    core.debug("Raw upload size: " + sarifPayload.length + " bytes");
+    core.debug("Base64 zipped upload size: " + zipped_sarif.length + " bytes");
+    core.debug("Number of results in upload: " + countResultsInSarif(sarifPayload));
+    // Make the upload
+    const succeeded = await uploadPayload(payload);
     core.endGroup();
     return succeeded;
 }

lib/util.js

@@ -42,16 +42,6 @@ function should_abort(actionName, requireInitActionHasRun) {
     return false;
 }
 exports.should_abort = should_abort;
-/**
- * Resolve the path to the workspace folder.
- */
-function workspaceFolder() {
-    let workspaceFolder = process.env['RUNNER_WORKSPACE'];
-    if (!workspaceFolder)
-        workspaceFolder = path.resolve('..');
-    return workspaceFolder;
-}
-exports.workspaceFolder = workspaceFolder;
 /**
  * Get an environment parameter, but throw an error if it is not set.
  */

src/config-utils.test.ts

@@ -18,7 +18,7 @@ function setInput(name: string, value: string | undefined) {
 
 test("load empty config", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     setInput('config-file', undefined);
@@ -31,7 +31,7 @@ test("load empty config", async t => {
 
 test("loading config saves config", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     const configFile = configUtils.getConfigFile();
@@ -50,7 +50,7 @@ test("loading config saves config", async t => {
 
 test("load input outside of workspace", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     setInput('config-file', '../input');
@@ -66,7 +66,7 @@ test("load input outside of workspace", async t => {
 
 test("load non-existent input", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     t.false(fs.existsSync(path.join(tmpDir, 'input')));
@@ -83,7 +83,7 @@ test("load non-existent input", async t => {
 
 test("load non-empty input", async t => {
   return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_WORKSPACE'] = tmpDir;
+    process.env['RUNNER_TEMP'] = tmpDir;
     process.env['GITHUB_WORKSPACE'] = tmpDir;
 
     // Just create a generic config object with non-default values for all fields
@@ -129,7 +129,7 @@ function doInvalidInputTest(
 
   test("load invalid input - " + testName, async t => {
     return await util.withTmpDir(async tmpDir => {
-      process.env['RUNNER_WORKSPACE'] = tmpDir;
+      process.env['RUNNER_TEMP'] = tmpDir;
       process.env['GITHUB_WORKSPACE'] = tmpDir;
 
       const inputFile = path.join(tmpDir, 'input');

src/config-utils.ts

@@ -248,7 +248,7 @@ function initConfig(): Config {
 }
 
 function getConfigFolder(): string {
-    return util.getRequiredEnvParam('RUNNER_WORKSPACE');
+    return util.getRequiredEnvParam('RUNNER_TEMP');
 }
 
 export function getConfigFile(): string {

src/external-queries.test.ts

@@ -13,7 +13,7 @@ test("checkoutExternalQueries", async t => {
     ];
 
     await util.withTmpDir(async tmpDir => {
-        process.env["RUNNER_WORKSPACE"] = tmpDir;
+        process.env["RUNNER_TEMP"] = tmpDir;
         await externalQueries.checkoutExternalQueries(config);
 
         // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in master

src/external-queries.ts

@@ -7,7 +7,7 @@ import * as configUtils from './config-utils';
 import * as util from './util';
 
 export async function checkoutExternalQueries(config: configUtils.Config) {
-  const folder = util.getRequiredEnvParam('RUNNER_WORKSPACE');
+  const folder = util.getRequiredEnvParam('RUNNER_TEMP');
 
   for (const externalQuery of config.externalQueries) {
     core.info('Checking out ' + externalQuery.repository);

src/finalize-db.ts

@@ -218,7 +218,7 @@ async function run() {
 
     if ('true' === core.getInput('upload')) {
       if (!await upload_lib.upload(sarifFolder)) {
-        await util.reportActionFailed('failed', 'upload');
+        await util.reportActionFailed('finish', 'upload');
         return;
       }
     }

src/setup-tracer.ts

@@ -108,13 +108,14 @@ function concatTracerConfigs(configs: { [lang: string]: TracerConfig }): TracerC
         totalLines.push(...lines.slice(2));
     }
 
-    const newLogFilePath = path.resolve(util.workspaceFolder(), 'compound-build-tracer.log');
-    const spec = path.resolve(util.workspaceFolder(), 'compound-spec');
-    const tempFolder = path.resolve(util.workspaceFolder(), 'compound-temp');
+    const tempFolder = util.getRequiredEnvParam('RUNNER_TEMP');
+    const newLogFilePath = path.resolve(tempFolder, 'compound-build-tracer.log');
+    const spec = path.resolve(tempFolder, 'compound-spec');
+    const compoundTempFolder = path.resolve(tempFolder, 'compound-temp');
     const newSpecContent = [newLogFilePath, totalCount.toString(10), ...totalLines];
 
     if (copyExecutables) {
-        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = tempFolder;
+        env['SEMMLE_COPY_EXECUTABLES_ROOT'] = compoundTempFolder;
         envSize += 1;
     }
 
@@ -181,7 +182,7 @@ async function run() {
         const codeqlRam = process.env['CODEQL_RAM'] || '6500';
         core.exportVariable('CODEQL_RAM', codeqlRam);
 
-        const databaseFolder = path.resolve(util.workspaceFolder(), 'codeql_databases');
+        const databaseFolder = path.resolve(util.getRequiredEnvParam('RUNNER_TEMP'), 'codeql_databases');
         await io.mkdirP(databaseFolder);
 
         let tracedLanguages: { [key: string]: TracerConfig } = {};
@@ -238,8 +239,8 @@ async function run() {
         await util.reportActionFailed('init', error.message, error.stack);
         return;
     }
-    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
     await util.reportActionSucceeded('init');
+    core.exportVariable(sharedEnv.CODEQL_ACTION_INIT_COMPLETED, 'true');
 }
 
 run().catch(e => {

src/upload-lib.ts

@@ -127,67 +127,63 @@ export function countResultsInSarif(sarif: string): number {
 // Returns true iff the upload occurred and succeeded
 async function uploadFiles(sarifFiles: string[]): Promise<boolean> {
     core.startGroup("Uploading results");
-    let succeeded = false;
-    try {
-        const sentinelEnvVar = "CODEQL_UPLOAD_SARIF";
-        if (process.env[sentinelEnvVar]) {
-            core.error("Aborting upload: only one run of the codeql/analyze or codeql/upload-sarif actions is allowed per job");
-            return false;
-        }
-        core.exportVariable(sentinelEnvVar, sentinelEnvVar);
 
-        const commitOid = await util.getCommitOid();
-        const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
-        const ref = util.getRef();
-        const analysisKey = await util.getAnalysisKey();
-        const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
-        const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
-
-        core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
-        let sarifPayload = combineSarifFiles(sarifFiles);
-        sarifPayload = fingerprints.addFingerprints(sarifPayload);
-
-        const zipped_sarif = zlib.gzipSync(sarifPayload).toString('base64');
-        let checkoutPath = core.getInput('checkout_path');
-        let checkoutURI = fileUrl(checkoutPath);
-        const workflowRunID = parseInt(workflowRunIDStr, 10);
-
-        if (Number.isNaN(workflowRunID)) {
-            core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
-            return false;
-        }
-
-        let matrix: string | undefined = core.getInput('matrix');
-        if (matrix === "null" || matrix === "") {
-            matrix = undefined;
-        }
-
-        const toolNames = util.getToolNames(sarifPayload);
-
-        const payload = JSON.stringify({
-            "commit_oid": commitOid,
-            "ref": ref,
-            "analysis_key": analysisKey,
-            "analysis_name": analysisName,
-            "sarif": zipped_sarif,
-            "workflow_run_id": workflowRunID,
-            "checkout_uri": checkoutURI,
-            "environment": matrix,
-            "started_at": startedAt,
-            "tool_names": toolNames,
-        });
-
-        // Log some useful debug info about the info
-        core.debug("Raw upload size: " + sarifPayload.length + " bytes");
-        core.debug("Base64 zipped upload size: " + zipped_sarif.length + " bytes");
-        core.debug("Number of results in upload: " + countResultsInSarif(sarifPayload));
-
-        // Make the upload
-        succeeded = await uploadPayload(payload);
-
-    } catch (error) {
-        core.setFailed(error.message);
+    const sentinelEnvVar = "CODEQL_UPLOAD_SARIF";
+    if (process.env[sentinelEnvVar]) {
+        core.error("Aborting upload: only one run of the codeql/analyze or codeql/upload-sarif actions is allowed per job");
+        return false;
     }
+    core.exportVariable(sentinelEnvVar, sentinelEnvVar);
+
+    const commitOid = await util.getCommitOid();
+    const workflowRunIDStr = util.getRequiredEnvParam('GITHUB_RUN_ID');
+    const ref = util.getRef();
+    const analysisKey = await util.getAnalysisKey();
+    const analysisName = util.getRequiredEnvParam('GITHUB_WORKFLOW');
+    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT];
+
+    core.info("Uploading sarif files: " + JSON.stringify(sarifFiles));
+    let sarifPayload = combineSarifFiles(sarifFiles);
+    sarifPayload = fingerprints.addFingerprints(sarifPayload);
+
+    const zipped_sarif = zlib.gzipSync(sarifPayload).toString('base64');
+    let checkoutPath = core.getInput('checkout_path');
+    let checkoutURI = fileUrl(checkoutPath);
+    const workflowRunID = parseInt(workflowRunIDStr, 10);
+
+    if (Number.isNaN(workflowRunID)) {
+        core.setFailed('GITHUB_RUN_ID must define a non NaN workflow run ID');
+        return false;
+    }
+
+    let matrix: string | undefined = core.getInput('matrix');
+    if (matrix === "null" || matrix === "") {
+        matrix = undefined;
+    }
+
+    const toolNames = util.getToolNames(sarifPayload);
+
+    const payload = JSON.stringify({
+        "commit_oid": commitOid,
+        "ref": ref,
+        "analysis_key": analysisKey,
+        "analysis_name": analysisName,
+        "sarif": zipped_sarif,
+        "workflow_run_id": workflowRunID,
+        "checkout_uri": checkoutURI,
+        "environment": matrix,
+        "started_at": startedAt,
+        "tool_names": toolNames,
+    });
+
+    // Log some useful debug info about the info
+    core.debug("Raw upload size: " + sarifPayload.length + " bytes");
+    core.debug("Base64 zipped upload size: " + zipped_sarif.length + " bytes");
+    core.debug("Number of results in upload: " + countResultsInSarif(sarifPayload));
+
+    // Make the upload
+    const succeeded = await uploadPayload(payload);
+
     core.endGroup();
 
     return succeeded;

src/util.ts

@@ -35,17 +35,6 @@ export function should_abort(actionName: string, requireInitActionHasRun: boolea
     return false;
 }
 
-/**
- * Resolve the path to the workspace folder.
- */
-export function workspaceFolder(): string {
-    let workspaceFolder = process.env['RUNNER_WORKSPACE'];
-    if (!workspaceFolder)
-        workspaceFolder = path.resolve('..');
-
-    return workspaceFolder;
-}
-
 /**
  * Get an environment parameter, but throw an error if it is not set.
  */