Merge branch 'main' into update-bundle/codeql-bundle-v2.19.2

src/actions-util.ts

@@ -559,3 +559,29 @@ export async function runTool(
   }
   return stdout;
 }
+
+const persistedInputsKey = "persisted_inputs";
+
+/**
+ * Persists all inputs to the action as state that can be retrieved later in the post-action.
+ * This would be simplified if actions/runner#3514 is addressed.
+ * https://github.com/actions/runner/issues/3514
+ */
+export const persistInputs = function () {
+  const inputEnvironmentVariables = Object.entries(process.env).filter(
+    ([name]) => name.startsWith("INPUT_"),
+  );
+  core.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables));
+};
+
+/**
+ * Restores all inputs to the action from the persisted state.
+ */
+export const restoreInputs = function () {
+  const persistedInputs = core.getState(persistedInputsKey);
+  if (persistedInputs) {
+    for (const [name, value] of JSON.parse(persistedInputs)) {
+      process.env[name] = value;
+    }
+  }
+};

src/analyze-action-post.ts

@@ -5,7 +5,7 @@
  */
 import * as core from "@actions/core";
 
-import { getTemporaryDirectory } from "./actions-util";
+import * as actionsUtil from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { getConfig } from "./config-utils";
 import * as debugArtifacts from "./debug-artifacts";
@@ -21,6 +21,7 @@ import {
 
 async function runWrapper() {
   try {
+    actionsUtil.restoreInputs();
     const logger = getActionsLogger();
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);
@@ -30,14 +31,17 @@ async function runWrapper() {
     const features = new Features(
       gitHubVersion,
       repositoryNwo,
-      getTemporaryDirectory(),
+      actionsUtil.getTemporaryDirectory(),
       logger,
     );
 
     // Upload SARIF artifacts if we determine that this is a first-party analysis run.
     // For third-party runs, this artifact will be uploaded in the `upload-sarif-post` step.
     if (process.env[EnvVar.INIT_ACTION_HAS_RUN] === "true") {
-      const config = await getConfig(getTemporaryDirectory(), logger);
+      const config = await getConfig(
+        actionsUtil.getTemporaryDirectory(),
+        logger,
+      );
       if (config !== undefined) {
         await withGroup("Uploading combined SARIF debug artifact", () =>
           debugArtifacts.uploadCombinedSarifArtifacts(

src/analyze-action.ts

@@ -199,6 +199,10 @@ async function run() {
   let didUploadTrapCaches = false;
   util.initializeEnvironment(actionsUtil.getActionVersion());
 
+  // Make inputs accessible in the `post` step, details at
+  // https://github.com/github/codeql-action/issues/2553
+  actionsUtil.persistInputs();
+
   const logger = getActionsLogger();
   try {
     const statusReportBase = await createStatusReportBase(

src/feature-flags.ts

@@ -51,6 +51,7 @@ export enum Feature {
   ArtifactV4Upgrade = "artifact_v4_upgrade",
   CleanupTrapCaches = "cleanup_trap_caches",
   CppDependencyInstallation = "cpp_dependency_installation_enabled",
+  DiffInformedQueries = "diff_informed_queries",
   DisableCsharpBuildless = "disable_csharp_buildless",
   DisableJavaBuildlessEnabled = "disable_java_buildless_enabled",
   DisableKotlinAnalysisEnabled = "disable_kotlin_analysis_enabled",
@@ -108,6 +109,12 @@ export const featureConfig: Record<
     legacyApi: true,
     minimumVersion: "2.15.0",
   },
+  [Feature.DiffInformedQueries]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_DIFF_INFORMED_QUERIES",
+    minimumVersion: undefined,
+    toolsFeature: ToolsFeature.DatabaseInterpretResultsSupportsSarifRunProperty,
+  },
   [Feature.DisableCsharpBuildless]: {
     defaultValue: false,
     envVar: "CODEQL_ACTION_DISABLE_CSHARP_BUILDLESS",

src/init-action-post.ts

@@ -6,7 +6,11 @@
 
 import * as core from "@actions/core";
 
-import { getTemporaryDirectory, printDebugLogs } from "./actions-util";
+import {
+  restoreInputs,
+  getTemporaryDirectory,
+  printDebugLogs,
+} from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { Config, getConfig } from "./config-utils";
 import * as debugArtifacts from "./debug-artifacts";
@@ -42,6 +46,9 @@ async function runWrapper() {
     | initActionPostHelper.UploadFailedSarifResult
     | undefined;
   try {
+    // Restore inputs from `init` Action.
+    restoreInputs();
+
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);
 

src/init-action.ts

@@ -12,6 +12,7 @@ import {
   getOptionalInput,
   getRequiredInput,
   getTemporaryDirectory,
+  persistInputs,
 } from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import { CodeQL } from "./codeql";
@@ -250,6 +251,9 @@ async function run() {
   const logger = getActionsLogger();
   initializeEnvironment(getActionVersion());
 
+  // Make inputs accessible in the `post` step.
+  persistInputs();
+
   let config: configUtils.Config | undefined;
   let codeql: CodeQL;
   let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined;

src/start-proxy-action-post.ts

@@ -20,6 +20,8 @@ import {
 
 async function runWrapper() {
   try {
+    // Restore inputs from `start-proxy` Action.
+    actionsUtil.restoreInputs();
     const pid = core.getState("proxy-process-pid");
     if (pid) {
       process.kill(Number(pid));

src/start-proxy-action.ts

@@ -91,6 +91,9 @@ function generateCertificateAuthority(): CertificateAuthority {
 }
 
 async function runWrapper() {
+  // Make inputs accessible in the `post` step.
+  actionsUtil.persistInputs();
+
   const logger = getActionsLogger();
 
   // Setup logging for the proxy

src/upload-sarif-action-post.ts

@@ -5,6 +5,7 @@
  */
 import * as core from "@actions/core";
 
+import * as actionsUtil from "./actions-util";
 import { getTemporaryDirectory } from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import * as debugArtifacts from "./debug-artifacts";
@@ -20,6 +21,8 @@ import {
 
 async function runWrapper() {
   try {
+    // Restore inputs from `upload-sarif` Action.
+    actionsUtil.restoreInputs();
     const logger = getActionsLogger();
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);

src/upload-sarif-action.ts

@@ -60,6 +60,9 @@ async function run() {
   const gitHubVersion = await getGitHubVersion();
   checkActionVersion(getActionVersion(), gitHubVersion);
 
+  // Make inputs accessible in the `post` step.
+  actionsUtil.persistInputs();
+
   const repositoryNwo = parseRepositoryNwo(
     getRequiredEnvParam("GITHUB_REPOSITORY"),
   );