robojerk/codeql-action

Mark third-party SARIF limits errors as configuration errors

Browse source
This commit is contained in:
Henry Mercer 2024-02-28 19:41:43 +00:00
parent bd56a05133
commit 888ab31e3e
12 changed files with 63 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/analyze-action.js generated
View file

@ -178,7 +178,7 @@ async function run() {
core.setOutput("sarif-output", path_1.default.resolve(outputDir));
const uploadInput = actionsUtil.getOptionalInput("upload");
if (runStats && actionsUtil.getUploadValue(uploadInput) === "always") {
uploadResult = await uploadLib.uploadFromActions(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger, { isThirdPartyUpload: false });
uploadResult = await uploadLib.uploadFromActions(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger);
core.setOutput("sarif-id", uploadResult.sarifID);
}
else {

2
lib/analyze-action.js.map
View file

File diff suppressed because one or more lines are too long

2
lib/init-action-post-helper.js generated
View file

@ -74,7 +74,7 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
await codeql.databaseExportDiagnostics(databasePath, sarifFile, category, config.tempDir, logger);
}
logger.info(`Uploading failed SARIF file ${sarifFile}`);
const uploadResult = await uploadLib.uploadFromActions(sarifFile, checkoutPath, category, logger, { isThirdPartyUpload: false });
const uploadResult = await uploadLib.uploadFromActions(sarifFile, checkoutPath, category, logger);
await uploadLib.waitForProcessing(repositoryNwo, uploadResult.sarifID, logger, { isUnsuccessfulExecution: true });
return uploadResult
? { ...uploadResult.statusReport, sarifID: uploadResult.sarifID }

2
lib/init-action-post-helper.js.map
View file

File diff suppressed because one or more lines are too long

34
lib/upload-lib.js generated
View file

@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.validateUniqueCategory = exports.waitForProcessing = exports.buildPayload = exports.validateSarifFileSchema = exports.uploadFromActions = exports.findSarifFilesInDir = exports.populateRunAutomationDetails = void 0;
exports.InvalidSarifUploadError = exports.validateUniqueCategory = exports.waitForProcessing = exports.buildPayload = exports.validateSarifFileSchema = exports.uploadFromActions = exports.findSarifFilesInDir = exports.populateRunAutomationDetails = void 0;
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
const zlib_1 = __importDefault(require("zlib"));
@ -151,23 +151,10 @@ exports.findSarifFilesInDir = findSarifFilesInDir;
/**
* Uploads a single SARIF file or a directory of SARIF files depending on what `sarifPath` refers
* to.
*
* @param isThirdPartyUpload Whether the SARIF to upload comes from a third party, or from
* first-party CodeQL analysis. If it comes from a third party,
* we classify certain errors as configuration errors for
* telemetry purposes.
*/
async function uploadFromActions(sarifPath, checkoutPath, category, logger, { isThirdPartyUpload: isThirdPartyUpload }) {
try {
async function uploadFromActions(sarifPath, checkoutPath, category, logger) {
return await uploadFiles(getSarifFilePaths(sarifPath), (0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(checkoutPath), await actionsUtil.getRef(), await api.getAnalysisKey(), category, util.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getWorkflowRunAttempt(), checkoutPath, actionsUtil.getRequiredInput("matrix"), logger);
}
catch (e) {
if (e instanceof InvalidSarifUploadError && isThirdPartyUpload) {
throw new util_1.ConfigurationError(e.message);
}
throw e;
}
}
exports.uploadFromActions = uploadFromActions;
function getSarifFilePaths(sarifPath) {
if (!fs.existsSync(sarifPath)) {
@ -364,9 +351,12 @@ async function waitForProcessing(repositoryNwo, sarifID, logger, options = {
}
else if (status === "failed") {
const message = `Code Scanning could not process the submitted SARIF file:\n${response.data.errors}`;
throw shouldConsiderConfigurationError(response.data.errors)
const processingErrors = response.data.errors;
throw shouldConsiderConfigurationError(processingErrors)
? new util_1.ConfigurationError(message)
: new InvalidSarifUploadError(message);
: shouldConsiderInvalidRequest(processingErrors)
? new InvalidSarifUploadError(message)
: new Error(message);
}
else {
util.assertNever(status);
@ -382,13 +372,20 @@ async function waitForProcessing(repositoryNwo, sarifID, logger, options = {
}
exports.waitForProcessing = waitForProcessing;
/**
* Returns whether the provided processing errors should be considered a user error.
* Returns whether the provided processing errors are a configuration error.
*/
function shouldConsiderConfigurationError(processingErrors) {
return (processingErrors.length === 1 &&
processingErrors[0] ===
"CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled");
}
/**
* Returns whether the provided processing errors are the result of an invalid SARIF upload request.
*/
function shouldConsiderInvalidRequest(processingErrors) {
return (processingErrors.length === 1 &&
processingErrors[0].startsWith("rejecting SARIF,"));
}
/**
* Checks the processing result for an unsuccessful execution. Throws if the
* result is not a failure with a single "unsuccessful execution" error.
@ -458,4 +455,5 @@ class InvalidSarifUploadError extends Error {
super(message);
}
}
exports.InvalidSarifUploadError = InvalidSarifUploadError;
//# sourceMappingURL=upload-lib.js.map

2
lib/upload-lib.js.map
View file

File diff suppressed because one or more lines are too long

6
lib/upload-sarif-action.js generated
View file

@ -48,7 +48,7 @@ async function run() {
(0, util_1.checkActionVersion)((0, actions_util_1.getActionVersion)(), gitHubVersion);
await (0, status_report_1.sendStatusReport)(await (0, status_report_1.createStatusReportBase)("upload-sarif", "starting", startedAt, undefined, await (0, util_1.checkDiskUsage)(), logger));
try {
const uploadResult = await upload_lib.uploadFromActions(actionsUtil.getRequiredInput("sarif_file"), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger, { isThirdPartyUpload: true });
const uploadResult = await upload_lib.uploadFromActions(actionsUtil.getRequiredInput("sarif_file"), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger);
core.setOutput("sarif-id", uploadResult.sarifID);
// We don't upload results in test mode, so don't wait for processing
if ((0, util_1.isInTestMode)()) {
@ -60,7 +60,9 @@ async function run() {
await sendSuccessStatusReport(startedAt, uploadResult.statusReport, logger);
}
catch (unwrappedError) {
const error = (0, util_1.wrapError)(unwrappedError);
const error = unwrappedError instanceof upload_lib.InvalidSarifUploadError
? new util_1.ConfigurationError(unwrappedError.message)
: (0, util_1.wrapError)(unwrappedError);
const message = error.message;
core.setFailed(message);
console.log(error);

2
lib/upload-sarif-action.js.map
View file

@ -1 +1 @@
{"version":3,"file":"upload-sarif-action.js","sourceRoot":"","sources":["../src/upload-sarif-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,iDAAkD;AAClD,6CAAgD;AAChD,uCAAqD;AACrD,6CAAkD;AAClD,mDAKyB;AACzB,yDAA2C;AAC3C,iCAOgB;AAMhB,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,WAA0C,EAC1C,MAAc;IAEd,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,cAAc,EACd,SAAS,EACT,SAAS,EACT,SAAS,EACT,MAAM,IAAA,qBAAc,GAAE,EACtB,MAAM,CACP,CAAC;IACF,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,GAAG,WAAW;KACf,CAAC;IACF,MAAM,IAAA,gCAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,IAAA,4BAAqB,EAAC,IAAA,+BAAgB,GAAE,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;IAC/C,IAAA,yBAAkB,EAAC,IAAA,+BAAgB,GAAE,EAAE,aAAa,CAAC,CAAC;IAEtD,MAAM,IAAA,gCAAgB,EACpB,MAAM,IAAA,sCAAsB,EAC1B,cAAc,EACd,UAAU,EACV,SAAS,EACT,SAAS,EACT,MAAM,IAAA,qBAAc,GAAE,EACtB,MAAM,CACP,CACF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,iBAAiB,CACrD,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAC1C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EACxC,MAAM,EACN,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAC7B,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAEjD,qEAAqE;QACrE,IAAI,IAAA,mBAAY,GAAE,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,WAAW,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,MAAM,EAAE,CAAC;YAC1E,MAAM,UAAU,CAAC,iBAAiB,CAChC,IAAA,+BAAkB,EAAC,IAAA,0BAAmB,EAAC,mBAAmB,CAAC,CAAC,EAC5D,YAAY,CAAC,OAAO,EACpB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,CAAC,SAAS,EAAE,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,cAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAA,gCAAgB,EACpB,MAAM,IAAA,sCAAsB,EAC1B,cAAc,EACd,IAAA,gCAAgB,EAAC,KAAK,CAAC,EACvB,SAAS,EACT,SAAS,EACT,MAAM,IAAA,qBAAc,GAAE,EACtB,MAAM,EACN,OAAO,EACP,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;IACT,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,sCAAsC,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
{"version":3,"file":"upload-sarif-action.js","sourceRoot":"","sources":["../src/upload-sarif-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,iDAAkD;AAClD,6CAAgD;AAChD,uCAAqD;AACrD,6CAAkD;AAClD,mDAKyB;AACzB,yDAA2C;AAC3C,iCAQgB;AAMhB,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,WAA0C,EAC1C,MAAc;IAEd,MAAM,gBAAgB,GAAG,MAAM,IAAA,sCAAsB,EACnD,cAAc,EACd,SAAS,EACT,SAAS,EACT,SAAS,EACT,MAAM,IAAA,qBAAc,GAAE,EACtB,MAAM,CACP,CAAC;IACF,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,GAAG,WAAW;KACf,CAAC;IACF,MAAM,IAAA,gCAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,IAAA,4BAAqB,EAAC,IAAA,+BAAgB,GAAE,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;IAC/C,IAAA,yBAAkB,EAAC,IAAA,+BAAgB,GAAE,EAAE,aAAa,CAAC,CAAC;IAEtD,MAAM,IAAA,gCAAgB,EACpB,MAAM,IAAA,sCAAsB,EAC1B,cAAc,EACd,UAAU,EACV,SAAS,EACT,SAAS,EACT,MAAM,IAAA,qBAAc,GAAE,EACtB,MAAM,CACP,CACF,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,iBAAiB,CACrD,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAC1C,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EACxC,MAAM,CACP,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAEjD,qEAAqE;QACrE,IAAI,IAAA,mBAAY,GAAE,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,WAAW,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,KAAK,MAAM,EAAE,CAAC;YAC1E,MAAM,UAAU,CAAC,iBAAiB,CAChC,IAAA,+BAAkB,EAAC,IAAA,0BAAmB,EAAC,mBAAmB,CAAC,CAAC,EAC5D,YAAY,CAAC,OAAO,EACpB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,uBAAuB,CAAC,SAAS,EAAE,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,cAAc,EAAE,CAAC;QACxB,MAAM,KAAK,GACT,cAAc,YAAY,UAAU,CAAC,uBAAuB;YAC1D,CAAC,CAAC,IAAI,yBAAkB,CAAC,cAAc,CAAC,OAAO,CAAC;YAChD,CAAC,CAAC,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAA,gCAAgB,EACpB,MAAM,IAAA,sCAAsB,EAC1B,cAAc,EACd,IAAA,gCAAgB,EAAC,KAAK,CAAC,EACvB,SAAS,EACT,SAAS,EACT,MAAM,IAAA,qBAAc,GAAE,EACtB,MAAM,EACN,OAAO,EACP,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;IACT,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CACZ,sCAAsC,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

1
src/analyze-action.ts
View file

@ -286,7 +286,6 @@ async function run() {
actionsUtil.getRequiredInput("checkout_path"),
actionsUtil.getOptionalInput("category"),
logger,
{ isThirdPartyUpload: false },
);
core.setOutput("sarif-id", uploadResult.sarifID);
} else {

1
src/init-action-post-helper.ts
View file

@ -107,7 +107,6 @@ async function maybeUploadFailedSarif(
checkoutPath,
category,
logger,
{ isThirdPartyUpload: false },
);
await uploadLib.waitForProcessing(
repositoryNwo,

34
src/upload-lib.ts
View file

@ -178,20 +178,13 @@ export function findSarifFilesInDir(sarifPath: string): string[] {
/**
* Uploads a single SARIF file or a directory of SARIF files depending on what `sarifPath` refers
* to.
*
* @param isThirdPartyUpload Whether the SARIF to upload comes from a third party, or from
* first-party CodeQL analysis. If it comes from a third party,
* we classify certain errors as configuration errors for
* telemetry purposes.
*/
export async function uploadFromActions(
sarifPath: string,
checkoutPath: string,
category: string | undefined,
logger: Logger,
{ isThirdPartyUpload: isThirdPartyUpload }: { isThirdPartyUpload: boolean },
): Promise<UploadResult> {
try {
return await uploadFiles(
getSarifFilePaths(sarifPath),
parseRepositoryNwo(util.getRequiredEnvParam("GITHUB_REPOSITORY")),
@ -206,12 +199,6 @@ export async function uploadFromActions(
actionsUtil.getRequiredInput("matrix"),
logger,
);
} catch (e) {
if (e instanceof InvalidSarifUploadError && isThirdPartyUpload) {
throw new ConfigurationError(e.message);
}
throw e;
}
}
function getSarifFilePaths(sarifPath: string) {
@ -509,9 +496,12 @@ export async function waitForProcessing(
break;
} else if (status === "failed") {
const message = `Code Scanning could not process the submitted SARIF file:\n${response.data.errors}`;
throw shouldConsiderConfigurationError(response.data.errors as string[])
const processingErrors = response.data.errors as string[];
throw shouldConsiderConfigurationError(processingErrors)
? new ConfigurationError(message)
: new InvalidSarifUploadError(message);
: shouldConsiderInvalidRequest(processingErrors)
? new InvalidSarifUploadError(message)
: new Error(message);
} else {
util.assertNever(status);
}
@ -526,7 +516,7 @@ export async function waitForProcessing(
}
/**
* Returns whether the provided processing errors should be considered a user error.
* Returns whether the provided processing errors are a configuration error.
*/
function shouldConsiderConfigurationError(processingErrors: string[]): boolean {
return (
@ -536,6 +526,16 @@ function shouldConsiderConfigurationError(processingErrors: string[]): boolean {
);
}
/**
* Returns whether the provided processing errors are the result of an invalid SARIF upload request.
*/
function shouldConsiderInvalidRequest(processingErrors: string[]): boolean {
return (
processingErrors.length === 1 &&
processingErrors[0].startsWith("rejecting SARIF,")
);
}
/**
* Checks the processing result for an unsuccessful execution. Throws if the
* result is not a failure with a single "unsuccessful execution" error.
@ -615,7 +615,7 @@ function sanitize(str?: string) {
/**
* An error that occurred due to an invalid SARIF upload request.
*/
class InvalidSarifUploadError extends Error {
export class InvalidSarifUploadError extends Error {
constructor(message: string) {
super(message);
}

7
src/upload-sarif-action.ts
View file

@ -13,6 +13,7 @@ import {
} from "./status-report";
import * as upload_lib from "./upload-lib";
import {
ConfigurationError,
checkActionVersion,
checkDiskUsage,
getRequiredEnvParam,
@ -70,7 +71,6 @@ async function run() {
actionsUtil.getRequiredInput("checkout_path"),
actionsUtil.getOptionalInput("category"),
logger,
{ isThirdPartyUpload: true },
);
core.setOutput("sarif-id", uploadResult.sarifID);
@ -86,7 +86,10 @@ async function run() {
}
await sendSuccessStatusReport(startedAt, uploadResult.statusReport, logger);
} catch (unwrappedError) {
const error = wrapError(unwrappedError);
const error =
unwrappedError instanceof upload_lib.InvalidSarifUploadError
? new ConfigurationError(unwrappedError.message)
: wrapError(unwrappedError);
const message = error.message;
core.setFailed(message);
console.log(error);