robojerk/codeql-action

Log warning if SIP is disabled and CLI version is < 2.15.1 (#2261)

Browse source 
* PR Checks: use `macos-12` runners for CLI v. < 2.15.1

Prior to CLI v2.15.1, MacOS ARM runners were not supported by the build tracer. "macos-latest" is now an ARM runner, so we run these tests on the old CLIs on Intel runners instead.

* Log a warning if SIP is disabled and CLI is < 2.15.1

* Add changenote for SIP-disabled support on old CLI versions

* Set up Python 3.11 for all MacOS checks
This commit is contained in:
Angela P Wen 2024-04-25 15:20:13 -07:00 • committed by GitHub
parent 0ad7791640
commit ac2f82a1ff
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
74 changed files with 251 additions and 136 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.github/workflows/__all-platform-bundle.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__analyze-ref-input.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__autobuild-action.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__autobuild-direct-tracing.yml generated vendored
View file

@ -45,7 +45,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__build-mode-autobuild.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__build-mode-manual.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__build-mode-none.yml generated vendored
View file

@ -41,7 +41,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__build-mode-rollback.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__config-export.yml generated vendored
View file

@ -49,7 +49,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__config-input.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__cpp-deptrace-disabled.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__cpp-deptrace-enabled-on-macos.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__cpp-deptrace-enabled.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

4
.github/workflows/__diagnostics-export.yml generated vendored
View file

@ -29,7 +29,7 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: windows-latest
version: stable-20230403
@ -55,7 +55,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__export-file-baseline-information.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__extractor-ram-threads.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

11
.github/workflows/__go-custom-queries.yml generated vendored
View file

@ -29,19 +29,19 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: windows-latest
version: stable-20230403
- os: ubuntu-latest
version: stable-v2.13.5
- os: macos-latest
- os: macos-12
version: stable-v2.13.5
- os: windows-latest
version: stable-v2.13.5
- os: ubuntu-latest
version: stable-v2.14.6
- os: macos-latest
- os: macos-12
version: stable-v2.14.6
- os: windows-latest
version: stable-v2.14.6
@ -85,7 +85,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||
@ -102,6 +102,9 @@ jobs:
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
- uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
- uses: ./../action/init
with:
languages: go

2
.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__go-indirect-tracing-workaround.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

8
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View file

@ -29,15 +29,15 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: ubuntu-latest
version: stable-v2.13.5
- os: macos-latest
- os: macos-12
version: stable-v2.13.5
- os: ubuntu-latest
version: stable-v2.14.6
- os: macos-latest
- os: macos-12
version: stable-v2.14.6
- os: ubuntu-latest
version: stable-v2.15.5
@ -69,7 +69,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

8
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View file

@ -29,15 +29,15 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: ubuntu-latest
version: stable-v2.13.5
- os: macos-latest
- os: macos-12
version: stable-v2.13.5
- os: ubuntu-latest
version: stable-v2.14.6
- os: macos-latest
- os: macos-12
version: stable-v2.14.6
- os: ubuntu-latest
version: stable-v2.15.5
@ -69,7 +69,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

8
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View file

@ -29,15 +29,15 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: ubuntu-latest
version: stable-v2.13.5
- os: macos-latest
- os: macos-12
version: stable-v2.13.5
- os: ubuntu-latest
version: stable-v2.14.6
- os: macos-latest
- os: macos-12
version: stable-v2.14.6
- os: ubuntu-latest
version: stable-v2.15.5
@ -69,7 +69,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__init-with-registries.yml generated vendored
View file

@ -56,7 +56,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__javascript-source-root.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__language-aliases.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

12
.github/workflows/__multi-language-autodetect.yml generated vendored
View file

@ -29,15 +29,15 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: ubuntu-latest
version: stable-v2.13.5
- os: macos-latest
- os: macos-12
version: stable-v2.13.5
- os: ubuntu-latest
version: stable-v2.14.6
- os: macos-latest
- os: macos-12
version: stable-v2.14.6
- os: ubuntu-latest
version: stable-v2.15.5
@ -69,7 +69,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||
@ -86,6 +86,10 @@ jobs:
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
- uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
- uses: ./../action/init
id: init
with:

2
.github/workflows/__packaging-codescanning-config-inputs-js.yml generated vendored
View file

@ -55,7 +55,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__packaging-config-inputs-js.yml generated vendored
View file

@ -55,7 +55,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__packaging-config-js.yml generated vendored
View file

@ -55,7 +55,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__packaging-inputs-js.yml generated vendored
View file

@ -55,7 +55,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

8
.github/workflows/__remote-config.yml generated vendored
View file

@ -29,19 +29,19 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: windows-latest
version: stable-20230403
- os: ubuntu-latest
version: stable-v2.13.5
- os: macos-latest
- os: macos-12
version: stable-v2.13.5
- os: windows-latest
version: stable-v2.13.5
- os: ubuntu-latest
version: stable-v2.14.6
- os: macos-latest
- os: macos-12
version: stable-v2.14.6
- os: windows-latest
version: stable-v2.14.6
@ -85,7 +85,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

4
.github/workflows/__resolve-environment-action.yml generated vendored
View file

@ -29,7 +29,7 @@ jobs:
include:
- os: ubuntu-latest
version: stable-v2.13.4
- os: macos-latest
- os: macos-12
version: stable-v2.13.4
- os: windows-latest
version: stable-v2.13.4
@ -61,7 +61,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__rubocop-multi-language.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__ruby.yml generated vendored
View file

@ -49,7 +49,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

12
.github/workflows/__scaling-reserved-ram.yml generated vendored
View file

@ -29,15 +29,15 @@ jobs:
include:
- os: ubuntu-latest
version: stable-20230403
- os: macos-latest
- os: macos-12
version: stable-20230403
- os: ubuntu-latest
version: stable-v2.13.5
- os: macos-latest
- os: macos-12
version: stable-v2.13.5
- os: ubuntu-latest
version: stable-v2.14.6
- os: macos-latest
- os: macos-12
version: stable-v2.14.6
- os: ubuntu-latest
version: stable-v2.15.5
@ -69,7 +69,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||
@ -86,6 +86,10 @@ jobs:
with:
version: ${{ matrix.version }}
use-all-platform-bundle: 'false'
- uses: actions/setup-go@v5
with:
go-version: '>=1.21.0'
- uses: ./../action/init
id: init
with:

2
.github/workflows/__split-workflow.yml generated vendored
View file

@ -49,7 +49,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__submit-sarif-failure.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__swift-custom-build.yml generated vendored
View file

@ -49,7 +49,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__test-autobuild-working-dir.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__test-local-codeql.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__test-proxy.yml generated vendored
View file

@ -39,7 +39,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__unset-environment.yml generated vendored
View file

@ -53,7 +53,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__upload-ref-sha-input.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
.github/workflows/__with-checkout-path.yml generated vendored
View file

@ -43,7 +43,7 @@ jobs:
- name: Setup Python on MacOS
uses: actions/setup-python@v5
if: >-
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||

2
CHANGELOG.md
View file

@ -6,7 +6,7 @@ Note that the only difference between `v2` and `v3` of the CodeQL Action is the
## [UNRELEASED]
No user facing changes.
- Workflows running on `macos-latest` using CodeQL CLI versions before v2.15.1 will need to either upgrade their CLI version to v2.15.1 or newer, or change the platform to an Intel MacOS runner, such as `macos-12`. ARM machines with SIP disabled, including the newest `macos-latest` image, are unsupported for CLI versions before 2.15.1. [#2261](https://github.com/github/codeql-action/pull/2261)
## 3.25.2 - 22 Apr 2024

2
lib/analyze.js generated
View file

@ -174,7 +174,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
}
statusReport["event_reports"].push(perQueryAlertCountEventReport);
}
if (!(await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_ANALYSIS_SUMMARY_V2))) {
if (!(await util.codeQlVersionAtLeast(codeql, codeql_1.CODEQL_VERSION_ANALYSIS_SUMMARY_V2))) {
await runPrintLinesOfCode(language);
}
}

2
lib/analyze.js.map
View file

File diff suppressed because one or more lines are too long

22
lib/codeql.js generated
View file

@ -274,13 +274,13 @@ async function getCodeQLForCmd(cmd, checkVersion) {
if (qlconfigFile !== undefined) {
extraArgs.push(`--qlconfig-file=${qlconfigFile}`);
}
if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG)) {
if (await util.codeQlVersionAtLeast(this, exports.CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG)) {
extraArgs.push("--calculate-language-specific-baseline");
}
if (await isSublanguageFileCoverageEnabled(config, this)) {
extraArgs.push("--sublanguage-file-coverage");
}
else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
else if (await util.codeQlVersionAtLeast(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
extraArgs.push("--no-sublanguage-file-coverage");
}
await runTool(cmd, [
@ -469,7 +469,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
ignoringOptions: ["--expect-discarded-cache"],
}),
];
if (await util.codeQlVersionAbove(this, feature_flags_1.CODEQL_VERSION_FINE_GRAINED_PARALLELISM)) {
if (await util.codeQlVersionAtLeast(this, feature_flags_1.CODEQL_VERSION_FINE_GRAINED_PARALLELISM)) {
codeqlArgs.push("--intra-layer-parallelism");
}
await runTool(cmd, codeqlArgs);
@ -503,7 +503,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
if (await isSublanguageFileCoverageEnabled(config, this)) {
codeqlArgs.push("--sublanguage-file-coverage");
}
else if (await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
else if (await util.codeQlVersionAtLeast(this, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)) {
codeqlArgs.push("--no-sublanguage-file-coverage");
}
if (shouldExportDiagnostics) {
@ -512,7 +512,7 @@ async function getCodeQLForCmd(cmd, checkVersion) {
else {
codeqlArgs.push("--no-sarif-include-diagnostics");
}
if ((await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2)) &&
if ((await util.codeQlVersionAtLeast(this, exports.CODEQL_VERSION_ANALYSIS_SUMMARY_V2)) &&
!(0, tools_features_1.isSupportedToolsFeature)(await this.getVersion(), tools_features_1.ToolsFeature.AnalysisSummaryV2IsDefault)) {
codeqlArgs.push("--new-analysis-summary");
}
@ -693,12 +693,12 @@ async function getCodeQLForCmd(cmd, checkVersion) {
// would call getVersion(), so the CLI version would be cached as soon as the
// CodeQL object is created.
if (checkVersion &&
!(await util.codeQlVersionAbove(codeql, CODEQL_MINIMUM_VERSION))) {
!(await util.codeQlVersionAtLeast(codeql, CODEQL_MINIMUM_VERSION))) {
throw new util.ConfigurationError(`Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${(await codeql.getVersion()).version}`);
}
else if (checkVersion &&
process.env[environment_1.EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
!(await util.codeQlVersionAbove(codeql, CODEQL_NEXT_MINIMUM_VERSION))) {
!(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))) {
const result = await codeql.getVersion();
core.warning(`CodeQL CLI version ${result.version} was discontinued on ` +
`${GHES_MOST_RECENT_DEPRECATION_DATE} alongside GitHub Enterprise Server ` +
@ -894,10 +894,10 @@ function getGeneratedCodeScanningConfigPath(config) {
}
exports.getGeneratedCodeScanningConfigPath = getGeneratedCodeScanningConfigPath;
async function isDiagnosticsExportInvalidSarifFixed(codeql) {
return await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED);
return await util.codeQlVersionAtLeast(codeql, exports.CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED);
}
async function getLanguageAliasingArguments(codeql) {
if (await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_LANGUAGE_ALIASING)) {
if (await util.codeQlVersionAtLeast(codeql, exports.CODEQL_VERSION_LANGUAGE_ALIASING)) {
return ["--extractor-include-aliases"];
}
return [];
@ -907,10 +907,10 @@ async function isSublanguageFileCoverageEnabled(config, codeql) {
// Sub-language file coverage is first supported in GHES 3.12.
(config.gitHubVersion.type !== util.GitHubVariant.GHES ||
semver.gte(config.gitHubVersion.version, "3.12.0")) &&
(await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)));
(await util.codeQlVersionAtLeast(codeql, exports.CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE)));
}
async function getCodeScanningQueryHelpArguments(codeql) {
if (await util.codeQlVersionAbove(codeql, CODEQL_VERSION_INCLUDE_QUERY_HELP)) {
if (await util.codeQlVersionAtLeast(codeql, CODEQL_VERSION_INCLUDE_QUERY_HELP)) {
return ["--sarif-include-query-help=always"];
}
return ["--sarif-add-query-help"];

2
lib/codeql.js.map
View file

File diff suppressed because one or more lines are too long

2
lib/config-utils.js generated
View file

@ -176,7 +176,7 @@ exports.getLanguages = getLanguages;
* version of the CLI.
*/
async function getLanguageAliases(codeql) {
if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_LANGUAGE_ALIASING)) {
if (await (0, util_1.codeQlVersionAtLeast)(codeql, codeql_1.CODEQL_VERSION_LANGUAGE_ALIASING)) {
return (await codeql.betterResolveLanguages()).aliases;
}
return undefined;

2
lib/config-utils.js.map
View file

File diff suppressed because one or more lines are too long

2
lib/feature-flags.js generated
View file

@ -144,7 +144,7 @@ class Features {
// Never use this feature if the CLI version explicitly can't support it.
const minimumVersion = exports.featureConfig[feature].minimumVersion;
if (codeql && minimumVersion) {
if (!(await util.codeQlVersionAbove(codeql, minimumVersion))) {
if (!(await util.codeQlVersionAtLeast(codeql, minimumVersion))) {
this.logger.debug(`Feature ${feature} is disabled because the CodeQL CLI version is older than the minimum ` +
`version ${minimumVersion}.`);
return false;

2
lib/feature-flags.js.map
View file

File diff suppressed because one or more lines are too long

22
lib/init-action.js generated
View file

@ -250,14 +250,14 @@ async function run() {
core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
}
const kotlinLimitVar = "CODEQL_EXTRACTOR_KOTLIN_OVERRIDE_MAXIMUM_VERSION_LIMIT";
if ((await (0, util_1.codeQlVersionAbove)(codeql, "2.13.4")) &&
!(await (0, util_1.codeQlVersionAbove)(codeql, "2.14.4"))) {
if ((await (0, util_1.codeQlVersionAtLeast)(codeql, "2.13.4")) &&
!(await (0, util_1.codeQlVersionAtLeast)(codeql, "2.14.4"))) {
core.exportVariable(kotlinLimitVar, "1.9.20");
}
if (config.languages.includes(languages_1.Language.java) &&
// Java Lombok support is enabled by default for >= 2.14.4
(await (0, util_1.codeQlVersionAbove)(codeql, "2.14.0")) &&
!(await (0, util_1.codeQlVersionAbove)(codeql, "2.14.4"))) {
(await (0, util_1.codeQlVersionAtLeast)(codeql, "2.14.0")) &&
!(await (0, util_1.codeQlVersionAtLeast)(codeql, "2.14.4"))) {
const envVar = "CODEQL_EXTRACTOR_JAVA_RUN_ANNOTATION_PROCESSORS";
if (process.env[envVar]) {
logger.info(`Environment variable ${envVar} already set. Not en/disabling CodeQL Java Lombok support`);
@ -282,17 +282,25 @@ async function run() {
core.exportVariable(envVar, "false");
}
}
// For CLI versions <2.15.1, build tracing caused errors in MacOS ARM machines with
// System Integrity Protection (SIP) disabled.
if (!(await (0, util_1.codeQlVersionAtLeast)(codeql, "2.15.1")) &&
process.platform === "darwin" &&
(process.arch === "arm" || process.arch === "arm64") &&
!(await (0, init_1.isSipEnabled)(logger))) {
logger.warning("CodeQL versions 2.15.0 and lower are not supported on MacOS ARM machines with System Integrity Protection (SIP) disabled.");
}
// From 2.16.0 the default for the python extractor is to not perform any
// dependency extraction. For versions before that, you needed to set this flag to
// enable this behavior (supported since 2.13.1).
if (await (0, util_1.codeQlVersionAbove)(codeql, "2.17.1")) {
if (await (0, util_1.codeQlVersionAtLeast)(codeql, "2.17.1")) {
// disabled by default, no warning
}
else if (await (0, util_1.codeQlVersionAbove)(codeql, "2.16.0")) {
else if (await (0, util_1.codeQlVersionAtLeast)(codeql, "2.16.0")) {
// disabled by default, prints warning if environment variable is not set
core.exportVariable("CODEQL_EXTRACTOR_PYTHON_DISABLE_LIBRARY_EXTRACTION", "true");
}
else if (await (0, util_1.codeQlVersionAbove)(codeql, "2.13.1")) {
else if (await (0, util_1.codeQlVersionAtLeast)(codeql, "2.13.1")) {
core.exportVariable("CODEQL_EXTRACTOR_PYTHON_DISABLE_LIBRARY_EXTRACTION", "true");
}
else {

2
lib/init-action.js.map
View file

File diff suppressed because one or more lines are too long

24
lib/init.js generated
View file

@ -23,9 +23,10 @@ var __importStar = (this && this.__importStar) || function (mod) {
return result;
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.checkInstallPython311 = exports.printPathFiltersWarning = exports.runInit = exports.initConfig = exports.initCodeQL = void 0;
exports.isSipEnabled = exports.checkInstallPython311 = exports.printPathFiltersWarning = exports.runInit = exports.initConfig = exports.initCodeQL = void 0;
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
const exec = __importStar(require("@actions/exec/lib/exec"));
const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
const safeWhich = __importStar(require("@chrisgavin/safe-which"));
const codeql_1 = require("./codeql");
@ -89,4 +90,25 @@ async function checkInstallPython311(languages, codeql) {
}
}
exports.checkInstallPython311 = checkInstallPython311;
// For MacOS runners: runs `csrutil status` to determine whether System
// Integrity Protection is enabled.
async function isSipEnabled(logger) {
try {
const sipStatusOutput = await exec.getExecOutput("csrutil status");
if (sipStatusOutput.exitCode === 0) {
if (sipStatusOutput.stdout.includes("System Integrity Protection status: enabled.")) {
return true;
}
if (sipStatusOutput.stdout.includes("System Integrity Protection status: disabled.")) {
return false;
}
}
return undefined;
}
catch (e) {
logger.warning(`Failed to determine if System Integrity Protection was enabled: ${e}`);
return undefined;
}
}
exports.isSipEnabled = isSipEnabled;
//# sourceMappingURL=init.js.map

2
lib/init.js.map
View file

@ -1 +1 @@
{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAGpD,qCAA+C;AAC/C,4DAA8C;AAE9C,2CAA0D;AAG1D,qDAAgD;AAChD,mDAAwE;AAGjE,KAAK,UAAU,UAAU,CAC9B,UAA8B,EAC9B,UAA4B,EAC5B,OAAe,EACf,OAA2B,EAC3B,iBAA2C,EAC3C,MAAc;IAOd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,YAAY,EAAE,GAClE,MAAM,IAAA,oBAAW,EACf,UAAU,EACV,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,EACjB,MAAM,EACN,IAAI,CACL,CAAC;IACJ,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACxE,CAAC;AA3BD,gCA2BC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAoC,EACpC,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpD,IACE,CAAC,CAAC,MAAM,MAAM,CAAC,eAAe,CAC5B,6BAAY,CAAC,kCAAkC,CAChD,CAAC,EACF,CAAC;QACD,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AAhBD,gCAgBC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B,EAC1B,UAAkB,EAClB,WAA+B,EAC/B,eAAmC,EACnC,UAAoC,EACpC,QAA2B,EAC3B,MAAc;IAEd,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErD,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAC1C,MAAM,WAAW,CAAC,kBAAkB,CAClC,eAAe,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;IACJ,MAAM,WAAW,CAAC,eAAe,CAC/B;QACE,YAAY,EAAE,UAAU,CAAC,IAAI;QAC7B,sBAAsB,EAAE,oBAAoB;KAC7C;IAED,0BAA0B;IAC1B,KAAK,IAAI,EAAE,CACT,MAAM,MAAM,CAAC,mBAAmB,CAC9B,MAAM,EACN,UAAU,EACV,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,MAAM,CACP,CACJ,CAAC;IACF,OAAO,MAAM,IAAA,uCAAuB,EAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AApCD,0BAoCC;AAED,SAAgB,uBAAuB,CACrC,MAA0B,EAC1B,MAAc;IAEd,qEAAqE;IACrE,sEAAsE;IACtE,IACE,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM;QACrC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACnD,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,6BAAiB,CAAC,EAC1C,CAAC;QACD,MAAM,CAAC,OAAO,CACZ,mGAAmG,CACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAfD,0DAeC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CACzC,SAAqB,EACrB,MAAc;IAEd,IACE,SAAS,CAAC,QAAQ,CAAC,oBAAQ,CAAC,MAAM,CAAC;QACnC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,iBAAiB,EACxD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CACzB,SAAS,EACT,iBAAiB,EACjB,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;YACvE,MAAM;SACP,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAlBD,sDAkBC"}
{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,6DAA+C;AAC/C,yEAA2D;AAC3D,kEAAoD;AAGpD,qCAA+C;AAC/C,4DAA8C;AAE9C,2CAA0D;AAG1D,qDAAgD;AAChD,mDAAwE;AAGjE,KAAK,UAAU,UAAU,CAC9B,UAA8B,EAC9B,UAA4B,EAC5B,OAAe,EACf,OAA2B,EAC3B,iBAA2C,EAC3C,MAAc;IAOd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,YAAY,EAAE,GAClE,MAAM,IAAA,oBAAW,EACf,UAAU,EACV,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,EACjB,MAAM,EACN,IAAI,CACL,CAAC;IACJ,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACxE,CAAC;AA3BD,gCA2BC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAoC,EACpC,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpD,IACE,CAAC,CAAC,MAAM,MAAM,CAAC,eAAe,CAC5B,6BAAY,CAAC,kCAAkC,CAChD,CAAC,EACF,CAAC;QACD,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AAhBD,gCAgBC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B,EAC1B,UAAkB,EAClB,WAA+B,EAC/B,eAAmC,EACnC,UAAoC,EACpC,QAA2B,EAC3B,MAAc;IAEd,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErD,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,GAC1C,MAAM,WAAW,CAAC,kBAAkB,CAClC,eAAe,EACf,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;IACJ,MAAM,WAAW,CAAC,eAAe,CAC/B;QACE,YAAY,EAAE,UAAU,CAAC,IAAI;QAC7B,sBAAsB,EAAE,oBAAoB;KAC7C;IAED,0BAA0B;IAC1B,KAAK,IAAI,EAAE,CACT,MAAM,MAAM,CAAC,mBAAmB,CAC9B,MAAM,EACN,UAAU,EACV,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,MAAM,CACP,CACJ,CAAC;IACF,OAAO,MAAM,IAAA,uCAAuB,EAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AApCD,0BAoCC;AAED,SAAgB,uBAAuB,CACrC,MAA0B,EAC1B,MAAc;IAEd,qEAAqE;IACrE,sEAAsE;IACtE,IACE,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM;QACrC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACnD,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,6BAAiB,CAAC,EAC1C,CAAC;QACD,MAAM,CAAC,OAAO,CACZ,mGAAmG,CACpG,CAAC;IACJ,CAAC;AACH,CAAC;AAfD,0DAeC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CACzC,SAAqB,EACrB,MAAc;IAEd,IACE,SAAS,CAAC,QAAQ,CAAC,oBAAQ,CAAC,MAAM,CAAC;QACnC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,iBAAiB,EACxD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CACzB,SAAS,EACT,iBAAiB,EACjB,oBAAoB,CACrB,CAAC;QACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;YACvE,MAAM;SACP,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAlBD,sDAkBC;AAED,uEAAuE;AACvE,mCAAmC;AAC5B,KAAK,UAAU,YAAY,CAAC,MAAM;IACvC,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,eAAe,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnC,IACE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAC7B,8CAA8C,CAC/C,EACD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAC7B,+CAA+C,CAChD,EACD,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CACZ,mEAAmE,CAAC,EAAE,CACvE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AA1BD,oCA0BC"}

4
lib/resolve-environment.js generated
View file

@ -33,7 +33,7 @@ async function runResolveBuildEnvironment(cmd, logger, workingDir, languageInput
let language = languageInput;
// If the CodeQL CLI version in use supports language aliasing, give the CLI the raw language
// input. Otherwise, parse the language input and give the CLI the parsed language.
if (!(await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_LANGUAGE_ALIASING))) {
if (!(await util.codeQlVersionAtLeast(codeql, codeql_1.CODEQL_VERSION_LANGUAGE_ALIASING))) {
const parsedLanguage = (0, languages_1.parseLanguage)(languageInput)?.toString();
if (parsedLanguage === undefined) {
throw new util.ConfigurationError(`Did not recognize the language '${languageInput}'.`);
@ -43,7 +43,7 @@ async function runResolveBuildEnvironment(cmd, logger, workingDir, languageInput
let result = {};
// If the CodeQL version in use does not support the `resolve build-environment`
// command, just return an empty configuration. Otherwise invoke the CLI.
if (!(await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_RESOLVE_ENVIRONMENT))) {
if (!(await util.codeQlVersionAtLeast(codeql, codeql_1.CODEQL_VERSION_RESOLVE_ENVIRONMENT))) {
logger.warning("Unsupported CodeQL CLI version for `resolve build-environment` command, " +
"returning an empty configuration.");
}

2
lib/resolve-environment.js.map
View file

@ -1 +1 @@
{"version":3,"file":"resolve-environment.js","sourceRoot":"","sources":["../src/resolve-environment.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qCAIkB;AAClB,2CAA4C;AAE5C,6CAA+B;AAExB,KAAK,UAAU,0BAA0B,CAC9C,GAAW,EACX,MAAc,EACd,UAA8B,EAC9B,aAAqB;IAErB,MAAM,CAAC,UAAU,CACf,+CAA+C,aAAa,EAAE,CAC/D,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,QAAQ,GAAG,aAAa,CAAC;IAC7B,6FAA6F;IAC7F,mFAAmF;IACnF,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,yCAAgC,CAAC,CAAC,EAC1E,CAAC;QACD,MAAM,cAAc,GAAG,IAAA,yBAAa,EAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC;QAChE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAC/B,mCAAmC,aAAa,IAAI,CACrD,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,cAAc,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,gFAAgF;IAChF,yEAAyE;IACzE,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,2CAAkC,CAAC,CAAC,EAC5E,CAAC;QACD,MAAM,CAAC,OAAO,CACZ,0EAA0E;YACxE,mCAAmC,CACtC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,UAAU,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AAhDD,gEAgDC"}
{"version":3,"file":"resolve-environment.js","sourceRoot":"","sources":["../src/resolve-environment.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qCAIkB;AAClB,2CAA4C;AAE5C,6CAA+B;AAExB,KAAK,UAAU,0BAA0B,CAC9C,GAAW,EACX,MAAc,EACd,UAA8B,EAC9B,aAAqB;IAErB,MAAM,CAAC,UAAU,CACf,+CAA+C,aAAa,EAAE,CAC/D,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,QAAQ,GAAG,aAAa,CAAC;IAC7B,6FAA6F;IAC7F,mFAAmF;IACnF,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,yCAAgC,CAAC,CAAC,EAC5E,CAAC;QACD,MAAM,cAAc,GAAG,IAAA,yBAAa,EAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC;QAChE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAC/B,mCAAmC,aAAa,IAAI,CACrD,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,cAAc,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,gFAAgF;IAChF,yEAAyE;IACzE,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAC/B,MAAM,EACN,2CAAkC,CACnC,CAAC,EACF,CAAC;QACD,MAAM,CAAC,OAAO,CACZ,0EAA0E;YACxE,mCAAmC,CACtC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,SAAS,UAAU,4BAA4B,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AAnDD,gEAmDC"}

6
lib/util.js generated
View file

@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.BuildMode = exports.checkActionVersion = exports.checkDiskUsage = exports.prettyPrintPack = exports.getErrorMessage = exports.wrapError = exports.fixInvalidNotificationsInFile = exports.fixInvalidNotifications = exports.parseMatrixInput = exports.isHostedRunner = exports.checkForTimeout = exports.withTimeout = exports.tryGetFolderBytes = exports.listFolder = exports.doesDirectoryExist = exports.isInTestMode = exports.isGoodVersion = exports.delay = exports.bundleDb = exports.codeQlVersionAbove = exports.getCachedCodeQlVersion = exports.cacheCodeQlVersion = exports.isHTTPError = exports.ConfigurationError = exports.HTTPError = exports.getRequiredEnvParam = exports.initializeEnvironment = exports.assertNever = exports.apiVersionInRange = exports.DisallowedAPIVersionReason = exports.checkGitHubVersionInRange = exports.GitHubVariant = exports.parseGitHubUrl = exports.getCodeQLDatabasePath = exports.getThreadsFlag = exports.getCgroupCpuCountFromCpus = exports.getThreadsFlagValue = exports.getAddSnippetsFlag = exports.getMemoryFlag = exports.getMemoryFlagValue = exports.getMemoryFlagValueForPlatform = exports.withTmpDir = exports.getToolNames = exports.getExtraOptionsEnvParam = exports.DEFAULT_DEBUG_DATABASE_NAME = exports.DEFAULT_DEBUG_ARTIFACT_NAME = exports.GITHUB_DOTCOM_URL = void 0;
exports.BuildMode = exports.checkActionVersion = exports.checkDiskUsage = exports.prettyPrintPack = exports.getErrorMessage = exports.wrapError = exports.fixInvalidNotificationsInFile = exports.fixInvalidNotifications = exports.parseMatrixInput = exports.isHostedRunner = exports.checkForTimeout = exports.withTimeout = exports.tryGetFolderBytes = exports.listFolder = exports.doesDirectoryExist = exports.isInTestMode = exports.isGoodVersion = exports.delay = exports.bundleDb = exports.codeQlVersionAtLeast = exports.getCachedCodeQlVersion = exports.cacheCodeQlVersion = exports.isHTTPError = exports.ConfigurationError = exports.HTTPError = exports.getRequiredEnvParam = exports.initializeEnvironment = exports.assertNever = exports.apiVersionInRange = exports.DisallowedAPIVersionReason = exports.checkGitHubVersionInRange = exports.GitHubVariant = exports.parseGitHubUrl = exports.getCodeQLDatabasePath = exports.getThreadsFlag = exports.getCgroupCpuCountFromCpus = exports.getThreadsFlagValue = exports.getAddSnippetsFlag = exports.getMemoryFlag = exports.getMemoryFlagValue = exports.getMemoryFlagValueForPlatform = exports.withTmpDir = exports.getToolNames = exports.getExtraOptionsEnvParam = exports.DEFAULT_DEBUG_DATABASE_NAME = exports.DEFAULT_DEBUG_ARTIFACT_NAME = exports.GITHUB_DOTCOM_URL = void 0;
const fs = __importStar(require("fs"));
const os = __importStar(require("os"));
const path = __importStar(require("path"));
@ -504,10 +504,10 @@ function getCachedCodeQlVersion() {
return cachedCodeQlVersion;
}
exports.getCachedCodeQlVersion = getCachedCodeQlVersion;
async function codeQlVersionAbove(codeql, requiredVersion) {
async function codeQlVersionAtLeast(codeql, requiredVersion) {
return semver.gte((await codeql.getVersion()).version, requiredVersion);
}
exports.codeQlVersionAbove = codeQlVersionAbove;
exports.codeQlVersionAtLeast = codeQlVersionAtLeast;
// Create a bundle for the given DB, if it doesn't already exist
async function bundleDb(config, language, codeql, dbName) {
const databasePath = getCodeQLDatabasePath(config, language);

2
lib/util.js.map
View file

File diff suppressed because one or more lines are too long

3
pr-checks/checks/go-custom-queries.yml
View file

@ -3,6 +3,9 @@ description: "Checks that Go works in conjunction with a config file specifying
env:
DOTNET_GENERATE_ASPNET_CERTIFICATE: "false"
steps:
- uses: actions/setup-go@v5
with:
go-version: ">=1.21.0"
- uses: ./../action/init
with:
languages: go

4
pr-checks/checks/multi-language-autodetect.yml
View file

@ -2,6 +2,10 @@ name: "Multi-language repository"
description: "An end-to-end integration test of a multi-language repository using automatic language detection"
operatingSystems: ["ubuntu", "macos"]
steps:
- uses: actions/setup-go@v5
with:
go-version: ">=1.21.0"
- uses: ./../action/init
id: init
with:

4
pr-checks/checks/scaling-reserved-ram.yml
View file

@ -4,6 +4,10 @@ operatingSystems: ["ubuntu", "macos"]
env:
CODEQL_ACTION_SCALING_RESERVED_RAM: true
steps:
- uses: actions/setup-go@v5
with:
go-version: ">=1.21.0"
- uses: ./../action/init
id: init
with:

10
pr-checks/sync.py
View file

@ -65,6 +65,14 @@ for file in (this_dir / 'checks').glob('*.yml'):
if image.startswith(operatingSystem)]
for runnerImage in runnerImages:
# Prior to CLI v2.15.1, ARM runners were not supported by the build tracer.
# "macos-latest" is now an ARM runner, so we run tests on the old CLIs on Intel runners instead.
if version in ["stable-20230403", "stable-v2.13.4", "stable-v2.13.5", "stable-v2.14.6"] and runnerImage == "macos-latest":
matrix.append({
'os': "macos-12",
'version': version
})
else:
matrix.append({
'os': runnerImage,
'version': version
@ -81,7 +89,7 @@ for file in (this_dir / 'checks').glob('*.yml'):
# Ensure that this is serialized as a folded (`>`) string to preserve the readability
# of the generated workflow.
'if': FoldedScalarString(textwrap.dedent('''
matrix.os == 'macos-latest' && (
runner.os == 'macOS' && (
matrix.version == 'stable-20230403' ||
matrix.version == 'stable-v2.13.5' ||
matrix.version == 'stable-v2.14.6')

2
src/analyze.ts
View file

@ -303,7 +303,7 @@ export async function runQueries(
}
if (
!(await util.codeQlVersionAbove(
!(await util.codeQlVersionAtLeast(
codeql,
CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
))

24
src/codeql.ts
View file

@ -597,7 +597,7 @@ export async function getCodeQLForCmd(
}
if (
await util.codeQlVersionAbove(
await util.codeQlVersionAtLeast(
this,
CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG,
)
@ -608,7 +608,7 @@ export async function getCodeQLForCmd(
if (await isSublanguageFileCoverageEnabled(config, this)) {
extraArgs.push("--sublanguage-file-coverage");
} else if (
await util.codeQlVersionAbove(
await util.codeQlVersionAtLeast(
this,
CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
)
@ -842,7 +842,7 @@ export async function getCodeQLForCmd(
}),
];
if (
await util.codeQlVersionAbove(
await util.codeQlVersionAtLeast(
this,
CODEQL_VERSION_FINE_GRAINED_PARALLELISM,
)
@ -897,7 +897,7 @@ export async function getCodeQLForCmd(
if (await isSublanguageFileCoverageEnabled(config, this)) {
codeqlArgs.push("--sublanguage-file-coverage");
} else if (
await util.codeQlVersionAbove(
await util.codeQlVersionAtLeast(
this,
CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
)
@ -910,7 +910,7 @@ export async function getCodeQLForCmd(
codeqlArgs.push("--no-sarif-include-diagnostics");
}
if (
(await util.codeQlVersionAbove(
(await util.codeQlVersionAtLeast(
this,
CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
)) &&
@ -1144,7 +1144,7 @@ export async function getCodeQLForCmd(
// CodeQL object is created.
if (
checkVersion &&
!(await util.codeQlVersionAbove(codeql, CODEQL_MINIMUM_VERSION))
!(await util.codeQlVersionAtLeast(codeql, CODEQL_MINIMUM_VERSION))
) {
throw new util.ConfigurationError(
`Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${
@ -1154,7 +1154,7 @@ export async function getCodeQLForCmd(
} else if (
checkVersion &&
process.env[EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
!(await util.codeQlVersionAbove(codeql, CODEQL_NEXT_MINIMUM_VERSION))
!(await util.codeQlVersionAtLeast(codeql, CODEQL_NEXT_MINIMUM_VERSION))
) {
const result = await codeql.getVersion();
core.warning(
@ -1403,14 +1403,16 @@ export function getGeneratedCodeScanningConfigPath(config: Config): string {
async function isDiagnosticsExportInvalidSarifFixed(
codeql: CodeQL,
): Promise<boolean> {
return await util.codeQlVersionAbove(
return await util.codeQlVersionAtLeast(
codeql,
CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED,
);
}
async function getLanguageAliasingArguments(codeql: CodeQL): Promise<string[]> {
if (await util.codeQlVersionAbove(codeql, CODEQL_VERSION_LANGUAGE_ALIASING)) {
if (
await util.codeQlVersionAtLeast(codeql, CODEQL_VERSION_LANGUAGE_ALIASING)
) {
return ["--extractor-include-aliases"];
}
return [];
@ -1424,7 +1426,7 @@ async function isSublanguageFileCoverageEnabled(
// Sub-language file coverage is first supported in GHES 3.12.
(config.gitHubVersion.type !== util.GitHubVariant.GHES ||
semver.gte(config.gitHubVersion.version, "3.12.0")) &&
(await util.codeQlVersionAbove(
(await util.codeQlVersionAtLeast(
codeql,
CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,
))
@ -1435,7 +1437,7 @@ async function getCodeScanningQueryHelpArguments(
codeql: CodeQL,
): Promise<string[]> {
if (
await util.codeQlVersionAbove(codeql, CODEQL_VERSION_INCLUDE_QUERY_HELP)
await util.codeQlVersionAtLeast(codeql, CODEQL_VERSION_INCLUDE_QUERY_HELP)
) {
return ["--sarif-include-query-help=always"];
}

4
src/config-utils.ts
View file

@ -13,7 +13,7 @@ import { Logger } from "./logging";
import { RepositoryNwo } from "./repository";
import { downloadTrapCaches } from "./trap-caching";
import {
codeQlVersionAbove,
codeQlVersionAtLeast,
GitHubVersion,
prettyPrintPack,
ConfigurationError,
@ -359,7 +359,7 @@ export async function getLanguages(
export async function getLanguageAliases(
codeql: CodeQL,
): Promise<{ [alias: string]: string } | undefined> {
if (await codeQlVersionAbove(codeql, CODEQL_VERSION_LANGUAGE_ALIASING)) {
if (await codeQlVersionAtLeast(codeql, CODEQL_VERSION_LANGUAGE_ALIASING)) {
return (await codeql.betterResolveLanguages()).aliases;
}
return undefined;

2
src/feature-flags.ts
View file

@ -200,7 +200,7 @@ export class Features implements FeatureEnablement {
// Never use this feature if the CLI version explicitly can't support it.
const minimumVersion = featureConfig[feature].minimumVersion;
if (codeql && minimumVersion) {
if (!(await util.codeQlVersionAbove(codeql, minimumVersion))) {
if (!(await util.codeQlVersionAtLeast(codeql, minimumVersion))) {
this.logger.debug(
`Feature ${feature} is disabled because the CodeQL CLI version is older than the minimum ` +
`version ${minimumVersion}.`,

37
src/init-action.ts
View file

@ -24,7 +24,13 @@ import {
} from "./diagnostics";
import { EnvVar } from "./environment";
import { Feature, Features } from "./feature-flags";
import { checkInstallPython311, initCodeQL, initConfig, runInit } from "./init";
import {
checkInstallPython311,
initCodeQL,
initConfig,
isSipEnabled,
runInit,
} from "./init";
import { Language } from "./languages";
import { getActionsLogger, Logger } from "./logging";
import { parseRepositoryNwo } from "./repository";
@ -42,7 +48,7 @@ import {
checkDiskUsage,
checkForTimeout,
checkGitHubVersionInRange,
codeQlVersionAbove,
codeQlVersionAtLeast,
DEFAULT_DEBUG_ARTIFACT_NAME,
DEFAULT_DEBUG_DATABASE_NAME,
getMemoryFlagValue,
@ -426,8 +432,8 @@ async function run() {
const kotlinLimitVar =
"CODEQL_EXTRACTOR_KOTLIN_OVERRIDE_MAXIMUM_VERSION_LIMIT";
if (
(await codeQlVersionAbove(codeql, "2.13.4")) &&
!(await codeQlVersionAbove(codeql, "2.14.4"))
(await codeQlVersionAtLeast(codeql, "2.13.4")) &&
!(await codeQlVersionAtLeast(codeql, "2.14.4"))
) {
core.exportVariable(kotlinLimitVar, "1.9.20");
}
@ -435,8 +441,8 @@ async function run() {
if (
config.languages.includes(Language.java) &&
// Java Lombok support is enabled by default for >= 2.14.4
(await codeQlVersionAbove(codeql, "2.14.0")) &&
!(await codeQlVersionAbove(codeql, "2.14.4"))
(await codeQlVersionAtLeast(codeql, "2.14.0")) &&
!(await codeQlVersionAtLeast(codeql, "2.14.4"))
) {
const envVar = "CODEQL_EXTRACTOR_JAVA_RUN_ANNOTATION_PROCESSORS";
if (process.env[envVar]) {
@ -467,19 +473,32 @@ async function run() {
}
}
// For CLI versions <2.15.1, build tracing caused errors in MacOS ARM machines with
// System Integrity Protection (SIP) disabled.
if (
!(await codeQlVersionAtLeast(codeql, "2.15.1")) &&
process.platform === "darwin" &&
(process.arch === "arm" || process.arch === "arm64") &&
!(await isSipEnabled(logger))
) {
logger.warning(
"CodeQL versions 2.15.0 and lower are not supported on MacOS ARM machines with System Integrity Protection (SIP) disabled.",
);
}
// From 2.16.0 the default for the python extractor is to not perform any
// dependency extraction. For versions before that, you needed to set this flag to
// enable this behavior (supported since 2.13.1).
if (await codeQlVersionAbove(codeql, "2.17.1")) {
if (await codeQlVersionAtLeast(codeql, "2.17.1")) {
// disabled by default, no warning
} else if (await codeQlVersionAbove(codeql, "2.16.0")) {
} else if (await codeQlVersionAtLeast(codeql, "2.16.0")) {
// disabled by default, prints warning if environment variable is not set
core.exportVariable(
"CODEQL_EXTRACTOR_PYTHON_DISABLE_LIBRARY_EXTRACTION",
"true",
);
} else if (await codeQlVersionAbove(codeql, "2.13.1")) {
} else if (await codeQlVersionAtLeast(codeql, "2.13.1")) {
core.exportVariable(
"CODEQL_EXTRACTOR_PYTHON_DISABLE_LIBRARY_EXTRACTION",
"true",

31
src/init.ts
View file

@ -1,6 +1,7 @@
import * as fs from "fs";
import * as path from "path";
import * as exec from "@actions/exec/lib/exec";
import * as toolrunner from "@actions/exec/lib/toolrunner";
import * as safeWhich from "@chrisgavin/safe-which";
@ -140,3 +141,33 @@ export async function checkInstallPython311(
]).exec();
}
}
// For MacOS runners: runs `csrutil status` to determine whether System
// Integrity Protection is enabled.
export async function isSipEnabled(logger): Promise<boolean | undefined> {
try {
const sipStatusOutput = await exec.getExecOutput("csrutil status");
if (sipStatusOutput.exitCode === 0) {
if (
sipStatusOutput.stdout.includes(
"System Integrity Protection status: enabled.",
)
) {
return true;
}
if (
sipStatusOutput.stdout.includes(
"System Integrity Protection status: disabled.",
)
) {
return false;
}
}
return undefined;
} catch (e) {
logger.warning(
`Failed to determine if System Integrity Protection was enabled: ${e}`,
);
return undefined;
}
}

7
src/resolve-environment.ts
View file

@ -23,7 +23,7 @@ export async function runResolveBuildEnvironment(
// If the CodeQL CLI version in use supports language aliasing, give the CLI the raw language
// input. Otherwise, parse the language input and give the CLI the parsed language.
if (
!(await util.codeQlVersionAbove(codeql, CODEQL_VERSION_LANGUAGE_ALIASING))
!(await util.codeQlVersionAtLeast(codeql, CODEQL_VERSION_LANGUAGE_ALIASING))
) {
const parsedLanguage = parseLanguage(languageInput)?.toString();
if (parsedLanguage === undefined) {
@ -39,7 +39,10 @@ export async function runResolveBuildEnvironment(
// If the CodeQL version in use does not support the `resolve build-environment`
// command, just return an empty configuration. Otherwise invoke the CLI.
if (
!(await util.codeQlVersionAbove(codeql, CODEQL_VERSION_RESOLVE_ENVIRONMENT))
!(await util.codeQlVersionAtLeast(
codeql,
CODEQL_VERSION_RESOLVE_ENVIRONMENT,
))
) {
logger.warning(
"Unsupported CodeQL CLI version for `resolve build-environment` command, " +

2
src/util.ts
View file

@ -682,7 +682,7 @@ export function getCachedCodeQlVersion(): undefined | VersionInfo {
return cachedCodeQlVersion;
}
export async function codeQlVersionAbove(
export async function codeQlVersionAtLeast(
codeql: CodeQL,
requiredVersion: string,
): Promise<boolean> {