robojerk/codeql-action

Autobuild: Remove CODEQL_RUNNER workaround

Browse source 
We do not need to prefix `$CODEQL_RUNNER` here on macOS to bypass SIP,
because we assume that the `init` step exported `DYLD_INSERT_LIBRARIES`
into the environment, which activates the Actions workaround for SIP.
See https://github.com/actions/runner/pull/416.
This commit is contained in:
Aditya Sharad 2022-07-25 14:31:52 -07:00
parent 58faf9d60c
commit b4ff463500
No known key found for this signature in database
GPG key ID: 66D1E528054C320C
3 changed files with 30 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

21
lib/codeql.js generated
View file

@ -510,13 +510,20 @@ async function getCodeQLForCmd(cmd, checkVersion) {
"-Dhttp.keepAlive=false", "-Dhttp.keepAlive=false",
"-Dmaven.wagon.http.pool=false", "-Dmaven.wagon.http.pool=false",
].join(" "); ].join(" ");
const runnerExe = process.env["CODEQL_RUNNER"]; // On macOS, System Integrity Protection (SIP) typically interferes with
if (runnerExe) { // CodeQL build tracing of protected binaries.
await runTool(runnerExe, [autobuildCmd]); // The usual workaround is to prefix `$CODEQL_RUNNER` to build commands:
} // `$CODEQL_RUNNER` (not to be confused with the deprecated CodeQL Runner tool)
else { // points to a simple wrapper binary included with the CLI, and the extra layer of
await runTool(autobuildCmd); // process indirection helps the tracer bypass SIP.
} // The above SIP workaround is *not* needed here.
// At the `autobuild` step in the Actions workflow, we assume the `init` step
// has successfully run, and will have exported `DYLD_INSERT_LIBRARIES`
// into the environment of subsequent steps, to activate the tracer.
// When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
// the Actions runtime introduces its own workaround for SIP
// (https://github.com/actions/runner/pull/416).
await runTool(autobuildCmd);
}, },
async extractScannedLanguage(databasePath, language, featureFlags) { async extractScannedLanguage(databasePath, language, featureFlags) {
// Get extractor location // Get extractor location

2
lib/codeql.js.map
View file

File diff suppressed because one or more lines are too long

21
src/codeql.ts
View file

@ -780,12 +780,21 @@ async function getCodeQLForCmd(
"-Dmaven.wagon.http.pool=false", "-Dmaven.wagon.http.pool=false",
].join(" "); ].join(" ");
const runnerExe = process.env["CODEQL_RUNNER"]; // On macOS, System Integrity Protection (SIP) typically interferes with
if (runnerExe) { // CodeQL build tracing of protected binaries.
await runTool(runnerExe, [autobuildCmd]); // The usual workaround is to prefix `$CODEQL_RUNNER` to build commands:
} else { // `$CODEQL_RUNNER` (not to be confused with the deprecated CodeQL Runner tool)
await runTool(autobuildCmd); // points to a simple wrapper binary included with the CLI, and the extra layer of
} // process indirection helps the tracer bypass SIP.
// The above SIP workaround is *not* needed here.
// At the `autobuild` step in the Actions workflow, we assume the `init` step
// has successfully run, and will have exported `DYLD_INSERT_LIBRARIES`
// into the environment of subsequent steps, to activate the tracer.
// When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,
// the Actions runtime introduces its own workaround for SIP
// (https://github.com/actions/runner/pull/416).
await runTool(autobuildCmd);
}, },
async extractScannedLanguage( async extractScannedLanguage(
databasePath: string, databasePath: string,