Merge branch 'main' into analysis_key_status

lib/config-utils.js

@@ -12,6 +12,7 @@ const io = __importStar(require("@actions/io"));
 const fs = __importStar(require("fs"));
 const yaml = __importStar(require("js-yaml"));
 const path = __importStar(require("path"));
+const api = __importStar(require("./api-client"));
 const util = __importStar(require("./util"));
 const NAME_PROPERTY = 'name';
 const DISPLAY_DEFAULT_QUERIES_PROPERTY = 'disable-default-queries';
@@ -146,10 +147,24 @@ function getConfigFileDoesNotExistErrorMessage(configFile) {
     return 'The configuration file "' + configFile + '" does not exist';
 }
 exports.getConfigFileDoesNotExistErrorMessage = getConfigFileDoesNotExistErrorMessage;
+function getConfigFileRepoFormatInvalidMessage(configFile) {
+    let error = 'The configuration file "' + configFile + '" is not a supported remote file reference.';
+    error += ' Expected format <owner>/<repository>/<file-path>@<ref>';
+    return error;
+}
+exports.getConfigFileRepoFormatInvalidMessage = getConfigFileRepoFormatInvalidMessage;
+function getConfigFileFormatInvalidMessage(configFile) {
+    return 'The configuration file "' + configFile + '" could not be read';
+}
+exports.getConfigFileFormatInvalidMessage = getConfigFileFormatInvalidMessage;
+function getConfigFileDirectoryGivenMessage(configFile) {
+    return 'The configuration file "' + configFile + '" looks like a directory, not a file';
+}
+exports.getConfigFileDirectoryGivenMessage = getConfigFileDirectoryGivenMessage;
 function getConfigFilePropertyError(configFile, property, error) {
     return 'The configuration file "' + configFile + '" is invalid: property "' + property + '" ' + error;
 }
-function initConfig() {
+async function initConfig() {
     let configFile = core.getInput('config-file');
     const config = new Config();
     // If no config file was provided create an empty one
@@ -157,18 +172,16 @@ function initConfig() {
         core.debug('No configuration file was provided');
         return config;
     }
-    // Treat the config file as relative to the workspace
-    const workspacePath = util.getRequiredEnvParam('GITHUB_WORKSPACE');
-    configFile = path.resolve(workspacePath, configFile);
-    // Error if the config file is now outside of the workspace
-    if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
-        throw new Error(getConfigFileOutsideWorkspaceErrorMessage(configFile));
+    let parsedYAML;
+    if (isLocal(configFile)) {
+        // Treat the config file as relative to the workspace
+        const workspacePath = util.getRequiredEnvParam('GITHUB_WORKSPACE');
+        configFile = path.resolve(workspacePath, configFile);
+        parsedYAML = getLocalConfig(configFile, workspacePath);
     }
-    // Error if the file does not exist
-    if (!fs.existsSync(configFile)) {
-        throw new Error(getConfigFileDoesNotExistErrorMessage(configFile));
+    else {
+        parsedYAML = await getRemoteConfig(configFile);
     }
-    const parsedYAML = yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
     if (NAME_PROPERTY in parsedYAML) {
         if (typeof parsedYAML[NAME_PROPERTY] !== "string") {
             throw new Error(getNameInvalid(configFile));
@@ -219,6 +232,50 @@ function initConfig() {
     }
     return config;
 }
+function isLocal(configPath) {
+    // If the path starts with ./, look locally
+    if (configPath.indexOf("./") === 0) {
+        return true;
+    }
+    return (configPath.indexOf("@") === -1);
+}
+function getLocalConfig(configFile, workspacePath) {
+    // Error if the config file is now outside of the workspace
+    if (!(configFile + path.sep).startsWith(workspacePath + path.sep)) {
+        throw new Error(getConfigFileOutsideWorkspaceErrorMessage(configFile));
+    }
+    // Error if the file does not exist
+    if (!fs.existsSync(configFile)) {
+        throw new Error(getConfigFileDoesNotExistErrorMessage(configFile));
+    }
+    return yaml.safeLoad(fs.readFileSync(configFile, 'utf8'));
+}
+async function getRemoteConfig(configFile) {
+    // retrieve the various parts of the config location, and ensure they're present
+    const format = new RegExp('(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)');
+    const pieces = format.exec(configFile);
+    // 5 = 4 groups + the whole expression
+    if (pieces === null || pieces.groups === undefined || pieces.length < 5) {
+        throw new Error(getConfigFileRepoFormatInvalidMessage(configFile));
+    }
+    const response = await api.client.repos.getContents({
+        owner: pieces.groups.owner,
+        repo: pieces.groups.repo,
+        path: pieces.groups.path,
+        ref: pieces.groups.ref,
+    });
+    let fileContents;
+    if ("content" in response.data && response.data.content !== undefined) {
+        fileContents = response.data.content;
+    }
+    else if (Array.isArray(response.data)) {
+        throw new Error(getConfigFileDirectoryGivenMessage(configFile));
+    }
+    else {
+        throw new Error(getConfigFileFormatInvalidMessage(configFile));
+    }
+    return yaml.safeLoad(Buffer.from(fileContents, 'base64').toString('binary'));
+}
 function getConfigFolder() {
     return util.getRequiredEnvParam('RUNNER_TEMP');
 }
@@ -242,7 +299,7 @@ async function loadConfig() {
         return JSON.parse(configString);
     }
     else {
-        const config = initConfig();
+        const config = await initConfig();
         core.debug('Initialized config:');
         core.debug(JSON.stringify(config));
         await saveConfig(config);

lib/config-utils.test.js

@@ -1,7 +1,4 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 var __importStar = (this && this.__importStar) || function (mod) {
     if (mod && mod.__esModule) return mod;
     var result = {};
@@ -9,10 +6,16 @@ var __importStar = (this && this.__importStar) || function (mod) {
     result["default"] = mod;
     return result;
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+const octokit = __importStar(require("@octokit/rest"));
 const ava_1 = __importDefault(require("ava"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const api = __importStar(require("./api-client"));
 const configUtils = __importStar(require("./config-utils"));
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
@@ -65,6 +68,21 @@ ava_1.default("load input outside of workspace", async (t) => {
         }
     });
 });
+ava_1.default("load non-local input with invalid repo syntax", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env['RUNNER_TEMP'] = tmpDir;
+        process.env['GITHUB_WORKSPACE'] = tmpDir;
+        // no filename given, just a repo
+        setInput('config-file', 'octo-org/codeql-config@main');
+        try {
+            await configUtils.loadConfig();
+            throw new Error('loadConfig did not throw error');
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileRepoFormatInvalidMessage('octo-org/codeql-config@main')));
+        }
+    });
+});
 ava_1.default("load non-existent input", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         process.env['RUNNER_TEMP'] = tmpDir;
@@ -114,6 +132,92 @@ ava_1.default("load non-empty input", async (t) => {
         t.deepEqual(actualConfig, expectedConfig);
     });
 });
+ava_1.default("API client used when reading remote config", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env['RUNNER_TEMP'] = tmpDir;
+        process.env['GITHUB_WORKSPACE'] = tmpDir;
+        const inputFileContents = `
+      name: my config
+      disable-default-queries: true
+      queries:
+        - uses: ./
+      paths-ignore:
+        - a
+        - b
+      paths:
+        - c/d`;
+        const dummyResponse = {
+            data: {
+                content: Buffer.from(inputFileContents).toString("base64"),
+            }
+        };
+        let ok = new octokit.Octokit({
+            userAgent: "CodeQL Action",
+        });
+        const repos = ok.repos;
+        const spyGetContents = sinon_1.default.stub(repos, "getContents").resolves(Promise.resolve(dummyResponse));
+        ok.repos = repos;
+        sinon_1.default.stub(api, "client").value(ok);
+        setInput('config-file', 'octo-org/codeql-config/config.yaml@main');
+        await configUtils.loadConfig();
+        t.assert(spyGetContents.called);
+        sinon_1.default.restore();
+    });
+});
+ava_1.default("Remote config handles the case where a directory is provided", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env['RUNNER_TEMP'] = tmpDir;
+        process.env['GITHUB_WORKSPACE'] = tmpDir;
+        const dummyResponse = {
+            data: [],
+        };
+        let ok = new octokit.Octokit({
+            userAgent: "CodeQL Action",
+        });
+        const repos = ok.repos;
+        sinon_1.default.stub(repos, "getContents").resolves(Promise.resolve(dummyResponse));
+        ok.repos = repos;
+        sinon_1.default.stub(api, "client").value(ok);
+        const repoReference = 'octo-org/codeql-config/config.yaml@main';
+        setInput('config-file', repoReference);
+        try {
+            await configUtils.loadConfig();
+            throw new Error('loadConfig did not throw error');
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileDirectoryGivenMessage(repoReference)));
+        }
+        sinon_1.default.restore();
+    });
+});
+ava_1.default("Invalid format of remote config handled correctly", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env['RUNNER_TEMP'] = tmpDir;
+        process.env['GITHUB_WORKSPACE'] = tmpDir;
+        const dummyResponse = {
+            data: {
+            // note no "content" property here
+            }
+        };
+        let ok = new octokit.Octokit({
+            userAgent: "CodeQL Action",
+        });
+        const repos = ok.repos;
+        sinon_1.default.stub(repos, "getContents").resolves(Promise.resolve(dummyResponse));
+        ok.repos = repos;
+        sinon_1.default.stub(api, "client").value(ok);
+        const repoReference = 'octo-org/codeql-config/config.yaml@main';
+        setInput('config-file', repoReference);
+        try {
+            await configUtils.loadConfig();
+            throw new Error('loadConfig did not throw error');
+        }
+        catch (err) {
+            t.deepEqual(err, new Error(configUtils.getConfigFileFormatInvalidMessage(repoReference)));
+        }
+        sinon_1.default.restore();
+    });
+});
 function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGenerator) {
     ava_1.default("load invalid input - " + testName, async (t) => {
         return await util.withTmpDir(async (tmpDir) => {