Drive-by linting fix

Previously we were implicitly converting `any` type to `string`; this does so explicitly.

.github/actions/setup-swift/action.yml

@@ -1,42 +1,32 @@
 name: "Set up Swift"
-description: Sets up an appropriate Swift version if supported on this platform.
+description: Performs necessary steps to set up appropriate Swift version.
 inputs:
   codeql-path:
-    description: Path to the CodeQL CLI executable.
     required: true
 runs:
   using: "composite"
   steps:
     - name: Get Swift version
       id: get_swift_version
-      if: runner.os != 'Windows'
+      # We don't support Swift on Windows or prior versions of CLI.
+      if: "(runner.os != 'Windows') && (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
       shell: bash
       env: 
-        CODEQL_PATH: ${{ inputs.codeql-path }}
+        CODEQL_PATH: ${{inputs.codeql-path}}
       run: |
-        if [[ $RUNNER_OS = "macOS" ]]; then
+        if [ $RUNNER_OS = "macOS" ]; then
           PLATFORM="osx64"
         else # We do not run this step on Windows.
           PLATFORM="linux64"
         fi 
         SWIFT_EXTRACTOR_DIR="$("$CODEQL_PATH" resolve languages --format json | jq -r '.swift[0]')"
-        if [ $SWIFT_EXTRACTOR_DIR = "null" ]; then
-          VERSION="null"
-        else
-          VERSION="$("$SWIFT_EXTRACTOR_DIR/tools/$PLATFORM/extractor" --version | awk '/version/ { print $3 }')"
-          # Specify 5.x.0, otherwise setup Action will default to latest minor version. 
-          if [ $VERSION = "5.7" ]; then
-            VERSION="5.7.0"
-          elif [ $VERSION = "5.8" ]; then
-            VERSION="5.8.0"
-          # setup-swift does not yet support v5.8.1 Remove this when it does.
-          elif [ $VERSION = "5.8.1" ]; then
-            VERSION="5.8.0"
-          fi 
+        VERSION="$("$SWIFT_EXTRACTOR_DIR/tools/$PLATFORM/extractor" --version | awk '/version/ { print $3 }')"
+        # Specify 5.7.0, otherwise setup Action will default to latest minor version. 
+        if [ $VERSION = "5.7" ]; then
+          VERSION="5.7.0"
         fi
         echo "version=$VERSION" | tee -a $GITHUB_OUTPUT
-
-    - uses: swift-actions/setup-swift@65540b95f51493d65f5e59e97dcef9629ddf11bf # Please update the corresponding SHA in the CLI's CodeQL Action Integration Test.
-      if: runner.os != 'Windows' && steps.get_swift_version.outputs.version != 'null'
+    - uses: swift-actions/setup-swift@da0e3e04b5e3e15dbc3861bd835ad9f0afe56296 # Please update the corresponding SHA in the CLI's CodeQL Action Integration Test.
+      if: "(runner.os != 'Windows') && (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version == 'nightly-latest')"
       with:
-        swift-version: "${{ steps.get_swift_version.outputs.version }}"
+        swift-version: "${{steps.get_swift_version.outputs.version}}"

.github/actions/update-bundle/index.ts

@@ -13,55 +13,57 @@ interface Defaults {
   priorCliVersion: string;
 }
 
+const CODEQL_BUNDLE_PREFIX = 'codeql-bundle-';
+
 function getCodeQLCliVersionForRelease(release): string {
   // We do not currently tag CodeQL bundles based on the CLI version they contain.
   // Instead, we use a marker file `cli-version-<version>.txt` to record the CLI version.
   // This marker file is uploaded as a release asset for all new CodeQL bundles.
   const cliVersionsFromMarkerFiles = release.assets
-    .map((asset) => asset.name.match(/cli-version-(.*)\.txt/)?.[1])
-    .filter((v) => v)
-    .map((v) => v as string);
+  .map((asset) => asset.name.match(/cli-version-(.*)\.txt/)?.[1])
+  .filter((v) => v)
+  .map((v) => v as string);
   if (cliVersionsFromMarkerFiles.length > 1) {
     throw new Error(
       `Release ${release.tag_name} has multiple CLI version marker files.`
-    );
-  } else if (cliVersionsFromMarkerFiles.length === 0) {
-    throw new Error(
-      `Failed to find the CodeQL CLI version for release ${release.tag_name}.`
-    );
-  }
-  return cliVersionsFromMarkerFiles[0];
-}
+      );
+    } else if (cliVersionsFromMarkerFiles.length === 0) {
+      throw new Error(
+        `Failed to find the CodeQL CLI version for release ${release.tag_name}.`
+        );
+      }
+      return cliVersionsFromMarkerFiles[0];
+    }
 
-async function getBundleInfoFromRelease(release): Promise<BundleInfo> {
-  return {
-    bundleVersion: release.tag_name,
-    cliVersion: getCodeQLCliVersionForRelease(release)
-  };
-}
+    async function getBundleInfoFromRelease(release): Promise<BundleInfo> {
+      return {
+        bundleVersion: release.tag_name.substring(CODEQL_BUNDLE_PREFIX.length),
+        cliVersion: getCodeQLCliVersionForRelease(release)
+      };
+    }
 
-async function getNewDefaults(currentDefaults: Defaults): Promise<Defaults> {
-  const release = github.context.payload.release;
-  console.log('Updating default bundle as a result of the following release: ' +
-    `${JSON.stringify(release)}.`)
+    async function getNewDefaults(currentDefaults: Defaults): Promise<Defaults> {
+      const release = github.context.payload.release;
+      console.log('Updating default bundle as a result of the following release: ' +
+      `${JSON.stringify(release)}.`)
 
-  const bundleInfo = await getBundleInfoFromRelease(release);
-  return {
-    bundleVersion: bundleInfo.bundleVersion,
-    cliVersion: bundleInfo.cliVersion,
-    priorBundleVersion: currentDefaults.bundleVersion,
-    priorCliVersion: currentDefaults.cliVersion
-  };
-}
+      const bundleInfo = await getBundleInfoFromRelease(release);
+      return {
+        bundleVersion: bundleInfo.bundleVersion,
+        cliVersion: bundleInfo.cliVersion,
+        priorBundleVersion: currentDefaults.bundleVersion,
+        priorCliVersion: currentDefaults.cliVersion
+      };
+    }
 
-async function main() {
-  const previousDefaults: Defaults = JSON.parse(fs.readFileSync('../../../src/defaults.json', 'utf8'));
-  const newDefaults = await getNewDefaults(previousDefaults);
-  // Update the source file in the repository. Calling workflows should subsequently rebuild
-  // the Action to update `lib/defaults.json`.
-  fs.writeFileSync('../../../src/defaults.json', JSON.stringify(newDefaults, null, 2) + "\n");
-}
+    async function main() {
+      const previousDefaults: Defaults = JSON.parse(fs.readFileSync('../../../src/defaults.json', 'utf8'));
+      const newDefaults = await getNewDefaults(previousDefaults);
+      // Update the source file in the repository. Calling workflows should subsequently rebuild
+      // the Action to update `lib/defaults.json`.
+      fs.writeFileSync('../../../src/defaults.json', JSON.stringify(newDefaults, null, 2) + "\n");
+    }
 
-// Ideally, we'd await main() here, but that doesn't work well with `ts-node`.
-// So instead we rely on the fact that Node won't exit until the event loop is empty.
-main();
+    // Ideally, we'd await main() here, but that doesn't work well with `ts-node`.
+    // So instead we rely on the fact that Node won't exit until the event loop is empty.
+    main();

.github/workflows/__analyze-ref-input.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: "PR Check - Analyze: 'ref' and 'sha' from inputs"
@@ -25,30 +25,24 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: windows-2019
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
+        - os: windows-2019
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: windows-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: windows-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
-        - os: windows-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -68,9 +62,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: "Analyze: 'ref' and 'sha' from inputs"
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -81,14 +72,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__autobuild-action.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - autobuild-action
@@ -32,9 +32,6 @@ jobs:
         - os: windows-latest
           version: latest
     name: autobuild-action
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -45,14 +42,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: csharp

.github/workflows/__config-export.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Config export
@@ -38,9 +38,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: Config export
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -51,14 +48,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: javascript

.github/workflows/__diagnostics-export.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Diagnostic export
@@ -44,9 +44,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: Diagnostic export
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -57,14 +54,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       id: init
       with:

.github/workflows/__export-file-baseline-information.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Export file baseline information
@@ -32,9 +32,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: Export file baseline information
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -45,14 +42,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       id: init
       with:
@@ -81,10 +70,7 @@ jobs:
       shell: bash
       run: |
         cd "$RUNNER_TEMP/results"
-        expected_baseline_languages="cpp cs go java js py rb"
-        if [[ $RUNNER_OS != "Windows" ]]; then
-          expected_baseline_languages+=" swift"
-        fi
+        expected_baseline_languages="cpp cs go java js py rb swift"
 
         for lang in ${expected_baseline_languages}; do
           rule_name="${lang}/baseline/expected-extracted-files"
@@ -98,4 +84,5 @@ jobs:
           fi
         done
     env:
+      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: true # Remove when Swift is GA.
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__extractor-ram-threads.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Extractor ram and threads options test
@@ -28,9 +28,6 @@ jobs:
         - os: ubuntu-latest
           version: latest
     name: Extractor ram and threads options test
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -41,14 +38,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: java

.github/workflows/__go-custom-queries.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Go: Custom queries'
@@ -25,30 +25,24 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: windows-2019
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
+        - os: windows-2019
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: windows-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: windows-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
-        - os: windows-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -68,9 +62,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: 'Go: Custom queries'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -81,14 +72,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__go-tracing-autobuilder.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Go: tracing with autobuilder step'
@@ -25,22 +25,18 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -54,9 +50,6 @@ jobs:
         - os: macos-latest
           version: nightly-latest
     name: 'Go: tracing with autobuilder step'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -67,14 +60,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Go: tracing with custom build steps'
@@ -25,22 +25,18 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -54,9 +50,6 @@ jobs:
         - os: macos-latest
           version: nightly-latest
     name: 'Go: tracing with custom build steps'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -67,14 +60,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Go: tracing with legacy workflow'
@@ -25,22 +25,18 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -54,9 +50,6 @@ jobs:
         - os: macos-latest
           version: nightly-latest
     name: 'Go: tracing with legacy workflow'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -67,14 +60,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: go

.github/workflows/__init-with-registries.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Download using registries'
@@ -44,10 +44,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: 'Packaging: Download using registries'
-    permissions:
-      contents: read
-      packages: read
-
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -58,14 +54,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Init with registries
       uses: ./../action/init
       with:
@@ -129,5 +117,9 @@ jobs:
             cat $QLCONFIG_PATH
             exit 1
         fi
+    permissions:
+      contents: read
+      packages: read
+
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__javascript-source-root.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Custom source root
@@ -32,9 +32,6 @@ jobs:
         - os: ubuntu-latest
           version: nightly-latest
     name: Custom source root
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -45,14 +42,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Move codeql-action
       shell: bash
       run: |

.github/workflows/__ml-powered-queries.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - ML-powered queries
@@ -25,30 +25,12 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
+        - os: ubuntu-20.04
+          version: stable-20220120
         - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: windows-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: windows-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
-        - os: windows-latest
-          version: stable-20221211
+          version: stable-20220120
+        - os: windows-2019
+          version: stable-20220120
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -68,9 +50,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: ML-powered queries
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -81,14 +60,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         languages: javascript
@@ -111,17 +87,16 @@ jobs:
     - name: Check sarif
       uses: ./../action/.github/actions/check-sarif
     # Running on Windows requires CodeQL CLI 2.9.0+.
-      if: "!(matrix.version == 'stable-20220401' && runner.os == 'Windows')"
+      if: "!(matrix.version == 'stable-20220120' && runner.os == 'Windows')"
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
-        queries-run: 
-          js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
+        queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
         queries-not-run: foo,bar
 
     - name: Check results
       env:
       # Running on Windows requires CodeQL CLI 2.9.0+.
-        SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220401' &&
+        SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220120' &&
           runner.os == 'Windows') }}
       shell: bash
       run: |

.github/workflows/__multi-language-autodetect.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Multi-language repository
@@ -25,22 +25,18 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -54,9 +50,6 @@ jobs:
         - os: macos-latest
           version: nightly-latest
     name: Multi-language repository
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -67,14 +60,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       id: init
       with:
@@ -83,7 +73,7 @@ jobs:
 
     - uses: ./../action/.github/actions/setup-swift
       with:
-        codeql-path: ${{ steps.init.outputs.codeql-path }}
+        codeql-path: ${{steps.init.outputs.codeql-path}}
 
     - name: Build code
       shell: bash
@@ -94,7 +84,7 @@ jobs:
       with:
         upload-database: false
 
-    - name: Check language autodetect for all languages excluding Swift
+    - name: Check language autodetect for all languages excluding Ruby, Swift
       shell: bash
       run: |
         CPP_DB=${{ fromJson(steps.analysis.outputs.db-locations).cpp }}
@@ -127,6 +117,12 @@ jobs:
           echo "Did not create a database for Python, or created it in the wrong location."
           exit 1
         fi
+
+    - name: Check language autodetect for Ruby
+      if: (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version
+        == 'nightly-latest')
+      shell: bash
+      run: |
         RUBY_DB=${{ fromJson(steps.analysis.outputs.db-locations).ruby }}
         if [[ ! -d $RUBY_DB ]] || [[ ! $RUBY_DB == ${{ runner.temp }}/customDbLocation/* ]]; then
           echo "Did not create a database for Ruby, or created it in the wrong location."
@@ -134,9 +130,8 @@ jobs:
         fi
 
     - name: Check language autodetect for Swift
-      if: >-
-        env.CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT == 'true' || 
-            (runner.os != 'Windows' && matrix.version == 'nightly-latest')
+      if: (matrix.version == 'cached' || matrix.version == 'latest' || matrix.version
+        == 'nightly-latest')
       shell: bash
       run: |
         SWIFT_DB=${{ fromJson(steps.analysis.outputs.db-locations).swift }}
@@ -145,4 +140,5 @@ jobs:
           exit 1
         fi
     env:
+      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Config and input passed to the CLI'
@@ -44,9 +44,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: 'Packaging: Config and input passed to the CLI'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -57,14 +54,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging3.yml
@@ -83,8 +72,7 @@ jobs:
       uses: ./../action/.github/actions/check-sarif
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
-        queries-run: 
-          javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
+        queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
         queries-not-run: foo,bar
 
     - name: Assert Results

.github/workflows/__packaging-config-inputs-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Config and input'
@@ -44,9 +44,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: 'Packaging: Config and input'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -57,14 +54,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging3.yml
@@ -83,8 +72,7 @@ jobs:
       uses: ./../action/.github/actions/check-sarif
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
-        queries-run: 
-          javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
+        queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
         queries-not-run: foo,bar
 
     - name: Assert Results

.github/workflows/__packaging-config-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Config file'
@@ -44,9 +44,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: 'Packaging: Config file'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -57,14 +54,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging.yml
@@ -82,8 +71,7 @@ jobs:
       uses: ./../action/.github/actions/check-sarif
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
-        queries-run: 
-          javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
+        queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
         queries-not-run: foo,bar
 
     - name: Assert Results

.github/workflows/__packaging-inputs-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Action input'
@@ -44,9 +44,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: 'Packaging: Action input'
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -57,14 +54,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging2.yml
@@ -82,8 +71,7 @@ jobs:
       uses: ./../action/.github/actions/check-sarif
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
-        queries-run: 
-          javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
+        queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
         queries-not-run: foo,bar
 
     - name: Assert Results

.github/workflows/__remote-config.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Remote config file
@@ -25,30 +25,24 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: windows-2019
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
+        - os: windows-2019
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: windows-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: windows-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
-        - os: windows-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -68,9 +62,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: Remote config file
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -81,14 +72,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__resolve-environment-action.yml

@@ -1,70 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
-# to regenerate this file.
-
-name: PR Check - Resolve environment
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
-on:
-  push:
-    branches:
-    - main
-    - releases/v2
-  pull_request:
-    types:
-    - opened
-    - synchronize
-    - reopened
-    - ready_for_review
-  workflow_dispatch: {}
-jobs:
-  resolve-environment-action:
-    strategy:
-      matrix:
-        include:
-        - os: ubuntu-latest
-          version: stable-v2.13.4
-        - os: macos-latest
-          version: stable-v2.13.4
-        - os: windows-latest
-          version: stable-v2.13.4
-    name: Resolve environment
-    permissions:
-      contents: read
-      security-events: write
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v3
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/actions/prepare-test
-      with:
-        version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
-    - uses: ./../action/init
-      with:
-        languages: go
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-
-    - uses: ./../action/resolve-environment
-      id: resolve-environment
-      with:
-        language: go
-
-    - name: Fail if no Go configuration was returned
-      if: (!fromJSON(steps.resolve-environment.outputs.environment).configuration.go)
-      run: exit 1
-    env:
-      CODEQL_ACTION_TEST_MODE: true

.github/workflows/__rubocop-multi-language.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - RuboCop multi-language
@@ -28,9 +28,6 @@ jobs:
         - os: ubuntu-latest
           version: cached
     name: RuboCop multi-language
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -41,14 +38,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:

.github/workflows/__ruby.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Ruby analysis
@@ -38,9 +38,6 @@ jobs:
         - os: macos-latest
           version: nightly-latest
     name: Ruby analysis
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -51,14 +48,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: ruby

.github/workflows/__split-workflow.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Split workflow
@@ -38,9 +38,6 @@ jobs:
         - os: macos-latest
           version: nightly-latest
     name: Split workflow
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -51,14 +48,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         config-file: .github/codeql/codeql-config-packaging3.yml

.github/workflows/__submit-sarif-failure.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Submit SARIF after failure
@@ -32,9 +32,6 @@ jobs:
         - os: ubuntu-latest
           version: nightly-latest
     name: Submit SARIF after failure
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -45,14 +42,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: actions/checkout@v3
     - uses: ./init
       with:

.github/workflows/__swift-custom-build.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Swift analysis using a custom build command
@@ -38,9 +38,6 @@ jobs:
         - os: macos-latest
           version: nightly-latest
     name: Swift analysis using a custom build command
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -51,14 +48,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       id: init
       with:
@@ -86,5 +75,6 @@ jobs:
           exit 1
         fi
     env:
+      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
       DOTNET_GENERATE_ASPNET_CERTIFICATE: 'false'
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__test-autobuild-working-dir.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Autobuild working directory
@@ -28,9 +28,6 @@ jobs:
         - os: ubuntu-latest
           version: latest
     name: Autobuild working directory
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -41,14 +38,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Test setup
       shell: bash
       run: |

.github/workflows/__test-local-codeql.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Local CodeQL bundle
@@ -28,9 +28,6 @@ jobs:
         - os: ubuntu-latest
           version: nightly-latest
     name: Local CodeQL bundle
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -41,27 +38,15 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - name: Fetch a CodeQL bundle
       shell: bash
       env:
         CODEQL_URL: ${{ steps.prepare-test.outputs.tools-url }}
       run: |
         wget "$CODEQL_URL"
-    - id: init
-      uses: ./../action/init
+    - uses: ./../action/init
       with:
         tools: ./codeql-bundle.tar.gz
-    - uses: ./../action/.github/actions/setup-swift
-      with:
-        codeql-path: ${{ steps.init.outputs.codeql-path }}
     - name: Build code
       shell: bash
       run: ./build.sh

.github/workflows/__test-proxy.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Proxy test
@@ -28,9 +28,6 @@ jobs:
         - os: ubuntu-latest
           version: latest
     name: Proxy test
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -41,14 +38,6 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
     - uses: ./../action/init
       with:
         languages: javascript

.github/workflows/__unset-environment.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Test unsetting environment variables
@@ -25,14 +25,12 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: ubuntu-latest
@@ -40,9 +38,6 @@ jobs:
         - os: ubuntu-latest
           version: nightly-latest
     name: Test unsetting environment variables
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -53,22 +48,15 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
-      id: init
       with:
         db-location: ${{ runner.temp }}/customDbLocation
         tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - uses: ./../action/.github/actions/setup-swift
-      with:
-        codeql-path: ${{ steps.init.outputs.codeql-path }}
     - name: Build code
       shell: bash
     # Disable Kotlin analysis while it's incompatible with Kotlin 1.8, until we find a

.github/workflows/__upload-ref-sha-input.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: "PR Check - Upload-sarif: 'ref' and 'sha' from inputs"
@@ -25,30 +25,24 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: windows-2019
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
+        - os: windows-2019
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: windows-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: windows-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
-        - os: windows-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -68,9 +62,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: "Upload-sarif: 'ref' and 'sha' from inputs"
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -81,14 +72,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: ./../action/init
       with:
         tools: ${{ steps.prepare-test.outputs.tools-url }}

.github/workflows/__with-checkout-path.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     pip install ruamel.yaml && python3 sync.py
 # to regenerate this file.
 
 name: PR Check - Use a custom `checkout_path`
@@ -25,30 +25,24 @@ jobs:
     strategy:
       matrix:
         include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: windows-2019
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
+        - os: windows-2019
+          version: stable-20220120
         - os: ubuntu-latest
           version: stable-20220401
         - os: macos-latest
           version: stable-20220401
         - os: windows-latest
           version: stable-20220401
-        - os: ubuntu-latest
-          version: stable-20220615
-        - os: macos-latest
-          version: stable-20220615
-        - os: windows-latest
-          version: stable-20220615
-        - os: ubuntu-latest
-          version: stable-20220908
-        - os: macos-latest
-          version: stable-20220908
-        - os: windows-latest
-          version: stable-20220908
-        - os: ubuntu-latest
-          version: stable-20221211
-        - os: macos-latest
-          version: stable-20221211
-        - os: windows-latest
-          version: stable-20221211
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -68,9 +62,6 @@ jobs:
         - os: windows-latest
           version: nightly-latest
     name: Use a custom `checkout_path`
-    permissions:
-      contents: read
-      security-events: write
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
     steps:
@@ -81,14 +72,11 @@ jobs:
       uses: ./.github/actions/prepare-test
       with:
         version: ${{ matrix.version }}
-    - name: Set environment variable for Swift enablement
-      if: >-
-        runner.os != 'Windows' && (
-            matrix.version == '20220908' ||
-            matrix.version == '20221211'
-        )
-      shell: bash
-      run: echo "CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT=true" >> $GITHUB_ENV
+    - name: Set up Go
+      if: matrix.os == 'ubuntu-20.04' || matrix.os == 'windows-2019'
+      uses: actions/setup-go@v4
+      with:
+        go-version: ^1.13.1
     - uses: actions/checkout@v3
       with:
         ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6

.github/workflows/debug-artifacts.yml

@@ -21,17 +21,31 @@ jobs:
   upload-artifacts:
     strategy:
       matrix:
-        os:
-        - ubuntu-latest
-        - macos-latest
-        version:
-        - stable-20220401
-        - stable-20220615
-        - stable-20220908
-        - stable-20221211
-        - cached
-        - latest
-        - nightly-latest
+        include:
+        - os: ubuntu-20.04
+          version: stable-20211005
+        - os: macos-latest
+          version: stable-20211005
+        - os: ubuntu-20.04
+          version: stable-20220120
+        - os: macos-latest
+          version: stable-20220120
+        - os: ubuntu-latest
+          version: stable-20220401
+        - os: macos-latest
+          version: stable-20220401
+        - os: ubuntu-latest
+          version: cached
+        - os: macos-latest
+          version: cached
+        - os: ubuntu-latest
+          version: latest
+        - os: macos-latest
+          version: latest
+        - os: ubuntu-latest
+          version: nightly-latest
+        - os: macos-latest
+          version: nightly-latest
     name: Upload debug artifacts
     env:
       CODEQL_ACTION_TEST_MODE: true
@@ -49,15 +63,11 @@ jobs:
         with:
           go-version: ^1.13.1
       - uses: ./../action/init
-        id: init
         with:
           tools: ${{ steps.prepare-test.outputs.tools-url }}
           debug: true
           debug-artifact-name: my-debug-artifacts
           debug-database-name: my-db
-      - uses: ./../action/.github/actions/setup-swift
-        with:
-          codeql-path: ${{ steps.init.outputs.codeql-path }}
       - name: Build code
         shell: bash
         run: ./build.sh
@@ -74,10 +84,17 @@ jobs:
       - name: Check expected artifacts exist
         shell: bash
         run: |
-          VERSIONS="stable-20220401 stable-20220615 stable-20220908 stable-20221211 cached latest nightly-latest"
+          VERSIONS="stable-20211005 stable-20220120 stable-20220401 cached latest nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
-            for os in ubuntu-latest macos-latest; do
+            if [[ "$version" =~ stable-(20211005|20220120|20210809) ]]; then
+              # Note the absence of the period in "ubuntu-2004": this is present in the image name
+              # but not the artifact name
+              OPERATING_SYSTEMS="ubuntu-2004 macos-latest"
+            else
+              OPERATING_SYSTEMS="ubuntu-latest macos-latest"
+            fi
+            for os in $OPERATING_SYSTEMS; do
               pushd "./my-debug-artifacts-$os-$version"
               echo "Artifacts from version $version on $os:"
               for language in $LANGUAGES; do

.github/workflows/post-release-mergeback.yml

@@ -40,7 +40,7 @@ jobs:
 
       - name: Update git config
         run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.email "github-actions@github.com"
           git config --global user.name "github-actions[bot]"
 
       - name: Get version and new branch

.github/workflows/python-deps.yml

@@ -72,7 +72,7 @@ jobs:
 
     - name: Verify packages installed
       run: |
-        $GITHUB_WORKSPACE/python-setup/tests/check_requests.sh ${PYTHON_VERSION} 2.31.0
+        $GITHUB_WORKSPACE/python-setup/tests/check_requests_2_26_0.sh ${PYTHON_VERSION}
 
   # This one shouldn't fail, but also won't install packages
   test-setup-python-scripts-non-standard-location:
@@ -170,5 +170,5 @@ jobs:
 
     - name: Verify packages installed
       run: |
-        $cmd = $Env:GITHUB_WORKSPACE + "\\python-setup\\tests\\check_requests.ps1"
-        powershell -File $cmd $Env:PYTHON_VERSION 2.31.0
+        $cmd = $Env:GITHUB_WORKSPACE + "\\python-setup\\tests\\check_requests_2_26_0.ps1"
+        powershell -File $cmd $Env:PYTHON_VERSION

.github/workflows/update-bundle.yml

@@ -2,20 +2,11 @@ name: Update default CodeQL bundle
 
 on:
   release:
-    # From https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release
-    # Note: The prereleased type will not trigger for pre-releases published
-    # from draft releases, but the published type will trigger. If you want a
-    # workflow to run when stable and pre-releases publish, subscribe to
-    # published instead of released and prereleased.
-    #
-    # From https://github.com/orgs/community/discussions/26281
-    # As a work around, in published type workflow,  you could add if condition
-    # to filter pre-release attribute.
-    types: [published]
+    types: [prereleased]
 
 jobs:
   update-bundle:
-    if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
+    if: startsWith(github.event.release.tag_name, 'codeql-bundle-')
     runs-on: ubuntu-latest
     steps:
       - name: Dump environment
@@ -30,7 +21,7 @@ jobs:
 
       - name: Update git config
         run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.email "github-actions@github.com"
           git config --global user.name "github-actions[bot]"
 
       - name: Update bundle

.github/workflows/update-dependencies.yml

@@ -29,7 +29,7 @@ jobs:
         git checkout "origin/$BRANCH"
         .github/workflows/script/update-node-modules.sh update
         if [ ! -z "$(git status --porcelain)" ]; then
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.email "github-actions@github.com"
           git config --global user.name "github-actions[bot]"
           git add node_modules
           git commit -am "Update checked-in dependencies"

.github/workflows/update-release-branch.yml

@@ -35,7 +35,7 @@ jobs:
 
     - name: Update git config
       run: |
-        git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git config --global user.email "github-actions@github.com"
         git config --global user.name "github-actions[bot]"
 
     - name: Update release branch

.github/workflows/update-supported-enterprise-server-versions.yml

@@ -35,22 +35,14 @@ jobs:
           npm run build
         env:
           ENTERPRISE_RELEASES_PATH: ${{ github.workspace }}/enterprise-releases/
-
-      - name: Update git config
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      - name: Commit changes and open PR
+      - name: Commit Changes
+        uses: peter-evans/create-pull-request@38e0b6e68b4c852a5500a94740f0e535e0d7ba54 # v4.2.4
+        with:
+          commit-message: Update supported GitHub Enterprise Server versions.
+          title: Update supported GitHub Enterprise Server versions.
+          body: ""
+          author: GitHub <noreply@github.com>
+          branch: update-supported-enterprise-server-versions
+          draft: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          if [[ -z $(git status --porcelain) ]]; then
-            echo "No changes to commit"
-          else
-            git checkout -b update-supported-enterprise-server-versions
-            git add .
-            git commit --message "Update supported GitHub Enterprise Server versions"
-            git push origin update-supported-enterprise-server-versions
-            gh pr create --fill --draft
-          fi

.github/workflows/update-supported-enterprise-server-versions/update.py

@@ -35,10 +35,7 @@ def main():
 
 		if oldest_supported_release is None or release_version < oldest_supported_release:
 			end_of_life_date = datetime.date.fromisoformat(release_data["end"])
-			# The GHES version is not actually end of life until the end of the day specified by
-			# `end_of_life_date`. Wait an extra week to be safe.
-			is_end_of_life = datetime.date.today() > end_of_life_date + datetime.timedelta(weeks=1)
-			if not is_end_of_life:
+			if end_of_life_date > datetime.date.today():
 				oldest_supported_release = release_version
 
 	api_compatibility_data = {

CHANGELOG.md

@@ -2,69 +2,8 @@
 
 ## [UNRELEASED]
 
-- This is the last release of the Action that supports CodeQL CLI versions 2.8.5 to 2.9.3. These versions of the CodeQL CLI were deprecated on June 20, 2023 alongside GitHub Enterprise Server 3.5 and will not be supported by the next release of the CodeQL Action (2.21.0).
-  - If you are using one of these versions, please update to CodeQL CLI version 2.9.4 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
-  - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.8.5 and 2.9.3, you can replace 'github/codeql-action/*@v2' by 'github/codeql-action/*@v2.20.4' in your code scanning workflow to ensure you continue using this version of the CodeQL Action.
-
-## 2.20.3 - 06 Jul 2023
-
-- Update default CodeQL bundle version to 2.13.5. [#1743](https://github.com/github/codeql-action/pull/1743)
-
-## 2.20.2 - 03 Jul 2023
-
 No user facing changes.
 
-## 2.20.1 - 21 Jun 2023
-
-- Update default CodeQL bundle version to 2.13.4. [#1721](https://github.com/github/codeql-action/pull/1721)
-- Experimental: add a new `resolve-environment` action which attempts to infer a configuration for the build environment that is required to build a given project. Do not use this in production as it is part of an internal experiment and subject to change at any time.
-
-## 2.20.0 - 13 Jun 2023
-
-- Bump the version of the Action to 2.20.0. This ensures that users who received a Dependabot upgrade to [`cdcdbb5`](https://github.com/github/codeql-action/commit/cdcdbb579706841c47f7063dda365e292e5cad7a), which was mistakenly marked as Action version 2.13.4, continue to receive updates to the CodeQL Action. Full details in [#1729](https://github.com/github/codeql-action/pull/1729)
-
-## 2.3.6 - 01 Jun 2023
-
-- Update default CodeQL bundle version to 2.13.3. [#1698](https://github.com/github/codeql-action/pull/1698)
-
-## 2.3.5 - 25 May 2023
-
-- Allow invalid URIs to be used as values to `artifactLocation.uri` properties. This reverses a change from [#1668](https://github.com/github/codeql-action/pull/1668) that inadvertently led to stricter validation of some URI values. [#1705](https://github.com/github/codeql-action/pull/1705)
-- Gracefully handle invalid URIs when fingerprinting. [#1694](https://github.com/github/codeql-action/pull/1694)
-
-## 2.3.4 - 24 May 2023
-
-- Updated the SARIF 2.1.0 JSON schema file to the latest from [oasis-tcs/sarif-spec](https://github.com/oasis-tcs/sarif-spec/blob/123e95847b13fbdd4cbe2120fa5e33355d4a042b/Schemata/sarif-schema-2.1.0.json). [#1668](https://github.com/github/codeql-action/pull/1668)
-- We are rolling out a feature in May 2023 that will disable Python dependency installation for new users of the CodeQL Action. This improves the speed of analysis while having only a very minor impact on results. [#1676](https://github.com/github/codeql-action/pull/1676)
-- We are improving the way that [CodeQL bundles](https://github.com/github/codeql-action/releases) are tagged to make it possible to easily identify bundles by their CodeQL semantic version. [#1682](https://github.com/github/codeql-action/pull/1682)
-  - As of CodeQL CLI 2.13.4, CodeQL bundles will be tagged using semantic versions, for example `codeql-bundle-v2.13.4`, instead of timestamps, like `codeql-bundle-20230615`.
-  - This change does not affect the majority of workflows, and we will not be changing tags for existing bundle releases.
-  - Some workflows with custom logic that depends on the specific format of the CodeQL bundle tag may need to be updated. For example, if your workflow matches CodeQL bundle tag names against a `codeql-bundle-yyyymmdd` pattern, you should update it to also recognize `codeql-bundle-vx.y.z` tags.
-- Remove the requirement for `on.push` and `on.pull_request` to trigger on the same branches. [#1675](https://github.com/github/codeql-action/pull/1675)
-
-## 2.3.3 - 04 May 2023
-
-- Update default CodeQL bundle version to 2.13.1. [#1664](https://github.com/github/codeql-action/pull/1664)
-- You can now configure CodeQL within your code scanning workflow by passing a `config` input to the `init` Action. See [Using a custom configuration file](https://aka.ms/code-scanning-docs/config-file) for more information about configuring code scanning. [#1590](https://github.com/github/codeql-action/pull/1590)
-
-## 2.3.2 - 27 Apr 2023
-
-No user facing changes.
-
-## 2.3.1 - 26 Apr 2023
-
-No user facing changes.
-
-## 2.3.0 - 21 Apr 2023
-
-- Update default CodeQL bundle version to 2.13.0. [#1649](https://github.com/github/codeql-action/pull/1649)
-- Bump the minimum CodeQL bundle version to 2.8.5. [#1618](https://github.com/github/codeql-action/pull/1618)
-
-## 2.2.12 - 13 Apr 2023
-
-- Include the value of the `GITHUB_RUN_ATTEMPT` environment variable in the telemetry sent to GitHub. [#1640](https://github.com/github/codeql-action/pull/1640)
-- Improve the ease of debugging failed runs configured using [default setup](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning-for-a-repository#configuring-code-scanning-automatically). The CodeQL Action will now upload diagnostic information to Code Scanning from failed runs configured using default setup. You can view this diagnostic information on the [tool status page](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-the-tool-status-page). [#1619](https://github.com/github/codeql-action/pull/1619)
-
 ## 2.2.11 - 06 Apr 2023
 
 No user facing changes.

CONTRIBUTING.md

@@ -12,7 +12,7 @@ Please note that this project is released with a [Contributor Code of Conduct][c
 
 ## Development and Testing
 
-Before you start, ensure that you have a recent version of node (16 or higher) installed, along with a recent version of npm (9.2 or higher). You can see which version of node is used by the action in `init/action.yml`.
+Before you start, ensure that you have a recent version of node (14 or higher) installed, along with a recent version of npm (7 or higher). You can see which version of node is used by the action in `init/action.yml`.
 
 ### Common tasks
 

README.md

@@ -135,42 +135,7 @@ By default, this will override any queries specified in a config file. If you wi
     queries: +<local-or-remote-query>,<another-query>
 ```
 
-### Configuration via `config` input
-
-You can alternatively configure CodeQL using the `config` input to the `init` Action. The value of this input must be a YAML string that follows the configuration file format documented at "[Using a custom configuration file](https://aka.ms/code-scanning-docs/config-file)."
-
-#### Example configuration
-
-```yaml
-- uses: github/codeql-action/init@v2
-  with:
-    languages: ${{ matrix.language }}
-    config: |
-      disable-default-queries: true
-      queries:
-        - uses: security-extended
-        - uses: security-and-quality
-      query-filters:
-        - include:
-      tags: /cwe-020/
-```
-
-
-#### Sharing configuration across multiple repositories
-
-You can use Actions or environment variables to share configuration across multiple repositories and to modify configuration without needing to edit the workflow file.  In the following example, `vars.CODEQL_CONF` is an [Actions configuration variable](https://docs.github.com/en/actions/learn-github-actions/variables#defining-configuration-variables-for-multiple-workflows):
-
-```yaml
-- uses: github/codeql-action/init@v2
-  with:
-    languages: ${{ matrix.language }}
-    config: ${{ vars.CODEQL_CONF }}
-```
-
 ## Troubleshooting
 
-Read about [troubleshooting code scanning](https://docs.github.com/en/code-security/code-scanning/troubleshooting-code-scanning).
+Read about [troubleshooting code scanning](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning).
 
-## Contributing
-
-This project welcomes contributions. See [CONTRIBUTING.md](CONTRIBUTING.md) for details on how to build, install, and contribute.

init/action.yml

@@ -44,9 +44,6 @@ inputs:
   db-location:
     description: Path where CodeQL databases should be created. If not specified, a temporary directory will be used.
     required: false
-  config:    
-    description: Configuration passed as a YAML string in the same format as the config-file input. This takes precedence over the config-file input.
-    required: false
   queries:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false

lib/actions-util.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUploadValue = exports.printDebugLogs = exports.isAnalyzingDefaultBranch = exports.getRelativeScriptPath = exports.isRunningLocalAction = exports.getWorkflowEventName = exports.sendStatusReport = exports.createStatusReportBase = exports.getActionVersion = exports.getActionsStatus = exports.getRef = exports.computeAutomationID = exports.getAutomationID = exports.getAnalysisKey = exports.determineMergeBaseCommitOid = exports.getCommitOid = exports.getTemporaryDirectory = exports.getOptionalInput = exports.getRequiredInput = void 0;
+exports.getUploadValue = exports.printDebugLogs = exports.isAnalyzingDefaultBranch = exports.getRelativeScriptPath = exports.isRunningLocalAction = exports.workflowEventName = exports.sendStatusReport = exports.createStatusReportBase = exports.getActionVersion = exports.getActionsStatus = exports.getRef = exports.computeAutomationID = exports.getAutomationID = exports.getAnalysisKey = exports.determineMergeBaseCommitOid = exports.getCommitOid = exports.getTemporaryDirectory = exports.getOptionalInput = exports.getRequiredInput = void 0;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -31,7 +31,7 @@ const core = __importStar(require("@actions/core"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 const api = __importStar(require("./api-client"));
-const environment_1 = require("./environment");
+const sharedEnv = __importStar(require("./shared-environment"));
 const util_1 = require("./util");
 const workflow_1 = require("./workflow");
 // eslint-disable-next-line import/no-commonjs
@@ -42,9 +42,9 @@ const pkg = require("../package.json");
  *
  * This allows us to get stronger type checking of required/optional inputs.
  */
-const getRequiredInput = function (name) {
+function getRequiredInput(name) {
     return core.getInput(name, { required: true });
-};
+}
 exports.getRequiredInput = getRequiredInput;
 /**
  * Wrapper around core.getInput that converts empty inputs to undefined.
@@ -104,7 +104,7 @@ exports.getCommitOid = getCommitOid;
  * Returns undefined if run by other triggers or the merge base cannot be determined.
  */
 const determineMergeBaseCommitOid = async function () {
-    if (getWorkflowEventName() !== "pull_request") {
+    if (workflowEventName() !== "pull_request") {
         return undefined;
     }
     const mergeSha = (0, util_1.getRequiredEnvParam)("GITHUB_SHA");
@@ -155,7 +155,7 @@ exports.determineMergeBaseCommitOid = determineMergeBaseCommitOid;
  *
  * This will combine the workflow path and current job name.
  * Computing this the first time requires making requests to
- * the GitHub API, but after that the result will be cached.
+ * the github API, but after that the result will be cached.
  */
 async function getAnalysisKey() {
     const analysisKeyEnvVar = "CODEQL_ACTION_ANALYSIS_KEY";
@@ -163,7 +163,7 @@ async function getAnalysisKey() {
     if (analysisKey !== undefined) {
         return analysisKey;
     }
-    const workflowPath = await (0, workflow_1.getWorkflowRelativePath)();
+    const workflowPath = await (0, workflow_1.getWorkflowPath)();
     const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");
     analysisKey = `${workflowPath}:${jobName}`;
     core.exportVariable(analysisKeyEnvVar, analysisKey);
@@ -172,7 +172,7 @@ async function getAnalysisKey() {
 exports.getAnalysisKey = getAnalysisKey;
 async function getAutomationID() {
     const analysis_key = await getAnalysisKey();
-    const environment = (0, exports.getRequiredInput)("matrix");
+    const environment = getRequiredInput("matrix");
     return computeAutomationID(analysis_key, environment);
 }
 exports.getAutomationID = getAutomationID;
@@ -290,28 +290,34 @@ exports.getActionVersion = getActionVersion;
 async function createStatusReportBase(actionName, status, actionStartedAt, cause, exception) {
     const commitOid = (0, exports.getOptionalInput)("sha") || process.env["GITHUB_SHA"] || "";
     const ref = await getRef();
-    const jobRunUUID = process.env[environment_1.EnvVar.JOB_RUN_UUID] || "";
-    const workflowRunID = (0, workflow_1.getWorkflowRunID)();
-    const workflowRunAttempt = (0, workflow_1.getWorkflowRunAttempt)();
+    const workflowRunIDStr = process.env["GITHUB_RUN_ID"];
+    let workflowRunID = -1;
+    if (workflowRunIDStr) {
+        workflowRunID = parseInt(workflowRunIDStr, 10);
+    }
+    const workflowRunAttemptStr = process.env["GITHUB_RUN_ATTEMPT"];
+    let workflowRunAttempt = -1;
+    if (workflowRunAttemptStr) {
+        workflowRunAttempt = parseInt(workflowRunAttemptStr, 10);
+    }
     const workflowName = process.env["GITHUB_WORKFLOW"] || "";
     const jobName = process.env["GITHUB_JOB"] || "";
     const analysis_key = await getAnalysisKey();
-    let workflowStartedAt = process.env[environment_1.EnvVar.WORKFLOW_STARTED_AT];
+    let workflowStartedAt = process.env[sharedEnv.CODEQL_WORKFLOW_STARTED_AT];
     if (workflowStartedAt === undefined) {
         workflowStartedAt = actionStartedAt.toISOString();
-        core.exportVariable(environment_1.EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt);
+        core.exportVariable(sharedEnv.CODEQL_WORKFLOW_STARTED_AT, workflowStartedAt);
     }
     const runnerOs = (0, util_1.getRequiredEnvParam)("RUNNER_OS");
     const codeQlCliVersion = (0, util_1.getCachedCodeQlVersion)();
     const actionRef = process.env["GITHUB_ACTION_REF"];
-    const testingEnvironment = process.env[environment_1.EnvVar.TESTING_ENVIRONMENT] || "";
+    const testingEnvironment = process.env[sharedEnv.CODEQL_ACTION_TESTING_ENVIRONMENT] || "";
     // re-export the testing environment variable so that it is available to subsequent steps,
     // even if it was only set for this step
     if (testingEnvironment !== "") {
-        core.exportVariable(environment_1.EnvVar.TESTING_ENVIRONMENT, testingEnvironment);
+        core.exportVariable(sharedEnv.CODEQL_ACTION_TESTING_ENVIRONMENT, testingEnvironment);
     }
     const statusReport = {
-        job_run_uuid: jobRunUUID,
         workflow_run_id: workflowRunID,
         workflow_run_attempt: workflowRunAttempt,
         workflow_name: workflowName,
@@ -342,7 +348,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, cause
         status === "user-error") {
         statusReport.completed_at = new Date().toISOString();
     }
-    const matrix = (0, exports.getRequiredInput)("matrix");
+    const matrix = getRequiredInput("matrix");
     if (matrix) {
         statusReport.matrix_vars = matrix;
     }
@@ -397,8 +403,7 @@ async function sendStatusReport(statusReport) {
         if ((0, util_1.isHTTPError)(e)) {
             switch (e.status) {
                 case 403:
-                    if (getWorkflowEventName() === "push" &&
-                        process.env["GITHUB_ACTOR"] === "dependabot[bot]") {
+                    if (workflowIsTriggeredByPushEvent() && isDependabotActor()) {
                         core.setFailed('Workflows triggered by Dependabot on the "push" event run with read-only access. ' +
                             "Uploading Code Scanning results requires write access. " +
                             'To use Code Scanning with Dependabot, please ensure you are using the "pull_request" event for this workflow and avoid triggering on the "push" event for Dependabot branches. ' +
@@ -431,36 +436,42 @@ async function sendStatusReport(statusReport) {
     }
 }
 exports.sendStatusReport = sendStatusReport;
-/**
- * Returns the name of the event that triggered this workflow.
- *
- * This will be "dynamic" for default setup workflow runs.
- */
-function getWorkflowEventName() {
-    return (0, util_1.getRequiredEnvParam)("GITHUB_EVENT_NAME");
+function workflowEventName() {
+    // If the original event is dynamic CODESCANNING_EVENT_NAME will contain the right info (push/pull_request)
+    if (process.env["GITHUB_EVENT_NAME"] === "dynamic") {
+        const value = process.env["CODESCANNING_EVENT_NAME"];
+        if (value === undefined || value.length === 0) {
+            return process.env["GITHUB_EVENT_NAME"];
+        }
+        return value;
+    }
+    return process.env["GITHUB_EVENT_NAME"];
 }
-exports.getWorkflowEventName = getWorkflowEventName;
-/**
- * Returns whether the current workflow is executing a local copy of the Action, e.g. we're running
- * a workflow on the codeql-action repo itself.
- */
+exports.workflowEventName = workflowEventName;
+// Was the workflow run triggered by a `push` event, for example as opposed to a `pull_request` event.
+function workflowIsTriggeredByPushEvent() {
+    return workflowEventName() === "push";
+}
+// Is dependabot the actor that triggered the current workflow run.
+function isDependabotActor() {
+    return process.env["GITHUB_ACTOR"] === "dependabot[bot]";
+}
+// Is the current action executing a local copy (i.e. we're running a workflow on the codeql-action repo itself)
+// as opposed to running a remote action (i.e. when another repo references us)
 function isRunningLocalAction() {
     const relativeScriptPath = getRelativeScriptPath();
     return (relativeScriptPath.startsWith("..") || path.isAbsolute(relativeScriptPath));
 }
 exports.isRunningLocalAction = isRunningLocalAction;
-/**
- * Get the location where the Action is running from.
- *
- * This can be used to get the Action's name or tell if we're running a local Action.
- */
+// Get the location where the action is running from.
+// This can be used to get the actions name or tell if we're running a local action.
 function getRelativeScriptPath() {
     const runnerTemp = (0, util_1.getRequiredEnvParam)("RUNNER_TEMP");
     const actionsDirectory = path.join(path.dirname(runnerTemp), "_actions");
     return path.relative(actionsDirectory, __filename);
 }
 exports.getRelativeScriptPath = getRelativeScriptPath;
-/** Returns the contents of `GITHUB_EVENT_PATH` as a JSON object. */
+// Reads the contents of GITHUB_EVENT_PATH as a JSON object
 function getWorkflowEvent() {
     const eventJsonFile = (0, util_1.getRequiredEnvParam)("GITHUB_EVENT_PATH");
     try {
@@ -473,13 +484,10 @@ function getWorkflowEvent() {
 function removeRefsHeadsPrefix(ref) {
     return ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref;
 }
-/**
- * Returns whether we are analyzing the default branch for the repository.
- *
- * This first checks the environment variable `CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH`. This
- * environment variable can be set in cases where repository information might not be available, for
- * example dynamic workflows.
- */
+// Returns whether we are analyzing the default branch for the repository.
+// For cases where the repository information might not be available (e.g.,
+// dynamic workflows), this can be forced by the environment variable
+// CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH.
 async function isAnalyzingDefaultBranch() {
     if (process.env.CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH === "true") {
         return true;
@@ -489,8 +497,8 @@ async function isAnalyzingDefaultBranch() {
     currentRef = removeRefsHeadsPrefix(currentRef);
     const event = getWorkflowEvent();
     let defaultBranch = event?.repository?.default_branch;
-    if (getWorkflowEventName() === "schedule") {
-        defaultBranch = removeRefsHeadsPrefix(getRefFromEnv());
+    if (process.env.GITHUB_EVENT_NAME === "schedule") {
+        defaultBranch = removeRefsHeadsPrefix((0, util_1.getRequiredEnvParam)("GITHUB_REF"));
     }
     return currentRef === defaultBranch;
 }
@@ -524,10 +532,7 @@ async function printDebugLogs(config) {
     }
 }
 exports.printDebugLogs = printDebugLogs;
-/**
- * Parses the `upload` input into an `UploadKind`, converting unspecified and deprecated upload
- * inputs appropriately.
- */
+// Parses the `upload` input into an `UploadKind`, converting unspecified and deprecated upload inputs appropriately.
 function getUploadValue(input) {
     switch (input) {
         case undefined:

lib/actions-util.test.js

@@ -31,7 +31,6 @@ const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
 const sinon = __importStar(require("sinon"));
 const actionsutil = __importStar(require("./actions-util"));
-const environment_1 = require("./environment");
 const testing_utils_1 = require("./testing-utils");
 const util_1 = require("./util");
 (0, testing_utils_1.setupTests)(ava_1.default);
@@ -170,10 +169,9 @@ const util_1 = require("./util");
 });
 (0, ava_1.default)("initializeEnvironment", (t) => {
     (0, util_1.initializeEnvironment)("1.2.3");
-    t.deepEqual(process.env[environment_1.EnvVar.VERSION], "1.2.3");
+    t.deepEqual(process.env.CODEQL_ACTION_VERSION, "1.2.3");
 });
 (0, ava_1.default)("isAnalyzingDefaultBranch()", async (t) => {
-    process.env["GITHUB_EVENT_NAME"] = "push";
     process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "true";
     t.deepEqual(await actionsutil.isAnalyzingDefaultBranch(), true);
     process.env["CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH"] = "false";
@@ -212,37 +210,12 @@ const util_1 = require("./util");
         getAdditionalInputStub.restore();
     });
 });
-(0, ava_1.default)("createStatusReportBase", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        process.env["GITHUB_REF"] = "refs/heads/main";
-        process.env["GITHUB_SHA"] = "a".repeat(40);
-        process.env["GITHUB_RUN_ID"] = "100";
-        process.env["GITHUB_RUN_ATTEMPT"] = "2";
-        process.env["GITHUB_REPOSITORY"] = "octocat/HelloWorld";
-        process.env["CODEQL_ACTION_ANALYSIS_KEY"] = "analysis-key";
-        process.env["RUNNER_OS"] = "macOS";
-        const getRequiredInput = sinon.stub(actionsutil, "getRequiredInput");
-        getRequiredInput.withArgs("matrix").resolves("input/matrix");
-        const statusReport = await actionsutil.createStatusReportBase("init", "failure", new Date("May 19, 2023 05:19:00"), "failure cause", "exception stack trace");
-        t.assert(typeof statusReport.job_run_uuid === "string");
-        t.assert(statusReport.workflow_run_id === 100);
-        t.assert(statusReport.workflow_run_attempt === 2);
-        t.assert(statusReport.workflow_name === (process.env["GITHUB_WORKFLOW"] || ""));
-        t.assert(statusReport.job_name === (process.env["GITHUB_JOB"] || ""));
-        t.assert(statusReport.analysis_key === "analysis-key");
-        t.assert(statusReport.commit_oid === process.env["GITHUB_SHA"]);
-        t.assert(statusReport.ref === process.env["GITHUB_REF"]);
-        t.assert(statusReport.action_name === "init");
-        t.assert(statusReport.action_oid === "unknown");
-        t.assert(statusReport.started_at === process.env[environment_1.EnvVar.WORKFLOW_STARTED_AT]);
-        t.assert(statusReport.action_started_at ===
-            new Date("May 19, 2023 05:19:00").toISOString());
-        t.assert(statusReport.status === "failure");
-        t.assert(statusReport.cause === "failure cause");
-        t.assert(statusReport.exception === "exception stack trace");
-        t.assert(statusReport.runner_os === process.env["RUNNER_OS"]);
-        t.assert(typeof statusReport.action_version === "string");
-    });
+(0, ava_1.default)("workflowEventName()", async (t) => {
+    process.env["GITHUB_EVENT_NAME"] = "push";
+    t.deepEqual(actionsutil.workflowEventName(), "push");
+    process.env["GITHUB_EVENT_NAME"] = "dynamic";
+    t.deepEqual(actionsutil.workflowEventName(), "dynamic");
+    process.env["CODESCANNING_EVENT_NAME"] = "push";
+    t.deepEqual(actionsutil.workflowEventName(), "push");
 });
 //# sourceMappingURL=actions-util.test.js.map

lib/analyze-action.js

@@ -38,13 +38,13 @@ const autobuild_1 = require("./autobuild");
 const codeql_1 = require("./codeql");
 const config_utils_1 = require("./config-utils");
 const database_upload_1 = require("./database-upload");
-const environment_1 = require("./environment");
 const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
 const repository_1 = require("./repository");
+const shared_environment_1 = require("./shared-environment");
 const trap_caching_1 = require("./trap-caching");
-const uploadLib = __importStar(require("./upload-lib"));
+const upload_lib = __importStar(require("./upload-lib"));
 const util = __importStar(require("./util"));
 const util_1 = require("./util");
 async function sendStatusReport(startedAt, config, stats, error, trapCacheUploadTime, dbCreationTimings, didUploadTrapCaches, logger) {
@@ -114,7 +114,7 @@ async function runAutobuildIfLegacyGoWorkflow(config, logger) {
     if (!config.languages.includes(languages_1.Language.go)) {
         return;
     }
-    if (process.env[environment_1.EnvVar.DID_AUTOBUILD_GOLANG] === "true") {
+    if (process.env[shared_environment_1.CODEQL_ACTION_DID_AUTOBUILD_GOLANG] === "true") {
         logger.debug("Won't run Go autobuild since it has already been run.");
         return;
     }
@@ -155,6 +155,7 @@ async function run() {
         if (hasBadExpectErrorInput()) {
             throw new Error("`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork.");
         }
+        await (0, codeql_1.enrichEnvironment)(await (0, codeql_1.getCodeQL)(config.codeQLCmd));
         const apiDetails = (0, api_client_1.getApiDetails)();
         const outputDir = actionsUtil.getRequiredInput("output");
         const threads = util.getThreadsFlag(actionsUtil.getOptionalInput("threads") || process.env["CODEQL_THREADS"], logger);
@@ -163,7 +164,7 @@ async function run() {
         const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
         const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, actionsUtil.getTemporaryDirectory(), logger);
         await runAutobuildIfLegacyGoWorkflow(config, logger);
-        dbCreationTimings = await (0, analyze_1.runFinalize)(outputDir, threads, memory, config, logger, features);
+        dbCreationTimings = await (0, analyze_1.runFinalize)(outputDir, threads, memory, config, logger);
         if (actionsUtil.getRequiredInput("skip-queries") !== "true") {
             runStats = await (0, analyze_1.runQueries)(outputDir, memory, util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), threads, actionsUtil.getOptionalInput("category"), config, logger, features);
         }
@@ -177,7 +178,7 @@ async function run() {
         core.setOutput("db-locations", dbLocations);
         const uploadInput = actionsUtil.getOptionalInput("upload");
         if (runStats && actionsUtil.getUploadValue(uploadInput) === "always") {
-            uploadResult = await uploadLib.uploadFromActions(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger);
+            uploadResult = await upload_lib.uploadFromActions(outputDir, actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getOptionalInput("category"), logger);
             core.setOutput("sarif-id", uploadResult.sarifID);
         }
         else {
@@ -196,13 +197,13 @@ async function run() {
         }
         else if (uploadResult !== undefined &&
             actionsUtil.getRequiredInput("wait-for-processing") === "true") {
-            await uploadLib.waitForProcessing((0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), uploadResult.sarifID, (0, logging_1.getActionsLogger)());
+            await upload_lib.waitForProcessing((0, repository_1.parseRepositoryNwo)(util.getRequiredEnvParam("GITHUB_REPOSITORY")), uploadResult.sarifID, (0, logging_1.getActionsLogger)());
         }
         // If we did not throw an error yet here, but we expect one, throw it.
         if (actionsUtil.getOptionalInput("expect-error") === "true") {
             core.setFailed(`expect-error input was set to true but no error was thrown.`);
         }
-        core.exportVariable(environment_1.EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
+        core.exportVariable(shared_environment_1.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY, "true");
     }
     catch (unwrappedError) {
         const error = (0, util_1.wrapError)(unwrappedError);

lib/analyze.js

@@ -36,10 +36,9 @@ const yaml = __importStar(require("js-yaml"));
 const analysisPaths = __importStar(require("./analysis-paths"));
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
-const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
+const sharedEnv = __importStar(require("./shared-environment"));
 const tracer_config_1 = require("./tracer-config");
-const upload_lib_1 = require("./upload-lib");
 const util = __importStar(require("./util"));
 class CodeQLAnalysisError extends Error {
     constructor(queriesStatusReport, message) {
@@ -49,17 +48,12 @@ class CodeQLAnalysisError extends Error {
     }
 }
 exports.CodeQLAnalysisError = CodeQLAnalysisError;
-async function setupPythonExtractor(logger, features, codeql) {
+async function setupPythonExtractor(logger) {
     const codeqlPython = process.env["CODEQL_PYTHON"];
     if (codeqlPython === undefined || codeqlPython.length === 0) {
         // If CODEQL_PYTHON is not set, no dependencies were installed, so we don't need to do anything
         return;
     }
-    if (await features.getValue(feature_flags_1.Feature.DisablePythonDependencyInstallationEnabled, codeql)) {
-        logger.warning("We recommend that you remove the CODEQL_PYTHON environment variable from your workflow. This environment variable was originally used to specify a Python executable that included the dependencies of your Python code, however Python analysis no longer uses these dependencies." +
-            "\nIf you used CODEQL_PYTHON to force the version of Python to analyze as, please use CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION instead, such as 'CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION=2.7' or 'CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION=3.11'.");
-        return;
-    }
     const scriptsFolder = path.resolve(__dirname, "../python-setup");
     let output = "";
     const options = {
@@ -77,7 +71,7 @@ async function setupPythonExtractor(logger, features, codeql) {
     logger.info(`Setting LGTM_PYTHON_SETUP_VERSION=${output}`);
     process.env["LGTM_PYTHON_SETUP_VERSION"] = output;
 }
-async function createdDBForScannedLanguages(codeql, config, logger, features) {
+async function createdDBForScannedLanguages(codeql, config, logger) {
     // Insert the LGTM_INDEX_X env vars at this point so they are set when
     // we extract any scanned languages.
     analysisPaths.includeAndExcludeAnalysisPaths(config);
@@ -86,7 +80,7 @@ async function createdDBForScannedLanguages(codeql, config, logger, features) {
             !dbIsFinalized(config, language, logger)) {
             logger.startGroup(`Extracting ${language}`);
             if (language === languages_1.Language.python) {
-                await setupPythonExtractor(logger, features, codeql);
+                await setupPythonExtractor(logger);
             }
             await codeql.extractScannedLanguage(config, language);
             logger.endGroup();
@@ -106,10 +100,10 @@ function dbIsFinalized(config, language, logger) {
     }
 }
 exports.dbIsFinalized = dbIsFinalized;
-async function finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger, features) {
+async function finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger) {
     const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     const extractionStart = perf_hooks_1.performance.now();
-    await createdDBForScannedLanguages(codeql, config, logger, features);
+    await createdDBForScannedLanguages(codeql, config, logger);
     const extractionTime = perf_hooks_1.performance.now() - extractionStart;
     const trapImportStart = perf_hooks_1.performance.now();
     for (const language of config.languages) {
@@ -139,9 +133,6 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
         const queryFilters = validateQueryFilters(config.originalUserInput["query-filters"]);
         const packsWithVersion = config.packs[language] || [];
         try {
-            const sarifFile = path.join(sarifFolder, `${language}.sarif`);
-            let startTimeInterpretResults;
-            let endTimeInterpretResults;
             if (await util.useCodeScanningConfigInCli(codeql, features)) {
                 // If we are using the code scanning config in the CLI,
                 // much of the work needed to generate the query suites
@@ -156,12 +147,11 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
                 statusReport[`analyze_builtin_queries_${language}_duration_ms`] =
                     new Date().getTime() - startTimeBuiltIn;
                 logger.startGroup(`Interpreting results for ${language}`);
-                startTimeInterpretResults = new Date();
+                const startTimeInterpretResults = new Date().getTime();
+                const sarifFile = path.join(sarifFolder, `${language}.sarif`);
                 const analysisSummary = await runInterpretResults(language, undefined, sarifFile, config.debugMode);
-                endTimeInterpretResults = new Date();
                 statusReport[`interpret_results_${language}_duration_ms`] =
-                    endTimeInterpretResults.getTime() -
-                        startTimeInterpretResults.getTime();
+                    new Date().getTime() - startTimeInterpretResults;
                 logger.endGroup();
                 logger.info(analysisSummary);
             }
@@ -206,31 +196,15 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
                 }
                 logger.endGroup();
                 logger.startGroup(`Interpreting results for ${language}`);
-                startTimeInterpretResults = new Date();
+                const startTimeInterpretResults = new Date().getTime();
+                const sarifFile = path.join(sarifFolder, `${language}.sarif`);
                 const analysisSummary = await runInterpretResults(language, querySuitePaths, sarifFile, config.debugMode);
-                endTimeInterpretResults = new Date();
                 statusReport[`interpret_results_${language}_duration_ms`] =
-                    endTimeInterpretResults.getTime() -
-                        startTimeInterpretResults.getTime();
+                    new Date().getTime() - startTimeInterpretResults;
                 logger.endGroup();
                 logger.info(analysisSummary);
             }
-            if (await features.getValue(feature_flags_1.Feature.QaTelemetryEnabled)) {
-                const perQueryAlertCounts = getPerQueryAlertCounts(sarifFile, logger);
-                const perQueryAlertCountEventReport = {
-                    event: "codeql database interpret-results",
-                    started_at: startTimeInterpretResults.toISOString(),
-                    completed_at: endTimeInterpretResults.toISOString(),
-                    exit_status: "success",
-                    language,
-                    properties: perQueryAlertCounts,
-                };
-                if (statusReport["event_reports"] === undefined) {
-                    statusReport["event_reports"] = [];
-                }
-                statusReport["event_reports"].push(perQueryAlertCountEventReport);
-            }
-            await runPrintLinesOfCode(language);
+            logger.info(await runPrintLinesOfCode(language));
         }
         catch (e) {
             logger.info(String(e));
@@ -246,26 +220,6 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
         const databasePath = util.getCodeQLDatabasePath(config, language);
         return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", automationDetailsId, config, features, logger);
     }
-    /** Get an object with all queries and their counts parsed from a SARIF file path. */
-    function getPerQueryAlertCounts(sarifPath, log) {
-        (0, upload_lib_1.validateSarifFileSchema)(sarifPath, log);
-        const sarifObject = JSON.parse(fs.readFileSync(sarifPath, "utf8"));
-        // We do not need to compute fingerprints because we are not sending data based off of locations.
-        // Generate the query: alert count object
-        const perQueryAlertCounts = {};
-        // All rules (queries), from all results, from all runs
-        for (const sarifRun of sarifObject.runs) {
-            if (sarifRun.results) {
-                for (const result of sarifRun.results) {
-                    const query = result.rule?.id || result.ruleId;
-                    if (query) {
-                        perQueryAlertCounts[query] = (perQueryAlertCounts[query] || 0) + 1;
-                    }
-                }
-            }
-        }
-        return perQueryAlertCounts;
-    }
     async function runPrintLinesOfCode(language) {
         const databasePath = util.getCodeQLDatabasePath(config, language);
         return await codeql.databasePrintBaseline(databasePath);
@@ -318,7 +272,7 @@ function createQuerySuiteContents(queries, queryFilters) {
     return yaml.dump(queries.map((q) => ({ query: q })).concat(queryFilters));
 }
 exports.createQuerySuiteContents = createQuerySuiteContents;
-async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger, features) {
+async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger) {
     try {
         await (0, del_1.default)(outputDir, { force: true });
     }
@@ -328,14 +282,21 @@ async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger, f
         }
     }
     await fs.promises.mkdir(outputDir, { recursive: true });
-    const timings = await finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger, features);
+    const timings = await finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger);
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     // WARNING: This does not _really_ end tracing, as the tracer will restore its
     // critical environment variables and it'll still be active for all processes
     // launched from this build step.
     // However, it will stop tracing for all steps past the codeql-action/analyze
     // step.
-    // Delete variables as specified by the end-tracing script
-    await (0, tracer_config_1.endTracingForCluster)(config);
+    if (await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+        // Delete variables as specified by the end-tracing script
+        await (0, tracer_config_1.endTracingForCluster)(config);
+    }
+    else {
+        // Delete the tracer config env var to avoid tracing ourselves
+        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
+    }
     return timings;
 }
 exports.runFinalize = runFinalize;

lib/analyze.test.js

@@ -37,16 +37,11 @@ const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
-const uploadLib = __importStar(require("./upload-lib"));
 const util = __importStar(require("./util"));
 (0, testing_utils_1.setupTests)(ava_1.default);
-/** Checks that the duration fields are populated for the correct language
- * and correct case of builtin or custom. Also checks the correct search
- * paths are set in the database analyze invocation.
- *
- * Mocks the QA telemetry feature flag and checks the appropriate status report
- * fields.
- */
+// Checks that the duration fields are populated for the correct language
+// and correct case of builtin or custom. Also checks the correct search
+// paths are set in the database analyze invocation.
 (0, ava_1.default)("status report fields and search path setting", async (t) => {
     let searchPathsUsed = [];
     return await util.withTmpDir(async (tmpDir) => {
@@ -58,7 +53,6 @@ const util = __importStar(require("./util"));
             [languages_1.Language.cpp]: ["a/b@1.0.0"],
             [languages_1.Language.java]: ["c/d@2.0.0"],
         };
-        sinon.stub(uploadLib, "validateSarifFileSchema");
         for (const language of Object.values(languages_1.Language)) {
             (0, codeql_1.setCodeQL)({
                 packDownload: async () => ({ packs: [] }),
@@ -136,25 +130,18 @@ const util = __importStar(require("./util"));
                 builtin: ["foo.ql"],
                 custom: [],
             };
-            const builtinStatusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.QaTelemetryEnabled]));
+            const builtinStatusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([]));
             const hasPacks = language in packs;
             const statusReportKeys = Object.keys(builtinStatusReport).sort();
             if (hasPacks) {
-                t.deepEqual(statusReportKeys.length, 4, statusReportKeys.toString());
+                t.deepEqual(statusReportKeys.length, 3, statusReportKeys.toString());
                 t.deepEqual(statusReportKeys[0], `analyze_builtin_queries_${language}_duration_ms`);
                 t.deepEqual(statusReportKeys[1], `analyze_custom_queries_${language}_duration_ms`);
-                t.deepEqual(statusReportKeys[2], "event_reports");
-                t.deepEqual(statusReportKeys[3], `interpret_results_${language}_duration_ms`);
+                t.deepEqual(statusReportKeys[2], `interpret_results_${language}_duration_ms`);
             }
             else {
                 t.deepEqual(statusReportKeys[0], `analyze_builtin_queries_${language}_duration_ms`);
-                t.deepEqual(statusReportKeys[1], "event_reports");
-                t.deepEqual(statusReportKeys[2], `interpret_results_${language}_duration_ms`);
-            }
-            if (builtinStatusReport.event_reports) {
-                for (const eventReport of builtinStatusReport.event_reports) {
-                    t.deepEqual(eventReport.event, "codeql database interpret-results");
-                }
+                t.deepEqual(statusReportKeys[1], `interpret_results_${language}_duration_ms`);
             }
             config.queries[language] = {
                 builtin: [],
@@ -169,20 +156,14 @@ const util = __importStar(require("./util"));
                     },
                 ],
             };
-            const customStatusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([feature_flags_1.Feature.QaTelemetryEnabled]));
-            t.deepEqual(Object.keys(customStatusReport).length, 3);
+            const customStatusReport = await (0, analyze_1.runQueries)(tmpDir, memoryFlag, addSnippetsFlag, threadsFlag, undefined, config, (0, logging_1.getRunnerLogger)(true), (0, testing_utils_1.createFeatures)([]));
+            t.deepEqual(Object.keys(customStatusReport).length, 2);
             t.true(`analyze_custom_queries_${language}_duration_ms` in customStatusReport);
             const expectedSearchPathsUsed = hasPacks
                 ? [undefined, undefined, "/1", "/2", undefined]
                 : [undefined, "/1", "/2"];
             t.deepEqual(searchPathsUsed, expectedSearchPathsUsed);
             t.true(`interpret_results_${language}_duration_ms` in customStatusReport);
-            t.true("event_reports" in customStatusReport);
-            if (customStatusReport.event_reports) {
-                for (const eventReport of customStatusReport.event_reports) {
-                    t.deepEqual(eventReport.event, "codeql database interpret-results");
-                }
-            }
         }
         verifyQuerySuites(tmpDir);
     });

lib/api-compatibility.json

@@ -1 +1 @@
-{ "maximumVersion": "3.10", "minimumVersion": "3.5" }
+{ "maximumVersion": "3.9", "minimumVersion": "3.5" }

lib/autobuild-action.js

@@ -28,9 +28,9 @@ const actions_util_1 = require("./actions-util");
 const api_client_1 = require("./api-client");
 const autobuild_1 = require("./autobuild");
 const configUtils = __importStar(require("./config-utils"));
-const environment_1 = require("./environment");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
+const shared_environment_1 = require("./shared-environment");
 const util_1 = require("./util");
 async function sendCompletedStatusReport(startedAt, allLanguages, failingLanguage, cause) {
     (0, util_1.initializeEnvironment)((0, actions_util_1.getActionVersion)());
@@ -69,7 +69,7 @@ async function run() {
                 currentLanguage = language;
                 await (0, autobuild_1.runAutobuild)(language, config, logger);
                 if (language === languages_1.Language.go) {
-                    core.exportVariable(environment_1.EnvVar.DID_AUTOBUILD_GOLANG, "true");
+                    core.exportVariable(shared_environment_1.CODEQL_ACTION_DID_AUTOBUILD_GOLANG, "true");
                 }
             }
         }

lib/autobuild-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAQwB;AACxB,6CAAgD;AAChD,2CAAwE;AACxE,4DAA8C;AAC9C,+CAAuC;AACvC,2CAAuC;AACvC,uCAA6C;AAC7C,iCAIgB;AAShB,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;IAEb,IAAA,4BAAqB,EAAC,IAAA,+BAAgB,GAAE,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAAsB,EACnD,WAAW,EACX,MAAM,EACN,SAAS,EACT,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,IAAA,+BAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,IAAI,eAAe,GAAyB,SAAS,CAAC;IACtD,IAAI,SAAS,GAA2B,SAAS,CAAC;IAClD,IAAI;QACF,IACE,CAAC,CAAC,MAAM,IAAA,+BAAgB,EACtB,MAAM,IAAA,qCAAsB,EAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CACjE,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QAED,SAAS,GAAG,MAAM,IAAA,uCAA2B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE;YAC3B,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;YAC/D,IAAI,gBAAgB,EAAE;gBACpB,MAAM,CAAC,IAAI,CACT,6CAA6C,gBAAgB,EAAE,CAChE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;aACjC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;gBAChC,eAAe,GAAG,QAAQ,CAAC;gBAC3B,MAAM,IAAA,wBAAY,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,EAAE,EAAE;oBAC5B,IAAI,CAAC,cAAc,CAAC,oBAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;iBAC1D;aACF;SACF;KACF;IAAC,OAAO,cAAc,EAAE;QACvB,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CACZ,kIAAkI,KAAK,CAAC,OAAO,EAAE,CAClJ,CAAC;QACF,MAAM,yBAAyB,CAC7B,SAAS,EACT,SAAS,IAAI,EAAE,EACf,eAAe,EACf,KAAK,CACN,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,4BAA4B,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACxE;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"autobuild-action.js","sourceRoot":"","sources":["../src/autobuild-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAQwB;AACxB,6CAAgD;AAChD,2CAAwE;AACxE,4DAA8C;AAC9C,2CAAuC;AACvC,uCAA6C;AAC7C,6DAA0E;AAC1E,iCAIgB;AAShB,KAAK,UAAU,yBAAyB,CACtC,SAAe,EACf,YAAsB,EACtB,eAAwB,EACxB,KAAa;IAEb,IAAA,4BAAqB,EAAC,IAAA,+BAAgB,GAAE,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,IAAA,qCAAsB,EACnD,WAAW,EACX,MAAM,EACN,SAAS,EACT,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAA0B;QAC1C,GAAG,gBAAgB;QACnB,mBAAmB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3C,iBAAiB,EAAE,eAAe;KACnC,CAAC;IACF,MAAM,IAAA,+BAAgB,EAAC,YAAY,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,IAAI,eAAe,GAAyB,SAAS,CAAC;IACtD,IAAI,SAAS,GAA2B,SAAS,CAAC;IAClD,IAAI;QACF,IACE,CAAC,CAAC,MAAM,IAAA,+BAAgB,EACtB,MAAM,IAAA,qCAAsB,EAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CACjE,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QAED,SAAS,GAAG,MAAM,IAAA,uCAA2B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE;YAC3B,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;YAC/D,IAAI,gBAAgB,EAAE;gBACpB,MAAM,CAAC,IAAI,CACT,6CAA6C,gBAAgB,EAAE,CAChE,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;aACjC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE;gBAChC,eAAe,GAAG,QAAQ,CAAC;gBAC3B,MAAM,IAAA,wBAAY,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,EAAE,EAAE;oBAC5B,IAAI,CAAC,cAAc,CAAC,uDAAkC,EAAE,MAAM,CAAC,CAAC;iBACjE;aACF;SACF;KACF;IAAC,OAAO,cAAc,EAAE;QACvB,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CACZ,kIAAkI,KAAK,CAAC,OAAO,EAAE,CAClJ,CAAC;QACF,MAAM,yBAAyB,CAC7B,SAAS,EACT,SAAS,IAAI,EAAE,EACf,eAAe,EACf,KAAK,CACN,CAAC;QACF,OAAO;KACR;IAED,MAAM,yBAAyB,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,4BAA4B,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACxE;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/codeql.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_NEW_ANALYSIS_SUMMARY = exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
+exports.enrichEnvironment = exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = exports.CODEQL_VERSION_NEW_TRACING = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
@@ -31,11 +31,11 @@ const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const yaml = __importStar(require("js-yaml"));
 const actions_util_1 = require("./actions-util");
 const config_utils_1 = require("./config-utils");
-const environment_1 = require("./environment");
 const error_matcher_1 = require("./error-matcher");
 const feature_flags_1 = require("./feature-flags");
 const languages_1 = require("./languages");
 const setupCodeql = __importStar(require("./setup-codeql"));
+const shared_environment_1 = require("./shared-environment");
 const toolrunner_error_catcher_1 = require("./toolrunner-error-catcher");
 const trap_caching_1 = require("./trap-caching");
 const util = __importStar(require("./util"));
@@ -62,20 +62,32 @@ let cachedCodeQL = undefined;
  * The version flags below can be used to conditionally enable certain features
  * on versions newer than this.
  */
-const CODEQL_MINIMUM_VERSION = "2.8.5";
-/**
- * This version will shortly become the oldest version of CodeQL that the Action will run with.
- */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.9.4";
+const CODEQL_MINIMUM_VERSION = "2.6.3";
 /**
  * Versions of CodeQL that version-flag certain functionality in the Action.
  * For convenience, please keep these in descending order. Once a version
  * flag is older than the oldest supported version above, it may be removed.
  */
+const CODEQL_VERSION_CUSTOM_QUERY_HELP = "2.7.1";
 const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.10.0";
 const CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED = "2.10.4";
 exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = "2.10.4";
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
+/**
+ * This variable controls using the new style of tracing from the CodeQL
+ * CLI. In particular, with versions above this we will use both indirect
+ * tracing, and multi-language tracing together with database clusters.
+ *
+ * Note that there were bugs in both of these features that were fixed in
+ * release 2.7.0 of the CodeQL CLI, therefore this flag is only enabled for
+ * versions above that.
+ */
+exports.CODEQL_VERSION_NEW_TRACING = "2.7.0";
+/**
+ * Versions 2.7.3+ of the CodeQL CLI support build tracing with glibc 2.34 on Linux. Versions before
+ * this cannot perform build tracing when running on the Actions `ubuntu-22.04` runner image.
+ */
+exports.CODEQL_VERSION_TRACING_GLIBC_2_34 = "2.7.3";
 /**
  * Versions 2.9.0+ of the CodeQL CLI run machine learning models from a temporary directory, which
  * resolves an issue on Windows where TensorFlow models are not correctly loaded due to the path of
@@ -88,31 +100,13 @@ exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = "2.9.0";
  */
 exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = "2.10.3";
 /**
- * Versions 2.11.1+ of the CodeQL Bundle include a `security-experimental` built-in query suite for
- * each language.
+ * Versions 2.11.1+ of the CodeQL Bundle include a `security-experimental` built-in query suite for each language.
  */
 exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = "2.12.1";
-/**
- * Versions 2.12.3+ of the CodeQL CLI support exporting configuration information from a code
- * scanning config file to SARIF.
- */
-exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = "2.12.3";
 /**
  * Versions 2.12.4+ of the CodeQL CLI support the `--qlconfig-file` flag in calls to `database init`.
  */
 exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = "2.12.4";
-/**
- * Versions 2.13.4+ of the CodeQL CLI support the `resolve build-environment` command.
- */
-exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = "2.13.4";
-/**
- * Versions 2.13.4+ of the CodeQL CLI have an associated CodeQL Bundle release that is semantically versioned.
- */
-exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = "2.13.4";
-/**
- * Versions 2.14.0+ of the CodeQL CLI support new analysis summaries.
- */
-exports.CODEQL_VERSION_NEW_ANALYSIS_SUMMARY = "2.14.0";
 /**
  * Set up CodeQL CLI access.
  *
@@ -145,7 +139,8 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV
         };
     }
     catch (e) {
-        throw new Error(`Unable to download and extract CodeQL CLI: ${(0, util_1.wrapError)(e).message}`);
+        logger.error((0, util_1.wrapError)(e).message);
+        throw new Error("Unable to download and extract CodeQL CLI");
     }
 }
 exports.setupCodeQL = setupCodeQL;
@@ -182,6 +177,8 @@ function setCodeQL(partialCodeql) {
         getPath: resolveFunction(partialCodeql, "getPath", () => "/tmp/dummy-path"),
         getVersion: resolveFunction(partialCodeql, "getVersion", () => new Promise((resolve) => resolve("1.0.0"))),
         printVersion: resolveFunction(partialCodeql, "printVersion"),
+        getTracerEnv: resolveFunction(partialCodeql, "getTracerEnv"),
+        databaseInit: resolveFunction(partialCodeql, "databaseInit"),
         databaseInitCluster: resolveFunction(partialCodeql, "databaseInitCluster"),
         runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),
         extractScannedLanguage: resolveFunction(partialCodeql, "extractScannedLanguage"),
@@ -189,7 +186,6 @@ function setCodeQL(partialCodeql) {
         resolveLanguages: resolveFunction(partialCodeql, "resolveLanguages"),
         betterResolveLanguages: resolveFunction(partialCodeql, "betterResolveLanguages"),
         resolveQueries: resolveFunction(partialCodeql, "resolveQueries"),
-        resolveBuildEnvironment: resolveFunction(partialCodeql, "resolveBuildEnvironment"),
         packDownload: resolveFunction(partialCodeql, "packDownload"),
         databaseCleanup: resolveFunction(partialCodeql, "databaseCleanup"),
         databaseBundle: resolveFunction(partialCodeql, "databaseBundle"),
@@ -198,7 +194,6 @@ function setCodeQL(partialCodeql) {
         databasePrintBaseline: resolveFunction(partialCodeql, "databasePrintBaseline"),
         databaseExportDiagnostics: resolveFunction(partialCodeql, "databaseExportDiagnostics"),
         diagnosticsExport: resolveFunction(partialCodeql, "diagnosticsExport"),
-        resolveExtractor: resolveFunction(partialCodeql, "resolveExtractor"),
     };
     return cachedCodeQL;
 }
@@ -250,6 +245,73 @@ async function getCodeQLForCmd(cmd, checkVersion) {
         async printVersion() {
             await runTool(cmd, ["version", "--format=json"]);
         },
+        async getTracerEnv(databasePath) {
+            // Write tracer-env.js to a temp location.
+            // BEWARE: The name and location of this file is recognized by `codeql database
+            // trace-command` in order to enable special support for concatenable tracer
+            // configurations. Consequently the name must not be changed.
+            // (This warning can be removed once a different way to recognize the
+            // action/runner has been implemented in `codeql database trace-command`
+            // _and_ is present in the latest supported CLI release.)
+            const tracerEnvJs = path.resolve(databasePath, "working", "tracer-env.js");
+            fs.mkdirSync(path.dirname(tracerEnvJs), { recursive: true });
+            fs.writeFileSync(tracerEnvJs, `
+        const fs = require('fs');
+        const env = {};
+        for (let entry of Object.entries(process.env)) {
+          const key = entry[0];
+          const value = entry[1];
+          if (typeof value !== 'undefined' && key !== '_' && !key.startsWith('JAVA_MAIN_CLASS_')) {
+            env[key] = value;
+          }
+        }
+        process.stdout.write(process.argv[2]);
+        fs.writeFileSync(process.argv[2], JSON.stringify(env), 'utf-8');`);
+            // BEWARE: The name and location of this file is recognized by `codeql database
+            // trace-command` in order to enable special support for concatenable tracer
+            // configurations. Consequently the name must not be changed.
+            // (This warning can be removed once a different way to recognize the
+            // action/runner has been implemented in `codeql database trace-command`
+            // _and_ is present in the latest supported CLI release.)
+            const envFile = path.resolve(databasePath, "working", "env.tmp");
+            try {
+                await runTool(cmd, [
+                    "database",
+                    "trace-command",
+                    databasePath,
+                    ...getExtraOptionsFromEnv(["database", "trace-command"]),
+                    process.execPath,
+                    tracerEnvJs,
+                    envFile,
+                ]);
+            }
+            catch (e) {
+                if (e instanceof CommandInvocationError &&
+                    e.output.includes("undefined symbol: __libc_dlopen_mode, version GLIBC_PRIVATE") &&
+                    process.platform === "linux" &&
+                    !(await util.codeQlVersionAbove(this, exports.CODEQL_VERSION_TRACING_GLIBC_2_34))) {
+                    throw new util.UserError("The CodeQL CLI is incompatible with the version of glibc on your system. " +
+                        `Please upgrade to CodeQL CLI version ${exports.CODEQL_VERSION_TRACING_GLIBC_2_34} or ` +
+                        "later. If you cannot upgrade to a newer version of the CodeQL CLI, you can " +
+                        `alternatively run your workflow on another runner image such as "ubuntu-20.04" ` +
+                        "that has glibc 2.33 or earlier installed.");
+                }
+                else {
+                    throw e;
+                }
+            }
+            return JSON.parse(fs.readFileSync(envFile, "utf-8"));
+        },
+        async databaseInit(databasePath, language, sourceRoot) {
+            await runTool(cmd, [
+                "database",
+                "init",
+                databasePath,
+                `--language=${language}`,
+                `--source-root=${sourceRoot}`,
+                ...getExtraOptionsFromEnv(["database", "init"]),
+            ]);
+        },
         async databaseInitCluster(config, sourceRoot, processName, features, qlconfigFile, logger) {
             const extraArgs = config.languages.map((language) => `--language=${language}`);
             if (config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l)).length > 0) {
@@ -294,7 +356,10 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             ], { stdin: externalRepositoryToken });
         },
         async runAutobuild(language) {
-            const autobuildCmd = path.join(await this.resolveExtractor(language), "tools", process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh");
+            const cmdName = process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh";
+            // The autobuilder for Swift is located in the experimental/ directory.
+            const possibleExperimentalDir = language === languages_1.Language.swift ? "experimental" : "";
+            const autobuildCmd = path.join(path.dirname(cmd), possibleExperimentalDir, language, "tools", cmdName);
             // Update JAVA_TOOL_OPTIONS to contain '-Dhttp.keepAlive=false'
             // This is because of an issue with Azure pipelines timing out connections after 4 minutes
             // and Maven not properly handling closed connections
@@ -323,9 +388,31 @@ async function getCodeQLForCmd(cmd, checkVersion) {
         },
         async extractScannedLanguage(config, language) {
             const databasePath = util.getCodeQLDatabasePath(config, language);
+            // Get extractor location
+            //
+            // Request it using `format=json` so we don't need to strip the trailing new line generated by
+            // the CLI.
+            let extractorPath = "";
+            await new toolrunner.ToolRunner(cmd, [
+                "resolve",
+                "extractor",
+                "--format=json",
+                `--language=${language}`,
+                ...getExtraOptionsFromEnv(["resolve", "extractor"]),
+            ], {
+                silent: true,
+                listeners: {
+                    stdout: (data) => {
+                        extractorPath += data.toString();
+                    },
+                    stderr: (data) => {
+                        process.stderr.write(data);
+                    },
+                },
+            }).exec();
             // Set trace command
             const ext = process.platform === "win32" ? ".cmd" : ".sh";
-            const traceCommand = path.resolve(await this.resolveExtractor(language), "tools", `autobuild${ext}`);
+            const traceCommand = path.resolve(JSON.parse(extractorPath), "tools", `autobuild${ext}`);
             // Run trace command
             await (0, toolrunner_error_catcher_1.toolrunnerErrorCatcher)(cmd, [
                 "database",
@@ -399,24 +486,6 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 throw new Error(`Unexpected output from codeql resolve queries: ${e}`);
             }
         },
-        async resolveBuildEnvironment(workingDir, language) {
-            const codeqlArgs = [
-                "resolve",
-                "build-environment",
-                `--language=${language}`,
-                ...getExtraOptionsFromEnv(["resolve", "build-environment"]),
-            ];
-            if (workingDir !== undefined) {
-                codeqlArgs.push("--working-dir", workingDir);
-            }
-            const output = await runTool(cmd, codeqlArgs);
-            try {
-                return JSON.parse(output);
-            }
-            catch (e) {
-                throw new Error(`Unexpected output from codeql resolve build-environment: ${e} in\n${output}`);
-            }
-        },
         async databaseRunQueries(databasePath, extraSearchPath, querySuitePath, flags, optimizeForLastQueryRun) {
             const codeqlArgs = [
                 "database",
@@ -456,11 +525,12 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 addSnippetsFlag,
                 "--print-diagnostics-summary",
                 "--print-metrics-summary",
-                "--sarif-add-query-help",
                 "--sarif-group-rules-by-pack",
-                ...(await getCodeScanningConfigExportArguments(config, this)),
+                ...(await getCodeScanningConfigExportArguments(config, this, features)),
                 ...getExtraOptionsFromEnv(["database", "interpret-results"]),
             ];
+            if (await util.codeQlVersionAbove(this, CODEQL_VERSION_CUSTOM_QUERY_HELP))
+                codeqlArgs.push("--sarif-add-query-help");
             if (automationDetailsId !== undefined) {
                 codeqlArgs.push("--sarif-category", automationDetailsId);
             }
@@ -473,12 +543,6 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             else if (await util.codeQlVersionAbove(this, "2.12.4")) {
                 codeqlArgs.push("--no-sarif-include-diagnostics");
             }
-            if (await features.getValue(feature_flags_1.Feature.NewAnalysisSummaryEnabled, codeql)) {
-                codeqlArgs.push("--new-analysis-summary");
-            }
-            else if (await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_NEW_ANALYSIS_SUMMARY)) {
-                codeqlArgs.push("--no-new-analysis-summary");
-            }
             codeqlArgs.push(databasePath);
             if (querySuitePaths) {
                 codeqlArgs.push(...querySuitePaths);
@@ -590,13 +654,13 @@ async function getCodeQLForCmd(cmd, checkVersion) {
                 util.fixInvalidNotificationsInFile(codeqlOutputFile, sarifFile, logger);
             }
         },
-        async diagnosticsExport(sarifFile, automationDetailsId, config) {
+        async diagnosticsExport(sarifFile, automationDetailsId, config, features) {
             const args = [
                 "diagnostics",
                 "export",
                 "--format=sarif-latest",
                 `--output=${sarifFile}`,
-                ...(await getCodeScanningConfigExportArguments(config, this)),
+                ...(await getCodeScanningConfigExportArguments(config, this, features)),
                 ...getExtraOptionsFromEnv(["diagnostics", "export"]),
             ];
             if (automationDetailsId !== undefined) {
@@ -604,29 +668,6 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             }
             await new toolrunner.ToolRunner(cmd, args).exec();
         },
-        async resolveExtractor(language) {
-            // Request it using `format=json` so we don't need to strip the trailing new line generated by
-            // the CLI.
-            let extractorPath = "";
-            await new toolrunner.ToolRunner(cmd, [
-                "resolve",
-                "extractor",
-                "--format=json",
-                `--language=${language}`,
-                ...getExtraOptionsFromEnv(["resolve", "extractor"]),
-            ], {
-                silent: true,
-                listeners: {
-                    stdout: (data) => {
-                        extractorPath += data.toString();
-                    },
-                    stderr: (data) => {
-                        process.stderr.write(data);
-                    },
-                },
-            }).exec();
-            return JSON.parse(extractorPath);
-        },
     };
     // To ensure that status reports include the CodeQL CLI version wherever
     // possible, we want to call getVersion(), which populates the version value
@@ -640,21 +681,6 @@ async function getCodeQLForCmd(cmd, checkVersion) {
         !(await util.codeQlVersionAbove(codeql, CODEQL_MINIMUM_VERSION))) {
         throw new Error(`Expected a CodeQL CLI with version at least ${CODEQL_MINIMUM_VERSION} but got version ${await codeql.getVersion()}`);
     }
-    else if (checkVersion &&
-        process.env[environment_1.EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING] !== "true" &&
-        !(await util.codeQlVersionAbove(codeql, CODEQL_NEXT_MINIMUM_VERSION))) {
-        core.warning(`CodeQL CLI version ${await codeql.getVersion()} was deprecated on 2023-06-20 alongside ` +
-            "GitHub Enterprise Server 3.5 and will not be supported by the next release of the " +
-            `CodeQL Action. Please update to CodeQL CLI version ${CODEQL_NEXT_MINIMUM_VERSION} or ` +
-            "later. For instance, if you have specified a custom version of the CLI using the " +
-            "'tools' input to the 'init' Action, you can remove this input to use the default " +
-            "version.\n\n" +
-            "Alternatively, if you want to continue using CodeQL CLI version " +
-            `${await codeql.getVersion()}, you can replace 'github/codeql-action/*@v2' by ` +
-            "'github/codeql-action/*@v2.20.4' in your code scanning workflow to ensure you continue " +
-            "using this version of the CodeQL Action.");
-        core.exportVariable(environment_1.EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");
-    }
     return codeql;
 }
 exports.getCodeQLForCmd = getCodeQLForCmd;
@@ -819,12 +845,27 @@ function cloneObject(obj) {
  *
  * Returns an empty list if a code scanning configuration file was not generated by the CLI.
  */
-async function getCodeScanningConfigExportArguments(config, codeql) {
+async function getCodeScanningConfigExportArguments(config, codeql, features) {
     const codeScanningConfigPath = (0, config_utils_1.getGeneratedCodeScanningConfigPath)(config);
     if (fs.existsSync(codeScanningConfigPath) &&
-        (await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG))) {
+        (await features.getValue(feature_flags_1.Feature.ExportCodeScanningConfigEnabled, codeql))) {
         return ["--sarif-codescanning-config", codeScanningConfigPath];
     }
     return [];
 }
+/**
+ * Enrich the environment variables with further flags that we cannot
+ * know the value of until we know what version of CodeQL we're running.
+ */
+async function enrichEnvironment(codeql) {
+    if (await util.codeQlVersionAbove(codeql, exports.CODEQL_VERSION_NEW_TRACING)) {
+        core.exportVariable(shared_environment_1.EnvVar.FEATURE_MULTI_LANGUAGE, "false");
+        core.exportVariable(shared_environment_1.EnvVar.FEATURE_SANDWICH, "false");
+    }
+    else {
+        core.exportVariable(shared_environment_1.EnvVar.FEATURE_MULTI_LANGUAGE, "true");
+        core.exportVariable(shared_environment_1.EnvVar.FEATURE_SANDWICH, "true");
+    }
+}
+exports.enrichEnvironment = enrichEnvironment;
 //# sourceMappingURL=codeql.js.map

lib/codeql.test.js

@@ -38,6 +38,7 @@ const yaml = __importStar(require("js-yaml"));
 const nock_1 = __importDefault(require("nock"));
 const sinon = __importStar(require("sinon"));
 const actionsUtil = __importStar(require("./actions-util"));
+const api = __importStar(require("./api-client"));
 const codeql = __importStar(require("./codeql"));
 const defaults = __importStar(require("./defaults.json"));
 const feature_flags_1 = require("./feature-flags");
@@ -48,11 +49,20 @@ const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
 const util_1 = require("./util");
 (0, testing_utils_1.setupTests)(ava_1.default);
+const sampleApiDetails = {
+    auth: "token",
+    url: "https://github.com",
+    apiURL: "https://api.github.com",
+};
 const sampleGHAEApiDetails = {
     auth: "token",
     url: "https://example.githubenterprise.com",
     apiURL: "https://example.githubenterprise.com/api/v3",
 };
+const SAMPLE_DEFAULT_CLI_VERSION = {
+    cliVersion: "2.0.0",
+    variant: util.GitHubVariant.DOTCOM,
+};
 let stubConfig;
 ava_1.default.beforeEach(() => {
     (0, util_1.initializeEnvironment)("1.2.3");
@@ -81,13 +91,34 @@ ava_1.default.beforeEach(() => {
         trapCacheDownloadTime: 0,
     };
 });
-async function installIntoToolcache({ apiDetails = testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, cliVersion, isPinned, tagName, tmpDir, }) {
-    const url = (0, testing_utils_1.mockBundleDownloadApi)({ apiDetails, isPinned, tagName });
-    await codeql.setupCodeQL(cliVersion !== undefined ? undefined : url, apiDetails, tmpDir, util.GitHubVariant.GHES, cliVersion !== undefined
-        ? { cliVersion, tagName }
-        : testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+/**
+ * Mocks the API for downloading the bundle tagged `tagName`.
+ *
+ * @returns the download URL for the bundle. This can be passed to the tools parameter of
+ * `codeql.setupCodeQL`.
+ */
+function mockDownloadApi({ apiDetails = sampleApiDetails, isPinned, repo = "github/codeql-action", platformSpecific = true, tagName, }) {
+    const platform = process.platform === "win32"
+        ? "win64"
+        : process.platform === "linux"
+            ? "linux64"
+            : "osx64";
+    const baseUrl = apiDetails?.url ?? "https://example.com";
+    const relativeUrl = apiDetails
+        ? `/${repo}/releases/download/${tagName}/codeql-bundle${platformSpecific ? `-${platform}` : ""}.tar.gz`
+        : `/download/${tagName}/codeql-bundle.tar.gz`;
+    (0, nock_1.default)(baseUrl)
+        .get(relativeUrl)
+        .replyWithFile(200, path_1.default.join(__dirname, `/../src/testdata/codeql-bundle${isPinned ? "-pinned" : ""}.tar.gz`));
+    return `${baseUrl}${relativeUrl}`;
 }
-function mockReleaseApi({ apiDetails = testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, assetNames, tagName, }) {
+async function installIntoToolcache({ apiDetails = sampleApiDetails, cliVersion, isPinned, tagName, tmpDir, }) {
+    const url = mockDownloadApi({ apiDetails, isPinned, tagName });
+    await codeql.setupCodeQL(cliVersion !== undefined ? undefined : url, apiDetails, tmpDir, util.GitHubVariant.GHES, cliVersion !== undefined
+        ? { cliVersion, tagName, variant: util.GitHubVariant.GHES }
+        : SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+}
+function mockReleaseApi({ apiDetails = sampleApiDetails, assetNames, tagName, }) {
     return (0, nock_1.default)(apiDetails.apiURL)
         .get(`/repos/github/codeql-action/releases/tags/${tagName}`)
         .reply(200, {
@@ -118,11 +149,11 @@ function mockApiDetails(apiDetails) {
         const versions = ["20200601", "20200610"];
         for (let i = 0; i < versions.length; i++) {
             const version = versions[i];
-            const url = (0, testing_utils_1.mockBundleDownloadApi)({
+            const url = mockDownloadApi({
                 tagName: `codeql-bundle-${version}`,
                 isPinned: false,
             });
-            const result = await codeql.setupCodeQL(url, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+            const result = await codeql.setupCodeQL(url, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
             t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
             t.is(result.toolsVersion, `0.0.0-${version}`);
             t.is(result.toolsSource, init_1.ToolsSource.Download);
@@ -139,10 +170,10 @@ function mockApiDetails(apiDetails) {
             isPinned: true,
             tmpDir,
         });
-        const url = (0, testing_utils_1.mockBundleDownloadApi)({
+        const url = mockDownloadApi({
             tagName: "codeql-bundle-20200610",
         });
-        const result = await codeql.setupCodeQL(url, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+        const result = await codeql.setupCodeQL(url, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
         t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
         t.deepEqual(result.toolsVersion, "0.0.0-20200610");
         t.is(result.toolsSource, init_1.ToolsSource.Download);
@@ -167,16 +198,16 @@ for (const { cliVersion, expectedToolcacheVersion, } of EXPLICITLY_REQUESTED_BUN
     (0, ava_1.default)(`caches an explicitly requested bundle containing CLI ${cliVersion} as ${expectedToolcacheVersion}`, async (t) => {
         await util.withTmpDir(async (tmpDir) => {
             (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-            mockApiDetails(testing_utils_1.SAMPLE_DOTCOM_API_DETAILS);
+            mockApiDetails(sampleApiDetails);
             sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
             const releaseApiMock = mockReleaseApi({
                 assetNames: [`cli-version-${cliVersion}.txt`],
                 tagName: "codeql-bundle-20200610",
             });
-            const url = (0, testing_utils_1.mockBundleDownloadApi)({
+            const url = mockDownloadApi({
                 tagName: "codeql-bundle-20200610",
             });
-            const result = await codeql.setupCodeQL(url, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+            const result = await codeql.setupCodeQL(url, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
             t.assert(releaseApiMock.isDone(), "Releases API should have been called");
             t.assert(toolcache.find("CodeQL", expectedToolcacheVersion));
             t.deepEqual(result.toolsVersion, cliVersion);
@@ -185,13 +216,23 @@ for (const { cliVersion, expectedToolcacheVersion, } of EXPLICITLY_REQUESTED_BUN
         });
     });
 }
-for (const toolcacheVersion of [
+for (const { githubReleases, toolcacheVersion } of [
     // Test that we use the tools from the toolcache when `SAMPLE_DEFAULT_CLI_VERSION` is requested
     // and `SAMPLE_DEFAULT_CLI_VERSION-` is in the toolcache.
-    testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion,
-    `${testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion}-20230101`,
+    {
+        toolcacheVersion: SAMPLE_DEFAULT_CLI_VERSION.cliVersion,
+    },
+    {
+        githubReleases: {
+            "codeql-bundle-20230101": `cli-version-${SAMPLE_DEFAULT_CLI_VERSION.cliVersion}.txt`,
+        },
+        toolcacheVersion: "0.0.0-20230101",
+    },
+    {
+        toolcacheVersion: `${SAMPLE_DEFAULT_CLI_VERSION.cliVersion}-20230101`,
+    },
 ]) {
-    (0, ava_1.default)(`uses tools from toolcache when ${testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion} is requested and ` +
+    (0, ava_1.default)(`uses tools from toolcache when ${SAMPLE_DEFAULT_CLI_VERSION.cliVersion} is requested and ` +
         `${toolcacheVersion} is installed`, async (t) => {
         await util.withTmpDir(async (tmpDir) => {
             (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
@@ -200,8 +241,23 @@ for (const toolcacheVersion of [
                 .withArgs("CodeQL", toolcacheVersion)
                 .returns("path/to/cached/codeql");
             sinon.stub(toolcache, "findAllVersions").returns([toolcacheVersion]);
-            const result = await codeql.setupCodeQL(undefined, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
-            t.is(result.toolsVersion, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION.cliVersion);
+            if (githubReleases) {
+                sinon.stub(api, "getApiClient").value(() => ({
+                    repos: {
+                        listReleases: sinon.stub().resolves(undefined),
+                    },
+                    paginate: sinon.stub().resolves(Object.entries(githubReleases).map(([releaseTagName, cliVersionMarkerFile]) => ({
+                        assets: [
+                            {
+                                name: cliVersionMarkerFile,
+                            },
+                        ],
+                        tag_name: releaseTagName,
+                    }))),
+                }));
+            }
+            const result = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+            t.is(result.toolsVersion, SAMPLE_DEFAULT_CLI_VERSION.cliVersion);
             t.is(result.toolsSource, init_1.ToolsSource.Toolcache);
             t.is(result.toolsDownloadDurationMs, undefined);
         });
@@ -216,9 +272,10 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
                 isPinned: true,
                 tmpDir,
             });
-            const result = await codeql.setupCodeQL(undefined, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, variant, {
+            const result = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, variant, {
                 cliVersion: defaults.cliVersion,
                 tagName: defaults.bundleVersion,
+                variant,
             }, (0, logging_1.getRunnerLogger)(true), false);
             t.deepEqual(result.toolsVersion, "0.0.0-20200601");
             t.is(result.toolsSource, init_1.ToolsSource.Toolcache);
@@ -235,12 +292,13 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
                 isPinned: false,
                 tmpDir,
             });
-            (0, testing_utils_1.mockBundleDownloadApi)({
+            mockDownloadApi({
                 tagName: defaults.bundleVersion,
             });
-            const result = await codeql.setupCodeQL(undefined, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, variant, {
+            const result = await codeql.setupCodeQL(undefined, sampleApiDetails, tmpDir, variant, {
                 cliVersion: defaults.cliVersion,
                 tagName: defaults.bundleVersion,
+                variant,
             }, (0, logging_1.getRunnerLogger)(true), false);
             t.deepEqual(result.toolsVersion, defaults.cliVersion);
             t.is(result.toolsSource, init_1.ToolsSource.Download);
@@ -258,10 +316,10 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
             isPinned: true,
             tmpDir,
         });
-        (0, testing_utils_1.mockBundleDownloadApi)({
+        mockDownloadApi({
             tagName: defaults.bundleVersion,
         });
-        const result = await codeql.setupCodeQL("latest", testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+        const result = await codeql.setupCodeQL("latest", sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
         t.deepEqual(result.toolsVersion, defaults.cliVersion);
         t.is(result.toolsSource, init_1.ToolsSource.Download);
         t.assert(Number.isInteger(result.toolsDownloadDurationMs));
@@ -305,6 +363,7 @@ for (const isBundleVersionInUrl of [true, false]) {
             const result = await codeql.setupCodeQL(undefined, sampleGHAEApiDetails, tmpDir, util.GitHubVariant.GHAE, {
                 cliVersion: defaults.cliVersion,
                 tagName: defaults.bundleVersion,
+                variant: util.GitHubVariant.GHAE,
             }, (0, logging_1.getRunnerLogger)(true), false);
             t.is(result.toolsSource, init_1.ToolsSource.Download);
             t.assert(Number.isInteger(result.toolsDownloadDurationMs));
@@ -316,18 +375,18 @@ for (const isBundleVersionInUrl of [true, false]) {
 (0, ava_1.default)("bundle URL from another repo is cached as 0.0.0-bundleVersion", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        mockApiDetails(testing_utils_1.SAMPLE_DOTCOM_API_DETAILS);
+        mockApiDetails(sampleApiDetails);
         sinon.stub(actionsUtil, "isRunningLocalAction").returns(true);
         const releasesApiMock = mockReleaseApi({
             assetNames: ["cli-version-2.12.2.txt"],
             tagName: "codeql-bundle-20230203",
         });
-        (0, testing_utils_1.mockBundleDownloadApi)({
+        mockDownloadApi({
             repo: "codeql-testing/codeql-cli-nightlies",
             platformSpecific: false,
             tagName: "codeql-bundle-20230203",
         });
-        const result = await codeql.setupCodeQL("https://github.com/codeql-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20230203/codeql-bundle.tar.gz", testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, tmpDir, util.GitHubVariant.DOTCOM, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
+        const result = await codeql.setupCodeQL("https://github.com/codeql-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20230203/codeql-bundle.tar.gz", sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
         t.is(result.toolsVersion, "0.0.0-20230203");
         t.is(result.toolsSource, init_1.ToolsSource.Download);
         t.true(Number.isInteger(result.toolsDownloadDurationMs));
@@ -359,6 +418,24 @@ for (const isBundleVersionInUrl of [true, false]) {
     t.throws(() => codeql.getExtraOptions({ foo: 87 }, ["foo"], []));
     t.throws(() => codeql.getExtraOptions({ "*": [42], foo: { "*": 87, bar: [99] } }, ["foo", "bar"], []));
 });
+(0, ava_1.default)("databaseInterpretResults() does not set --sarif-add-query-help for 2.7.0", async (t) => {
+    const runnerConstructorStub = stubToolRunnerConstructor();
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeqlObject, "getVersion").resolves("2.7.0");
+    // safeWhich throws because of the test CodeQL object.
+    sinon.stub(safeWhich, "safeWhich").resolves("");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", stubConfig, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+    t.false(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be absent, but it is present");
+});
+(0, ava_1.default)("databaseInterpretResults() sets --sarif-add-query-help for 2.7.1", async (t) => {
+    const runnerConstructorStub = stubToolRunnerConstructor();
+    const codeqlObject = await codeql.getCodeQLForTesting();
+    sinon.stub(codeqlObject, "getVersion").resolves("2.7.1");
+    // safeWhich throws because of the test CodeQL object.
+    sinon.stub(safeWhich, "safeWhich").resolves("");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "", stubConfig, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+    t.true(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be present, but it is absent");
+});
 (0, ava_1.default)("databaseInitCluster() without injected codescanning config", async (t) => {
     await util.withTmpDir(async (tempDir) => {
         const runnerConstructorStub = stubToolRunnerConstructor();

lib/config-utils.js

@@ -932,17 +932,8 @@ function dbLocationOrDefault(dbLocation, tempDir) {
  * This will parse the config from the user input if present, or generate
  * a default config. The parsed config is then stored to a known location.
  */
-async function initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, configInput, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
+async function initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
     let config;
-    // if configInput is set, it takes precedence over configFile
-    if (configInput) {
-        if (configFile) {
-            logger.warning(`Both a config file and config input were provided. Ignoring config file.`);
-        }
-        configFile = path.resolve(workspacePath, "user-config-from-action.yml");
-        fs.writeFileSync(configFile, configInput);
-        logger.debug(`Using config from action input: ${configFile}`);
-    }
     // If no config file was provided create an empty one
     if (!configFile) {
         logger.debug("No configuration file was provided");

lib/config-utils.test.js

@@ -102,8 +102,8 @@ function mockListLanguages(languages) {
                 return { packs: [] };
             },
         });
-        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
-        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger));
+        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
+        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger));
     });
 });
 (0, ava_1.default)("loading config saves config", async (t) => {
@@ -128,7 +128,7 @@ function mockListLanguages(languages) {
         t.false(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // Sanity check that getConfig returns undefined before we have called initConfig
         t.deepEqual(await configUtils.getConfig(tmpDir, logger), undefined);
-        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
+        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), logger);
         // The saved config file should now exist
         t.true(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // And that same newly-initialised config should now be returned by getConfig
@@ -144,7 +144,7 @@ function mockListLanguages(languages) {
 (0, ava_1.default)("load input outside of workspace", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, "../input", undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, "../input", undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -157,7 +157,7 @@ function mockListLanguages(languages) {
         // no filename given, just a repo
         const configFile = "octo-org/codeql-config@main";
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, configFile, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -171,7 +171,7 @@ function mockListLanguages(languages) {
         const configFile = "input";
         t.false(fs.existsSync(path.join(tmpDir, configFile)));
         try {
-            await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -247,7 +247,7 @@ function mockListLanguages(languages) {
         };
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        const actualConfig = await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, undefined, false, false, "my-artifact", "my-db", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const actualConfig = await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, false, false, "my-artifact", "my-db", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Should exactly equal the object we constructed earlier
         t.deepEqual(actualConfig, expectedConfig);
     });
@@ -286,7 +286,7 @@ function mockListLanguages(languages) {
         fs.mkdirSync(path.join(tmpDir, "foo"));
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolve queries was called correctly
         t.deepEqual(resolveQueriesArgs.length, 1);
         t.deepEqual(resolveQueriesArgs[0].queries, [
@@ -332,7 +332,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries
         // and once for `./foo` from the config file.
@@ -368,7 +368,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries and once for `./override`,
         // but won't be called for './foo' from the config file.
@@ -403,7 +403,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for `./workflow-query`,
         // but won't be called for the default one since that was disabled
@@ -432,7 +432,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly:
         // It'll be called once for the default queries,
         // and then once for each of the two queries from the workflow
@@ -474,7 +474,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, undefined, configFilePath, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries,
         // once for each of additional1 and additional2,
@@ -495,97 +495,6 @@ function queriesToResolvedQueryForm(queries) {
         t.true(config.queries["javascript"].custom[2].queries[0].endsWith(`${path.sep}foo`));
     });
 });
-(0, ava_1.default)("Queries can be specified using config input", async (t) => {
-    return await util.withTmpDir(async (tmpDir) => {
-        const configInput = `
-      name: my config
-      queries:
-        - uses: ./foo
-      packs:
-        javascript:
-          - a/b@1.2.3
-        python:
-          - c/d@1.2.3
-    `;
-        fs.mkdirSync(path.join(tmpDir, "foo"));
-        const resolveQueriesArgs = [];
-        const codeQL = (0, codeql_1.setCodeQL)({
-            async resolveQueries(queries, extraSearchPath) {
-                resolveQueriesArgs.push({ queries, extraSearchPath });
-                return queriesToResolvedQueryForm(queries);
-            },
-            async packDownload() {
-                return { packs: [] };
-            },
-        });
-        // Only JS, python packs will be ignored
-        const languages = "javascript";
-        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, configInput, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
-        // Check resolveQueries was called correctly
-        // It'll be called once for the default queries
-        // and once for `./foo` from the config file.
-        t.deepEqual(resolveQueriesArgs.length, 2);
-        t.deepEqual(resolveQueriesArgs[1].queries.length, 1);
-        t.true(resolveQueriesArgs[1].queries[0].endsWith(`${path.sep}foo`));
-        t.deepEqual(config.packs, {
-            [languages_1.Language.javascript]: ["a/b@1.2.3"],
-        });
-        // Now check that the end result contains the default queries and the query from config
-        t.deepEqual(config.queries["javascript"].builtin.length, 1);
-        t.deepEqual(config.queries["javascript"].custom.length, 1);
-        t.true(config.queries["javascript"].builtin[0].endsWith("javascript-code-scanning.qls"));
-        t.true(config.queries["javascript"].custom[0].queries[0].endsWith(`${path.sep}foo`));
-    });
-});
-(0, ava_1.default)("Using config input and file together, config input should be used.", async (t) => {
-    return await util.withTmpDir(async (tmpDir) => {
-        process.env["RUNNER_TEMP"] = tmpDir;
-        process.env["GITHUB_WORKSPACE"] = tmpDir;
-        const inputFileContents = `
-      name: my config
-      queries:
-        - uses: ./foo_file`;
-        const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        const configInput = `
-      name: my config
-      queries:
-        - uses: ./foo
-      packs:
-        javascript:
-          - a/b@1.2.3
-        python:
-          - c/d@1.2.3
-    `;
-        fs.mkdirSync(path.join(tmpDir, "foo"));
-        const resolveQueriesArgs = [];
-        const codeQL = (0, codeql_1.setCodeQL)({
-            async resolveQueries(queries, extraSearchPath) {
-                resolveQueriesArgs.push({ queries, extraSearchPath });
-                return queriesToResolvedQueryForm(queries);
-            },
-            async packDownload() {
-                return { packs: [] };
-            },
-        });
-        // Only JS, python packs will be ignored
-        const languages = "javascript";
-        const config = await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, configFilePath, configInput, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
-        // Check resolveQueries was called correctly
-        // It'll be called once for the default queries
-        // and once for `./foo` from the config file.
-        t.deepEqual(resolveQueriesArgs.length, 2);
-        t.deepEqual(resolveQueriesArgs[1].queries.length, 1);
-        t.true(resolveQueriesArgs[1].queries[0].endsWith(`${path.sep}foo`));
-        t.deepEqual(config.packs, {
-            [languages_1.Language.javascript]: ["a/b@1.2.3"],
-        });
-        // Now check that the end result contains the default queries and the query from config
-        t.deepEqual(config.queries["javascript"].builtin.length, 1);
-        t.deepEqual(config.queries["javascript"].custom.length, 1);
-        t.true(config.queries["javascript"].builtin[0].endsWith("javascript-code-scanning.qls"));
-        t.true(config.queries["javascript"].custom[0].queries[0].endsWith(`${path.sep}foo`));
-    });
-});
 (0, ava_1.default)("Invalid queries in workflow file handled correctly", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         const queries = "foo/bar@v1@v3";
@@ -607,7 +516,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         try {
-            await configUtils.initConfig(languages, queries, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(languages, queries, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             t.fail("initConfig did not throw error");
         }
         catch (err) {
@@ -653,7 +562,7 @@ function queriesToResolvedQueryForm(queries) {
         fs.mkdirSync(path.join(tmpDir, "foo/bar/dev"), { recursive: true });
         const configFile = "octo-org/codeql-config/config.yaml@main";
         const languages = "javascript";
-        await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         t.assert(spyGetContents.called);
     });
 });
@@ -663,7 +572,7 @@ function queriesToResolvedQueryForm(queries) {
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, repoReference, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, repoReference, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -679,7 +588,7 @@ function queriesToResolvedQueryForm(queries) {
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, repoReference, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, repoReference, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -699,7 +608,7 @@ function queriesToResolvedQueryForm(queries) {
             },
         });
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -711,7 +620,7 @@ function queriesToResolvedQueryForm(queries) {
     return await util.withTmpDir(async (tmpDir) => {
         const languages = "rubbish,english";
         try {
-            await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+            await configUtils.initConfig(languages, undefined, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, (0, codeql_1.getCachedCodeQL)(), tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -742,7 +651,7 @@ function queriesToResolvedQueryForm(queries) {
         const configFile = path.join(tmpDir, "codeql-config.yaml");
         fs.writeFileSync(configFile, inputFileContents);
         const languages = "javascript";
-        const { packs } = await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const { packs } = await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         t.deepEqual(packs, {
             [languages_1.Language.javascript]: ["a/b@1.2.3"],
         });
@@ -779,7 +688,7 @@ function queriesToResolvedQueryForm(queries) {
         fs.writeFileSync(configFile, inputFileContents);
         fs.mkdirSync(path.join(tmpDir, "foo"));
         const languages = "javascript,python,cpp";
-        const { packs, queries } = await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+        const { packs, queries } = await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
         t.deepEqual(packs, {
             [languages_1.Language.javascript]: ["a/b@1.2.3"],
             [languages_1.Language.python]: ["c/d@1.2.3"],
@@ -825,7 +734,7 @@ function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGen
             const inputFile = path.join(tmpDir, configFile);
             fs.writeFileSync(inputFile, inputFileContents, "utf8");
             try {
-                await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
+                await configUtils.initConfig(languages, undefined, undefined, undefined, configFile, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)([]), (0, logging_1.getRunnerLogger)(true));
                 throw new Error("initConfig did not throw error");
             }
             catch (err) {
@@ -1082,7 +991,7 @@ const mlPoweredQueriesMacro = ava_1.default.macro({
                     return { packs: [] };
                 },
             });
-            const { packs } = await configUtils.initConfig("javascript", queriesInput, packsInput, undefined, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example" }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)(isMlPoweredQueriesEnabled ? [feature_flags_1.Feature.MlPoweredQueriesEnabled] : []), (0, logging_1.getRunnerLogger)(true));
+            const { packs } = await configUtils.initConfig("javascript", queriesInput, packsInput, undefined, undefined, undefined, false, false, "", "", { owner: "github", repo: "example " }, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, (0, testing_utils_1.createFeatures)(isMlPoweredQueriesEnabled ? [feature_flags_1.Feature.MlPoweredQueriesEnabled] : []), (0, logging_1.getRunnerLogger)(true));
             if (expectedVersionString !== undefined) {
                 t.deepEqual(packs, {
                     [languages_1.Language.javascript]: [

lib/debug-artifacts.js

@@ -74,6 +74,7 @@ async function uploadSarifDebugArtifact(config, outputDir) {
 }
 exports.uploadSarifDebugArtifact = uploadSarifDebugArtifact;
 async function uploadLogsDebugArtifact(config) {
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
     let toUpload = [];
     for (const language of config.languages) {
         const databaseDirectory = (0, util_1.getCodeQLDatabasePath)(config, language);
@@ -82,12 +83,21 @@ async function uploadLogsDebugArtifact(config) {
             toUpload = toUpload.concat((0, util_1.listFolder)(logsDirectory));
         }
     }
-    // Multilanguage tracing: there are additional logs in the root of the cluster
-    const multiLanguageTracingLogsDirectory = path.resolve(config.dbLocation, "log");
-    if ((0, util_1.doesDirectoryExist)(multiLanguageTracingLogsDirectory)) {
-        toUpload = toUpload.concat((0, util_1.listFolder)(multiLanguageTracingLogsDirectory));
+    if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+        // Multilanguage tracing: there are additional logs in the root of the cluster
+        const multiLanguageTracingLogsDirectory = path.resolve(config.dbLocation, "log");
+        if ((0, util_1.doesDirectoryExist)(multiLanguageTracingLogsDirectory)) {
+            toUpload = toUpload.concat((0, util_1.listFolder)(multiLanguageTracingLogsDirectory));
+        }
     }
     await uploadDebugArtifacts(toUpload, config.dbLocation, config.debugArtifactName);
+    // Before multi-language tracing, we wrote a compound-build-tracer.log in the temp dir
+    if (!(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING))) {
+        const compoundBuildTracerLogDirectory = path.resolve(config.tempDir, "compound-build-tracer.log");
+        if ((0, util_1.doesDirectoryExist)(compoundBuildTracerLogDirectory)) {
+            await uploadDebugArtifacts([compoundBuildTracerLogDirectory], config.tempDir, config.debugArtifactName);
+        }
+    }
 }
 exports.uploadLogsDebugArtifact = uploadLogsDebugArtifact;
 /**

lib/debug-artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"debug-artifacts.js","sourceRoot":"","sources":["../src/debug-artifacts.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oDAAsC;AACtC,sDAA6B;AAC7B,8CAAsB;AAEtB,iDAAkD;AAClD,uCAA0C;AAC1C,qCAAqC;AAIrC,iCAKgB;AAEhB,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAFD,kDAEC;AAEM,KAAK,UAAU,oBAAoB,CACxC,QAAkB,EAClB,OAAe,EACf,YAAoB;IAEpB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACzB,OAAO;KACR;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE;QACV,IAAI;YACF,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAC9B,CAAC,IAAI,EAAE;gBACN,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;SAC7B;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,IAAI,CACP,+HAA+H,CAChI,CAAC;SACH;KACF;IACD,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,cAAc,CACpC,mBAAmB,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,EAC/C,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AA3BD,oDA2BC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC,IAAA,yBAAkB,EAAC,SAAS,CAAC,EAAE;QAClC,OAAO;KACR;IAED,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;YAC5B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACvC;KACF;IACD,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAhBD,4DAgBC;AAEM,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,iBAAiB,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,IAAA,yBAAkB,EAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,aAAa,CAAC,CAAC,CAAC;SACvD;KACF;IAED,8EAA8E;IAC9E,MAAM,iCAAiC,GAAG,IAAI,CAAC,OAAO,CACpD,MAAM,CAAC,UAAU,EACjB,KAAK,CACN,CAAC;IACF,IAAI,IAAA,yBAAkB,EAAC,iCAAiC,CAAC,EAAE;QACzD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,iCAAiC,CAAC,CAAC,CAAC;KAC3E;IAED,MAAM,oBAAoB,CACxB,QAAQ,EACR,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;AACJ,CAAC;AAxBD,0DAwBC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,MAAc,EACd,QAAkB;IAElB,MAAM,YAAY,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CACrC,MAAM,CAAC,UAAU,EACjB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,cAAc,CACtD,CAAC;IACF,IAAI,CAAC,IAAI,CACP,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,2DAA2D,kBAAkB,KAAK,CAC1H,CAAC;IACF,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QACrC,MAAM,IAAA,aAAG,EAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KAChD;IACD,MAAM,GAAG,GAAG,IAAI,iBAAM,EAAE,CAAC;IACzB,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAkB;IAElB,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,MAAM,IAAA,eAAQ,EACvC,MAAM,EACN,QAAQ,EACR,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,EACjC,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,EAAE,CAC1C,CAAC;IACF,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,IAAI,kBAA0B,CAAC;YAC/B,IAAI,CAAC,IAAA,uBAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC5C,kBAAkB,GAAG,MAAM,2BAA2B,CACpD,MAAM,EACN,QAAQ,CACT,CAAC;aACH;iBAAM;gBACL,kBAAkB,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACtE;YACD,MAAM,oBAAoB,CACxB,CAAC,kBAAkB,CAAC,EACpB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,IAAI,CAAC,IAAI,CACP,8CAA8C,MAAM,CAAC,iBAAiB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAC/F,CAAC;SACH;KACF;AACH,CAAC;AA1BD,8EA0BC"}
+{"version":3,"file":"debug-artifacts.js","sourceRoot":"","sources":["../src/debug-artifacts.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oDAAsC;AACtC,sDAA6B;AAC7B,8CAAsB;AAEtB,iDAAkD;AAClD,uCAA0C;AAC1C,qCAAiE;AAIjE,iCAMgB;AAEhB,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAFD,kDAEC;AAEM,KAAK,UAAU,oBAAoB,CACxC,QAAkB,EAClB,OAAe,EACf,YAAoB;IAEpB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACzB,OAAO;KACR;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE;QACV,IAAI;YACF,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAC9B,CAAC,IAAI,EAAE;gBACN,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;SAC7B;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,IAAI,CACP,+HAA+H,CAChI,CAAC;SACH;KACF;IACD,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,cAAc,CACpC,mBAAmB,CAAC,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC,EAC/C,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AA3BD,oDA2BC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,SAAiB;IAEjB,IAAI,CAAC,IAAA,yBAAkB,EAAC,SAAS,CAAC,EAAE;QAClC,OAAO;KACR;IAED,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;YAC5B,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;SACvC;KACF;IACD,MAAM,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC5E,CAAC;AAhBD,4DAgBC;AAEM,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,iBAAiB,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,IAAA,yBAAkB,EAAC,aAAa,CAAC,EAAE;YACrC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,aAAa,CAAC,CAAC,CAAC;SACvD;KACF;IAED,IAAI,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,mCAA0B,CAAC,EAAE;QAChE,8EAA8E;QAC9E,MAAM,iCAAiC,GAAG,IAAI,CAAC,OAAO,CACpD,MAAM,CAAC,UAAU,EACjB,KAAK,CACN,CAAC;QACF,IAAI,IAAA,yBAAkB,EAAC,iCAAiC,CAAC,EAAE;YACzD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAU,EAAC,iCAAiC,CAAC,CAAC,CAAC;SAC3E;KACF;IACD,MAAM,oBAAoB,CACxB,QAAQ,EACR,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;IAEF,sFAAsF;IACtF,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAkB,EAAC,MAAM,EAAE,mCAA0B,CAAC,CAAC,EAAE;QACnE,MAAM,+BAA+B,GAAG,IAAI,CAAC,OAAO,CAClD,MAAM,CAAC,OAAO,EACd,2BAA2B,CAC5B,CAAC;QACF,IAAI,IAAA,yBAAkB,EAAC,+BAA+B,CAAC,EAAE;YACvD,MAAM,oBAAoB,CACxB,CAAC,+BAA+B,CAAC,EACjC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;KACF;AACH,CAAC;AA1CD,0DA0CC;AAED;;;;GAIG;AACH,KAAK,UAAU,2BAA2B,CACxC,MAAc,EACd,QAAkB;IAElB,MAAM,YAAY,GAAG,IAAA,4BAAqB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CACrC,MAAM,CAAC,UAAU,EACjB,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,cAAc,CACtD,CAAC;IACF,IAAI,CAAC,IAAI,CACP,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,2DAA2D,kBAAkB,KAAK,CAC1H,CAAC;IACF,qEAAqE;IACrE,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QACrC,MAAM,IAAA,aAAG,EAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KAChD;IACD,MAAM,GAAG,GAAG,IAAI,iBAAM,EAAE,CAAC;IACzB,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACjC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACjC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAc,EACd,QAAkB;IAElB,kDAAkD;IAClD,MAAM,kBAAkB,GAAG,MAAM,IAAA,eAAQ,EACvC,MAAM,EACN,QAAQ,EACR,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,EACjC,GAAG,MAAM,CAAC,iBAAiB,IAAI,QAAQ,EAAE,CAC1C,CAAC;IACF,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAEM,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI;YACF,IAAI,kBAA0B,CAAC;YAC/B,IAAI,CAAC,IAAA,uBAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;gBAC5C,kBAAkB,GAAG,MAAM,2BAA2B,CACpD,MAAM,EACN,QAAQ,CACT,CAAC;aACH;iBAAM;gBACL,kBAAkB,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACtE;YACD,MAAM,oBAAoB,CACxB,CAAC,kBAAkB,CAAC,EACpB,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,iBAAiB,CACzB,CAAC;SACH;QAAC,OAAO,KAAK,EAAE;YACd,IAAI,CAAC,IAAI,CACP,8CAA8C,MAAM,CAAC,iBAAiB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAC/F,CAAC;SACH;KACF;AACH,CAAC;AA1BD,8EA0BC"}

lib/defaults.json

@@ -1,6 +1,6 @@
 {
-    "bundleVersion": "codeql-bundle-v2.13.5",
-    "cliVersion": "2.13.5",
-    "priorBundleVersion": "codeql-bundle-v2.13.4",
-    "priorCliVersion": "2.13.4"
+    "bundleVersion": "codeql-bundle-20230403",
+    "cliVersion": "2.12.6",
+    "priorBundleVersion": "codeql-bundle-20230317",
+    "priorCliVersion": "2.12.5"
 }

lib/environment.js

@@ -1,55 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EnvVar = void 0;
-var EnvVar;
-(function (EnvVar) {
-    /** Set to true when the `analyze` Action completes successfully. */
-    EnvVar["ANALYZE_DID_COMPLETE_SUCCESSFULLY"] = "CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY";
-    /** Set to "true" when the CodeQL Action has invoked the Go autobuilder. */
-    EnvVar["DID_AUTOBUILD_GOLANG"] = "CODEQL_ACTION_DID_AUTOBUILD_GOLANG";
-    /**
-     * Used to disable the SARIF post-processing in the Action that removes duplicate locations from
-     * notifications in the `run[].invocations[].toolExecutionNotifications` SARIF property.
-     */
-    EnvVar["DISABLE_DUPLICATE_LOCATION_FIX"] = "CODEQL_ACTION_DISABLE_DUPLICATE_LOCATION_FIX";
-    /**
-     * If set to the "true" string, then the CodeQL Action is using its
-     * own deprecated and non-standard way of scanning for multiple
-     * languages.
-     */
-    EnvVar["FEATURE_MULTI_LANGUAGE"] = "CODEQL_ACTION_FEATURE_MULTI_LANGUAGE";
-    /**
-     * If set to the "true" string, then the CodeQL Action is using its
-     * own sandwiched workflow mechanism.
-     */
-    EnvVar["FEATURE_SANDWICH"] = "CODEQL_ACTION_FEATURE_SANDWICH";
-    /**
-     * If set to a truthy value, then the CodeQL Action might combine SARIF
-     * output from several `interpret-results` runs for the same language.
-     */
-    EnvVar["FEATURE_SARIF_COMBINE"] = "CODEQL_ACTION_FEATURE_SARIF_COMBINE";
-    /**
-     * If set to the "true" string, then the CodeQL Action will upload SARIF,
-     * not the CLI.
-     */
-    EnvVar["FEATURE_WILL_UPLOAD"] = "CODEQL_ACTION_FEATURE_WILL_UPLOAD";
-    /** UUID representing the current job run. */
-    EnvVar["JOB_RUN_UUID"] = "JOB_RUN_UUID";
-    EnvVar["ODASA_TRACER_CONFIGURATION"] = "ODASA_TRACER_CONFIGURATION";
-    /** Whether to suppress the warning if the current CLI will soon be unsupported. */
-    EnvVar["SUPPRESS_DEPRECATED_SOON_WARNING"] = "CODEQL_ACTION_SUPPRESS_DEPRECATED_SOON_WARNING";
-    /** Used to disable uploading SARIF results or status reports to the GitHub API */
-    EnvVar["TEST_MODE"] = "CODEQL_ACTION_TEST_MODE";
-    EnvVar["TESTING_ENVIRONMENT"] = "CODEQL_ACTION_TESTING_ENVIRONMENT";
-    /** Semver of the CodeQL Action as specified in `package.json`. */
-    EnvVar["VERSION"] = "CODEQL_ACTION_VERSION";
-    /**
-     * The time at which the first action (normally init) started executing.
-     * If a workflow invokes a different action without first invoking the init
-     * action (i.e. the upload action is being used by a third-party integrator)
-     * then this variable will be assigned the start time of the action invoked
-     * rather that the init action.
-     */
-    EnvVar["WORKFLOW_STARTED_AT"] = "CODEQL_WORKFLOW_STARTED_AT";
-})(EnvVar = exports.EnvVar || (exports.EnvVar = {}));
-//# sourceMappingURL=environment.js.map

lib/environment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../src/environment.ts"],"names":[],"mappings":";;;AAAA,IAAY,MA8DX;AA9DD,WAAY,MAAM;IAChB,oEAAoE;IACpE,+FAAqF,CAAA;IAErF,2EAA2E;IAC3E,qEAA2D,CAAA;IAE3D;;;OAGG;IACH,yFAA+E,CAAA;IAE/E;;;;OAIG;IACH,yEAA+D,CAAA;IAE/D;;;OAGG;IACH,6DAAmD,CAAA;IAEnD;;;OAGG;IACH,uEAA6D,CAAA;IAE7D;;;OAGG;IACH,mEAAyD,CAAA;IAEzD,6CAA6C;IAC7C,uCAA6B,CAAA;IAE7B,mEAAyD,CAAA;IAEzD,mFAAmF;IACnF,6FAAmF,CAAA;IAEnF,kFAAkF;IAClF,+CAAqC,CAAA;IAErC,mEAAyD,CAAA;IAEzD,kEAAkE;IAClE,2CAAiC,CAAA;IAEjC;;;;;;OAMG;IACH,4DAAkD,CAAA;AACpD,CAAC,EA9DW,MAAM,GAAN,cAAM,KAAN,cAAM,QA8DjB"}

lib/feature-flags.js

@@ -28,7 +28,6 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const semver = __importStar(require("semver"));
 const api_client_1 = require("./api-client");
-const codeql_1 = require("./codeql");
 const defaults = __importStar(require("./defaults.json"));
 const util = __importStar(require("./util"));
 const DEFAULT_VERSION_FEATURE_FLAG_PREFIX = "default_codeql_version_";
@@ -37,11 +36,9 @@ var Feature;
 (function (Feature) {
     Feature["CliConfigFileEnabled"] = "cli_config_file_enabled";
     Feature["DisableKotlinAnalysisEnabled"] = "disable_kotlin_analysis_enabled";
-    Feature["DisablePythonDependencyInstallationEnabled"] = "disable_python_dependency_installation_enabled";
+    Feature["ExportCodeScanningConfigEnabled"] = "export_code_scanning_config_enabled";
     Feature["ExportDiagnosticsEnabled"] = "export_diagnostics_enabled";
     Feature["MlPoweredQueriesEnabled"] = "ml_powered_queries_enabled";
-    Feature["NewAnalysisSummaryEnabled"] = "new_analysis_summary_enabled";
-    Feature["QaTelemetryEnabled"] = "qa_telemetry_enabled";
     Feature["UploadFailedSarifEnabled"] = "upload_failed_sarif_enabled";
 })(Feature = exports.Feature || (exports.Feature = {}));
 exports.featureConfig = {
@@ -55,6 +52,11 @@ exports.featureConfig = {
         minimumVersion: "2.11.6",
         defaultValue: true,
     },
+    [Feature.ExportCodeScanningConfigEnabled]: {
+        envVar: "CODEQL_ACTION_EXPORT_CODE_SCANNING_CONFIG",
+        minimumVersion: "2.12.3",
+        defaultValue: true,
+    },
     [Feature.ExportDiagnosticsEnabled]: {
         envVar: "CODEQL_ACTION_EXPORT_DIAGNOSTICS",
         minimumVersion: "2.12.4",
@@ -65,31 +67,11 @@ exports.featureConfig = {
         minimumVersion: "2.7.5",
         defaultValue: false,
     },
-    [Feature.NewAnalysisSummaryEnabled]: {
-        envVar: "CODEQL_ACTION_NEW_ANALYSIS_SUMMARY",
-        minimumVersion: codeql_1.CODEQL_VERSION_NEW_ANALYSIS_SUMMARY,
-        defaultValue: false,
-    },
-    [Feature.QaTelemetryEnabled]: {
-        envVar: "CODEQL_ACTION_QA_TELEMETRY",
-        minimumVersion: undefined,
-        defaultValue: false,
-    },
     [Feature.UploadFailedSarifEnabled]: {
         envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
         minimumVersion: "2.11.3",
         defaultValue: true,
     },
-    [Feature.DisablePythonDependencyInstallationEnabled]: {
-        envVar: "CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION",
-        // Although the python extractor only started supporting not extracting installed
-        // dependencies in 2.13.1, the init-action can still benefit from not installing
-        // dependencies no matter what codeql version we are using, so therefore the
-        // minimumVersion is set to 'undefined'. This means that with an old CodeQL version,
-        // packages available with current python3 installation might get extracted.
-        minimumVersion: undefined,
-        defaultValue: false,
-    },
 };
 exports.FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";
 /**
@@ -181,20 +163,26 @@ class GitHubFeatureFlags {
     }
     async getDefaultCliVersion(variant) {
         if (variant === util.GitHubVariant.DOTCOM) {
-            return await this.getDefaultDotcomCliVersion();
+            const defaultDotComCliVersion = await this.getDefaultDotcomCliVersion();
+            return {
+                cliVersion: defaultDotComCliVersion.version,
+                toolsFeatureFlagsValid: this.hasAccessedRemoteFeatureFlags
+                    ? defaultDotComCliVersion.toolsFeatureFlagsValid
+                    : undefined,
+                variant,
+            };
         }
         return {
             cliVersion: defaults.cliVersion,
             tagName: defaults.bundleVersion,
+            variant,
         };
     }
     async getDefaultDotcomCliVersion() {
         const response = await this.getAllFeatures();
         const enabledFeatureFlagCliVersions = Object.entries(response)
             .map(([f, isEnabled]) => isEnabled ? this.getCliVersionFromFeatureFlag(f) : undefined)
-            .filter((f) => f !== undefined &&
-            // Only consider versions that have semantically versioned bundles.
-            semver.gte(f, codeql_1.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED))
+            .filter((f) => f !== undefined)
             .map((f) => f);
         if (enabledFeatureFlagCliVersions.length === 0) {
             // We expect at least one default CLI version to be enabled on Dotcom at any time. However if
@@ -209,22 +197,16 @@ class GitHubFeatureFlags {
             // version that would have been specified by the feature flags before they were misconfigured.
             this.logger.warning("Feature flags do not specify a default CLI version. Falling back to the CLI version " +
                 `shipped with the Action. This is ${defaults.cliVersion}.`);
-            const result = {
-                cliVersion: defaults.cliVersion,
-                tagName: defaults.bundleVersion,
+            return {
+                version: defaults.cliVersion,
+                toolsFeatureFlagsValid: this.hasAccessedRemoteFeatureFlags
+                    ? false
+                    : undefined,
             };
-            if (this.hasAccessedRemoteFeatureFlags) {
-                result.toolsFeatureFlagsValid = false;
-            }
-            return result;
         }
         const maxCliVersion = enabledFeatureFlagCliVersions.reduce((maxVersion, currentVersion) => currentVersion > maxVersion ? currentVersion : maxVersion, enabledFeatureFlagCliVersions[0]);
         this.logger.debug(`Derived default CLI version of ${maxCliVersion} from feature flags.`);
-        return {
-            cliVersion: maxCliVersion,
-            tagName: `codeql-bundle-v${maxCliVersion}`,
-            toolsFeatureFlagsValid: true,
-        };
+        return { version: maxCliVersion, toolsFeatureFlagsValid: true };
     }
     async getValue(feature) {
         const response = await this.getAllFeatures();

lib/feature-flags.test.js

@@ -223,40 +223,27 @@ for (const variant of [util_1.GitHubVariant.GHAE, util_1.GitHubVariant.GHES]) {
             t.deepEqual(defaultCliVersion, {
                 cliVersion: defaults.cliVersion,
                 tagName: defaults.bundleVersion,
+                variant,
             });
         });
     });
 }
-(0, ava_1.default)("selects CLI v2.20.1 on Dotcom when feature flags enable v2.20.0 and v2.20.1", async (t) => {
+(0, ava_1.default)("selects CLI v2.12.1 on Dotcom when feature flags enable v2.12.0 and v2.12.1", async (t) => {
     await (0, util_1.withTmpDir)(async (tmpDir) => {
         const features = setUpFeatureFlagTests(tmpDir);
         const expectedFeatureEnablement = initializeFeatures(true);
-        expectedFeatureEnablement["default_codeql_version_2_20_0_enabled"] = true;
-        expectedFeatureEnablement["default_codeql_version_2_20_1_enabled"] = true;
-        expectedFeatureEnablement["default_codeql_version_2_20_2_enabled"] = false;
-        expectedFeatureEnablement["default_codeql_version_2_20_3_enabled"] = false;
-        expectedFeatureEnablement["default_codeql_version_2_20_4_enabled"] = false;
-        expectedFeatureEnablement["default_codeql_version_2_20_5_enabled"] = false;
+        expectedFeatureEnablement["default_codeql_version_2_12_0_enabled"] = true;
+        expectedFeatureEnablement["default_codeql_version_2_12_1_enabled"] = true;
+        expectedFeatureEnablement["default_codeql_version_2_12_2_enabled"] = false;
+        expectedFeatureEnablement["default_codeql_version_2_12_3_enabled"] = false;
+        expectedFeatureEnablement["default_codeql_version_2_12_4_enabled"] = false;
+        expectedFeatureEnablement["default_codeql_version_2_12_5_enabled"] = false;
         (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
         const defaultCliVersion = await features.getDefaultCliVersion(util_1.GitHubVariant.DOTCOM);
         t.deepEqual(defaultCliVersion, {
-            cliVersion: "2.20.1",
-            tagName: "codeql-bundle-v2.20.1",
-            toolsFeatureFlagsValid: true,
-        });
-    });
-});
-(0, ava_1.default)("includes tag name when feature flags enable version greater than v2.13.4", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        const features = setUpFeatureFlagTests(tmpDir);
-        const expectedFeatureEnablement = initializeFeatures(true);
-        expectedFeatureEnablement["default_codeql_version_2_20_0_enabled"] = true;
-        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
-        const defaultCliVersion = await features.getDefaultCliVersion(util_1.GitHubVariant.DOTCOM);
-        t.deepEqual(defaultCliVersion, {
-            cliVersion: "2.20.0",
-            tagName: "codeql-bundle-v2.20.0",
+            cliVersion: "2.12.1",
             toolsFeatureFlagsValid: true,
+            variant: util_1.GitHubVariant.DOTCOM,
         });
     });
 });
@@ -268,23 +255,8 @@ for (const variant of [util_1.GitHubVariant.GHAE, util_1.GitHubVariant.GHES]) {
         const defaultCliVersion = await features.getDefaultCliVersion(util_1.GitHubVariant.DOTCOM);
         t.deepEqual(defaultCliVersion, {
             cliVersion: defaults.cliVersion,
-            tagName: defaults.bundleVersion,
-            toolsFeatureFlagsValid: false,
-        });
-    });
-});
-(0, ava_1.default)(`selects CLI from defaults.json on Dotcom when default version feature flags are unsupported`, async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        const features = setUpFeatureFlagTests(tmpDir);
-        const expectedFeatureEnablement = initializeFeatures(true);
-        // Doesn't have a semantically versioned bundle
-        expectedFeatureEnablement["default_codeql_version_2_13_3_enabled"] = true;
-        (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
-        const defaultCliVersion = await features.getDefaultCliVersion(util_1.GitHubVariant.DOTCOM);
-        t.deepEqual(defaultCliVersion, {
-            cliVersion: defaults.cliVersion,
-            tagName: defaults.bundleVersion,
             toolsFeatureFlagsValid: false,
+            variant: util_1.GitHubVariant.DOTCOM,
         });
     });
 });
@@ -293,20 +265,20 @@ for (const variant of [util_1.GitHubVariant.GHAE, util_1.GitHubVariant.GHES]) {
         const loggedMessages = [];
         const features = setUpFeatureFlagTests(tmpDir, (0, testing_utils_1.getRecordingLogger)(loggedMessages));
         const expectedFeatureEnablement = initializeFeatures(true);
-        expectedFeatureEnablement["default_codeql_version_2_20_0_enabled"] = true;
-        expectedFeatureEnablement["default_codeql_version_2_20_1_enabled"] = true;
-        expectedFeatureEnablement["default_codeql_version_2_20_invalid_enabled"] =
+        expectedFeatureEnablement["default_codeql_version_2_12_0_enabled"] = true;
+        expectedFeatureEnablement["default_codeql_version_2_12_1_enabled"] = true;
+        expectedFeatureEnablement["default_codeql_version_2_12_invalid_enabled"] =
             true;
         (0, testing_utils_1.mockFeatureFlagApiEndpoint)(200, expectedFeatureEnablement);
         const defaultCliVersion = await features.getDefaultCliVersion(util_1.GitHubVariant.DOTCOM);
         t.deepEqual(defaultCliVersion, {
-            cliVersion: "2.20.1",
-            tagName: "codeql-bundle-v2.20.1",
+            cliVersion: "2.12.1",
             toolsFeatureFlagsValid: true,
+            variant: util_1.GitHubVariant.DOTCOM,
         });
         t.assert(loggedMessages.find((v) => v.type === "warning" &&
             v.message ===
-                "Ignoring feature flag default_codeql_version_2_20_invalid_enabled as it does not specify a valid CodeQL version.") !== undefined);
+                "Ignoring feature flag default_codeql_version_2_12_invalid_enabled as it does not specify a valid CodeQL version.") !== undefined);
     });
 });
 function assertAllFeaturesUndefinedInApi(t, loggedMessages) {

lib/fingerprints.js

@@ -194,14 +194,7 @@ function resolveUriToFile(location, artifacts, sourceRoot, logger) {
         logger.debug(`Ignoring location as URI "${location.uri}" is invalid`);
         return undefined;
     }
-    let uri;
-    try {
-        uri = decodeURIComponent(location.uri);
-    }
-    catch (e) {
-        logger.debug(`Ignoring location as URI "${location.uri}" is invalid`);
-        return undefined;
-    }
+    let uri = decodeURIComponent(location.uri);
     // Remove a file scheme, and abort if the scheme is anything else
     const fileUriPrefix = "file://";
     if (uri.startsWith(fileUriPrefix)) {

lib/init-action-post-helper.js

@@ -28,8 +28,8 @@ const core = __importStar(require("@actions/core"));
 const actionsUtil = __importStar(require("./actions-util"));
 const codeql_1 = require("./codeql");
 const config_utils_1 = require("./config-utils");
-const environment_1 = require("./environment");
 const feature_flags_1 = require("./feature-flags");
+const shared_environment_1 = require("./shared-environment");
 const uploadLib = __importStar(require("./upload-lib"));
 const util_1 = require("./util");
 const workflow_1 = require("./workflow");
@@ -52,7 +52,7 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
     if (!(await features.getValue(feature_flags_1.Feature.UploadFailedSarifEnabled, codeql))) {
         return { upload_failed_run_skipped_because: "Feature disabled" };
     }
-    const workflow = await (0, workflow_1.getWorkflow)(logger);
+    const workflow = await (0, workflow_1.getWorkflow)();
     const jobName = (0, util_1.getRequiredEnvParam)("GITHUB_JOB");
     const matrix = (0, util_1.parseMatrixInput)(actionsUtil.getRequiredInput("matrix"));
     const shouldUpload = (0, workflow_1.getUploadInputOrThrow)(workflow, jobName, matrix);
@@ -67,7 +67,7 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
     // If there is no database or the feature flag is off, we run 'export diagnostics'
     if (databasePath === undefined ||
         !(await features.getValue(feature_flags_1.Feature.ExportDiagnosticsEnabled, codeql))) {
-        await codeql.diagnosticsExport(sarifFile, category, config);
+        await codeql.diagnosticsExport(sarifFile, category, config, features);
     }
     else {
         // We call 'database export-diagnostics' to find any per-database diagnostics.
@@ -79,7 +79,7 @@ async function maybeUploadFailedSarif(config, repositoryNwo, features, logger) {
     return uploadResult?.statusReport ?? {};
 }
 async function tryUploadSarifIfRunFailed(config, repositoryNwo, features, logger) {
-    if (process.env[environment_1.EnvVar.ANALYZE_DID_COMPLETE_SUCCESSFULLY] !== "true") {
+    if (process.env[shared_environment_1.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY] !== "true") {
         try {
             return await maybeUploadFailedSarif(config, repositoryNwo, features, logger);
         }
@@ -110,9 +110,8 @@ async function run(uploadDatabaseBundleDebugArtifact, uploadLogsDebugArtifact, p
     // but we didn't upload anything.
     if (process.env["CODEQL_ACTION_EXPECT_UPLOAD_FAILED_SARIF"] === "true" &&
         !uploadFailedSarifResult.raw_upload_size_bytes) {
-        const error = JSON.stringify(uploadFailedSarifResult);
         throw new Error("Expected to upload a failed SARIF file for this CodeQL code scanning run, " +
-            `but the result was instead ${error}.`);
+            `but the result was instead ${uploadFailedSarifResult}.`);
     }
     // Upload appropriate Actions artifacts for debugging
     if (config.debugMode) {

lib/init-action-post-helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-action-post-helper.js","sourceRoot":"","sources":["../src/init-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,qCAAqC;AACrC,iDAAmD;AACnD,+CAAuC;AACvC,mDAA6D;AAG7D,wDAA0C;AAC1C,iCAKgB;AAChB,yCAKoB;AAWpB,SAAS,mCAAmC,CAC1C,KAAc;IAEd,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;IACtC,OAAO;QACL,uBAAuB,EAAE,YAAY,CAAC,OAAO;QAC7C,6BAA6B,EAAE,YAAY,CAAC,KAAK;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;QACrB,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EAAE;QACxE,OAAO,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,CAAC;KAClE;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,EAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAA,0BAAmB,EAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAA,gCAAqB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAClC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CACzC;QACD,IAAA,mBAAY,GAAE,EACd;QACA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,QAAQ,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IAEvC,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,kFAAkF;IAClF,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EACpE;QACA,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;KAC7D;SAAM;QACL,8EAA8E;QAC9E,MAAM,MAAM,CAAC,yBAAyB,CACpC,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;KACH;IAED,IAAI,CAAC,IAAI,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,MAAM,CACP,CAAC;IACF,MAAM,SAAS,CAAC,iBAAiB,CAC/B,aAAa,EACb,YAAY,CAAC,OAAO,EACpB,MAAM,EACN,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,YAAY,EAAE,YAAY,IAAI,EAAE,CAAC;AAC1C,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAM,CAAC,iCAAiC,CAAC,KAAK,MAAM,EAAE;QACpE,IAAI;YACF,OAAO,MAAM,sBAAsB,CACjC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CACV,2EAA2E,CAAC,EAAE,CAC/E,CAAC;YACF,OAAO,mCAAmC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,OAAO;YACL,iCAAiC,EAC/B,uCAAuC;SAC1C,CAAC;KACH;AACH,CAAC;AA1BD,8DA0BC;AAEM,KAAK,UAAU,GAAG,CACvB,iCAA2C,EAC3C,uBAAiC,EACjC,cAAwB,EACxB,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,CAAC,OAAO,CACZ,iGAAiG,CAClG,CAAC;QACF,OAAO;KACR;IAED,MAAM,uBAAuB,GAAG,MAAM,yBAAyB,CAC7D,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,uBAAuB,CAAC,iCAAiC,EAAE;QAC7D,MAAM,CAAC,KAAK,CACV,8EAA8E;YAC5E,GAAG,uBAAuB,CAAC,iCAAiC,GAAG,CAClE,CAAC;KACH;IACD,8FAA8F;IAC9F,iCAAiC;IACjC,IACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,MAAM;QAClE,CAAC,uBAAuB,CAAC,qBAAqB,EAC9C;QACA,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,8BAA8B,KAAK,GAAG,CACzC,CAAC;KACH;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CACP,mGAAmG,CACpG,CAAC;QACF,MAAM,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;KAC9B;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAtDD,kBAsDC"}
+{"version":3,"file":"init-action-post-helper.js","sourceRoot":"","sources":["../src/init-action-post-helper.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,qCAAqC;AACrC,iDAAmD;AACnD,mDAA6D;AAG7D,6DAAuF;AACvF,wDAA0C;AAC1C,iCAKgB;AAChB,yCAKoB;AAWpB,SAAS,mCAAmC,CAC1C,KAAc;IAEd,MAAM,YAAY,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;IACtC,OAAO;QACL,uBAAuB,EAAE,YAAY,CAAC,OAAO;QAC7C,6BAA6B,EAAE,YAAY,CAAC,KAAK;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;QACrB,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EAAE;QACxE,OAAO,EAAE,iCAAiC,EAAE,kBAAkB,EAAE,CAAC;KAClE;IACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAW,GAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAA,0BAAmB,EAAC,YAAY,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,uBAAgB,EAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,IAAA,gCAAqB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,IACE,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAClC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CACzC;QACD,IAAA,mBAAY,GAAE,EACd;QACA,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,CAAC;KAC1E;IACD,MAAM,QAAQ,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAA,sCAA2B,EAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;IAEvC,MAAM,SAAS,GAAG,4BAA4B,CAAC;IAE/C,kFAAkF;IAClF,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,uBAAO,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,EACpE;QACA,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;KACvE;SAAM;QACL,8EAA8E;QAC9E,MAAM,MAAM,CAAC,yBAAyB,CACpC,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;KACH;IAED,IAAI,CAAC,IAAI,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,MAAM,CACP,CAAC;IACF,MAAM,SAAS,CAAC,iBAAiB,CAC/B,aAAa,EACb,YAAY,CAAC,OAAO,EACpB,MAAM,EACN,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;IACF,OAAO,YAAY,EAAE,YAAY,IAAI,EAAE,CAAC;AAC1C,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,IAAI,OAAO,CAAC,GAAG,CAAC,oEAA+C,CAAC,KAAK,MAAM,EAAE;QAC3E,IAAI;YACF,OAAO,MAAM,sBAAsB,CACjC,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,KAAK,CACV,2EAA2E,CAAC,EAAE,CAC/E,CAAC;YACF,OAAO,mCAAmC,CAAC,CAAC,CAAC,CAAC;SAC/C;KACF;SAAM;QACL,OAAO;YACL,iCAAiC,EAC/B,uCAAuC;SAC1C,CAAC;KACH;AACH,CAAC;AA1BD,8DA0BC;AAEM,KAAK,UAAU,GAAG,CACvB,iCAA2C,EAC3C,uBAAiC,EACjC,cAAwB,EACxB,aAA4B,EAC5B,QAA2B,EAC3B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAS,EAAC,WAAW,CAAC,qBAAqB,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;QACxB,MAAM,CAAC,OAAO,CACZ,iGAAiG,CAClG,CAAC;QACF,OAAO;KACR;IAED,MAAM,uBAAuB,GAAG,MAAM,yBAAyB,CAC7D,MAAM,EACN,aAAa,EACb,QAAQ,EACR,MAAM,CACP,CAAC;IAEF,IAAI,uBAAuB,CAAC,iCAAiC,EAAE;QAC7D,MAAM,CAAC,KAAK,CACV,8EAA8E;YAC5E,GAAG,uBAAuB,CAAC,iCAAiC,GAAG,CAClE,CAAC;KACH;IACD,8FAA8F;IAC9F,iCAAiC;IACjC,IACE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,MAAM;QAClE,CAAC,uBAAuB,CAAC,qBAAqB,EAC9C;QACA,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,8BAA8B,uBAAuB,GAAG,CAC3D,CAAC;KACH;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE;QACpB,IAAI,CAAC,IAAI,CACP,mGAAmG,CACpG,CAAC;QACF,MAAM,iCAAiC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;KAC9B;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC;AArDD,kBAqDC"}

lib/init-action-post-helper.test.js

@@ -347,7 +347,7 @@ async function testFailedSarifUpload(t, actionsWorkflow, { category, databaseExi
             t.true(databaseExportDiagnosticsStub.calledOnceWith(config.dbLocation, sinon.match.string, category, sinon.match.any, sinon.match.any), `Actual args were: ${databaseExportDiagnosticsStub.args}`);
         }
         else {
-            t.true(diagnosticsExportStub.calledOnceWith(sinon.match.string, category, config), `Actual args were: ${diagnosticsExportStub.args}`);
+            t.true(diagnosticsExportStub.calledOnceWith(sinon.match.string, category, config, sinon.match.any), `Actual args were: ${diagnosticsExportStub.args}`);
         }
         t.true(uploadFromActions.calledOnceWith(sinon.match.string, sinon.match.string, category, sinon.match.any), `Actual args were: ${uploadFromActions.args}`);
         t.true(waitForProcessing.calledOnceWith(sinon.match.any, "42", sinon.match.any, {

lib/init-action.js

@@ -25,10 +25,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
-const uuid_1 = require("uuid");
 const actions_util_1 = require("./actions-util");
 const api_client_1 = require("./api-client");
-const environment_1 = require("./environment");
+const codeql_1 = require("./codeql");
 const feature_flags_1 = require("./feature-flags");
 const init_1 = require("./init");
 const languages_1 = require("./languages");
@@ -116,20 +115,22 @@ async function run() {
     const repositoryNwo = (0, repository_1.parseRepositoryNwo)((0, util_1.getRequiredEnvParam)("GITHUB_REPOSITORY"));
     const registriesInput = (0, actions_util_1.getOptionalInput)("registries");
     const features = new feature_flags_1.Features(gitHubVersion, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), logger);
-    core.exportVariable(environment_1.EnvVar.JOB_RUN_UUID, (0, uuid_1.v4)());
     try {
-        const workflowErrors = await (0, workflow_1.validateWorkflow)(logger);
+        const workflowErrors = await (0, workflow_1.validateWorkflow)();
         if (!(await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)("init", "starting", startedAt, workflowErrors)))) {
             return;
         }
         const codeQLDefaultVersionInfo = await features.getDefaultCliVersion(gitHubVersion.type);
-        toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
+        if (codeQLDefaultVersionInfo.variant === util_1.GitHubVariant.DOTCOM) {
+            toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid;
+        }
         const initCodeQLResult = await (0, init_1.initCodeQL)((0, actions_util_1.getOptionalInput)("tools"), apiDetails, (0, actions_util_1.getTemporaryDirectory)(), gitHubVersion.type, codeQLDefaultVersionInfo, logger);
         codeql = initCodeQLResult.codeql;
         toolsDownloadDurationMs = initCodeQLResult.toolsDownloadDurationMs;
         toolsVersion = initCodeQLResult.toolsVersion;
         toolsSource = initCodeQLResult.toolsSource;
-        config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), registriesInput, (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), (0, actions_util_1.getOptionalInput)("config"), getTrapCachingEnabled(), 
+        await (0, codeql_1.enrichEnvironment)(codeql);
+        config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), registriesInput, (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), getTrapCachingEnabled(), 
         // Debug mode is enabled if:
         // - The `init` Action is passed `debug: true`.
         // - Actions step debugging is enabled (e.g. by [enabling debug logging for a rerun](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs#re-running-all-the-jobs-in-a-workflow),
@@ -137,17 +138,12 @@ async function run() {
         (0, actions_util_1.getOptionalInput)("debug") === "true" || core.isDebug(), (0, actions_util_1.getOptionalInput)("debug-artifact-name") || util_1.DEFAULT_DEBUG_ARTIFACT_NAME, (0, actions_util_1.getOptionalInput)("debug-database-name") || util_1.DEFAULT_DEBUG_DATABASE_NAME, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), codeql, (0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), gitHubVersion, apiDetails, features, logger);
         if (config.languages.includes(languages_1.Language.python) &&
             (0, actions_util_1.getRequiredInput)("setup-python-dependencies") === "true") {
-            if (await features.getValue(feature_flags_1.Feature.DisablePythonDependencyInstallationEnabled, codeql)) {
-                logger.info("Skipping python dependency installation");
+            try {
+                await (0, init_1.installPythonDeps)(codeql, logger);
             }
-            else {
-                try {
-                    await (0, init_1.installPythonDeps)(codeql, logger);
-                }
-                catch (unwrappedError) {
-                    const error = (0, util_1.wrapError)(unwrappedError);
-                    logger.warning(`${error.message} You can call this action with 'setup-python-dependencies: false' to disable this process`);
-                }
+            catch (unwrappedError) {
+                const error = (0, util_1.wrapError)(unwrappedError);
+                logger.warning(`${error.message} You can call this action with 'setup-python-dependencies: false' to disable this process`);
             }
         }
     }
@@ -176,16 +172,16 @@ async function run() {
         if (await features.getValue(feature_flags_1.Feature.DisableKotlinAnalysisEnabled)) {
             core.exportVariable("CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN", "true");
         }
-        // Disable Python dependency extraction if feature flag set
-        if (await features.getValue(feature_flags_1.Feature.DisablePythonDependencyInstallationEnabled, codeql)) {
-            core.exportVariable("CODEQL_EXTRACTOR_PYTHON_DISABLE_LIBRARY_EXTRACTION", "true");
-        }
         const sourceRoot = path.resolve((0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), (0, actions_util_1.getOptionalInput)("source-root") || "");
         const tracerConfig = await (0, init_1.runInit)(codeql, config, sourceRoot, "Runner.Worker.exe", registriesInput, features, apiDetails, logger);
         if (tracerConfig !== undefined) {
             for (const [key, value] of Object.entries(tracerConfig.env)) {
                 core.exportVariable(key, value);
             }
+            if (process.platform === "win32" &&
+                !(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING))) {
+                await (0, init_1.injectWindowsTracer)("Runner.Worker.exe", undefined, config, codeql, tracerConfig);
+            }
         }
         core.setOutput("codeql-path", config.codeQLCmd);
     }

lib/init.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.installPythonDeps = exports.runInit = exports.initConfig = exports.initCodeQL = exports.ToolsSource = void 0;
+exports.installPythonDeps = exports.injectWindowsTracer = exports.runInit = exports.initConfig = exports.initCodeQL = exports.ToolsSource = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
@@ -33,6 +33,7 @@ const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
 const tracer_config_1 = require("./tracer-config");
 const util = __importStar(require("./util"));
+const util_1 = require("./util");
 var ToolsSource;
 (function (ToolsSource) {
     ToolsSource["Unknown"] = "UNKNOWN";
@@ -48,9 +49,9 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe
     return { codeql, toolsDownloadDurationMs, toolsSource, toolsVersion };
 }
 exports.initCodeQL = initCodeQL;
-async function initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, configInput, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
+async function initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger) {
     logger.startGroup("Load language configuration");
-    const config = await configUtils.initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, configInput, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
+    const config = await configUtils.initConfig(languagesInput, queriesInput, packsInput, registriesInput, configFile, dbLocation, trapCachingEnabled, debugMode, debugArtifactName, debugDatabaseName, repository, tempDir, codeQL, workspacePath, gitHubVersion, apiDetails, features, logger);
     analysisPaths.printPathFiltersWarning(config, logger);
     logger.endGroup();
     return config;
@@ -59,27 +60,35 @@ exports.initConfig = initConfig;
 async function runInit(codeql, config, sourceRoot, processName, registriesInput, features, apiDetails, logger) {
     fs.mkdirSync(config.dbLocation, { recursive: true });
     try {
-        // When parsing the codeql config in the CLI, we have not yet created the qlconfig file.
-        // So, create it now.
-        // If we are parsing the config file in the Action, then the qlconfig file was already created
-        // before the `pack download` command was invoked. It is not required for the init command.
-        let registriesAuthTokens;
-        let qlconfigFile;
-        if (await util.useCodeScanningConfigInCli(codeql, features)) {
-            ({ registriesAuthTokens, qlconfigFile } =
-                await configUtils.generateRegistries(registriesInput, codeql, config.tempDir, logger));
+        if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+            // When parsing the codeql config in the CLI, we have not yet created the qlconfig file.
+            // So, create it now.
+            // If we are parsing the config file in the Action, then the qlconfig file was already created
+            // before the `pack download` command was invoked. It is not required for the init command.
+            let registriesAuthTokens;
+            let qlconfigFile;
+            if (await util.useCodeScanningConfigInCli(codeql, features)) {
+                ({ registriesAuthTokens, qlconfigFile } =
+                    await configUtils.generateRegistries(registriesInput, codeql, config.tempDir, logger));
+            }
+            await configUtils.wrapEnvironment({
+                GITHUB_TOKEN: apiDetails.auth,
+                CODEQL_REGISTRIES_AUTH: registriesAuthTokens,
+            }, 
+            // Init a database cluster
+            async () => await codeql.databaseInitCluster(config, sourceRoot, processName, features, qlconfigFile, logger));
+        }
+        else {
+            for (const language of config.languages) {
+                // Init language database
+                await codeql.databaseInit(util.getCodeQLDatabasePath(config, language), language, sourceRoot);
+            }
         }
-        await configUtils.wrapEnvironment({
-            GITHUB_TOKEN: apiDetails.auth,
-            CODEQL_REGISTRIES_AUTH: registriesAuthTokens,
-        }, 
-        // Init a database cluster
-        async () => await codeql.databaseInitCluster(config, sourceRoot, processName, features, qlconfigFile, logger));
     }
     catch (e) {
         throw processError(e);
     }
-    return await (0, tracer_config_1.getCombinedTracerConfig)(config);
+    return await (0, tracer_config_1.getCombinedTracerConfig)(config, codeql);
 }
 exports.runInit = runInit;
 /**
@@ -110,6 +119,89 @@ function processError(e) {
     }
     return e;
 }
+// Runs a powershell script to inject the tracer into a parent process
+// so it can tracer future processes, hopefully including the build process.
+// If processName is given then injects into the nearest parent process with
+// this name, otherwise uses the processLevel-th parent if defined, otherwise
+// defaults to the 3rd parent as a rough guess.
+async function injectWindowsTracer(processName, processLevel, config, codeql, tracerConfig) {
+    let script;
+    if (processName !== undefined) {
+        script = `
+      Param(
+          [Parameter(Position=0)]
+          [String]
+          $tracer
+      )
+
+      $id = $PID
+      while ($true) {
+        $p = Get-CimInstance -Class Win32_Process -Filter "ProcessId = $id"
+        Write-Host "Found process: $p"
+        if ($p -eq $null) {
+          throw "Could not determine ${processName} process"
+        }
+        if ($p[0].Name -eq "${processName}") {
+          Break
+        } else {
+          $id = $p[0].ParentProcessId
+        }
+      }
+      Write-Host "Final process: $p"
+
+      Invoke-Expression "&$tracer --inject=$id"`;
+    }
+    else {
+        // If the level is not defined then guess at the 3rd parent process.
+        // This won't be correct in every setting but it should be enough in most settings,
+        // and overestimating is likely better in this situation so we definitely trace
+        // what we want, though this does run the risk of interfering with future CI jobs.
+        // Note that the default of 3 doesn't work on github actions, so we include a
+        // special case in the script that checks for Runner.Worker.exe so we can still work
+        // on actions if the runner is invoked there.
+        processLevel = processLevel || 3;
+        script = `
+      Param(
+          [Parameter(Position=0)]
+          [String]
+          $tracer
+      )
+
+      $id = $PID
+      for ($i = 0; $i -le ${processLevel}; $i++) {
+        $p = Get-CimInstance -Class Win32_Process -Filter "ProcessId = $id"
+        Write-Host "Parent process \${i}: $p"
+        if ($p -eq $null) {
+          throw "Process tree ended before reaching required level"
+        }
+        # Special case just in case the runner is used on actions
+        if ($p[0].Name -eq "Runner.Worker.exe") {
+          Write-Host "Found Runner.Worker.exe process which means we are running on GitHub Actions"
+          Write-Host "Aborting search early and using process: $p"
+          Break
+        } elseif ($p[0].Name -eq "Agent.Worker.exe") {
+          Write-Host "Found Agent.Worker.exe process which means we are running on Azure Pipelines"
+          Write-Host "Aborting search early and using process: $p"
+          Break
+        } else {
+          $id = $p[0].ParentProcessId
+        }
+      }
+      Write-Host "Final process: $p"
+
+      Invoke-Expression "&$tracer --inject=$id"`;
+    }
+    const injectTracerPath = path.join(config.tempDir, "inject-tracer.ps1");
+    fs.writeFileSync(injectTracerPath, script);
+    await new toolrunner.ToolRunner(await safeWhich.safeWhich("powershell"), [
+        "-ExecutionPolicy",
+        "Bypass",
+        "-file",
+        injectTracerPath,
+        path.resolve(path.dirname(codeql.getPath()), "tools", "win64", "tracer.exe"),
+    ], { env: { ODASA_TRACER_CONFIGURATION: tracerConfig.spec } }).exec();
+}
+exports.injectWindowsTracer = injectWindowsTracer;
 async function installPythonDeps(codeql, logger) {
     logger.startGroup("Setup Python dependencies");
     const scriptsFolder = path.resolve(__dirname, "../python-setup");

lib/resolve-environment-action.js

@@ -1,82 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const core = __importStar(require("@actions/core"));
-const actions_util_1 = require("./actions-util");
-const api_client_1 = require("./api-client");
-const codeql_1 = require("./codeql");
-const configUtils = __importStar(require("./config-utils"));
-const languages_1 = require("./languages");
-const logging_1 = require("./logging");
-const resolve_environment_1 = require("./resolve-environment");
-const util_1 = require("./util");
-const ACTION_NAME = "resolve-environment";
-const ENVIRONMENT_OUTPUT_NAME = "environment";
-async function run() {
-    const startedAt = new Date();
-    const logger = (0, logging_1.getActionsLogger)();
-    const language = (0, languages_1.resolveAlias)((0, actions_util_1.getRequiredInput)("language"));
-    try {
-        if (!(await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)(ACTION_NAME, "starting", startedAt)))) {
-            return;
-        }
-        const gitHubVersion = await (0, api_client_1.getGitHubVersion)();
-        (0, util_1.checkGitHubVersionInRange)(gitHubVersion, logger);
-        const config = await configUtils.getConfig((0, actions_util_1.getTemporaryDirectory)(), logger);
-        if (config === undefined) {
-            throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
-        }
-        const workingDirectory = (0, actions_util_1.getOptionalInput)("working-directory");
-        const result = await (0, resolve_environment_1.runResolveBuildEnvironment)(config.codeQLCmd, logger, workingDirectory, language);
-        core.setOutput(ENVIRONMENT_OUTPUT_NAME, result);
-    }
-    catch (unwrappedError) {
-        const error = (0, util_1.wrapError)(unwrappedError);
-        if (error instanceof codeql_1.CommandInvocationError) {
-            // If the CLI failed to run successfully for whatever reason,
-            // we just return an empty JSON object and proceed with the workflow.
-            core.setOutput(ENVIRONMENT_OUTPUT_NAME, {});
-            logger.warning(`Failed to resolve a build environment suitable for automatically building your code. ${error.message}`);
-        }
-        else {
-            // For any other error types, something has more seriously gone wrong and we fail.
-            core.setFailed(`Failed to resolve a build environment suitable for automatically building your code. ${error.message}`);
-            await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)(ACTION_NAME, (0, actions_util_1.getActionsStatus)(error), startedAt, error.message, error.stack));
-        }
-        return;
-    }
-    await (0, actions_util_1.sendStatusReport)(await (0, actions_util_1.createStatusReportBase)(ACTION_NAME, "success", startedAt));
-}
-async function runWrapper() {
-    try {
-        await run();
-    }
-    catch (error) {
-        core.setFailed(`${ACTION_NAME} action failed: ${(0, util_1.wrapError)(error).message}`);
-    }
-    await (0, util_1.checkForTimeout)();
-}
-void runWrapper();
-//# sourceMappingURL=resolve-environment-action.js.map

lib/resolve-environment-action.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-environment-action.js","sourceRoot":"","sources":["../src/resolve-environment-action.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAEtC,iDAOwB;AACxB,6CAAgD;AAChD,qCAAkD;AAClD,4DAA8C;AAC9C,2CAAqD;AACrD,uCAA6C;AAC7C,+DAAmE;AACnE,iCAA+E;AAE/E,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAE9C,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,GAAE,CAAC;IAClC,MAAM,QAAQ,GAAa,IAAA,wBAAY,EAAC,IAAA,+BAAgB,EAAC,UAAU,CAAC,CAAC,CAAC;IAEtE,IAAI;QACF,IACE,CAAC,CAAC,MAAM,IAAA,+BAAgB,EACtB,MAAM,IAAA,qCAAsB,EAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CACjE,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,aAAa,GAAG,MAAM,IAAA,6BAAgB,GAAE,CAAC;QAC/C,IAAA,gCAAyB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAA,oCAAqB,GAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QAED,MAAM,gBAAgB,GAAG,IAAA,+BAAgB,EAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,gDAA0B,EAC7C,MAAM,CAAC,SAAS,EAChB,MAAM,EACN,gBAAgB,EAChB,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;KACjD;IAAC,OAAO,cAAc,EAAE;QACvB,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,cAAc,CAAC,CAAC;QAExC,IAAI,KAAK,YAAY,+BAAsB,EAAE;YAC3C,6DAA6D;YAC7D,qEAAqE;YACrE,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,CACZ,wFAAwF,KAAK,CAAC,OAAO,EAAE,CACxG,CAAC;SACH;aAAM;YACL,kFAAkF;YAClF,IAAI,CAAC,SAAS,CACZ,wFAAwF,KAAK,CAAC,OAAO,EAAE,CACxG,CAAC;YAEF,MAAM,IAAA,+BAAgB,EACpB,MAAM,IAAA,qCAAsB,EAC1B,WAAW,EACX,IAAA,+BAAgB,EAAC,KAAK,CAAC,EACvB,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;SACH;QAED,OAAO;KACR;IAED,MAAM,IAAA,+BAAgB,EACpB,MAAM,IAAA,qCAAsB,EAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,GAAG,WAAW,mBAAmB,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KAC7E;IACD,MAAM,IAAA,sBAAe,GAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/resolve-environment.js

@@ -1,49 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runResolveBuildEnvironment = void 0;
-const codeql_1 = require("./codeql");
-const util = __importStar(require("./util"));
-async function runResolveBuildEnvironment(cmd, logger, workingDir, language) {
-    logger.startGroup(`Attempting to resolve build environment for ${language}`);
-    const codeql = await (0, codeql_1.getCodeQL)(cmd);
-    let result = {};
-    // If the CodeQL version in use does not support the `resolve build-environment`
-    // command, just return an empty configuration. Otherwise invoke the CLI.
-    if (!(await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_RESOLVE_ENVIRONMENT))) {
-        logger.warning("Unsupported CodeQL CLI version for `resolve build-environment` command, " +
-            "returning an empty configuration.");
-    }
-    else {
-        if (workingDir !== undefined) {
-            logger.info(`Using ${workingDir} as the working directory.`);
-        }
-        result = await codeql.resolveBuildEnvironment(workingDir, language);
-    }
-    logger.endGroup();
-    return result;
-}
-exports.runResolveBuildEnvironment = runResolveBuildEnvironment;
-//# sourceMappingURL=resolve-environment.js.map

lib/resolve-environment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-environment.js","sourceRoot":"","sources":["../src/resolve-environment.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qCAAyE;AAGzE,6CAA+B;AAExB,KAAK,UAAU,0BAA0B,CAC9C,GAAW,EACX,MAAc,EACd,UAA8B,EAC9B,QAAkB;IAElB,MAAM,CAAC,UAAU,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,gFAAgF;IAChF,yEAAyE;IACzE,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,2CAAkC,CAAC,CAAC,EAC5E;QACA,MAAM,CAAC,OAAO,CACZ,0EAA0E;YACxE,mCAAmC,CACtC,CAAC;KACH;SAAM;QACL,IAAI,UAAU,KAAK,SAAS,EAAE;YAC5B,MAAM,CAAC,IAAI,CAAC,SAAS,UAAU,4BAA4B,CAAC,CAAC;SAC9D;QAED,MAAM,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;KACrE;IAED,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AA9BD,gEA8BC"}

lib/setup-codeql.js

@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupCodeQLBundle = exports.getCodeQLURLVersion = exports.downloadCodeQL = exports.tryGetFallbackToolcacheVersion = exports.getCodeQLSource = exports.convertToSemVer = exports.tryGetBundleVersionFromUrl = exports.tryFindCliVersionDotcomOnly = exports.getCodeQLActionRepository = exports.CODEQL_DEFAULT_ACTION_REPOSITORY = void 0;
+exports.setupCodeQLBundle = exports.getCodeQLURLVersion = exports.downloadCodeQL = exports.tryGetFallbackToolcacheVersion = exports.getCodeQLSource = exports.convertToSemVer = exports.tryGetBundleVersionFromUrl = exports.tryFindCliVersionDotcomOnly = exports.findCodeQLBundleTagDotcomOnly = exports.getCodeQLActionRepository = exports.CODEQL_DEFAULT_ACTION_REPOSITORY = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const perf_hooks_1 = require("perf_hooks");
@@ -71,6 +71,34 @@ function getCodeQLActionRepository(logger) {
     return util.getRequiredEnvParam("GITHUB_ACTION_REPOSITORY");
 }
 exports.getCodeQLActionRepository = getCodeQLActionRepository;
+/**
+ * Gets the tag name and, if known, the CodeQL CLI version for each CodeQL bundle release.
+ *
+ * CodeQL bundles are currently tagged in the form `codeql-bundle-yyyymmdd`, so it is not possible
+ * to directly find the CodeQL bundle release for a particular CLI version or find the CodeQL CLI
+ * version for a particular CodeQL bundle.
+ *
+ * To get around this, we add a `cli-version-x.y.z.txt` asset to each bundle release that specifies
+ * the CLI version for that bundle release. We can then use the GitHub Releases for the CodeQL
+ * Action as a source of truth.
+ *
+ * In the medium term, we should migrate to a tagging scheme that allows us to directly find the
+ * CodeQL bundle release for a particular CLI version, for example `codeql-bundle-vx.y.z`.
+ */
+async function getCodeQLBundleReleasesDotcomOnly(logger) {
+    logger.debug(`Fetching CodeQL CLI version and CodeQL bundle tag name information for releases of the CodeQL tools.`);
+    const apiClient = api.getApiClient();
+    const codeQLActionRepository = getCodeQLActionRepository(logger);
+    const releases = await apiClient.paginate(apiClient.repos.listReleases, {
+        owner: codeQLActionRepository.split("/")[0],
+        repo: codeQLActionRepository.split("/")[1],
+    });
+    logger.debug(`Found ${releases.length} releases.`);
+    return releases.map((release) => ({
+        cliVersion: tryGetCodeQLCliVersionForRelease(release, logger),
+        tagName: release.tag_name,
+    }));
+}
 function tryGetCodeQLCliVersionForRelease(release, logger) {
     const cliVersionsFromMarkerFiles = release.assets
         .map((asset) => asset.name.match(/cli-version-(.*)\.txt/)?.[1])
@@ -86,6 +114,18 @@ function tryGetCodeQLCliVersionForRelease(release, logger) {
     }
     return cliVersionsFromMarkerFiles[0];
 }
+async function findCodeQLBundleTagDotcomOnly(cliVersion, logger) {
+    const filtered = (await getCodeQLBundleReleasesDotcomOnly(logger)).filter((release) => release.cliVersion === cliVersion);
+    if (filtered.length === 0) {
+        throw new Error(`Failed to find a release of the CodeQL tools that contains CodeQL CLI ${cliVersion}.`);
+    }
+    else if (filtered.length > 1) {
+        throw new Error(`Found multiple releases of the CodeQL tools that contain CodeQL CLI ${cliVersion}. ` +
+            `Only one such release should exist.`);
+    }
+    return filtered[0].tagName;
+}
+exports.findCodeQLBundleTagDotcomOnly = findCodeQLBundleTagDotcomOnly;
 async function tryFindCliVersionDotcomOnly(tagName, logger) {
     try {
         logger.debug(`Fetching the GitHub Release for the CodeQL bundle tagged ${tagName}.`);
@@ -275,18 +315,11 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
         // If a tools URL was provided, then use that.
         tagName = tryGetTagNameFromUrl(toolsInput, logger);
         url = toolsInput;
-        if (tagName) {
-            const bundleVersion = tryGetBundleVersionFromTagName(tagName, logger);
-            // If the bundle version is a semantic version, it is a CLI version number.
-            if (bundleVersion && semver.valid(bundleVersion)) {
-                cliVersion = convertToSemVer(bundleVersion, logger);
-            }
-        }
     }
     else {
         // Otherwise, use the default CLI version passed in.
         cliVersion = defaultCliVersion.cliVersion;
-        tagName = defaultCliVersion.tagName;
+        tagName = defaultCliVersion["tagName"];
     }
     const bundleVersion = tagName && tryGetBundleVersionFromTagName(tagName, logger);
     const humanReadableVersion = cliVersion ??
@@ -328,14 +361,20 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
         }
     }
     // Fall back to matching `0.0.0-<bundleVersion>`.
-    if (!codeqlFolder && tagName) {
-        const fallbackVersion = await tryGetFallbackToolcacheVersion(cliVersion, tagName, logger);
-        if (fallbackVersion) {
-            codeqlFolder = toolcache.find("CodeQL", fallbackVersion);
+    if (!codeqlFolder && (cliVersion || tagName)) {
+        if (cliVersion || tagName) {
+            const fallbackVersion = await tryGetFallbackToolcacheVersion(cliVersion, tagName, variant, logger);
+            if (fallbackVersion) {
+                codeqlFolder = toolcache.find("CodeQL", fallbackVersion);
+            }
+            else {
+                logger.debug("Could not determine a fallback toolcache version number for CodeQL tools version " +
+                    `${humanReadableVersion}.`);
+            }
         }
         else {
-            logger.debug("Could not determine a fallback toolcache version number for CodeQL tools version " +
-                `${humanReadableVersion}.`);
+            logger.debug("Both the CLI version and the bundle version are unknown, so we will not be able to find " +
+                "the requested version of the CodeQL tools in the toolcache.");
         }
     }
     if (codeqlFolder) {
@@ -363,6 +402,13 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, apiDetails, varian
         }
     }
     if (!url) {
+        if (!tagName && cliVersion && variant === util.GitHubVariant.DOTCOM) {
+            tagName = await findCodeQLBundleTagDotcomOnly(cliVersion, logger);
+        }
+        else if (!tagName) {
+            throw new Error(`Could not obtain the requested version (${humanReadableVersion}) of the CodeQL tools ` +
+                "since we could not compute the tag name.");
+        }
         url = await getCodeQLBundleDownloadURL(tagName, apiDetails, variant, logger);
     }
     return {
@@ -378,7 +424,16 @@ exports.getCodeQLSource = getCodeQLSource;
  * Gets a fallback version number to use when looking for CodeQL in the toolcache if we didn't find
  * the `x.y.z` version. This is to support old versions of the toolcache.
  */
-async function tryGetFallbackToolcacheVersion(cliVersion, tagName, logger) {
+async function tryGetFallbackToolcacheVersion(cliVersion, tagName, variant, logger) {
+    //
+    // If we are on Dotcom, we will make an HTTP request to the Releases API here
+    // to find the tag name for the requested version.
+    if (cliVersion && !tagName && variant === util.GitHubVariant.DOTCOM) {
+        tagName = await findCodeQLBundleTagDotcomOnly(cliVersion, logger);
+    }
+    if (!tagName) {
+        return undefined;
+    }
     const bundleVersion = tryGetBundleVersionFromTagName(tagName, logger);
     if (!bundleVersion) {
         return undefined;

lib/setup-codeql.test.js

@@ -30,6 +30,7 @@ const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
 const sinon = __importStar(require("sinon"));
 const actionsUtil = __importStar(require("./actions-util"));
+const api = __importStar(require("./api-client"));
 const logging_1 = require("./logging");
 const setupCodeql = __importStar(require("./setup-codeql"));
 const testing_utils_1 = require("./testing-utils");
@@ -74,14 +75,46 @@ ava_1.default.beforeEach(() => {
     const repoEnv = setupCodeql.getCodeQLActionRepository(logger);
     t.deepEqual(repoEnv, "xxx/yyy");
 });
-(0, ava_1.default)("getCodeQLSource sets CLI version for a semver tagged bundle", async (t) => {
-    await (0, util_1.withTmpDir)(async (tmpDir) => {
-        (0, testing_utils_1.setupActionsVars)(tmpDir, tmpDir);
-        const tagName = "codeql-bundle-v1.2.3";
-        (0, testing_utils_1.mockBundleDownloadApi)({ tagName });
-        const source = await setupCodeql.getCodeQLSource(`https://github.com/github/codeql-action/releases/download/${tagName}/codeql-bundle-linux64.tar.gz`, testing_utils_1.SAMPLE_DEFAULT_CLI_VERSION, testing_utils_1.SAMPLE_DOTCOM_API_DETAILS, util_1.GitHubVariant.DOTCOM, (0, logging_1.getRunnerLogger)(true));
-        t.is(source.sourceType, "download");
-        t.is(source["cliVersion"], "1.2.3");
+(0, ava_1.default)("findCodeQLBundleTagDotcomOnly() matches GitHub Release with marker file", async (t) => {
+    // Look for GitHub Releases in github/codeql-action
+    sinon.stub(actionsUtil, "isRunningLocalAction").resolves(true);
+    sinon.stub(api, "getApiClient").value(() => ({
+        repos: {
+            listReleases: sinon.stub().resolves(undefined),
+        },
+        paginate: sinon.stub().resolves([
+            {
+                assets: [
+                    {
+                        name: "cli-version-2.12.0.txt",
+                    },
+                ],
+                tag_name: "codeql-bundle-20230106",
+            },
+        ]),
+    }));
+    t.is(await setupCodeql.findCodeQLBundleTagDotcomOnly("2.12.0", (0, logging_1.getRunnerLogger)(true)), "codeql-bundle-20230106");
+});
+(0, ava_1.default)("findCodeQLBundleTagDotcomOnly() errors if no GitHub Release matches marker file", async (t) => {
+    // Look for GitHub Releases in github/codeql-action
+    sinon.stub(actionsUtil, "isRunningLocalAction").resolves(true);
+    sinon.stub(api, "getApiClient").value(() => ({
+        repos: {
+            listReleases: sinon.stub().resolves(undefined),
+        },
+        paginate: sinon.stub().resolves([
+            {
+                assets: [
+                    {
+                        name: "cli-version-2.12.0.txt",
+                    },
+                ],
+                tag_name: "codeql-bundle-20230106",
+            },
+        ]),
+    }));
+    await t.throwsAsync(async () => await setupCodeql.findCodeQLBundleTagDotcomOnly("2.12.1", (0, logging_1.getRunnerLogger)(true)), {
+        message: "Failed to find a release of the CodeQL tools that contains CodeQL CLI 2.12.1.",
     });
 });
 //# sourceMappingURL=setup-codeql.test.js.map

lib/setup-codeql.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-codeql.test.js","sourceRoot":"","sources":["../src/setup-codeql.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,uCAA4C;AAC5C,4DAA8C;AAC9C,mDAMyB;AACzB,iCAKgB;AAEhB,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,UAAU,CAAC,GAAG,EAAE;IACnB,IAAA,4BAAqB,EAAC,OAAO,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE;IAC5C,CAAC,CAAC,SAAS,CACT,WAAW,CAAC,mBAAmB,CAC7B,mDAAmD,CACpD,EACD,UAAU,CACX,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;IAC9B,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,gBAAgB;QAC5B,YAAY,EAAE,kBAAkB;QAChC,cAAc,EAAE,cAAc;QAC9B,OAAO,EAAE,OAAO;QAChB,aAAa,EAAE,aAAa;QAC5B,cAAc,EAAE,cAAc;KAC/B,CAAC;IAEF,KAAK,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC9D,IAAI;YACF,MAAM,aAAa,GAAG,WAAW,CAAC,eAAe,CAC/C,OAAO,EACP,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;SAC7C;QAAC,OAAO,CAAC,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,IAAA,gBAAS,EAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SAC9B;KACF;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;IACtC,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,CAAC;IAErC,IAAA,4BAAqB,EAAC,OAAO,CAAC,CAAC;IAE/B,kCAAkC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,WAAW,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAErD,mCAAmC;IACnC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAC;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,6DAA6D,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC9E,MAAM,IAAA,iBAAU,EAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAChC,IAAA,gCAAgB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,sBAAsB,CAAC;QACvC,IAAA,qCAAqB,EAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,eAAe,CAC9C,6DAA6D,OAAO,+BAA+B,EACnG,0CAA0B,EAC1B,yCAAyB,EACzB,oBAAa,CAAC,MAAM,EACpB,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;QAEF,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"setup-codeql.test.js","sourceRoot":"","sources":["../src/setup-codeql.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AACvB,6CAA+B;AAE/B,4DAA8C;AAC9C,kDAAoC;AACpC,uCAA4C;AAC5C,4DAA8C;AAC9C,mDAA6C;AAC7C,iCAA0D;AAE1D,IAAA,0BAAU,EAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,UAAU,CAAC,GAAG,EAAE;IACnB,IAAA,4BAAqB,EAAC,OAAO,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE;IAC5C,CAAC,CAAC,SAAS,CACT,WAAW,CAAC,mBAAmB,CAC7B,mDAAmD,CACpD,EACD,UAAU,CACX,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;IAC9B,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,gBAAgB;QAC5B,YAAY,EAAE,kBAAkB;QAChC,cAAc,EAAE,cAAc;QAC9B,OAAO,EAAE,OAAO;QAChB,aAAa,EAAE,aAAa;QAC5B,cAAc,EAAE,cAAc;KAC/B,CAAC;IAEF,KAAK,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QAC9D,IAAI;YACF,MAAM,aAAa,GAAG,WAAW,CAAC,eAAe,CAC/C,OAAO,EACP,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;SAC7C;QAAC,OAAO,CAAC,EAAE;YACV,CAAC,CAAC,IAAI,CAAC,IAAA,gBAAS,EAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SAC9B;KACF;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;IACtC,MAAM,MAAM,GAAG,IAAA,yBAAe,EAAC,IAAI,CAAC,CAAC;IAErC,IAAA,4BAAqB,EAAC,OAAO,CAAC,CAAC;IAE/B,kCAAkC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,eAAe,GAAG,WAAW,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;IAErD,mCAAmC;IACnC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAC;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,yEAAyE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1F,mDAAmD;IACnD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,KAAK,EAAE;YACL,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;SAC/C;QACD,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC;YAC9B;gBACE,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,wBAAwB;qBAC/B;iBACF;gBACD,QAAQ,EAAE,wBAAwB;aACnC;SACF,CAAC;KACH,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,EAAE,CACF,MAAM,WAAW,CAAC,6BAA6B,CAC7C,QAAQ,EACR,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,EACD,wBAAwB,CACzB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,aAAI,EAAC,iFAAiF,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClG,mDAAmD;IACnD,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,KAAK,EAAE;YACL,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;SAC/C;QACD,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC;YAC9B;gBACE,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,wBAAwB;qBAC/B;iBACF;gBACD,QAAQ,EAAE,wBAAwB;aACnC;SACF,CAAC;KACH,CAAC,CAAC,CAAC;IACJ,MAAM,CAAC,CAAC,WAAW,CACjB,KAAK,IAAI,EAAE,CACT,MAAM,WAAW,CAAC,6BAA6B,CAC7C,QAAQ,EACR,IAAA,yBAAe,EAAC,IAAI,CAAC,CACtB,EACH;QACE,OAAO,EACL,+EAA+E;KAClF,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

lib/shared-environment.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ODASA_TRACER_CONFIGURATION = exports.CODEQL_WORKFLOW_STARTED_AT = exports.CODEQL_ACTION_DISABLE_DUPLICATE_LOCATION_FIX = exports.CODEQL_ACTION_TEST_MODE = exports.CODEQL_ACTION_TESTING_ENVIRONMENT = exports.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY = exports.CODEQL_ACTION_DID_AUTOBUILD_GOLANG = exports.EnvVar = void 0;
+/**
+ * Environment variables to be set by codeql-action and used by the
+ * CLI.
+ */
+var EnvVar;
+(function (EnvVar) {
+    /**
+     * Semver of the codeql-action as specified in package.json.
+     */
+    EnvVar["VERSION"] = "CODEQL_ACTION_VERSION";
+    /**
+     * If set to a truthy value, then the codeql-action might combine SARIF
+     * output from several `interpret-results` runs for the same Language.
+     */
+    EnvVar["FEATURE_SARIF_COMBINE"] = "CODEQL_ACTION_FEATURE_SARIF_COMBINE";
+    /**
+     * If set to the "true" string, then the codeql-action will upload SARIF,
+     * not the cli.
+     */
+    EnvVar["FEATURE_WILL_UPLOAD"] = "CODEQL_ACTION_FEATURE_WILL_UPLOAD";
+    /**
+     * If set to the "true" string, then the codeql-action is using its
+     * own deprecated and non-standard way of scanning for multiple
+     * languages.
+     */
+    EnvVar["FEATURE_MULTI_LANGUAGE"] = "CODEQL_ACTION_FEATURE_MULTI_LANGUAGE";
+    /**
+     * If set to the "true" string, then the codeql-action is using its
+     * own sandwiched workflow mechanism
+     */
+    EnvVar["FEATURE_SANDWICH"] = "CODEQL_ACTION_FEATURE_SANDWICH";
+})(EnvVar = exports.EnvVar || (exports.EnvVar = {}));
+/**
+ * Environment variable that is set to true when the CodeQL Action has invoked
+ * the Go autobuilder.
+ */
+exports.CODEQL_ACTION_DID_AUTOBUILD_GOLANG = "CODEQL_ACTION_DID_AUTOBUILD_GOLANG";
+/**
+ * This environment variable is set to true when the `analyze` Action
+ * completes successfully.
+ */
+exports.CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY = "CODEQL_ACTION_ANALYZE_DID_COMPLETE_SUCCESSFULLY";
+exports.CODEQL_ACTION_TESTING_ENVIRONMENT = "CODEQL_ACTION_TESTING_ENVIRONMENT";
+/** Used to disable uploading SARIF results or status reports to the GitHub API */
+exports.CODEQL_ACTION_TEST_MODE = "CODEQL_ACTION_TEST_MODE";
+/**
+ * Used to disable the SARIF post-processing in the Action that removes duplicate locations from
+ * notifications in the `run[].invocations[].toolExecutionNotifications` SARIF property.
+ */
+exports.CODEQL_ACTION_DISABLE_DUPLICATE_LOCATION_FIX = "CODEQL_ACTION_DISABLE_DUPLICATE_LOCATION_FIX";
+/**
+ * The time at which the first action (normally init) started executing.
+ * If a workflow invokes a different action without first invoking the init
+ * action (i.e. the upload action is being used by a third-party integrator)
+ * then this variable will be assigned the start time of the action invoked
+ * rather that the init action.
+ */
+exports.CODEQL_WORKFLOW_STARTED_AT = "CODEQL_WORKFLOW_STARTED_AT";
+exports.ODASA_TRACER_CONFIGURATION = "ODASA_TRACER_CONFIGURATION";
+//# sourceMappingURL=shared-environment.js.map

lib/shared-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-environment.js","sourceRoot":"","sources":["../src/shared-environment.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,IAAY,MA8BX;AA9BD,WAAY,MAAM;IAChB;;OAEG;IACH,2CAAiC,CAAA;IAEjC;;;OAGG;IACH,uEAA6D,CAAA;IAE7D;;;OAGG;IACH,mEAAyD,CAAA;IAEzD;;;;OAIG;IACH,yEAA+D,CAAA;IAE/D;;;OAGG;IACH,6DAAmD,CAAA;AACrD,CAAC,EA9BW,MAAM,GAAN,cAAM,KAAN,cAAM,QA8BjB;AAED;;;GAGG;AACU,QAAA,kCAAkC,GAC7C,oCAAoC,CAAC;AAEvC;;;GAGG;AACU,QAAA,+CAA+C,GAC1D,iDAAiD,CAAC;AAEvC,QAAA,iCAAiC,GAC5C,mCAAmC,CAAC;AAEtC,kFAAkF;AACrE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;;GAGG;AACU,QAAA,4CAA4C,GACvD,8CAA8C,CAAC;AAEjD;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAE1D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC"}

lib/testing-utils.js

@@ -22,28 +22,15 @@ var __importStar = (this && this.__importStar) || function (mod) {
     __setModuleDefault(result, mod);
     return result;
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.mockBundleDownloadApi = exports.createFeatures = exports.mockCodeQLVersion = exports.mockLanguagesInRepo = exports.mockFeatureFlagApiEndpoint = exports.getRecordingLogger = exports.setupActionsVars = exports.setupTests = exports.SAMPLE_DEFAULT_CLI_VERSION = exports.SAMPLE_DOTCOM_API_DETAILS = void 0;
+exports.createFeatures = exports.mockCodeQLVersion = exports.mockLanguagesInRepo = exports.mockFeatureFlagApiEndpoint = exports.getRecordingLogger = exports.setupActionsVars = exports.setupTests = void 0;
 const node_util_1 = require("node:util");
-const path_1 = __importDefault(require("path"));
 const github = __importStar(require("@actions/github"));
-const nock_1 = __importDefault(require("nock"));
+const nock = __importStar(require("nock"));
 const sinon = __importStar(require("sinon"));
 const apiClient = __importStar(require("./api-client"));
 const CodeQL = __importStar(require("./codeql"));
 const util_1 = require("./util");
-exports.SAMPLE_DOTCOM_API_DETAILS = {
-    auth: "token",
-    url: "https://github.com",
-    apiURL: "https://api.github.com",
-};
-exports.SAMPLE_DEFAULT_CLI_VERSION = {
-    cliVersion: "2.20.0",
-    tagName: "codeql-bundle-v2.20.0",
-};
 function wrapOutput(context) {
     // Function signature taken from Socket.write.
     // Note there are two overloads:
@@ -105,7 +92,7 @@ function setupTests(test) {
             process.stdout.write(t.context.testOutput);
         }
         // Undo any modifications made by nock
-        nock_1.default.cleanAll();
+        nock.cleanAll();
         // Undo any modifications made by sinon
         sinon.restore();
         // Undo any modifications to the env
@@ -209,26 +196,4 @@ function createFeatures(enabledFeatures) {
     };
 }
 exports.createFeatures = createFeatures;
-/**
- * Mocks the API for downloading the bundle tagged `tagName`.
- *
- * @returns the download URL for the bundle. This can be passed to the tools parameter of
- * `codeql.setupCodeQL`.
- */
-function mockBundleDownloadApi({ apiDetails = exports.SAMPLE_DOTCOM_API_DETAILS, isPinned, repo = "github/codeql-action", platformSpecific = true, tagName, }) {
-    const platform = process.platform === "win32"
-        ? "win64"
-        : process.platform === "linux"
-            ? "linux64"
-            : "osx64";
-    const baseUrl = apiDetails?.url ?? "https://example.com";
-    const relativeUrl = apiDetails
-        ? `/${repo}/releases/download/${tagName}/codeql-bundle${platformSpecific ? `-${platform}` : ""}.tar.gz`
-        : `/download/${tagName}/codeql-bundle.tar.gz`;
-    (0, nock_1.default)(baseUrl)
-        .get(relativeUrl)
-        .replyWithFile(200, path_1.default.join(__dirname, `/../src/testdata/codeql-bundle${isPinned ? "-pinned" : ""}.tar.gz`));
-    return `${baseUrl}${relativeUrl}`;
-}
-exports.mockBundleDownloadApi = mockBundleDownloadApi;
 //# sourceMappingURL=testing-utils.js.map

lib/tracer-config.js

@@ -23,10 +23,20 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getCombinedTracerConfig = exports.getTracerConfigForCluster = exports.endTracingForCluster = void 0;
+exports.getCombinedTracerConfig = exports.concatTracerConfigs = exports.getTracerConfigForLanguage = exports.getTracerConfigForCluster = exports.endTracingForCluster = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const codeql_1 = require("./codeql");
 const languages_1 = require("./languages");
+const util = __importStar(require("./util"));
+const util_1 = require("./util");
+const CRITICAL_TRACER_VARS = new Set([
+    "SEMMLE_PRELOAD_libtrace",
+    "SEMMLE_RUNNER",
+    "SEMMLE_COPY_EXECUTABLES_ROOT",
+    "SEMMLE_DEPTRACE_SOCKET",
+    "SEMMLE_JAVA_TOOL_OPTIONS",
+]);
 async function endTracingForCluster(config) {
     // If there are no traced languages, we don't need to do anything.
     if (!config.languages.some((l) => (0, languages_1.isTracedLanguage)(l)))
@@ -54,17 +64,162 @@ exports.endTracingForCluster = endTracingForCluster;
 async function getTracerConfigForCluster(config) {
     const tracingEnvVariables = JSON.parse(fs.readFileSync(path.resolve(config.dbLocation, "temp/tracingEnvironment/start-tracing.json"), "utf8"));
     return {
+        spec: tracingEnvVariables["ODASA_TRACER_CONFIGURATION"],
         env: tracingEnvVariables,
     };
 }
 exports.getTracerConfigForCluster = getTracerConfigForCluster;
-async function getCombinedTracerConfig(config) {
+async function getTracerConfigForLanguage(codeql, config, language) {
+    const env = await codeql.getTracerEnv(util.getCodeQLDatabasePath(config, language));
+    const spec = env["ODASA_TRACER_CONFIGURATION"];
+    const info = { spec, env: {} };
+    // Extract critical tracer variables from the environment
+    for (const entry of Object.entries(env)) {
+        const key = entry[0];
+        const value = entry[1];
+        // skip ODASA_TRACER_CONFIGURATION as it is handled separately
+        if (key === "ODASA_TRACER_CONFIGURATION") {
+            continue;
+        }
+        // skip undefined values
+        if (typeof value === "undefined") {
+            continue;
+        }
+        // Keep variables that do not exist in current environment. In addition always keep
+        // critical and CODEQL_ variables
+        if (typeof process.env[key] === "undefined" ||
+            CRITICAL_TRACER_VARS.has(key) ||
+            key.startsWith("CODEQL_")) {
+            info.env[key] = value;
+        }
+    }
+    return info;
+}
+exports.getTracerConfigForLanguage = getTracerConfigForLanguage;
+function concatTracerConfigs(tracerConfigs, config, writeBothEnvironments = false) {
+    // A tracer config is a map containing additional environment variables and a tracer 'spec' file.
+    // A tracer 'spec' file has the following format [log_file, number_of_blocks, blocks_text]
+    // Merge the environments
+    const env = {};
+    let copyExecutables = false;
+    let envSize = 0;
+    for (const v of Object.values(tracerConfigs)) {
+        for (const e of Object.entries(v.env)) {
+            const name = e[0];
+            const value = e[1];
+            // skip SEMMLE_COPY_EXECUTABLES_ROOT as it is handled separately
+            if (name === "SEMMLE_COPY_EXECUTABLES_ROOT") {
+                copyExecutables = true;
+            }
+            else if (name in env) {
+                if (env[name] !== value) {
+                    throw Error(`Incompatible values in environment parameter ${name}: ${env[name]} and ${value}`);
+                }
+            }
+            else {
+                env[name] = value;
+                envSize += 1;
+            }
+        }
+    }
+    // Concatenate spec files into a new spec file
+    const languages = Object.keys(tracerConfigs);
+    const cppIndex = languages.indexOf("cpp");
+    // Make sure cpp is the last language, if it's present since it must be concatenated last
+    if (cppIndex !== -1) {
+        const lastLang = languages[languages.length - 1];
+        languages[languages.length - 1] = languages[cppIndex];
+        languages[cppIndex] = lastLang;
+    }
+    const totalLines = [];
+    let totalCount = 0;
+    for (const lang of languages) {
+        const lines = fs
+            .readFileSync(tracerConfigs[lang].spec, "utf8")
+            .split(/\r?\n/);
+        const count = parseInt(lines[1], 10);
+        totalCount += count;
+        totalLines.push(...lines.slice(2));
+    }
+    const newLogFilePath = path.resolve(config.tempDir, "compound-build-tracer.log");
+    const spec = path.resolve(config.tempDir, "compound-spec");
+    const compoundTempFolder = path.resolve(config.tempDir, "compound-temp");
+    const newSpecContent = [
+        newLogFilePath,
+        totalCount.toString(10),
+        ...totalLines,
+    ];
+    if (copyExecutables) {
+        env["SEMMLE_COPY_EXECUTABLES_ROOT"] = compoundTempFolder;
+        envSize += 1;
+    }
+    fs.writeFileSync(spec, newSpecContent.join("\n"));
+    if (writeBothEnvironments || process.platform !== "win32") {
+        // Prepare the content of the compound environment file on Unix
+        let buffer = Buffer.alloc(4);
+        buffer.writeInt32LE(envSize, 0);
+        for (const e of Object.entries(env)) {
+            const key = e[0];
+            const value = e[1];
+            const lineBuffer = Buffer.from(`${key}=${value}\0`, "utf8");
+            const sizeBuffer = Buffer.alloc(4);
+            sizeBuffer.writeInt32LE(lineBuffer.length, 0);
+            buffer = Buffer.concat([buffer, sizeBuffer, lineBuffer]);
+        }
+        // Write the compound environment for Unix
+        const envPath = `${spec}.environment`;
+        fs.writeFileSync(envPath, buffer);
+    }
+    if (writeBothEnvironments || process.platform === "win32") {
+        // Prepare the content of the compound environment file on Windows
+        let bufferWindows = Buffer.alloc(0);
+        let length = 0;
+        for (const e of Object.entries(env)) {
+            const key = e[0];
+            const value = e[1];
+            const string = `${key}=${value}\0`;
+            length += string.length;
+            const lineBuffer = Buffer.from(string, "utf16le");
+            bufferWindows = Buffer.concat([bufferWindows, lineBuffer]);
+        }
+        const sizeBuffer = Buffer.alloc(4);
+        sizeBuffer.writeInt32LE(length + 1, 0); // Add one for trailing null character marking end
+        const trailingNull = Buffer.from(`\0`, "utf16le");
+        bufferWindows = Buffer.concat([sizeBuffer, bufferWindows, trailingNull]);
+        // Write the compound environment for Windows
+        const envPathWindows = `${spec}.win32env`;
+        fs.writeFileSync(envPathWindows, bufferWindows);
+    }
+    return { env, spec };
+}
+exports.concatTracerConfigs = concatTracerConfigs;
+async function getCombinedTracerConfig(config, codeql) {
     // Abort if there are no traced languages as there's nothing to do
     const tracedLanguages = config.languages.filter((l) => (0, languages_1.isTracedLanguage)(l));
     if (tracedLanguages.length === 0) {
         return undefined;
     }
-    const mainTracerConfig = await getTracerConfigForCluster(config);
+    let mainTracerConfig;
+    if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+        mainTracerConfig = await getTracerConfigForCluster(config);
+    }
+    else {
+        // Get all the tracer configs and combine them together
+        const tracedLanguageConfigs = {};
+        for (const language of tracedLanguages) {
+            tracedLanguageConfigs[language] = await getTracerConfigForLanguage(codeql, config, language);
+        }
+        mainTracerConfig = concatTracerConfigs(tracedLanguageConfigs, config);
+        // Add a couple more variables
+        mainTracerConfig.env["ODASA_TRACER_CONFIGURATION"] = mainTracerConfig.spec;
+        const codeQLDir = path.dirname(codeql.getPath());
+        if (process.platform === "darwin") {
+            mainTracerConfig.env["DYLD_INSERT_LIBRARIES"] = path.join(codeQLDir, "tools", "osx64", "libtrace.dylib");
+        }
+        else if (process.platform !== "win32") {
+            mainTracerConfig.env["LD_PRELOAD"] = path.join(codeQLDir, "tools", "linux64", "${LIB}trace.so");
+        }
+    }
     // On macos it's necessary to prefix the build command with the runner executable
     // on order to trace when System Integrity Protection is enabled.
     // The executable also exists and works for other platforms so we output this env

lib/tracer-config.test.js

@@ -29,6 +29,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
+const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
 const languages_1 = require("./languages");
 const testing_utils_1 = require("./testing-utils");
@@ -55,35 +56,267 @@ function getTestConfig(tmpDir) {
         trapCacheDownloadTime: 0,
     };
 }
+// A very minimal setup
+(0, ava_1.default)("getTracerConfigForLanguage - minimal setup", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: "abc",
+                    foo: "bar",
+                };
+            },
+        });
+        const result = await (0, tracer_config_1.getTracerConfigForLanguage)(codeQL, config, languages_1.Language.javascript);
+        t.deepEqual(result, { spec: "abc", env: { foo: "bar" } });
+    });
+});
+// Existing vars should not be overwritten, unless they are critical or prefixed with CODEQL_
+(0, ava_1.default)("getTracerConfigForLanguage - existing / critical vars", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        // Set up some variables in the environment
+        process.env["foo"] = "abc";
+        process.env["SEMMLE_PRELOAD_libtrace"] = "abc";
+        process.env["SEMMLE_RUNNER"] = "abc";
+        process.env["SEMMLE_COPY_EXECUTABLES_ROOT"] = "abc";
+        process.env["SEMMLE_DEPTRACE_SOCKET"] = "abc";
+        process.env["SEMMLE_JAVA_TOOL_OPTIONS"] = "abc";
+        process.env["CODEQL_VAR"] = "abc";
+        // Now CodeQL returns all these variables, and one more, with different values
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: "abc",
+                    foo: "bar",
+                    baz: "qux",
+                    SEMMLE_PRELOAD_libtrace: "SEMMLE_PRELOAD_libtrace",
+                    SEMMLE_RUNNER: "SEMMLE_RUNNER",
+                    SEMMLE_COPY_EXECUTABLES_ROOT: "SEMMLE_COPY_EXECUTABLES_ROOT",
+                    SEMMLE_DEPTRACE_SOCKET: "SEMMLE_DEPTRACE_SOCKET",
+                    SEMMLE_JAVA_TOOL_OPTIONS: "SEMMLE_JAVA_TOOL_OPTIONS",
+                    CODEQL_VAR: "CODEQL_VAR",
+                };
+            },
+        });
+        const result = await (0, tracer_config_1.getTracerConfigForLanguage)(codeQL, config, languages_1.Language.javascript);
+        t.deepEqual(result, {
+            spec: "abc",
+            env: {
+                // Should contain all variables except 'foo', because that already existed in the
+                // environment with a different value, and is not deemed a "critical" variable.
+                baz: "qux",
+                SEMMLE_PRELOAD_libtrace: "SEMMLE_PRELOAD_libtrace",
+                SEMMLE_RUNNER: "SEMMLE_RUNNER",
+                SEMMLE_COPY_EXECUTABLES_ROOT: "SEMMLE_COPY_EXECUTABLES_ROOT",
+                SEMMLE_DEPTRACE_SOCKET: "SEMMLE_DEPTRACE_SOCKET",
+                SEMMLE_JAVA_TOOL_OPTIONS: "SEMMLE_JAVA_TOOL_OPTIONS",
+                CODEQL_VAR: "CODEQL_VAR",
+            },
+        });
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - minimal configs correctly combined", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec1 = path.join(tmpDir, "spec1");
+        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
+        const tc1 = {
+            spec: spec1,
+            env: {
+                a: "a",
+                b: "b",
+            },
+        };
+        const spec2 = path.join(tmpDir, "spec2");
+        fs.writeFileSync(spec2, "foo.log\n1\nghi");
+        const tc2 = {
+            spec: spec2,
+            env: {
+                c: "c",
+            },
+        };
+        const result = (0, tracer_config_1.concatTracerConfigs)({ javascript: tc1, python: tc2 }, config);
+        t.deepEqual(result, {
+            spec: path.join(tmpDir, "compound-spec"),
+            env: {
+                a: "a",
+                b: "b",
+                c: "c",
+            },
+        });
+        t.true(fs.existsSync(result.spec));
+        t.deepEqual(fs.readFileSync(result.spec, "utf8"), `${path.join(tmpDir, "compound-build-tracer.log")}\n3\nabc\ndef\nghi`);
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - conflicting env vars", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec = path.join(tmpDir, "spec");
+        fs.writeFileSync(spec, "foo.log\n0");
+        // Ok if env vars have the same name and the same value
+        t.deepEqual((0, tracer_config_1.concatTracerConfigs)({
+            javascript: { spec, env: { a: "a", b: "b" } },
+            python: { spec, env: { b: "b", c: "c" } },
+        }, config).env, {
+            a: "a",
+            b: "b",
+            c: "c",
+        });
+        // Throws if env vars have same name but different values
+        const e = t.throws(() => (0, tracer_config_1.concatTracerConfigs)({
+            javascript: { spec, env: { a: "a", b: "b" } },
+            python: { spec, env: { b: "c" } },
+        }, config));
+        // If e is undefined, then the previous assertion will fail.
+        if (e !== undefined) {
+            t.deepEqual(e.message, "Incompatible values in environment parameter b: b and c");
+        }
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - cpp spec lines come last if present", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec1 = path.join(tmpDir, "spec1");
+        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
+        const tc1 = {
+            spec: spec1,
+            env: {
+                a: "a",
+                b: "b",
+            },
+        };
+        const spec2 = path.join(tmpDir, "spec2");
+        fs.writeFileSync(spec2, "foo.log\n1\nghi");
+        const tc2 = {
+            spec: spec2,
+            env: {
+                c: "c",
+            },
+        };
+        const result = (0, tracer_config_1.concatTracerConfigs)({ cpp: tc1, python: tc2 }, config);
+        t.deepEqual(result, {
+            spec: path.join(tmpDir, "compound-spec"),
+            env: {
+                a: "a",
+                b: "b",
+                c: "c",
+            },
+        });
+        t.true(fs.existsSync(result.spec));
+        t.deepEqual(fs.readFileSync(result.spec, "utf8"), `${path.join(tmpDir, "compound-build-tracer.log")}\n3\nghi\nabc\ndef`);
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - SEMMLE_COPY_EXECUTABLES_ROOT is updated to point to compound spec", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec = path.join(tmpDir, "spec");
+        fs.writeFileSync(spec, "foo.log\n0");
+        const result = (0, tracer_config_1.concatTracerConfigs)({
+            javascript: { spec, env: { a: "a", b: "b" } },
+            python: { spec, env: { SEMMLE_COPY_EXECUTABLES_ROOT: "foo" } },
+        }, config);
+        t.deepEqual(result.env, {
+            a: "a",
+            b: "b",
+            SEMMLE_COPY_EXECUTABLES_ROOT: path.join(tmpDir, "compound-temp"),
+        });
+    });
+});
+(0, ava_1.default)("concatTracerConfigs - compound environment file is created correctly", async (t) => {
+    await util.withTmpDir(async (tmpDir) => {
+        const config = getTestConfig(tmpDir);
+        const spec1 = path.join(tmpDir, "spec1");
+        fs.writeFileSync(spec1, "foo.log\n2\nabc\ndef");
+        const tc1 = {
+            spec: spec1,
+            env: {
+                a: "a",
+            },
+        };
+        const spec2 = path.join(tmpDir, "spec2");
+        fs.writeFileSync(spec2, "foo.log\n1\nghi");
+        const tc2 = {
+            spec: spec2,
+            env: {
+                foo: "bar_baz",
+            },
+        };
+        const result = (0, tracer_config_1.concatTracerConfigs)({ javascript: tc1, python: tc2 }, config, true);
+        // Check binary contents for the Unix file
+        const envPath = `${result.spec}.environment`;
+        t.true(fs.existsSync(envPath));
+        const buffer = fs.readFileSync(envPath);
+        t.deepEqual(buffer.length, 28);
+        t.deepEqual(buffer.readInt32LE(0), 2); // number of env vars
+        t.deepEqual(buffer.readInt32LE(4), 4); // length of env var definition
+        t.deepEqual(buffer.toString("utf8", 8, 12), "a=a\0"); // [key]=[value]\0
+        t.deepEqual(buffer.readInt32LE(12), 12); // length of env var definition
+        t.deepEqual(buffer.toString("utf8", 16, 28), "foo=bar_baz\0"); // [key]=[value]\0
+        // Check binary contents for the Windows file
+        const envPathWindows = `${result.spec}.win32env`;
+        t.true(fs.existsSync(envPathWindows));
+        const bufferWindows = fs.readFileSync(envPathWindows);
+        t.deepEqual(bufferWindows.length, 38);
+        t.deepEqual(bufferWindows.readInt32LE(0), 4 + 12 + 1); // number of tchars to represent the environment
+        t.deepEqual(bufferWindows.toString("utf16le", 4, 12), "a=a\0"); // [key]=[value]\0
+        t.deepEqual(bufferWindows.toString("utf16le", 12, 36), "foo=bar_baz\0"); // [key]=[value]\0
+        t.deepEqual(bufferWindows.toString("utf16le", 36, 38), "\0"); // trailing null character
+    });
+});
 (0, ava_1.default)("getCombinedTracerConfig - return undefined when no languages are traced languages", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         const config = getTestConfig(tmpDir);
         // No traced languages
         config.languages = [languages_1.Language.javascript, languages_1.Language.python];
-        t.deepEqual(await (0, tracer_config_1.getCombinedTracerConfig)(config), undefined);
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: "abc",
+                    CODEQL_DIST: "/",
+                    foo: "bar",
+                };
+            },
+        });
+        t.deepEqual(await (0, tracer_config_1.getCombinedTracerConfig)(config, codeQL), undefined);
     });
 });
-(0, ava_1.default)("getCombinedTracerConfig - with start-tracing.json environment file", async (t) => {
+(0, ava_1.default)("getCombinedTracerConfig - valid spec file", async (t) => {
     await util.withTmpDir(async (tmpDir) => {
         const config = getTestConfig(tmpDir);
+        const spec = path.join(tmpDir, "spec");
+        fs.writeFileSync(spec, "foo.log\n2\nabc\ndef");
         const bundlePath = path.join(tmpDir, "bundle");
         const codeqlPlatform = process.platform === "win32"
             ? "win64"
             : process.platform === "darwin"
                 ? "osx64"
                 : "linux64";
-        const startTracingEnv = {
+        const codeQL = (0, codeql_1.setCodeQL)({
+            async getTracerEnv() {
+                return {
+                    ODASA_TRACER_CONFIGURATION: spec,
+                    CODEQL_DIST: bundlePath,
+                    CODEQL_PLATFORM: codeqlPlatform,
+                    foo: "bar",
+                };
+            },
+        });
+        const result = await (0, tracer_config_1.getCombinedTracerConfig)(config, codeQL);
+        t.notDeepEqual(result, undefined);
+        const expectedEnv = {
             foo: "bar",
             CODEQL_DIST: bundlePath,
             CODEQL_PLATFORM: codeqlPlatform,
+            ODASA_TRACER_CONFIGURATION: result.spec,
         };
-        const tracingEnvironmentDir = path.join(config.dbLocation, "temp", "tracingEnvironment");
-        fs.mkdirSync(tracingEnvironmentDir, { recursive: true });
-        const startTracingJson = path.join(tracingEnvironmentDir, "start-tracing.json");
-        fs.writeFileSync(startTracingJson, JSON.stringify(startTracingEnv));
-        const result = await (0, tracer_config_1.getCombinedTracerConfig)(config);
-        t.notDeepEqual(result, undefined);
-        const expectedEnv = startTracingEnv;
+        if (process.platform === "darwin") {
+            expectedEnv["DYLD_INSERT_LIBRARIES"] = path.join(path.dirname(codeQL.getPath()), "tools", "osx64", "libtrace.dylib");
+        }
+        else if (process.platform !== "win32") {
+            expectedEnv["LD_PRELOAD"] = path.join(path.dirname(codeQL.getPath()), "tools", "linux64", "${LIB}trace.so");
+        }
         if (process.platform === "win32") {
             expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/win64/runner.exe");
         }
@@ -94,6 +327,7 @@ function getTestConfig(tmpDir) {
             expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/linux64/runner");
         }
         t.deepEqual(result, {
+            spec: path.join(tmpDir, "compound-spec"),
             env: expectedEnv,
         });
     });