Catch auto_install_packages errors

Update python scripts download link
Call core.endGroup() when doing an early return in installPythonDeps
2026-08-06 05:07:52 -05:00 · 2020-07-23 15:56:03 +02:00 · 2020-07-23 13:12:47 +02:00 · 2020-07-23 13:05:30 +02:00 · 2020-07-23 12:57:35 +02:00 · 2020-07-23 12:57:12 +02:00
41 changed files with 1527 additions and 821 deletions
@@ -0,0 +1,25 @@
+{
+  // Use IntelliSense to learn about possible attributes.
+  // Hover to view descriptions of existing attributes.
+  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Debug AVA test file",
+      "runtimeExecutable": "${workspaceFolder}/node_modules/.bin/ava",
+      "runtimeArgs": [
+        "${file}",
+        "--break",
+        "--serial",
+        "--timeout=20m"
+      ],
+      "port": 9229,
+      "outputCapture": "std",
+      "skipFiles": [
+        "<node_internals>/**/*.js"
+      ]
+    }
+  ]
+}
@@ -20,6 +20,8 @@ Before you start, ensure that you have a recent version of node installed. You c
 * Run tests: `npm run test`.  You’ll need to ensure that the JavaScript files are up-to-date first by running the command above.
 * Run the linter: `npm run lint`.

+This project also includes configuration to run tests from VSCode (with support for breakpoints) - open the test file you wish to run and choose "Debug AVA test file" from the Run menu in the Run panel.
+
 ### Running the action

 To see the effect of your changes and to test them, push your changes in a branch and then look at the [Actions output](https://github.com/github/codeql-action/actions) for that branch.  You can also exercise the code locally by running the automated tests.
@@ -20,6 +20,10 @@ inputs:
    description: The number of threads to be used by CodeQL.
    required: false
    default: "1"
+  checkout_path:
+    description: "The path at which the analyzed repository was checked out. Used to relativeize any absolute paths in the uploaded SARIF file."
+    required: false
+    default: ${{ github.workspace }}
  token:
    default: ${{ github.token }}
  matrix:
@@ -16,6 +16,10 @@ inputs:
  config-file:
    description: Path of the config file to use
    required: false
+  setup-python-dependencies:
+    description: Try to auto-install your python dependencies
+    required: true
+    default: 'true'
 runs:
  using: 'node12'
  main: '../lib/setup-tracer.js'
@@ -23,7 +23,7 @@ function buildIncludeExcludeEnvVar(paths) {
    }
    return paths.join('\n');
 }
-function includeAndExcludeAnalysisPaths(config, languages) {
+function includeAndExcludeAnalysisPaths(config) {
    // The 'LGTM_INDEX_INCLUDE' and 'LGTM_INDEX_EXCLUDE' environment variables
    // control which files/directories are traversed when scanning.
    // This allows including files that otherwise would not be scanned, or
@@ -51,7 +51,7 @@ function includeAndExcludeAnalysisPaths(config, languages) {
    if ((config.paths.length !== 0 ||
        config.pathsIgnore.length !== 0 ||
        filters.length !== 0) &&
-        !languages.every(isInterpretedLanguage)) {
+        !config.languages.every(isInterpretedLanguage)) {
        core.warning('The "paths"/"paths-ignore" fields of the config only have effect for Javascript and Python');
    }
 }
@@ -1 +1 @@
-{"version":3,"file":"analysis-paths.js","sourceRoot":"","sources":["../src/analysis-paths.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAItC,SAAS,qBAAqB,CAAC,QAAQ;IACrC,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,QAAQ,CAAC;AAC5D,CAAC;AAED,6FAA6F;AAChF,QAAA,+BAA+B,GAAG,eAAe,CAAC;AAE/D,uFAAuF;AACvF,SAAS,yBAAyB,CAAC,KAAe;IAChD,iCAAiC;IACjC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjD,uDAAuD;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uCAA+B,CAAC,CAAC,CAAC;KACrE;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,8BAA8B,CAAC,MAA0B,EAAE,SAAmB;IAC5F,0EAA0E;IAC1E,+DAA+D;IAC/D,sEAAsE;IACtE,qDAAqD;IACrD,gFAAgF;IAChF,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC7B,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;KACpF;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;QACnC,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;KAC1F;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;QACxB,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;KAC/D;IAED,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QACvB,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE;QAC3C,IAAI,CAAC,OAAO,CAAC,4FAA4F,CAAC,CAAC;KAC5G;AACH,CAAC;AAjCD,wEAiCC"}
+{"version":3,"file":"analysis-paths.js","sourceRoot":"","sources":["../src/analysis-paths.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAItC,SAAS,qBAAqB,CAAC,QAAQ;IACrC,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,QAAQ,CAAC;AAC5D,CAAC;AAED,6FAA6F;AAChF,QAAA,+BAA+B,GAAG,eAAe,CAAC;AAE/D,uFAAuF;AACvF,SAAS,yBAAyB,CAAC,KAAe;IAChD,iCAAiC;IACjC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjD,uDAAuD;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;QAChC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uCAA+B,CAAC,CAAC,CAAC;KACrE;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,8BAA8B,CAAC,MAA0B;IACvE,0EAA0E;IAC1E,+DAA+D;IAC/D,sEAAsE;IACtE,qDAAqD;IACrD,gFAAgF;IAChF,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC7B,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;KACpF;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;QACnC,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;KAC1F;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;QACxB,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;KAC/D;IAED,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QACvB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE;QAClD,IAAI,CAAC,OAAO,CAAC,4FAA4F,CAAC,CAAC;KAC5G;AACH,CAAC;AAjCD,wEAiCC"}
@@ -12,21 +12,28 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const ava_1 = __importDefault(require("ava"));
 const analysisPaths = __importStar(require("./analysis-paths"));
-const configUtils = __importStar(require("./config-utils"));
 const testing_utils_1 = require("./testing-utils");
 testing_utils_1.setupTests(ava_1.default);
 ava_1.default("emptyPaths", async (t) => {
-    let config = new configUtils.Config();
-    analysisPaths.includeAndExcludeAnalysisPaths(config, []);
+    const config = {
+        languages: [],
+        queries: {},
+        pathsIgnore: [],
+        paths: [],
+    };
+    analysisPaths.includeAndExcludeAnalysisPaths(config);
    t.is(process.env['LGTM_INDEX_INCLUDE'], undefined);
    t.is(process.env['LGTM_INDEX_EXCLUDE'], undefined);
    t.is(process.env['LGTM_INDEX_FILTERS'], undefined);
 });
 ava_1.default("nonEmptyPaths", async (t) => {
-    let config = new configUtils.Config();
-    config.paths.push('path1', 'path2', '**/path3');
-    config.pathsIgnore.push('path4', 'path5', 'path6/**');
-    analysisPaths.includeAndExcludeAnalysisPaths(config, []);
+    const config = {
+        languages: [],
+        queries: {},
+        paths: ['path1', 'path2', '**/path3'],
+        pathsIgnore: ['path4', 'path5', 'path6/**'],
+    };
+    analysisPaths.includeAndExcludeAnalysisPaths(config);
    t.is(process.env['LGTM_INDEX_INCLUDE'], 'path1\npath2');
    t.is(process.env['LGTM_INDEX_EXCLUDE'], 'path4\npath5');
    t.is(process.env['LGTM_INDEX_FILTERS'], 'include:path1\ninclude:path2\ninclude:**/path3\nexclude:path4\nexclude:path5\nexclude:path6/**');
@@ -1 +1 @@
-{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AAEvB,gEAAkD;AAClD,4DAA8C;AAC9C,mDAA2C;AAE3C,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,YAAY,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC3B,IAAI,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACtC,aAAa,CAAC,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,eAAe,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC9B,IAAI,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IACtD,aAAa,CAAC,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,gGAAgG,CAAC,CAAC;AAC5I,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AAEvB,gEAAkD;AAClD,mDAA2C;AAE3C,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,YAAY,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC3B,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,EAAE;KACV,CAAC;IACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,eAAe,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC9B,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;QACrC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;KAC5C,CAAC;IACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,gGAAgG,CAAC,CAAC;AAC5I,CAAC,CAAC,CAAC"}
@@ -14,6 +14,11 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const semver = __importStar(require("semver"));
 const util = __importStar(require("./util"));
+/**
+ * Stores the CodeQL object, and is populated by `setupCodeQL` or `getCodeQL`.
+ * Can be overridden in tests using `setCodeQL`.
+ */
+let cachedCodeQL = undefined;
 /**
 * Environment variable used to store the location of the CodeQL CLI executable.
 * Value is set by setupCodeQL and read by getCodeQL.
@@ -39,8 +44,9 @@ async function setupCodeQL() {
        else if (process.platform !== 'linux' && process.platform !== 'darwin') {
            throw new Error("Unsupported plaform: " + process.platform);
        }
+        cachedCodeQL = getCodeQLForCmd(codeqlCmd);
        core.exportVariable(CODEQL_ACTION_CMD, codeqlCmd);
-        return getCodeQLForCmd(codeqlCmd);
+        return cachedCodeQL;
    }
    catch (e) {
        core.error(e);
@@ -66,10 +72,42 @@ function getCodeQLURLVersion(url) {
 }
 exports.getCodeQLURLVersion = getCodeQLURLVersion;
 function getCodeQL() {
-    const codeqlCmd = util.getRequiredEnvParam(CODEQL_ACTION_CMD);
-    return getCodeQLForCmd(codeqlCmd);
+    if (cachedCodeQL === undefined) {
+        const codeqlCmd = util.getRequiredEnvParam(CODEQL_ACTION_CMD);
+        cachedCodeQL = getCodeQLForCmd(codeqlCmd);
+    }
+    return cachedCodeQL;
 }
 exports.getCodeQL = getCodeQL;
+function resolveFunction(partialCodeql, methodName) {
+    if (typeof partialCodeql[methodName] !== 'function') {
+        const dummyMethod = () => {
+            throw new Error('CodeQL ' + methodName + ' method not correctly defined');
+        };
+        return dummyMethod;
+    }
+    return partialCodeql[methodName];
+}
+/**
+ * Set the functionality for CodeQL methods. Only for use in tests.
+ *
+ * Accepts a partial object and any undefined methods will be implemented
+ * to immediately throw an exception indicating which method is missing.
+ */
+function setCodeQL(partialCodeql) {
+    cachedCodeQL = {
+        getDir: resolveFunction(partialCodeql, 'getDir'),
+        printVersion: resolveFunction(partialCodeql, 'printVersion'),
+        getTracerEnv: resolveFunction(partialCodeql, 'getTracerEnv'),
+        databaseInit: resolveFunction(partialCodeql, 'databaseInit'),
+        runAutobuild: resolveFunction(partialCodeql, 'runAutobuild'),
+        extractScannedLanguage: resolveFunction(partialCodeql, 'extractScannedLanguage'),
+        finalizeDatabase: resolveFunction(partialCodeql, 'finalizeDatabase'),
+        resolveQueries: resolveFunction(partialCodeql, 'resolveQueries'),
+        databaseAnalyze: resolveFunction(partialCodeql, 'databaseAnalyze')
+    };
+}
+exports.setCodeQL = setCodeQL;
 function getCodeQLForCmd(cmd) {
    return {
        getDir: function () {
@@ -150,14 +188,18 @@ function getCodeQLForCmd(cmd) {
                databasePath
            ]);
        },
-        resolveQueries: async function (queries) {
-            let output = '';
-            await exec.exec(cmd, [
+        resolveQueries: async function (queries, extraSearchPath) {
+            const codeqlArgs = [
                'resolve',
                'queries',
                ...queries,
                '--format=bylanguage'
-            ], {
+            ];
+            if (extraSearchPath !== undefined) {
+                codeqlArgs.push('--search-path', extraSearchPath);
+            }
+            let output = '';
+            await exec.exec(cmd, codeqlArgs, {
                listeners: {
                    stdout: (data) => {
                        output += data.toString();
@@ -13,98 +13,168 @@ const fs = __importStar(require("fs"));
 const yaml = __importStar(require("js-yaml"));
 const path = __importStar(require("path"));
 const api = __importStar(require("./api-client"));
+const codeql_1 = require("./codeql");
+const externalQueries = __importStar(require("./external-queries"));
 const util = __importStar(require("./util"));
+// Property names from the user-supplied config file.
 const NAME_PROPERTY = 'name';
-const DISPLAY_DEFAULT_QUERIES_PROPERTY = 'disable-default-queries';
+const DISABLE_DEFAULT_QUERIES_PROPERTY = 'disable-default-queries';
 const QUERIES_PROPERTY = 'queries';
 const QUERIES_USES_PROPERTY = 'uses';
 const PATHS_IGNORE_PROPERTY = 'paths-ignore';
 const PATHS_PROPERTY = 'paths';
-class ExternalQuery {
-    constructor(repository, ref) {
-        this.path = '';
-        this.repository = repository;
-        this.ref = ref;
+/**
+ * A list of queries from https://github.com/github/codeql that
+ * we don't want to run. Disabling them here is a quicker alternative to
+ * disabling them in the code scanning query suites. Queries should also
+ * be disabled in the suites, and removed from this list here once the
+ * bundle is updated to make those suite changes live.
+ *
+ * Format is a map from language to an array of path suffixes of .ql files.
+ */
+const DISABLED_BUILTIN_QUERIES = {
+    'csharp': [
+        'ql/src/Security Features/CWE-937/VulnerablePackage.ql',
+        'ql/src/Security Features/CWE-451/MissingXFrameOptions.ql',
+    ]
+};
+function queryIsDisabled(language, query) {
+    return (DISABLED_BUILTIN_QUERIES[language] || [])
+        .some(disabledQuery => query.endsWith(disabledQuery));
+}
+/**
+ * Asserts that the noDeclaredLanguage and multipleDeclaredLanguages fields are
+ * both empty and errors if they are not.
+ */
+function validateQueries(resolvedQueries) {
+    const noDeclaredLanguage = resolvedQueries.noDeclaredLanguage;
+    const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
+    if (noDeclaredLanguageQueries.length !== 0) {
+        throw new Error('The following queries do not declare a language. ' +
+            'Their qlpack.yml files are either missing or is invalid.\n' +
+            noDeclaredLanguageQueries.join('\n'));
+    }
+    const multipleDeclaredLanguages = resolvedQueries.multipleDeclaredLanguages;
+    const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
+    if (multipleDeclaredLanguagesQueries.length !== 0) {
+        throw new Error('The following queries declare multiple languages. ' +
+            'Their qlpack.yml files are either missing or is invalid.\n' +
+            multipleDeclaredLanguagesQueries.join('\n'));
    }
 }
-exports.ExternalQuery = ExternalQuery;
+/**
+ * Run 'codeql resolve queries' and add the results to resultMap
+ */
+async function runResolveQueries(resultMap, toResolve, extraSearchPath, errorOnInvalidQueries) {
+    const codeQl = codeql_1.getCodeQL();
+    const resolvedQueries = await codeQl.resolveQueries(toResolve, extraSearchPath);
+    for (const [language, queries] of Object.entries(resolvedQueries.byLanguage)) {
+        if (resultMap[language] === undefined) {
+            resultMap[language] = [];
+        }
+        resultMap[language].push(...Object.keys(queries).filter(q => !queryIsDisabled(language, q)));
+    }
+    if (errorOnInvalidQueries) {
+        validateQueries(resolvedQueries);
+    }
+}
+/**
+ * Get the set of queries included by default.
+ */
+async function addDefaultQueries(languages, resultMap) {
+    const suites = languages.map(l => l + '-code-scanning.qls');
+    await runResolveQueries(resultMap, suites, undefined, false);
+}
 // The set of acceptable values for built-in suites from the codeql bundle
 const builtinSuites = ['security-extended', 'security-and-quality'];
-class Config {
-    constructor() {
-        this.name = "";
-        this.disableDefaultQueries = false;
-        this.additionalQueries = [];
-        this.externalQueries = [];
-        this.additionalSuites = [];
-        this.pathsIgnore = [];
-        this.paths = [];
-    }
-    addQuery(configFile, queryUses) {
-        // The logic for parsing the string is based on what actions does for
-        // parsing the 'uses' actions in the workflow file
-        queryUses = queryUses.trim();
-        if (queryUses === "") {
-            throw new Error(getQueryUsesInvalid(configFile));
-        }
-        // Check for the local path case before we start trying to parse the repository name
-        if (queryUses.startsWith("./")) {
-            const localQueryPath = queryUses.slice(2);
-            // Resolve the local path against the workspace so that when this is
-            // passed to codeql it resolves to exactly the path we expect it to resolve to.
-            const workspacePath = fs.realpathSync(util.getRequiredEnvParam('GITHUB_WORKSPACE'));
-            let absoluteQueryPath = path.join(workspacePath, localQueryPath);
-            // Check the file exists
-            if (!fs.existsSync(absoluteQueryPath)) {
-                throw new Error(getLocalPathDoesNotExist(configFile, localQueryPath));
-            }
-            // Call this after checking file exists, because it'll fail if file doesn't exist
-            absoluteQueryPath = fs.realpathSync(absoluteQueryPath);
-            // Check the local path doesn't jump outside the repo using '..' or symlinks
-            if (!(absoluteQueryPath + path.sep).startsWith(workspacePath + path.sep)) {
-                throw new Error(getLocalPathOutsideOfRepository(configFile, localQueryPath));
-            }
-            this.additionalQueries.push(absoluteQueryPath);
-            return;
-        }
-        // Check for one of the builtin suites
-        if (queryUses.indexOf('/') === -1 && queryUses.indexOf('@') === -1) {
-            const suite = builtinSuites.find((suite) => suite === queryUses);
-            if (suite) {
-                this.additionalSuites.push(suite);
-                return;
-            }
-            else {
-                throw new Error(getQueryUsesInvalid(configFile, queryUses));
-            }
-        }
-        let tok = queryUses.split('@');
-        if (tok.length !== 2) {
-            throw new Error(getQueryUsesInvalid(configFile, queryUses));
-        }
-        const ref = tok[1];
-        tok = tok[0].split('/');
-        // The first token is the owner
-        // The second token is the repo
-        // The rest is a path, if there is more than one token combine them to form the full path
-        if (tok.length < 2) {
-            throw new Error(getQueryUsesInvalid(configFile, queryUses));
-        }
-        if (tok.length > 3) {
-            tok = [tok[0], tok[1], tok.slice(2).join('/')];
-        }
-        // Check none of the parts of the repository name are empty
-        if (tok[0].trim() === '' || tok[1].trim() === '') {
-            throw new Error(getQueryUsesInvalid(configFile, queryUses));
-        }
-        let external = new ExternalQuery(tok[0] + '/' + tok[1], ref);
-        if (tok.length === 3) {
-            external.path = tok[2];
-        }
-        this.externalQueries.push(external);
+/**
+ * Determine the set of queries associated with suiteName's suites and add them to resultMap.
+ * Throws an error if suiteName is not a valid builtin suite.
+ */
+async function addBuiltinSuiteQueries(configFile, languages, resultMap, suiteName) {
+    const suite = builtinSuites.find((suite) => suite === suiteName);
+    if (!suite) {
+        throw new Error(getQueryUsesInvalid(configFile, suiteName));
    }
+    const suites = languages.map(l => l + '-' + suiteName + '.qls');
+    await runResolveQueries(resultMap, suites, undefined, false);
+}
+/**
+ * Retrieve the set of queries at localQueryPath and add them to resultMap.
+ */
+async function addLocalQueries(configFile, resultMap, localQueryPath) {
+    // Resolve the local path against the workspace so that when this is
+    // passed to codeql it resolves to exactly the path we expect it to resolve to.
+    const workspacePath = fs.realpathSync(util.getRequiredEnvParam('GITHUB_WORKSPACE'));
+    let absoluteQueryPath = path.join(workspacePath, localQueryPath);
+    // Check the file exists
+    if (!fs.existsSync(absoluteQueryPath)) {
+        throw new Error(getLocalPathDoesNotExist(configFile, localQueryPath));
+    }
+    // Call this after checking file exists, because it'll fail if file doesn't exist
+    absoluteQueryPath = fs.realpathSync(absoluteQueryPath);
+    // Check the local path doesn't jump outside the repo using '..' or symlinks
+    if (!(absoluteQueryPath + path.sep).startsWith(workspacePath + path.sep)) {
+        throw new Error(getLocalPathOutsideOfRepository(configFile, localQueryPath));
+    }
+    // Get the root of the current repo to use when resolving query dependencies
+    const rootOfRepo = util.getRequiredEnvParam('GITHUB_WORKSPACE');
+    await runResolveQueries(resultMap, [absoluteQueryPath], rootOfRepo, true);
+}
+/**
+ * Retrieve the set of queries at the referenced remote repo and add them to resultMap.
+ */
+async function addRemoteQueries(configFile, resultMap, queryUses) {
+    let tok = queryUses.split('@');
+    if (tok.length !== 2) {
+        throw new Error(getQueryUsesInvalid(configFile, queryUses));
+    }
+    const ref = tok[1];
+    tok = tok[0].split('/');
+    // The first token is the owner
+    // The second token is the repo
+    // The rest is a path, if there is more than one token combine them to form the full path
+    if (tok.length < 2) {
+        throw new Error(getQueryUsesInvalid(configFile, queryUses));
+    }
+    // Check none of the parts of the repository name are empty
+    if (tok[0].trim() === '' || tok[1].trim() === '') {
+        throw new Error(getQueryUsesInvalid(configFile, queryUses));
+    }
+    const nwo = tok[0] + '/' + tok[1];
+    // Checkout the external repository
+    const rootOfRepo = await externalQueries.checkoutExternalRepository(nwo, ref);
+    const queryPath = tok.length > 2
+        ? path.join(rootOfRepo, tok.slice(2).join('/'))
+        : rootOfRepo;
+    await runResolveQueries(resultMap, [queryPath], rootOfRepo, true);
+}
+/**
+ * Parse a query 'uses' field to a discrete set of query files and update resultMap.
+ *
+ * The logic for parsing the string is based on what actions does for
+ * parsing the 'uses' actions in the workflow file. So it can handle
+ * local paths starting with './', or references to remote repos, or
+ * a finite set of hardcoded terms for builtin suites.
+ */
+async function parseQueryUses(configFile, languages, resultMap, queryUses) {
+    queryUses = queryUses.trim();
+    if (queryUses === "") {
+        throw new Error(getQueryUsesInvalid(configFile));
+    }
+    // Check for the local path case before we start trying to parse the repository name
+    if (queryUses.startsWith("./")) {
+        await addLocalQueries(configFile, resultMap, queryUses.slice(2));
+        return;
+    }
+    // Check for one of the builtin suites
+    if (queryUses.indexOf('/') === -1 && queryUses.indexOf('@') === -1) {
+        await addBuiltinSuiteQueries(configFile, languages, resultMap, queryUses);
+        return;
+    }
+    // Otherwise, must be a reference to another repo
+    await addRemoteQueries(configFile, resultMap, queryUses);
 }
-exports.Config = Config;
 // Regex validating stars in paths or paths-ignore entries.
 // The intention is to only allow ** to appear when immediately
 // preceded and followed by a slash.
@@ -156,7 +226,7 @@ function getNameInvalid(configFile) {
 }
 exports.getNameInvalid = getNameInvalid;
 function getDisableDefaultQueriesInvalid(configFile) {
-    return getConfigFilePropertyError(configFile, DISPLAY_DEFAULT_QUERIES_PROPERTY, 'must be a boolean');
+    return getConfigFilePropertyError(configFile, DISABLE_DEFAULT_QUERIES_PROPERTY, 'must be a boolean');
 }
 exports.getDisableDefaultQueriesInvalid = getDisableDefaultQueriesInvalid;
 function getQueriesInvalid(configFile) {
@@ -210,14 +280,88 @@ exports.getConfigFileDirectoryGivenMessage = getConfigFileDirectoryGivenMessage;
 function getConfigFilePropertyError(configFile, property, error) {
    return 'The configuration file "' + configFile + '" is invalid: property "' + property + '" ' + error;
 }
-async function initConfig() {
-    let configFile = core.getInput('config-file');
-    const config = new Config();
-    // If no config file was provided create an empty one
-    if (configFile === '') {
-        core.debug('No configuration file was provided');
-        return config;
+/**
+ * Gets the set of languages in the current repository
+ */
+async function getLanguagesInRepo() {
+    var _a;
+    // Translate between GitHub's API names for languages and ours
+    const codeqlLanguages = {
+        'C': 'cpp',
+        'C++': 'cpp',
+        'C#': 'csharp',
+        'Go': 'go',
+        'Java': 'java',
+        'JavaScript': 'javascript',
+        'TypeScript': 'javascript',
+        'Python': 'python',
+    };
+    let repo_nwo = (_a = process.env['GITHUB_REPOSITORY']) === null || _a === void 0 ? void 0 : _a.split("/");
+    if (repo_nwo) {
+        let owner = repo_nwo[0];
+        let repo = repo_nwo[1];
+        core.debug(`GitHub repo ${owner} ${repo}`);
+        const response = await api.getApiClient().request("GET /repos/:owner/:repo/languages", ({
+            owner,
+            repo
+        }));
+        core.debug("Languages API response: " + JSON.stringify(response));
+        // The GitHub API is going to return languages in order of popularity,
+        // When we pick a language to autobuild we want to pick the most popular traced language
+        // Since sets in javascript maintain insertion order, using a set here and then splatting it
+        // into an array gives us an array of languages ordered by popularity
+        let languages = new Set();
+        for (let lang in response.data) {
+            if (lang in codeqlLanguages) {
+                languages.add(codeqlLanguages[lang]);
+            }
+        }
+        return [...languages];
    }
+    else {
+        return [];
+    }
+}
+/**
+ * Get the languages to analyse.
+ *
+ * The result is obtained from the action input parameter 'languages' if that
+ * has been set, otherwise it is deduced as all languages in the repo that
+ * can be analysed.
+ */
+async function getLanguages() {
+    // Obtain from action input 'languages' if set
+    let languages = core.getInput('languages', { required: false })
+        .split(',')
+        .map(x => x.trim())
+        .filter(x => x.length > 0);
+    core.info("Languages from configuration: " + JSON.stringify(languages));
+    if (languages.length === 0) {
+        // Obtain languages as all languages in the repo that can be analysed
+        languages = await getLanguagesInRepo();
+        core.info("Automatically detected languages: " + JSON.stringify(languages));
+    }
+    return languages;
+}
+/**
+ * Get the default config for when the user has not supplied one.
+ */
+async function getDefaultConfig() {
+    const languages = await getLanguages();
+    const queries = {};
+    await addDefaultQueries(languages, queries);
+    return {
+        languages: languages,
+        queries: queries,
+        pathsIgnore: [],
+        paths: []
+    };
+}
+exports.getDefaultConfig = getDefaultConfig;
+/**
+ * Load the config from the given file.
+ */
+async function loadConfig(configFile) {
    let parsedYAML;
    if (isLocal(configFile)) {
        // Treat the config file as relative to the workspace
@@ -228,6 +372,8 @@ async function initConfig() {
    else {
        parsedYAML = await getRemoteConfig(configFile);
    }
+    // Validate that the 'name' property is syntactically correct,
+    // even though we don't use the value yet.
    if (NAME_PROPERTY in parsedYAML) {
        if (typeof parsedYAML[NAME_PROPERTY] !== "string") {
            throw new Error(getNameInvalid(configFile));
@@ -235,24 +381,36 @@ async function initConfig() {
        if (parsedYAML[NAME_PROPERTY].length === 0) {
            throw new Error(getNameInvalid(configFile));
        }
-        config.name = parsedYAML[NAME_PROPERTY];
    }
-    if (DISPLAY_DEFAULT_QUERIES_PROPERTY in parsedYAML) {
-        if (typeof parsedYAML[DISPLAY_DEFAULT_QUERIES_PROPERTY] !== "boolean") {
+    const languages = await getLanguages();
+    // If the languages parameter was not given and no languages were
+    // detected then fail here as this is a workflow configuration error.
+    if (languages.length === 0) {
+        throw new Error("Did not detect any languages to analyze. Please update input in workflow.");
+    }
+    const queries = {};
+    const pathsIgnore = [];
+    const paths = [];
+    let disableDefaultQueries = false;
+    if (DISABLE_DEFAULT_QUERIES_PROPERTY in parsedYAML) {
+        if (typeof parsedYAML[DISABLE_DEFAULT_QUERIES_PROPERTY] !== "boolean") {
            throw new Error(getDisableDefaultQueriesInvalid(configFile));
        }
-        config.disableDefaultQueries = parsedYAML[DISPLAY_DEFAULT_QUERIES_PROPERTY];
+        disableDefaultQueries = parsedYAML[DISABLE_DEFAULT_QUERIES_PROPERTY];
+    }
+    if (!disableDefaultQueries) {
+        await addDefaultQueries(languages, queries);
    }
    if (QUERIES_PROPERTY in parsedYAML) {
        if (!(parsedYAML[QUERIES_PROPERTY] instanceof Array)) {
            throw new Error(getQueriesInvalid(configFile));
        }
-        parsedYAML[QUERIES_PROPERTY].forEach(query => {
+        for (const query of parsedYAML[QUERIES_PROPERTY]) {
            if (!(QUERIES_USES_PROPERTY in query) || typeof query[QUERIES_USES_PROPERTY] !== "string") {
                throw new Error(getQueryUsesInvalid(configFile));
            }
-            config.addQuery(configFile, query[QUERIES_USES_PROPERTY]);
-        });
+            await parseQueryUses(configFile, languages, queries, query[QUERIES_USES_PROPERTY]);
+        }
    }
    if (PATHS_IGNORE_PROPERTY in parsedYAML) {
        if (!(parsedYAML[PATHS_IGNORE_PROPERTY] instanceof Array)) {
@@ -262,7 +420,7 @@ async function initConfig() {
            if (typeof path !== "string" || path === '') {
                throw new Error(getPathsIgnoreInvalid(configFile));
            }
-            config.pathsIgnore.push(validateAndSanitisePath(path, PATHS_IGNORE_PROPERTY, configFile));
+            pathsIgnore.push(validateAndSanitisePath(path, PATHS_IGNORE_PROPERTY, configFile));
        });
    }
    if (PATHS_PROPERTY in parsedYAML) {
@@ -273,11 +431,33 @@ async function initConfig() {
            if (typeof path !== "string" || path === '') {
                throw new Error(getPathsInvalid(configFile));
            }
-            config.paths.push(validateAndSanitisePath(path, PATHS_PROPERTY, configFile));
+            paths.push(validateAndSanitisePath(path, PATHS_PROPERTY, configFile));
        });
    }
+    return { languages, queries, pathsIgnore, paths };
+}
+/**
+ * Load and return the config.
+ *
+ * This will parse the config from the user input if present, or generate
+ * a default config. The parsed config is then stored to a known location.
+ */
+async function initConfig() {
+    const configFile = core.getInput('config-file');
+    let config;
+    // If no config file was provided create an empty one
+    if (configFile === '') {
+        core.debug('No configuration file was provided');
+        config = await getDefaultConfig();
+    }
+    else {
+        config = await loadConfig(configFile);
+    }
+    // Save the config so we can easily access it again in the future
+    await saveConfig(config);
    return config;
 }
+exports.initConfig = initConfig;
 function isLocal(configPath) {
    // If the path starts with ./, look locally
    if (configPath.indexOf("./") === 0) {
@@ -322,35 +502,46 @@ async function getRemoteConfig(configFile) {
    }
    return yaml.safeLoad(Buffer.from(fileContents, 'base64').toString('binary'));
 }
-function getConfigFolder() {
+/**
+ * Get the directory where the parsed config will be stored.
+ */
+function getPathToParsedConfigFolder() {
    return util.getRequiredEnvParam('RUNNER_TEMP');
 }
-function getConfigFile() {
-    return path.join(getConfigFolder(), 'config');
+/**
+ * Get the file path where the parsed config will be stored.
+ */
+function getPathToParsedConfigFile() {
+    return path.join(getPathToParsedConfigFolder(), 'config');
 }
-exports.getConfigFile = getConfigFile;
+exports.getPathToParsedConfigFile = getPathToParsedConfigFile;
+/**
+ * Store the given config to the path returned from getPathToParsedConfigFile.
+ */
 async function saveConfig(config) {
    const configString = JSON.stringify(config);
-    await io.mkdirP(getConfigFolder());
-    fs.writeFileSync(getConfigFile(), configString, 'utf8');
+    await io.mkdirP(getPathToParsedConfigFolder());
+    fs.writeFileSync(getPathToParsedConfigFile(), configString, 'utf8');
    core.debug('Saved config:');
    core.debug(configString);
 }
-async function loadConfig() {
-    const configFile = getConfigFile();
-    if (fs.existsSync(configFile)) {
-        const configString = fs.readFileSync(configFile, 'utf8');
-        core.debug('Loaded config:');
-        core.debug(configString);
-        return JSON.parse(configString);
-    }
-    else {
-        const config = await initConfig();
-        core.debug('Initialized config:');
-        core.debug(JSON.stringify(config));
-        await saveConfig(config);
-        return config;
+/**
+ * Get the config.
+ *
+ * If this is the first time in a workflow that this is being called then
+ * this will parse the config from the user input. The parsed config is then
+ * stored to a known location. On the second and further calls, this will
+ * return the contents of the parsed config from the known location.
+ */
+async function getConfig() {
+    const configFile = getPathToParsedConfigFile();
+    if (!fs.existsSync(configFile)) {
+        throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
    }
+    const configString = fs.readFileSync(configFile, 'utf8');
+    core.debug('Loaded config:');
+    core.debug(configString);
+    return JSON.parse(configString);
 }
-exports.loadConfig = loadConfig;
+exports.getConfig = getConfig;
 //# sourceMappingURL=config-utils.js.map
@@ -16,6 +16,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const sinon_1 = __importDefault(require("sinon"));
 const api = __importStar(require("./api-client"));
+const CodeQL = __importStar(require("./codeql"));
 const configUtils = __importStar(require("./config-utils"));
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
@@ -46,22 +47,45 @@ ava_1.default("load empty config", async (t) => {
        process.env['RUNNER_TEMP'] = tmpDir;
        process.env['GITHUB_WORKSPACE'] = tmpDir;
        setInput('config-file', undefined);
-        const config = await configUtils.loadConfig();
-        t.deepEqual(config, new configUtils.Config());
+        setInput('languages', 'javascript,python');
+        CodeQL.setCodeQL({
+            resolveQueries: async function () {
+                return {
+                    byLanguage: {},
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        const config = await configUtils.initConfig();
+        t.deepEqual(config, await configUtils.getDefaultConfig());
    });
 });
 ava_1.default("loading config saves config", async (t) => {
    return await util.withTmpDir(async (tmpDir) => {
        process.env['RUNNER_TEMP'] = tmpDir;
        process.env['GITHUB_WORKSPACE'] = tmpDir;
-        const configFile = configUtils.getConfigFile();
+        setInput('config-file', undefined);
+        setInput('languages', 'javascript,python');
+        CodeQL.setCodeQL({
+            resolveQueries: async function () {
+                return {
+                    byLanguage: {},
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
        // Sanity check the saved config file does not already exist
-        t.false(fs.existsSync(configFile));
-        const config = await configUtils.loadConfig();
+        t.false(fs.existsSync(configUtils.getPathToParsedConfigFile()));
+        // Sanity check that getConfig throws before we have called initConfig
+        await t.throwsAsync(configUtils.getConfig);
+        const config1 = await configUtils.initConfig();
        // The saved config file should now exist
-        t.true(fs.existsSync(configFile));
-        // And the contents should parse correctly to the config that was returned
-        t.deepEqual(fs.readFileSync(configFile, 'utf8'), JSON.stringify(config));
+        t.true(fs.existsSync(configUtils.getPathToParsedConfigFile()));
+        // And that same newly-initialised config should now be returned by getConfig
+        const config2 = await configUtils.getConfig();
+        t.deepEqual(config1, config2);
    });
 });
 ava_1.default("load input outside of workspace", async (t) => {
@@ -70,8 +94,8 @@ ava_1.default("load input outside of workspace", async (t) => {
        process.env['GITHUB_WORKSPACE'] = tmpDir;
        setInput('config-file', '../input');
        try {
-            await configUtils.loadConfig();
-            throw new Error('loadConfig did not throw error');
+            await configUtils.initConfig();
+            throw new Error('initConfig did not throw error');
        }
        catch (err) {
            t.deepEqual(err, new Error(configUtils.getConfigFileOutsideWorkspaceErrorMessage(path.join(tmpDir, '../input'))));
@@ -85,8 +109,8 @@ ava_1.default("load non-local input with invalid repo syntax", async (t) => {
        // no filename given, just a repo
        setInput('config-file', 'octo-org/codeql-config@main');
        try {
-            await configUtils.loadConfig();
-            throw new Error('loadConfig did not throw error');
+            await configUtils.initConfig();
+            throw new Error('initConfig did not throw error');
        }
        catch (err) {
            t.deepEqual(err, new Error(configUtils.getConfigFileRepoFormatInvalidMessage('octo-org/codeql-config@main')));
@@ -99,9 +123,10 @@ ava_1.default("load non-existent input", async (t) => {
        process.env['GITHUB_WORKSPACE'] = tmpDir;
        t.false(fs.existsSync(path.join(tmpDir, 'input')));
        setInput('config-file', 'input');
+        setInput('languages', 'javascript');
        try {
-            await configUtils.loadConfig();
-            throw new Error('loadConfig did not throw error');
+            await configUtils.initConfig();
+            throw new Error('initConfig did not throw error');
        }
        catch (err) {
            t.deepEqual(err, new Error(configUtils.getConfigFileDoesNotExistErrorMessage(path.join(tmpDir, 'input'))));
@@ -112,10 +137,102 @@ ava_1.default("load non-empty input", async (t) => {
    return await util.withTmpDir(async (tmpDir) => {
        process.env['RUNNER_TEMP'] = tmpDir;
        process.env['GITHUB_WORKSPACE'] = tmpDir;
+        CodeQL.setCodeQL({
+            resolveQueries: async function () {
+                return {
+                    byLanguage: {
+                        'javascript': {
+                            '/foo/a.ql': {},
+                            '/bar/b.ql': {},
+                        },
+                    },
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
        // Just create a generic config object with non-default values for all fields
        const inputFileContents = `
      name: my config
      disable-default-queries: true
+      queries:
+        - uses: ./foo
+      paths-ignore:
+        - a
+        - b
+      paths:
+        - c/d`;
+        fs.mkdirSync(path.join(tmpDir, 'foo'));
+        // And the config we expect it to parse to
+        const expectedConfig = {
+            languages: ['javascript'],
+            queries: { 'javascript': ['/foo/a.ql', '/bar/b.ql'] },
+            pathsIgnore: ['a', 'b'],
+            paths: ['c/d'],
+        };
+        fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
+        setInput('config-file', 'input');
+        setInput('languages', 'javascript');
+        const actualConfig = await configUtils.initConfig();
+        // Should exactly equal the object we constructed earlier
+        t.deepEqual(actualConfig, expectedConfig);
+    });
+});
+ava_1.default("default queries are used", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env['RUNNER_TEMP'] = tmpDir;
+        process.env['GITHUB_WORKSPACE'] = tmpDir;
+        // Check that the default behaviour is to add the default queries.
+        // In this case if a config file is specified but does not include
+        // the disable-default-queries field.
+        // We determine this by whether CodeQL.resolveQueries is called
+        // with the correct arguments.
+        const resolveQueriesArgs = [];
+        CodeQL.setCodeQL({
+            resolveQueries: async function (queries, extraSearchPath) {
+                resolveQueriesArgs.push({ queries, extraSearchPath });
+                return {
+                    byLanguage: {
+                        'javascript': {},
+                    },
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        // The important point of this config is that it doesn't specify
+        // the disable-default-queries field.
+        // Any other details are hopefully irrelevant for this tetst.
+        const inputFileContents = `
+      paths:
+        - foo`;
+        fs.mkdirSync(path.join(tmpDir, 'foo'));
+        fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
+        setInput('config-file', 'input');
+        setInput('languages', 'javascript');
+        await configUtils.initConfig();
+        // Check resolve queries was called correctly
+        t.deepEqual(resolveQueriesArgs.length, 1);
+        t.deepEqual(resolveQueriesArgs[0].queries, ['javascript-code-scanning.qls']);
+        t.deepEqual(resolveQueriesArgs[0].extraSearchPath, undefined);
+    });
+});
+ava_1.default("API client used when reading remote config", async (t) => {
+    return await util.withTmpDir(async (tmpDir) => {
+        process.env['RUNNER_TEMP'] = tmpDir;
+        process.env['GITHUB_WORKSPACE'] = tmpDir;
+        CodeQL.setCodeQL({
+            resolveQueries: async function () {
+                return {
+                    byLanguage: {},
+                    noDeclaredLanguage: {},
+                    multipleDeclaredLanguages: {},
+                };
+            },
+        });
+        const inputFileContents = `
+      name: my config
+      disable-default-queries: true
      queries:
        - uses: ./
        - uses: ./foo
@@ -123,45 +240,17 @@ ava_1.default("load non-empty input", async (t) => {
      paths-ignore:
        - a
        - b
-      paths:
-        - c/d`;
-        fs.mkdirSync(path.join(tmpDir, 'foo'));
-        // And the config we expect it to parse to
-        const expectedConfig = new configUtils.Config();
-        expectedConfig.name = 'my config';
-        expectedConfig.disableDefaultQueries = true;
-        expectedConfig.additionalQueries.push(fs.realpathSync(tmpDir));
-        expectedConfig.additionalQueries.push(fs.realpathSync(path.join(tmpDir, 'foo')));
-        expectedConfig.externalQueries = [new configUtils.ExternalQuery('foo/bar', 'dev')];
-        expectedConfig.pathsIgnore = ['a', 'b'];
-        expectedConfig.paths = ['c/d'];
-        fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
-        setInput('config-file', 'input');
-        const actualConfig = await configUtils.loadConfig();
-        // Should exactly equal the object we constructed earlier
-        t.deepEqual(actualConfig, expectedConfig);
-    });
-});
-ava_1.default("API client used when reading remote config", async (t) => {
-    return await util.withTmpDir(async (tmpDir) => {
-        process.env['RUNNER_TEMP'] = tmpDir;
-        process.env['GITHUB_WORKSPACE'] = tmpDir;
-        const inputFileContents = `
-      name: my config
-      disable-default-queries: true
-      queries:
-        - uses: ./
-      paths-ignore:
-        - a
-        - b
      paths:
        - c/d`;
        const dummyResponse = {
            content: Buffer.from(inputFileContents).toString("base64"),
        };
        const spyGetContents = mockGetContents(dummyResponse);
+        // Create checkout directory for remote queries repository
+        fs.mkdirSync(path.join(tmpDir, 'foo/bar'), { recursive: true });
        setInput('config-file', 'octo-org/codeql-config/config.yaml@main');
-        await configUtils.loadConfig();
+        setInput('languages', 'javascript');
+        await configUtils.initConfig();
        t.assert(spyGetContents.called);
    });
 });
@@ -174,8 +263,8 @@ ava_1.default("Remote config handles the case where a directory is provided", as
        const repoReference = 'octo-org/codeql-config/config.yaml@main';
        setInput('config-file', repoReference);
        try {
-            await configUtils.loadConfig();
-            throw new Error('loadConfig did not throw error');
+            await configUtils.initConfig();
+            throw new Error('initConfig did not throw error');
        }
        catch (err) {
            t.deepEqual(err, new Error(configUtils.getConfigFileDirectoryGivenMessage(repoReference)));
@@ -193,8 +282,8 @@ ava_1.default("Invalid format of remote config handled correctly", async (t) =>
        const repoReference = 'octo-org/codeql-config/config.yaml@main';
        setInput('config-file', repoReference);
        try {
-            await configUtils.loadConfig();
-            throw new Error('loadConfig did not throw error');
+            await configUtils.initConfig();
+            throw new Error('initConfig did not throw error');
        }
        catch (err) {
            t.deepEqual(err, new Error(configUtils.getConfigFileFormatInvalidMessage(repoReference)));
@@ -206,12 +295,22 @@ function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGen
        return await util.withTmpDir(async (tmpDir) => {
            process.env['RUNNER_TEMP'] = tmpDir;
            process.env['GITHUB_WORKSPACE'] = tmpDir;
+            CodeQL.setCodeQL({
+                resolveQueries: async function () {
+                    return {
+                        byLanguage: {},
+                        noDeclaredLanguage: {},
+                        multipleDeclaredLanguages: {},
+                    };
+                },
+            });
            const inputFile = path.join(tmpDir, 'input');
            fs.writeFileSync(inputFile, inputFileContents, 'utf8');
            setInput('config-file', 'input');
+            setInput('languages', 'javascript');
            try {
-                await configUtils.loadConfig();
-                throw new Error('loadConfig did not throw error');
+                await configUtils.initConfig();
+                throw new Error('initConfig did not throw error');
            }
            catch (err) {
                t.deepEqual(err, new Error(expectedErrorMessageGenerator(inputFile)));
@@ -12,22 +12,23 @@ const exec = __importStar(require("@actions/exec"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const util = __importStar(require("./util"));
-async function checkoutExternalQueries(config) {
+/**
+ * Check out repository at the given ref, and return the directory of the checkout.
+ */
+async function checkoutExternalRepository(repository, ref) {
    const folder = util.getRequiredEnvParam('RUNNER_TEMP');
-    for (const externalQuery of config.externalQueries) {
-        core.info('Checking out ' + externalQuery.repository);
-        const checkoutLocation = path.join(folder, externalQuery.repository);
-        if (!fs.existsSync(checkoutLocation)) {
-            const repoURL = 'https://github.com/' + externalQuery.repository + '.git';
-            await exec.exec('git', ['clone', repoURL, checkoutLocation]);
-            await exec.exec('git', [
-                '--work-tree=' + checkoutLocation,
-                '--git-dir=' + checkoutLocation + '/.git',
-                'checkout', externalQuery.ref,
-            ]);
-        }
-        config.additionalQueries.push(path.join(checkoutLocation, externalQuery.path));
+    core.info('Checking out ' + repository);
+    const checkoutLocation = path.join(folder, repository);
+    if (!fs.existsSync(checkoutLocation)) {
+        const repoURL = 'https://github.com/' + repository + '.git';
+        await exec.exec('git', ['clone', repoURL, checkoutLocation]);
+        await exec.exec('git', [
+            '--work-tree=' + checkoutLocation,
+            '--git-dir=' + checkoutLocation + '/.git',
+            'checkout', ref,
+        ]);
    }
+    return checkoutLocation;
 }
-exports.checkoutExternalQueries = checkoutExternalQueries;
+exports.checkoutExternalRepository = checkoutExternalRepository;
 //# sourceMappingURL=external-queries.js.map
@@ -1 +1 @@
-{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AACtC,oDAAsC;AACtC,uCAAyB;AACzB,2CAA6B;AAG7B,6CAA+B;AAExB,KAAK,UAAU,uBAAuB,CAAC,MAA0B;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAEvD,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,eAAe,EAAE;QAClD,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAEtD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;YACpC,MAAM,OAAO,GAAG,qBAAqB,GAAG,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC;YAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;gBACrB,cAAc,GAAG,gBAAgB;gBACjC,YAAY,GAAG,gBAAgB,GAAG,OAAO;gBACzC,UAAU,EAAE,aAAa,CAAC,GAAG;aAC9B,CAAC,CAAC;SACJ;QAED,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;KAChF;AACH,CAAC;AAnBD,0DAmBC"}
+{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AACtC,oDAAsC;AACtC,uCAAyB;AACzB,2CAA6B;AAE7B,6CAA+B;AAE/B;;GAEG;AACI,KAAK,UAAU,0BAA0B,CAAC,UAAkB,EAAE,GAAW;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAEvD,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,CAAC;IAExC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;QACpC,MAAM,OAAO,GAAG,qBAAqB,GAAG,UAAU,GAAG,MAAM,CAAC;QAC5D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;YACrB,cAAc,GAAG,gBAAgB;YACjC,YAAY,GAAG,gBAAgB,GAAG,OAAO;YACzC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;KACJ;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAjBD,gEAiBC"}
@@ -13,20 +13,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const ava_1 = __importDefault(require("ava"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const configUtils = __importStar(require("./config-utils"));
 const externalQueries = __importStar(require("./external-queries"));
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
 testing_utils_1.setupTests(ava_1.default);
 ava_1.default("checkoutExternalQueries", async (t) => {
-    let config = new configUtils.Config();
-    config.externalQueries = [
-        new configUtils.ExternalQuery("github/codeql-go", "df4c6869212341b601005567381944ed90906b6b"),
-    ];
    await util.withTmpDir(async (tmpDir) => {
        process.env["RUNNER_TEMP"] = tmpDir;
-        await externalQueries.checkoutExternalQueries(config);
-        // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in master
+        await externalQueries.checkoutExternalRepository("github/codeql-go", "df4c6869212341b601005567381944ed90906b6b");
+        // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in the default branch
        t.true(fs.existsSync(path.join(tmpDir, "github", "codeql-go", "COPYRIGHT")));
    });
 });
@@ -1 +1 @@
-{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AACvB,uCAAyB;AACzB,2CAA6B;AAE7B,4DAA8C;AAC9C,oEAAsD;AACtD,mDAA2C;AAC3C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACxC,IAAI,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,CAAC,eAAe,GAAG;QACvB,IAAI,WAAW,CAAC,aAAa,CAAC,kBAAkB,EAAE,0CAA0C,CAAC;KAC9F,CAAC;IAEF,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;QACnC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;QACpC,MAAM,eAAe,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEtD,uFAAuF;QACvF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AACvB,uCAAyB;AACzB,2CAA6B;AAE7B,oEAAsD;AACtD,mDAA2C;AAC3C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACxC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAC,MAAM,EAAC,EAAE;QACnC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;QACpC,MAAM,eAAe,CAAC,0BAA0B,CAAC,kBAAkB,EAAE,0CAA0C,CAAC,CAAC;QAEjH,mGAAmG;QACnG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
@@ -8,33 +8,36 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
 const io = __importStar(require("@actions/io"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const codeql_1 = require("./codeql");
 const configUtils = __importStar(require("./config-utils"));
-const externalQueries = __importStar(require("./external-queries"));
 const sharedEnv = __importStar(require("./shared-environment"));
 const upload_lib = __importStar(require("./upload-lib"));
 const util = __importStar(require("./util"));
-/**
- * A list of queries from https://github.com/github/codeql that
- * we don't want to run. Disabling them here is a quicker alternative to
- * disabling them in the code scanning query suites. Queries should also
- * be disabled in the suites, and removed from this list here once the
- * bundle is updated to make those suite changes live.
- *
- * Format is a map from language to an array of path suffixes of .ql files.
- */
-const DISABLED_BUILTIN_QUERIES = {
-    'csharp': [
-        'ql/src/Security Features/CWE-937/VulnerablePackage.ql',
-        'ql/src/Security Features/CWE-451/MissingXFrameOptions.ql',
-    ]
-};
-function queryIsDisabled(language, query) {
-    return (DISABLED_BUILTIN_QUERIES[language] || [])
-        .some(disabledQuery => query.endsWith(disabledQuery));
+async function setupPythonExtractor() {
+    const codeqlPython = process.env["CODEQL_PYTHON"];
+    if (codeqlPython === undefined || codeqlPython.length === 0) {
+        // If CODEQL_PYTHON is not set, no dependencies were installed, so we don't need to do anything
+        return;
+    }
+    let output = '';
+    const options = {
+        listeners: {
+            stdout: (data) => {
+                output += data.toString();
+            }
+        }
+    };
+    await exec.exec(codeqlPython, ['-c', 'import os; import pip; print(os.path.dirname(os.path.dirname(pip.__file__)))'], options);
+    core.info('Setting LGTM_INDEX_IMPORT_PATH=' + output);
+    process.env['LGTM_INDEX_IMPORT_PATH'] = output;
+    output = '';
+    await exec.exec(codeqlPython, ['-c', 'import sys; print(sys.version_info[0])'], options);
+    core.info('Setting LGTM_PYTHON_SETUP_VERSION=' + output);
+    process.env['LGTM_PYTHON_SETUP_VERSION'] = output;
 }
 async function createdDBForScannedLanguages(databaseFolder) {
    const scannedLanguages = process.env[sharedEnv.CODEQL_ACTION_SCANNED_LANGUAGES];
@@ -42,70 +45,29 @@ async function createdDBForScannedLanguages(databaseFolder) {
        const codeql = codeql_1.getCodeQL();
        for (const language of scannedLanguages.split(',')) {
            core.startGroup('Extracting ' + language);
+            if (language === 'python') {
+                await setupPythonExtractor();
+            }
            await codeql.extractScannedLanguage(path.join(databaseFolder, language), language);
            core.endGroup();
        }
    }
 }
-async function finalizeDatabaseCreation(databaseFolder) {
+async function finalizeDatabaseCreation(databaseFolder, config) {
    await createdDBForScannedLanguages(databaseFolder);
-    const languages = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES] || '';
    const codeql = codeql_1.getCodeQL();
-    for (const language of languages.split(',')) {
+    for (const language of config.languages) {
        core.startGroup('Finalizing ' + language);
        await codeql.finalizeDatabase(path.join(databaseFolder, language));
        core.endGroup();
    }
 }
-async function resolveQueryLanguages(config) {
-    let res = new Map();
-    const codeql = codeql_1.getCodeQL();
-    if (!config.disableDefaultQueries || config.additionalSuites.length !== 0) {
-        const suites = [];
-        for (const language of await util.getLanguages()) {
-            if (!config.disableDefaultQueries) {
-                suites.push(language + '-code-scanning.qls');
-            }
-            for (const additionalSuite of config.additionalSuites) {
-                suites.push(language + '-' + additionalSuite + '.qls');
-            }
-        }
-        const resolveQueriesOutputObject = await codeql.resolveQueries(suites);
-        for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
-            if (res[language] === undefined) {
-                res[language] = [];
-            }
-            res[language].push(...Object.keys(queries).filter(q => !queryIsDisabled(language, q)));
-        }
-    }
-    if (config.additionalQueries.length !== 0) {
-        const resolveQueriesOutputObject = await codeql.resolveQueries(config.additionalQueries);
-        for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
-            if (res[language] === undefined) {
-                res[language] = [];
-            }
-            res[language].push(...Object.keys(queries));
-        }
-        const noDeclaredLanguage = resolveQueriesOutputObject.noDeclaredLanguage;
-        const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
-        if (noDeclaredLanguageQueries.length !== 0) {
-            throw new Error('Some queries do not declare a language, their qlpack.yml file is missing or is invalid');
-        }
-        const multipleDeclaredLanguages = resolveQueriesOutputObject.multipleDeclaredLanguages;
-        const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
-        if (multipleDeclaredLanguagesQueries.length !== 0) {
-            throw new Error('Some queries declare multiple languages, their qlpack.yml file is missing or is invalid');
-        }
-    }
-    return res;
-}
 // Runs queries and creates sarif files in the given folder
 async function runQueries(databaseFolder, sarifFolder, config) {
-    const queriesPerLanguage = await resolveQueryLanguages(config);
    const codeql = codeql_1.getCodeQL();
    for (let database of fs.readdirSync(databaseFolder)) {
        core.startGroup('Analyzing ' + database);
-        const queries = queriesPerLanguage[database] || [];
+        const queries = config.queries[database] || [];
        if (queries.length === 0) {
            throw new Error('Unable to analyse ' + database + ' as no queries were selected for this language');
        }
@@ -126,15 +88,14 @@ async function run() {
        if (util.should_abort('finish', true) || !await util.reportActionStarting('finish')) {
            return;
        }
-        const config = await configUtils.loadConfig();
+        const config = await configUtils.getConfig();
        core.exportVariable(sharedEnv.ODASA_TRACER_CONFIGURATION, '');
        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
        const databaseFolder = util.getRequiredEnvParam(sharedEnv.CODEQL_ACTION_DATABASE_DIR);
        const sarifFolder = core.getInput('output');
        await io.mkdirP(sarifFolder);
        core.info('Finalizing database creation');
-        await finalizeDatabaseCreation(databaseFolder);
-        await externalQueries.checkoutExternalQueries(config);
+        await finalizeDatabaseCreation(databaseFolder, config);
        core.info('Analyzing database');
        await runQueries(databaseFolder, sarifFolder, config);
        if ('true' === core.getInput('upload')) {
@@ -10,6 +10,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core = __importStar(require("@actions/core"));
 const exec = __importStar(require("@actions/exec"));
 const io = __importStar(require("@actions/io"));
+const toolcache = __importStar(require("@actions/tool-cache"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const analysisPaths = __importStar(require("./analysis-paths"));
@@ -121,21 +122,55 @@ function concatTracerConfigs(configs) {
    fs.writeFileSync(envPath, buffer);
    return { env, spec };
 }
+async function installPythonDeps(codeql) {
+    core.startGroup('Setup Python dependencies');
+    let scriptsFolder = '';
+    try {
+        const repoPath = await toolcache.downloadTool('https://github.com/Daverlo/codeql-python-autobuild/archive/master.zip');
+        const extracted = await toolcache.extractZip(repoPath);
+        scriptsFolder = path.join(extracted, 'codeql-python-autobuild-master');
+    }
+    catch (e) {
+        // The download should not fail, but in case it fails we just abort trying to setup the python deps
+        core.warning('Unable to download and extract the scripts needed for installing the python dependecies');
+        core.endGroup();
+        return;
+    }
+    // Setup tools
+    try {
+        await exec.exec(path.join(scriptsFolder, 'install_tools.sh'));
+    }
+    catch (e) {
+        // This script tries to install some needed tools in the runner. It should not fail, but if it does
+        // we just abort the process without failing the action
+        core.warning('Unable to download and extract the scripts needed for installing the python dependecies');
+        core.endGroup();
+        return;
+    }
+    // Install dependencies
+    try {
+        await exec.exec(path.join(scriptsFolder, 'auto_install_packages.py'), [codeql.getDir()]);
+    }
+    catch (e) {
+        core.endGroup();
+        throw new Error('We were unable to install your python dependencies. You can call this action with "setup-python-dependencies: false" to disable this process');
+    }
+    core.endGroup();
+}
 async function run() {
-    let languages;
+    let config;
+    let codeql;
    try {
        if (util.should_abort('init', false) || !await util.reportActionStarting('init')) {
            return;
        }
+        core.startGroup('Setup CodeQL tools');
+        codeql = await codeql_1.setupCodeQL();
+        await codeql.printVersion();
+        core.endGroup();
        core.startGroup('Load language configuration');
-        const config = await configUtils.loadConfig();
-        languages = await util.getLanguages();
-        // If the languages parameter was not given and no languages were
-        // detected then fail here as this is a workflow configuration error.
-        if (languages.length === 0) {
-            throw new Error("Did not detect any languages to analyze. Please update input in workflow.");
-        }
-        analysisPaths.includeAndExcludeAnalysisPaths(config, languages);
+        config = await configUtils.initConfig();
+        analysisPaths.includeAndExcludeAnalysisPaths(config);
        core.endGroup();
    }
    catch (e) {
@@ -145,16 +180,16 @@ async function run() {
    }
    try {
        const sourceRoot = path.resolve();
-        core.startGroup('Setup CodeQL tools');
-        const codeql = await codeql_1.setupCodeQL();
-        await codeql.printVersion();
-        core.endGroup();
        // Forward Go flags
        const goFlags = process.env['GOFLAGS'];
        if (goFlags) {
            core.exportVariable('GOFLAGS', goFlags);
            core.warning("Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.");
        }
+        const setupPythonDependencies = core.getInput('setup-python-dependencies', { required: true });
+        if (config.languages.includes('python') && setupPythonDependencies === 'true') {
+            await installPythonDeps(codeql);
+        }
        // Setup CODEQL_RAM flag (todo improve this https://github.com/github/dsp-code-scanning/issues/935)
        const codeqlRam = process.env['CODEQL_RAM'] || '6500';
        core.exportVariable('CODEQL_RAM', codeqlRam);
@@ -163,7 +198,7 @@ async function run() {
        let tracedLanguages = {};
        let scannedLanguages = [];
        // TODO: replace this code once CodeQL supports multi-language tracing
-        for (let language of languages) {
+        for (let language of config.languages) {
            const languageDatabase = path.join(databaseFolder, language);
            // Init language database
            await codeql.databaseInit(languageDatabase, language, sourceRoot);
@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CODEQL_ACTION_DATABASE_DIR = 'CODEQL_ACTION_DATABASE_DIR';
-exports.CODEQL_ACTION_LANGUAGES = 'CODEQL_ACTION_LANGUAGES';
 exports.CODEQL_ACTION_ANALYSIS_KEY = 'CODEQL_ACTION_ANALYSIS_KEY';
 exports.ODASA_TRACER_CONFIGURATION = 'ODASA_TRACER_CONFIGURATION';
 exports.CODEQL_ACTION_SCANNED_LANGUAGES = 'CODEQL_ACTION_SCANNED_LANGUAGES';
@@ -1 +1 @@
-{"version":3,"file":"shared-environment.js","sourceRoot":"","sources":["../src/shared-environment.ts"],"names":[],"mappings":";;AAAa,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAC1D,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AACpD,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAC1D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAC1D,QAAA,+BAA+B,GAAG,iCAAiC,CAAC;AACpE,QAAA,8BAA8B,GAAG,gCAAgC,CAAC;AAC/E,wEAAwE;AACxE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,+BAA+B;AAClB,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AACnE,wDAAwD;AAC3C,QAAA,4BAA4B,GAAG,8BAA8B,CAAC"}
+{"version":3,"file":"shared-environment.js","sourceRoot":"","sources":["../src/shared-environment.ts"],"names":[],"mappings":";;AAAa,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAC1D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAC1D,QAAA,0BAA0B,GAAG,4BAA4B,CAAC;AAC1D,QAAA,+BAA+B,GAAG,iCAAiC,CAAC;AACpE,QAAA,8BAA8B,GAAG,gCAAgC,CAAC;AAC/E,wEAAwE;AACxE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,+BAA+B;AAClB,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AACnE,wDAAwD;AAC3C,QAAA,4BAA4B,GAAG,8BAA8B,CAAC"}
@@ -2,8 +2,16 @@
 var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
+    result["default"] = mod;
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const sinon_1 = __importDefault(require("sinon"));
+const CodeQL = __importStar(require("./codeql"));
 function wrapOutput(context) {
    // Function signature taken from Socket.write.
    // Note there are two overloads:
@@ -32,6 +40,10 @@ function wrapOutput(context) {
 function setupTests(test) {
    const typedTest = test;
    typedTest.beforeEach(t => {
+        // Set an empty CodeQL object so that all method calls will fail
+        // unless the test explicitly sets one up.
+        CodeQL.setCodeQL({});
+        // Replace stdout and stderr so we can record output during tests
        t.context.testOutput = "";
        const processStdoutWrite = process.stdout.write.bind(process.stdout);
        t.context.stdoutWrite = processStdoutWrite;
@@ -39,16 +51,24 @@ function setupTests(test) {
        const processStderrWrite = process.stderr.write.bind(process.stderr);
        t.context.stderrWrite = processStderrWrite;
        process.stderr.write = wrapOutput(t.context);
+        // Many tests modify environment variables. Take a copy now so that
+        // we reset them after the test to keep tests independent of each other.
+        // process.env only has strings fields, so a shallow copy is fine.
+        t.context.env = {};
+        Object.assign(t.context.env, process.env);
    });
    typedTest.afterEach.always(t => {
+        // Restore stdout and stderr
+        // The captured output is only replayed if the test failed
        process.stdout.write = t.context.stdoutWrite;
        process.stderr.write = t.context.stderrWrite;
        if (!t.passed) {
            process.stdout.write(t.context.testOutput);
        }
-    });
-    typedTest.afterEach.always(() => {
+        // Undo any modifications made by sinon
        sinon_1.default.restore();
+        // Undo any modifications to the env
+        process.env = t.context.env;
    });
 }
 exports.setupTests = setupTests;
@@ -1 +1 @@
-{"version":3,"file":"testing-utils.js","sourceRoot":"","sources":["../src/testing-utils.ts"],"names":[],"mappings":";;;;;AACA,kDAA0B;AAI1B,SAAS,UAAU,CAAC,OAAoB;IACtC,8CAA8C;IAC9C,gCAAgC;IAChC,2EAA2E;IAC3E,2FAA2F;IAC3F,OAAO,CAAC,KAA0B,EAAE,QAAiB,EAAE,EAA0B,EAAW,EAAE;QAC5F,2CAA2C;QAC3C,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE;YACtD,EAAE,GAAG,QAAQ,CAAC;YACd,QAAQ,GAAG,SAAS,CAAC;SACtB;QAED,oBAAoB;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YAC7B,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;SAC7B;aAAM;YACL,OAAO,CAAC,UAAU,IAAI,IAAI,WAAW,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC1E;QAED,iDAAiD;QACjD,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE;YAChD,EAAE,EAAE,CAAC;SACN;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,UAAU,CAAC,IAAwB;IACjD,MAAM,SAAS,GAAG,IAAkC,CAAC;IAErD,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QACvB,CAAC,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAE1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAQ,CAAC;QAEpD,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAQ,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAE7C,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SAC5C;IACH,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE;QAC9B,eAAK,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AA3BD,gCA2BC"}
+{"version":3,"file":"testing-utils.js","sourceRoot":"","sources":["../src/testing-utils.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,kDAA0B;AAE1B,iDAAmC;AAInC,SAAS,UAAU,CAAC,OAAoB;IACtC,8CAA8C;IAC9C,gCAAgC;IAChC,2EAA2E;IAC3E,2FAA2F;IAC3F,OAAO,CAAC,KAA0B,EAAE,QAAiB,EAAE,EAA0B,EAAW,EAAE;QAC5F,2CAA2C;QAC3C,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE;YACtD,EAAE,GAAG,QAAQ,CAAC;YACd,QAAQ,GAAG,SAAS,CAAC;SACtB;QAED,oBAAoB;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE;YAC7B,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;SAC7B;aAAM;YACL,OAAO,CAAC,UAAU,IAAI,IAAI,WAAW,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC1E;QAED,iDAAiD;QACjD,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE;YAChD,EAAE,EAAE,CAAC;SACN;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,UAAU,CAAC,IAAwB;IACjD,MAAM,SAAS,GAAG,IAAkC,CAAC;IAErD,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QACvB,gEAAgE;QAChE,0CAA0C;QAC1C,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAErB,iEAAiE;QACjE,CAAC,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAC1B,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAQ,CAAC;QACpD,MAAM,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,CAAC,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAQ,CAAC;QAEpD,mEAAmE;QACnE,wEAAwE;QACxE,kEAAkE;QAClE,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC7B,4BAA4B;QAC5B,0DAA0D;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SAC5C;QAED,uCAAuC;QACvC,eAAK,CAAC,OAAO,EAAE,CAAC;QAEhB,oCAAoC;QACpC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAvCD,gCAuCC"}
@@ -13,6 +13,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const api = __importStar(require("./api-client"));
+const configUtils = __importStar(require("./config-utils"));
 const sharedEnv = __importStar(require("./shared-environment"));
 /**
 * Should the current action be aborted?
@@ -48,83 +49,6 @@ function getRequiredEnvParam(paramName) {
    return value;
 }
 exports.getRequiredEnvParam = getRequiredEnvParam;
-/**
- * Gets the set of languages in the current repository
- */
-async function getLanguagesInRepo() {
-    var _a;
-    // Translate between GitHub's API names for languages and ours
-    const codeqlLanguages = {
-        'C': 'cpp',
-        'C++': 'cpp',
-        'C#': 'csharp',
-        'Go': 'go',
-        'Java': 'java',
-        'JavaScript': 'javascript',
-        'TypeScript': 'javascript',
-        'Python': 'python',
-    };
-    let repo_nwo = (_a = process.env['GITHUB_REPOSITORY']) === null || _a === void 0 ? void 0 : _a.split("/");
-    if (repo_nwo) {
-        let owner = repo_nwo[0];
-        let repo = repo_nwo[1];
-        core.debug(`GitHub repo ${owner} ${repo}`);
-        const response = await api.getApiClient().request("GET /repos/:owner/:repo/languages", ({
-            owner,
-            repo
-        }));
-        core.debug("Languages API response: " + JSON.stringify(response));
-        // The GitHub API is going to return languages in order of popularity,
-        // When we pick a language to autobuild we want to pick the most popular traced language
-        // Since sets in javascript maintain insertion order, using a set here and then splatting it
-        // into an array gives us an array of languages ordered by popularity
-        let languages = new Set();
-        for (let lang in response.data) {
-            if (lang in codeqlLanguages) {
-                languages.add(codeqlLanguages[lang]);
-            }
-        }
-        return [...languages];
-    }
-    else {
-        return [];
-    }
-}
-/**
- * Get the languages to analyse.
- *
- * The result is obtained from the environment parameter CODEQL_ACTION_LANGUAGES
- * if that has been set, otherwise it is obtained from the action input parameter
- * 'languages' if that has been set, otherwise it is deduced as all languages in the
- * repo that can be analysed.
- *
- * If the languages are obtained from either of the second choices, the
- * CODEQL_ACTION_LANGUAGES environment variable will be exported with the
- * deduced list.
- */
-async function getLanguages() {
-    // Obtain from CODEQL_ACTION_LANGUAGES if set
-    const langsVar = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES];
-    if (langsVar) {
-        return langsVar.split(',')
-            .map(x => x.trim())
-            .filter(x => x.length > 0);
-    }
-    // Obtain from action input 'languages' if set
-    let languages = core.getInput('languages', { required: false })
-        .split(',')
-        .map(x => x.trim())
-        .filter(x => x.length > 0);
-    core.info("Languages from configuration: " + JSON.stringify(languages));
-    if (languages.length === 0) {
-        // Obtain languages as all languages in the repo that can be analysed
-        languages = await getLanguagesInRepo();
-        core.info("Automatically detected languages: " + JSON.stringify(languages));
-    }
-    core.exportVariable(sharedEnv.CODEQL_ACTION_LANGUAGES, languages.join(','));
-    return languages;
-}
-exports.getLanguages = getLanguages;
 /**
 * Gets the SHA of the commit that is currently checked out.
 */
@@ -219,6 +143,18 @@ exports.getRef = getRef;
 * @param exception Exception (only supply if status is 'failure')
 */
 async function createStatusReport(actionName, status, cause, exception) {
+    var _a, _b;
+    // If this is not the init action starting up or aborting then try to load the config.
+    // If it fails then carry because it's important to still send the status report.
+    let config = undefined;
+    if (actionName !== 'init' || (status !== 'starting' && status !== 'aborted')) {
+        try {
+            config = await configUtils.getConfig();
+        }
+        catch (e) {
+            core.error('Unable to load config: ' + e);
+        }
+    }
    const commitOid = process.env['GITHUB_SHA'] || '';
    const ref = getRef();
    const workflowRunIDStr = process.env['GITHUB_RUN_ID'];
@@ -229,7 +165,7 @@ async function createStatusReport(actionName, status, cause, exception) {
    const workflowName = process.env['GITHUB_WORKFLOW'] || '';
    const jobName = process.env['GITHUB_JOB'] || '';
    const analysis_key = await getAnalysisKey();
-    const languages = (await getLanguages()).sort().join(',');
+    const languages = ((_b = (_a = config) === null || _a === void 0 ? void 0 : _a.languages) === null || _b === void 0 ? void 0 : _b.join(',')) || "";
    const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT] || new Date().toISOString();
    core.exportVariable(sharedEnv.CODEQL_ACTION_STARTED_AT, startedAt);
    let statusReport = {
@@ -9,11 +9,17 @@

 import javascript

+/**
+ * A declaration of a github action, including its inputs and entrypoint.
+ */
 class ActionDeclaration extends File {
  ActionDeclaration() {
    getRelativePath().matches("%/action.yml")
  }

+  /**
+   * The name of the action.
+   */
  string getName() {
    result = getRelativePath().regexpCapture("(.*)/action.yml", 1)
  }
@@ -22,10 +28,16 @@ class ActionDeclaration extends File {
    result.getFile() = this
  }

+  /**
+   * The name of any input to this action.
+   */
  string getAnInput() {
    result = getRootNode().(YAMLMapping).lookup("inputs").(YAMLMapping).getKey(_).(YAMLString).getValue()
  }

+  /**
+   * The function that is the entrypoint to this action.
+   */
  FunctionDeclStmt getEntrypoint() {
    result.getFile().getRelativePath() = getRootNode().
      (YAMLMapping).lookup("runs").
@@ -35,6 +47,21 @@ class ActionDeclaration extends File {
  }
 }

+/**
+ * A function declared on CodeQL interface from codeql.ts
+ */
+class CodeQLFunction extends Function {
+  CodeQLFunction() {
+    exists(Function getCodeQLForCmd, ObjectExpr obj |
+      getCodeQLForCmd.getName() = "getCodeQLForCmd" and
+      obj = getCodeQLForCmd.getAStmt().(ReturnStmt).getExpr() and
+      obj.getAProperty().getInit() = this)
+  }
+}
+
+/**
+ * Any expr that is a transitive child of the given function.
+ */
 Expr getAFunctionChildExpr(Function f) {
  result.getContainer() = f
 }
@@ -45,14 +72,25 @@ Expr getAFunctionChildExpr(Function f) {
 Function calledBy(Function f) {
  result = getAFunctionChildExpr(f).(InvokeExpr).getResolvedCallee()
  or
-  result.getEnclosingContainer() = f // assume outer function causes inner function to be called
+  // Assume outer function causes inner function to be called,
+  // except for the special case of the CodeQL functions.
+  (result.getEnclosingContainer() = f and not result instanceof CodeQLFunction)
+  or
+  // Handle calls to CodeQL functions by name
+  getAFunctionChildExpr(f).(InvokeExpr).getCalleeName() = result.(CodeQLFunction).getName()
 }

+/**
+ * A call to the core.getInput method.
+ */
 class GetInputMethodCallExpr extends MethodCallExpr {
  GetInputMethodCallExpr() {
    getMethodName() = "getInput"
  }

+  /**
+   * The name of the input being accessed.
+   */
  string getInputName() {
    result = getArgument(0).(StringLiteral).getValue()
  }
@@ -62,4 +100,4 @@ from ActionDeclaration action, GetInputMethodCallExpr getInputCall, string input
 where getAFunctionChildExpr(calledBy*(action.getEntrypoint())) = getInputCall and
  inputName = getInputCall.getInputName() and
  not inputName = action.getAnInput()
-select getInputCall, "The $@ input is not defined for the $@ action", inputName, inputName, action, action.getName()
+select getInputCall, "The $@ input is not defined for the $@ action", inputName, inputName, action, action.getName()
@@ -1,24 +1,31 @@
 import test from 'ava';

 import * as analysisPaths from './analysis-paths';
-import * as configUtils from './config-utils';
 import {setupTests} from './testing-utils';

 setupTests(test);

 test("emptyPaths", async t => {
-  let config = new configUtils.Config();
-  analysisPaths.includeAndExcludeAnalysisPaths(config, []);
+  const config = {
+    languages: [],
+    queries: {},
+    pathsIgnore: [],
+    paths: [],
+  };
+  analysisPaths.includeAndExcludeAnalysisPaths(config);
  t.is(process.env['LGTM_INDEX_INCLUDE'], undefined);
  t.is(process.env['LGTM_INDEX_EXCLUDE'], undefined);
  t.is(process.env['LGTM_INDEX_FILTERS'], undefined);
 });

 test("nonEmptyPaths", async t => {
-  let config = new configUtils.Config();
-  config.paths.push('path1', 'path2', '**/path3');
-  config.pathsIgnore.push('path4', 'path5', 'path6/**');
-  analysisPaths.includeAndExcludeAnalysisPaths(config, []);
+  const config = {
+    languages: [],
+    queries: {},
+    paths: ['path1', 'path2', '**/path3'],
+    pathsIgnore: ['path4', 'path5', 'path6/**'],
+  };
+  analysisPaths.includeAndExcludeAnalysisPaths(config);
  t.is(process.env['LGTM_INDEX_INCLUDE'], 'path1\npath2');
  t.is(process.env['LGTM_INDEX_EXCLUDE'], 'path4\npath5');
  t.is(process.env['LGTM_INDEX_FILTERS'], 'include:path1\ninclude:path2\ninclude:**/path3\nexclude:path4\nexclude:path5\nexclude:path6/**');
@@ -22,7 +22,7 @@ function buildIncludeExcludeEnvVar(paths: string[]): string {
  return paths.join('\n');
 }

-export function includeAndExcludeAnalysisPaths(config: configUtils.Config, languages: string[]) {
+export function includeAndExcludeAnalysisPaths(config: configUtils.Config) {
  // The 'LGTM_INDEX_INCLUDE' and 'LGTM_INDEX_EXCLUDE' environment variables
  // control which files/directories are traversed when scanning.
  // This allows including files that otherwise would not be scanned, or
@@ -52,7 +52,7 @@ export function includeAndExcludeAnalysisPaths(config: configUtils.Config, langu
  if ((config.paths.length !== 0 ||
        config.pathsIgnore.length !== 0 ||
        filters.length !== 0) &&
-      !languages.every(isInterpretedLanguage)) {
+      !config.languages.every(isInterpretedLanguage)) {
    core.warning('The "paths"/"paths-ignore" fields of the config only have effect for Javascript and Python');
  }
 }
@@ -41,7 +41,7 @@ export interface CodeQL {
  /**
   * Run 'codeql resolve queries'.
   */
-  resolveQueries(queries: string[]): Promise<ResolveQueriesOutput>;
+  resolveQueries(queries: string[], extraSearchPath: string | undefined): Promise<ResolveQueriesOutput>;
  /**
   * Run 'codeql database analyze'.
   */
@@ -62,6 +62,12 @@ export interface ResolveQueriesOutput {
  };
 }

+/**
+ * Stores the CodeQL object, and is populated by `setupCodeQL` or `getCodeQL`.
+ * Can be overridden in tests using `setCodeQL`.
+ */
+let cachedCodeQL: CodeQL | undefined = undefined;
+
 /**
 * Environment variable used to store the location of the CodeQL CLI executable.
 * Value is set by setupCodeQL and read by getCodeQL.
@@ -89,8 +95,9 @@ export async function setupCodeQL(): Promise<CodeQL> {
      throw new Error("Unsupported plaform: " + process.platform);
    }

+    cachedCodeQL = getCodeQLForCmd(codeqlCmd);
    core.exportVariable(CODEQL_ACTION_CMD, codeqlCmd);
-    return getCodeQLForCmd(codeqlCmd);
+    return cachedCodeQL;

  } catch (e) {
    core.error(e);
@@ -121,8 +128,41 @@ export function getCodeQLURLVersion(url: string): string {
 }

 export function getCodeQL(): CodeQL {
-  const codeqlCmd = util.getRequiredEnvParam(CODEQL_ACTION_CMD);
-  return getCodeQLForCmd(codeqlCmd);
+  if (cachedCodeQL === undefined) {
+    const codeqlCmd = util.getRequiredEnvParam(CODEQL_ACTION_CMD);
+    cachedCodeQL = getCodeQLForCmd(codeqlCmd);
+  }
+  return cachedCodeQL;
+}
+
+function resolveFunction<T>(partialCodeql: Partial<CodeQL>, methodName: string): T {
+  if (typeof partialCodeql[methodName] !== 'function') {
+    const dummyMethod = () => {
+      throw new Error('CodeQL ' + methodName + ' method not correctly defined');
+    };
+    return dummyMethod as any;
+  }
+  return partialCodeql[methodName];
+}
+
+/**
+ * Set the functionality for CodeQL methods. Only for use in tests.
+ *
+ * Accepts a partial object and any undefined methods will be implemented
+ * to immediately throw an exception indicating which method is missing.
+ */
+export function setCodeQL(partialCodeql: Partial<CodeQL>) {
+  cachedCodeQL = {
+    getDir: resolveFunction(partialCodeql, 'getDir'),
+    printVersion: resolveFunction(partialCodeql, 'printVersion'),
+    getTracerEnv: resolveFunction(partialCodeql, 'getTracerEnv'),
+    databaseInit: resolveFunction(partialCodeql, 'databaseInit'),
+    runAutobuild: resolveFunction(partialCodeql, 'runAutobuild'),
+    extractScannedLanguage: resolveFunction(partialCodeql, 'extractScannedLanguage'),
+    finalizeDatabase: resolveFunction(partialCodeql, 'finalizeDatabase'),
+    resolveQueries: resolveFunction(partialCodeql, 'resolveQueries'),
+    databaseAnalyze: resolveFunction(partialCodeql, 'databaseAnalyze')
+  };
 }

 function getCodeQLForCmd(cmd: string): CodeQL {
@@ -212,23 +252,24 @@ function getCodeQLForCmd(cmd: string): CodeQL {
        databasePath
      ]);
    },
-    resolveQueries: async function(queries: string[]) {
+    resolveQueries: async function(queries: string[], extraSearchPath: string | undefined) {
+      const codeqlArgs = [
+        'resolve',
+        'queries',
+        ...queries,
+        '--format=bylanguage'
+      ];
+      if (extraSearchPath !== undefined) {
+        codeqlArgs.push('--search-path', extraSearchPath);
+      }
      let output = '';
-      await exec.exec(
-        cmd,
-        [
-          'resolve',
-          'queries',
-          ...queries,
-          '--format=bylanguage'
-        ],
-        {
-          listeners: {
-            stdout: (data: Buffer) => {
-              output += data.toString();
-            }
+      await exec.exec(cmd, codeqlArgs, {
+        listeners: {
+          stdout: (data: Buffer) => {
+            output += data.toString();
          }
-        });
+        }
+      });

      return JSON.parse(output);
    },
@@ -5,6 +5,7 @@ import * as path from 'path';
 import sinon from 'sinon';

 import * as api from './api-client';
+import * as CodeQL from './codeql';
 import * as configUtils from './config-utils';
 import {setupTests} from './testing-utils';
 import * as util from './util';
@@ -41,10 +42,21 @@ test("load empty config", async t => {
    process.env['GITHUB_WORKSPACE'] = tmpDir;

    setInput('config-file', undefined);
+    setInput('languages', 'javascript,python');

-    const config = await configUtils.loadConfig();
+    CodeQL.setCodeQL({
+      resolveQueries: async function() {
+        return {
+          byLanguage: {},
+          noDeclaredLanguage: {},
+          multipleDeclaredLanguages: {},
+        };
+      },
+    });

-    t.deepEqual(config, new configUtils.Config());
+    const config = await configUtils.initConfig();
+
+    t.deepEqual(config, await configUtils.getDefaultConfig());
  });
 });

@@ -53,17 +65,34 @@ test("loading config saves config", async t => {
    process.env['RUNNER_TEMP'] = tmpDir;
    process.env['GITHUB_WORKSPACE'] = tmpDir;

-    const configFile = configUtils.getConfigFile();
-    // Sanity check the saved config file does not already exist
-    t.false(fs.existsSync(configFile));
+    setInput('config-file', undefined);
+    setInput('languages', 'javascript,python');

-    const config = await configUtils.loadConfig();
+    CodeQL.setCodeQL({
+      resolveQueries: async function() {
+        return {
+          byLanguage: {},
+          noDeclaredLanguage: {},
+          multipleDeclaredLanguages: {},
+        };
+      },
+    });
+
+
+    // Sanity check the saved config file does not already exist
+    t.false(fs.existsSync(configUtils.getPathToParsedConfigFile()));
+
+    // Sanity check that getConfig throws before we have called initConfig
+    await t.throwsAsync(configUtils.getConfig);
+
+    const config1 = await configUtils.initConfig();

    // The saved config file should now exist
-    t.true(fs.existsSync(configFile));
+    t.true(fs.existsSync(configUtils.getPathToParsedConfigFile()));

-    // And the contents should parse correctly to the config that was returned
-    t.deepEqual(fs.readFileSync(configFile, 'utf8'), JSON.stringify(config));
+    // And that same newly-initialised config should now be returned by getConfig
+    const config2 = await configUtils.getConfig();
+    t.deepEqual(config1, config2);
  });
 });

@@ -75,8 +104,8 @@ test("load input outside of workspace", async t => {
    setInput('config-file', '../input');

    try {
-      await configUtils.loadConfig();
-      throw new Error('loadConfig did not throw error');
+      await configUtils.initConfig();
+      throw new Error('initConfig did not throw error');
    } catch (err) {
      t.deepEqual(err, new Error(configUtils.getConfigFileOutsideWorkspaceErrorMessage(path.join(tmpDir, '../input'))));
    }
@@ -92,8 +121,8 @@ test("load non-local input with invalid repo syntax", async t => {
    setInput('config-file', 'octo-org/codeql-config@main');

    try {
-      await configUtils.loadConfig();
-      throw new Error('loadConfig did not throw error');
+      await configUtils.initConfig();
+      throw new Error('initConfig did not throw error');
    } catch (err) {
      t.deepEqual(err, new Error(configUtils.getConfigFileRepoFormatInvalidMessage('octo-org/codeql-config@main')));
    }
@@ -107,10 +136,11 @@ test("load non-existent input", async t => {

    t.false(fs.existsSync(path.join(tmpDir, 'input')));
    setInput('config-file', 'input');
+    setInput('languages', 'javascript');

    try {
-      await configUtils.loadConfig();
-      throw new Error('loadConfig did not throw error');
+      await configUtils.initConfig();
+      throw new Error('initConfig did not throw error');
    } catch (err) {
      t.deepEqual(err, new Error(configUtils.getConfigFileDoesNotExistErrorMessage(path.join(tmpDir, 'input'))));
    }
@@ -122,7 +152,116 @@ test("load non-empty input", async t => {
    process.env['RUNNER_TEMP'] = tmpDir;
    process.env['GITHUB_WORKSPACE'] = tmpDir;

+    CodeQL.setCodeQL({
+      resolveQueries: async function() {
+        return {
+          byLanguage: {
+            'javascript': {
+              '/foo/a.ql': {},
+              '/bar/b.ql': {},
+            },
+          },
+          noDeclaredLanguage: {},
+          multipleDeclaredLanguages: {},
+        };
+      },
+    });
+
    // Just create a generic config object with non-default values for all fields
+    const inputFileContents = `
+      name: my config
+      disable-default-queries: true
+      queries:
+        - uses: ./foo
+      paths-ignore:
+        - a
+        - b
+      paths:
+        - c/d`;
+
+    fs.mkdirSync(path.join(tmpDir, 'foo'));
+
+    // And the config we expect it to parse to
+    const expectedConfig: configUtils.Config = {
+      languages: ['javascript'],
+      queries: {'javascript': ['/foo/a.ql', '/bar/b.ql']},
+      pathsIgnore: ['a', 'b'],
+      paths: ['c/d'],
+    };
+
+    fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
+    setInput('config-file', 'input');
+    setInput('languages', 'javascript');
+
+    const actualConfig = await configUtils.initConfig();
+
+    // Should exactly equal the object we constructed earlier
+    t.deepEqual(actualConfig, expectedConfig);
+  });
+});
+
+test("default queries are used", async t => {
+  return await util.withTmpDir(async tmpDir => {
+    process.env['RUNNER_TEMP'] = tmpDir;
+    process.env['GITHUB_WORKSPACE'] = tmpDir;
+
+    // Check that the default behaviour is to add the default queries.
+    // In this case if a config file is specified but does not include
+    // the disable-default-queries field.
+    // We determine this by whether CodeQL.resolveQueries is called
+    // with the correct arguments.
+
+    const resolveQueriesArgs: {queries: string[], extraSearchPath: string | undefined}[] = [];
+    CodeQL.setCodeQL({
+      resolveQueries: async function(queries: string[], extraSearchPath: string | undefined) {
+        resolveQueriesArgs.push({queries, extraSearchPath});
+        return {
+          byLanguage: {
+            'javascript': {},
+          },
+          noDeclaredLanguage: {},
+          multipleDeclaredLanguages: {},
+        };
+      },
+    });
+
+    // The important point of this config is that it doesn't specify
+    // the disable-default-queries field.
+    // Any other details are hopefully irrelevant for this tetst.
+    const inputFileContents = `
+      paths:
+        - foo`;
+
+    fs.mkdirSync(path.join(tmpDir, 'foo'));
+
+    fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
+    setInput('config-file', 'input');
+    setInput('languages', 'javascript');
+
+    await configUtils.initConfig();
+
+    // Check resolve queries was called correctly
+    t.deepEqual(resolveQueriesArgs.length, 1);
+    t.deepEqual(resolveQueriesArgs[0].queries, ['javascript-code-scanning.qls']);
+    t.deepEqual(resolveQueriesArgs[0].extraSearchPath, undefined);
+  });
+});
+
+test("API client used when reading remote config", async t => {
+  return await util.withTmpDir(async tmpDir => {
+    process.env['RUNNER_TEMP'] = tmpDir;
+    process.env['GITHUB_WORKSPACE'] = tmpDir;
+
+    CodeQL.setCodeQL({
+      resolveQueries: async function() {
+        return {
+          byLanguage: {},
+          noDeclaredLanguage: {},
+          multipleDeclaredLanguages: {},
+        };
+      },
+    });
+
    const inputFileContents = `
      name: my config
      disable-default-queries: true
@@ -135,51 +274,18 @@ test("load non-empty input", async t => {
        - b
      paths:
        - c/d`;
-
-    fs.mkdirSync(path.join(tmpDir, 'foo'));
-
-    // And the config we expect it to parse to
-    const expectedConfig = new configUtils.Config();
-    expectedConfig.name = 'my config';
-    expectedConfig.disableDefaultQueries = true;
-    expectedConfig.additionalQueries.push(fs.realpathSync(tmpDir));
-    expectedConfig.additionalQueries.push(fs.realpathSync(path.join(tmpDir, 'foo')));
-    expectedConfig.externalQueries = [new configUtils.ExternalQuery('foo/bar', 'dev')];
-    expectedConfig.pathsIgnore = ['a', 'b'];
-    expectedConfig.paths = ['c/d'];
-
-    fs.writeFileSync(path.join(tmpDir, 'input'), inputFileContents, 'utf8');
-    setInput('config-file', 'input');
-
-    const actualConfig = await configUtils.loadConfig();
-
-    // Should exactly equal the object we constructed earlier
-    t.deepEqual(actualConfig, expectedConfig);
-  });
-});
-
-test("API client used when reading remote config", async t => {
-  return await util.withTmpDir(async tmpDir => {
-    process.env['RUNNER_TEMP'] = tmpDir;
-    process.env['GITHUB_WORKSPACE'] = tmpDir;
-
-    const inputFileContents = `
-      name: my config
-      disable-default-queries: true
-      queries:
-        - uses: ./
-      paths-ignore:
-        - a
-        - b
-      paths:
-        - c/d`;
    const dummyResponse = {
      content: Buffer.from(inputFileContents).toString("base64"),
    };
    const spyGetContents = mockGetContents(dummyResponse);

+    // Create checkout directory for remote queries repository
+    fs.mkdirSync(path.join(tmpDir, 'foo/bar'), { recursive: true });
+
    setInput('config-file', 'octo-org/codeql-config/config.yaml@main');
-    await configUtils.loadConfig();
+    setInput('languages', 'javascript');
+
+    await configUtils.initConfig();
    t.assert(spyGetContents.called);
  });
 });
@@ -195,8 +301,8 @@ test("Remote config handles the case where a directory is provided", async t =>
    const repoReference = 'octo-org/codeql-config/config.yaml@main';
    setInput('config-file', repoReference);
    try {
-      await configUtils.loadConfig();
-      throw new Error('loadConfig did not throw error');
+      await configUtils.initConfig();
+      throw new Error('initConfig did not throw error');
    } catch (err) {
      t.deepEqual(err, new Error(configUtils.getConfigFileDirectoryGivenMessage(repoReference)));
    }
@@ -216,8 +322,8 @@ test("Invalid format of remote config handled correctly", async t => {
    const repoReference = 'octo-org/codeql-config/config.yaml@main';
    setInput('config-file', repoReference);
    try {
-      await configUtils.loadConfig();
-      throw new Error('loadConfig did not throw error');
+      await configUtils.initConfig();
+      throw new Error('initConfig did not throw error');
    } catch (err) {
      t.deepEqual(err, new Error(configUtils.getConfigFileFormatInvalidMessage(repoReference)));
    }
@@ -234,13 +340,24 @@ function doInvalidInputTest(
      process.env['RUNNER_TEMP'] = tmpDir;
      process.env['GITHUB_WORKSPACE'] = tmpDir;

+      CodeQL.setCodeQL({
+        resolveQueries: async function() {
+          return {
+            byLanguage: {},
+            noDeclaredLanguage: {},
+            multipleDeclaredLanguages: {},
+          };
+        },
+      });
+
      const inputFile = path.join(tmpDir, 'input');
      fs.writeFileSync(inputFile, inputFileContents, 'utf8');
      setInput('config-file', 'input');
+      setInput('languages', 'javascript');

      try {
-        await configUtils.loadConfig();
-        throw new Error('loadConfig did not throw error');
+        await configUtils.initConfig();
+        throw new Error('initConfig did not throw error');
      } catch (err) {
        t.deepEqual(err, new Error(expectedErrorMessageGenerator(inputFile)));
      }
@@ -5,112 +5,238 @@ import * as yaml from 'js-yaml';
 import * as path from 'path';

 import * as api from './api-client';
+import { getCodeQL, ResolveQueriesOutput } from './codeql';
+import * as externalQueries from "./external-queries";
 import * as util from './util';

+// Property names from the user-supplied config file.
 const NAME_PROPERTY = 'name';
-const DISPLAY_DEFAULT_QUERIES_PROPERTY = 'disable-default-queries';
+const DISABLE_DEFAULT_QUERIES_PROPERTY = 'disable-default-queries';
 const QUERIES_PROPERTY = 'queries';
 const QUERIES_USES_PROPERTY = 'uses';
 const PATHS_IGNORE_PROPERTY = 'paths-ignore';
 const PATHS_PROPERTY = 'paths';

-export class ExternalQuery {
-  public repository: string;
-  public ref: string;
-  public path = '';
+/**
+ * Format of the parsed config file.
+ */
+export interface Config {
+  /**
+   * Set of languages to run analysis for.
+   */
+  languages: string[];
+  /**
+   * Map from language to query files.
+   * Will only contain .ql files and not other kinds of files,
+   * and all file paths will be absolute.
+   */
+  queries: { [language: string]: string[] };
+  /**
+   * List of paths to ignore from analysis.
+   */
+  pathsIgnore: string[];
+  /**
+   * List of paths to include in analysis.
+   */
+  paths: string[];
+}

-  constructor(repository: string, ref: string) {
-    this.repository = repository;
-    this.ref = ref;
+/**
+ * A list of queries from https://github.com/github/codeql that
+ * we don't want to run. Disabling them here is a quicker alternative to
+ * disabling them in the code scanning query suites. Queries should also
+ * be disabled in the suites, and removed from this list here once the
+ * bundle is updated to make those suite changes live.
+ *
+ * Format is a map from language to an array of path suffixes of .ql files.
+ */
+const DISABLED_BUILTIN_QUERIES: {[language: string]: string[]} = {
+  'csharp': [
+    'ql/src/Security Features/CWE-937/VulnerablePackage.ql',
+    'ql/src/Security Features/CWE-451/MissingXFrameOptions.ql',
+  ]
+};
+
+function queryIsDisabled(language, query): boolean {
+  return (DISABLED_BUILTIN_QUERIES[language] || [])
+    .some(disabledQuery => query.endsWith(disabledQuery));
+}
+
+/**
+ * Asserts that the noDeclaredLanguage and multipleDeclaredLanguages fields are
+ * both empty and errors if they are not.
+ */
+function validateQueries(resolvedQueries: ResolveQueriesOutput) {
+  const noDeclaredLanguage = resolvedQueries.noDeclaredLanguage;
+  const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
+  if (noDeclaredLanguageQueries.length !== 0) {
+    throw new Error('The following queries do not declare a language. ' +
+      'Their qlpack.yml files are either missing or is invalid.\n' +
+      noDeclaredLanguageQueries.join('\n'));
  }
+
+  const multipleDeclaredLanguages = resolvedQueries.multipleDeclaredLanguages;
+  const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
+  if (multipleDeclaredLanguagesQueries.length !== 0) {
+    throw new Error('The following queries declare multiple languages. ' +
+      'Their qlpack.yml files are either missing or is invalid.\n' +
+      multipleDeclaredLanguagesQueries.join('\n'));
+  }
+}
+
+/**
+ * Run 'codeql resolve queries' and add the results to resultMap
+ */
+async function runResolveQueries(
+  resultMap: { [language: string]: string[] },
+  toResolve: string[],
+  extraSearchPath: string | undefined,
+  errorOnInvalidQueries: boolean) {
+
+  const codeQl = getCodeQL();
+  const resolvedQueries = await codeQl.resolveQueries(toResolve, extraSearchPath);
+
+  for (const [language, queries] of Object.entries(resolvedQueries.byLanguage)) {
+    if (resultMap[language] === undefined) {
+      resultMap[language] = [];
+    }
+    resultMap[language].push(...Object.keys(queries).filter(q => !queryIsDisabled(language, q)));
+  }
+
+  if (errorOnInvalidQueries) {
+    validateQueries(resolvedQueries);
+  }
+}
+
+/**
+ * Get the set of queries included by default.
+ */
+async function addDefaultQueries(languages: string[], resultMap: { [language: string]: string[] }) {
+  const suites = languages.map(l => l + '-code-scanning.qls');
+  await runResolveQueries(resultMap, suites, undefined, false);
 }

 // The set of acceptable values for built-in suites from the codeql bundle
 const builtinSuites = ['security-extended', 'security-and-quality'] as const;
-// Derive the union type from the array values
-type BuiltInSuite = typeof builtinSuites[number];

-export class Config {
-  public name = "";
-  public disableDefaultQueries = false;
-  public additionalQueries: string[] = [];
-  public externalQueries: ExternalQuery[] = [];
-  public additionalSuites: BuiltInSuite[] = [];
-  public pathsIgnore: string[] = [];
-  public paths: string[] = [];
+/**
+ * Determine the set of queries associated with suiteName's suites and add them to resultMap.
+ * Throws an error if suiteName is not a valid builtin suite.
+ */
+async function addBuiltinSuiteQueries(
+  configFile: string,
+  languages: string[],
+  resultMap: { [language: string]: string[] },
+  suiteName: string) {

-  public addQuery(configFile: string, queryUses: string) {
-    // The logic for parsing the string is based on what actions does for
-    // parsing the 'uses' actions in the workflow file
-    queryUses = queryUses.trim();
-    if (queryUses === "") {
-      throw new Error(getQueryUsesInvalid(configFile));
-    }
-
-    // Check for the local path case before we start trying to parse the repository name
-    if (queryUses.startsWith("./")) {
-      const localQueryPath = queryUses.slice(2);
-      // Resolve the local path against the workspace so that when this is
-      // passed to codeql it resolves to exactly the path we expect it to resolve to.
-      const workspacePath = fs.realpathSync(util.getRequiredEnvParam('GITHUB_WORKSPACE'));
-      let absoluteQueryPath = path.join(workspacePath, localQueryPath);
-
-      // Check the file exists
-      if (!fs.existsSync(absoluteQueryPath)) {
-        throw new Error(getLocalPathDoesNotExist(configFile, localQueryPath));
-      }
-
-      // Call this after checking file exists, because it'll fail if file doesn't exist
-      absoluteQueryPath = fs.realpathSync(absoluteQueryPath);
-
-      // Check the local path doesn't jump outside the repo using '..' or symlinks
-      if (!(absoluteQueryPath + path.sep).startsWith(workspacePath + path.sep)) {
-        throw new Error(getLocalPathOutsideOfRepository(configFile, localQueryPath));
-      }
-
-      this.additionalQueries.push(absoluteQueryPath);
-      return;
-    }
-
-    // Check for one of the builtin suites
-    if (queryUses.indexOf('/') === -1 && queryUses.indexOf('@') === -1) {
-      const suite = builtinSuites.find((suite) => suite === queryUses);
-      if (suite) {
-        this.additionalSuites.push(suite);
-        return;
-      } else {
-        throw new Error(getQueryUsesInvalid(configFile, queryUses));
-      }
-    }
-
-    let tok = queryUses.split('@');
-    if (tok.length !== 2) {
-      throw new Error(getQueryUsesInvalid(configFile, queryUses));
-    }
-
-    const ref = tok[1];
-    tok = tok[0].split('/');
-    // The first token is the owner
-    // The second token is the repo
-    // The rest is a path, if there is more than one token combine them to form the full path
-    if (tok.length < 2) {
-      throw new Error(getQueryUsesInvalid(configFile, queryUses));
-    }
-    if (tok.length > 3) {
-      tok = [tok[0], tok[1], tok.slice(2).join('/')];
-    }
-
-    // Check none of the parts of the repository name are empty
-    if (tok[0].trim() === '' || tok[1].trim() === '') {
-      throw new Error(getQueryUsesInvalid(configFile, queryUses));
-    }
-
-    let external = new ExternalQuery(tok[0] + '/' + tok[1], ref);
-    if (tok.length === 3) {
-      external.path = tok[2];
-    }
-    this.externalQueries.push(external);
+  const suite = builtinSuites.find((suite) => suite === suiteName);
+  if (!suite) {
+    throw new Error(getQueryUsesInvalid(configFile, suiteName));
  }
+
+  const suites = languages.map(l => l + '-' + suiteName + '.qls');
+  await runResolveQueries(resultMap, suites, undefined, false);
+}
+
+/**
+ * Retrieve the set of queries at localQueryPath and add them to resultMap.
+ */
+async function addLocalQueries(
+  configFile: string,
+  resultMap: { [language: string]: string[] },
+  localQueryPath: string) {
+
+  // Resolve the local path against the workspace so that when this is
+  // passed to codeql it resolves to exactly the path we expect it to resolve to.
+  const workspacePath = fs.realpathSync(util.getRequiredEnvParam('GITHUB_WORKSPACE'));
+  let absoluteQueryPath = path.join(workspacePath, localQueryPath);
+
+  // Check the file exists
+  if (!fs.existsSync(absoluteQueryPath)) {
+    throw new Error(getLocalPathDoesNotExist(configFile, localQueryPath));
+  }
+
+  // Call this after checking file exists, because it'll fail if file doesn't exist
+  absoluteQueryPath = fs.realpathSync(absoluteQueryPath);
+
+  // Check the local path doesn't jump outside the repo using '..' or symlinks
+  if (!(absoluteQueryPath + path.sep).startsWith(workspacePath + path.sep)) {
+    throw new Error(getLocalPathOutsideOfRepository(configFile, localQueryPath));
+  }
+
+  // Get the root of the current repo to use when resolving query dependencies
+  const rootOfRepo = util.getRequiredEnvParam('GITHUB_WORKSPACE');
+
+  await runResolveQueries(resultMap, [absoluteQueryPath], rootOfRepo, true);
+}
+
+/**
+ * Retrieve the set of queries at the referenced remote repo and add them to resultMap.
+ */
+async function addRemoteQueries(configFile: string, resultMap: { [language: string]: string[] }, queryUses: string) {
+  let tok = queryUses.split('@');
+  if (tok.length !== 2) {
+    throw new Error(getQueryUsesInvalid(configFile, queryUses));
+  }
+
+  const ref = tok[1];
+
+  tok = tok[0].split('/');
+  // The first token is the owner
+  // The second token is the repo
+  // The rest is a path, if there is more than one token combine them to form the full path
+  if (tok.length < 2) {
+    throw new Error(getQueryUsesInvalid(configFile, queryUses));
+  }
+  // Check none of the parts of the repository name are empty
+  if (tok[0].trim() === '' || tok[1].trim() === '') {
+    throw new Error(getQueryUsesInvalid(configFile, queryUses));
+  }
+  const nwo = tok[0] + '/' + tok[1];
+
+  // Checkout the external repository
+  const rootOfRepo = await externalQueries.checkoutExternalRepository(nwo, ref);
+
+  const queryPath = tok.length > 2
+    ? path.join(rootOfRepo, tok.slice(2).join('/'))
+    : rootOfRepo;
+
+  await runResolveQueries(resultMap, [queryPath], rootOfRepo, true);
+}
+
+/**
+ * Parse a query 'uses' field to a discrete set of query files and update resultMap.
+ *
+ * The logic for parsing the string is based on what actions does for
+ * parsing the 'uses' actions in the workflow file. So it can handle
+ * local paths starting with './', or references to remote repos, or
+ * a finite set of hardcoded terms for builtin suites.
+ */
+async function parseQueryUses(
+  configFile: string,
+  languages: string[],
+  resultMap: { [language: string]: string[] },
+  queryUses: string) {
+
+  queryUses = queryUses.trim();
+  if (queryUses === "") {
+    throw new Error(getQueryUsesInvalid(configFile));
+  }
+
+  // Check for the local path case before we start trying to parse the repository name
+  if (queryUses.startsWith("./")) {
+    await addLocalQueries(configFile, resultMap, queryUses.slice(2));
+    return;
+  }
+
+  // Check for one of the builtin suites
+  if (queryUses.indexOf('/') === -1 && queryUses.indexOf('@') === -1) {
+    await addBuiltinSuiteQueries(configFile, languages, resultMap, queryUses);
+    return;
+  }
+
+  // Otherwise, must be a reference to another repo
+  await addRemoteQueries(configFile, resultMap, queryUses);
 }

 // Regex validating stars in paths or paths-ignore entries.
@@ -189,7 +315,7 @@ export function getNameInvalid(configFile: string): string {
 }

 export function getDisableDefaultQueriesInvalid(configFile: string): string {
-  return getConfigFilePropertyError(configFile, DISPLAY_DEFAULT_QUERIES_PROPERTY, 'must be a boolean');
+  return getConfigFilePropertyError(configFile, DISABLE_DEFAULT_QUERIES_PROPERTY, 'must be a boolean');
 }

 export function getQueriesInvalid(configFile: string): string {
@@ -254,17 +380,94 @@ function getConfigFilePropertyError(configFile: string, property: string, error:
  return 'The configuration file "' + configFile + '" is invalid: property "' + property + '" ' + error;
 }

-async function initConfig(): Promise<Config> {
-  let configFile = core.getInput('config-file');
+/**
+ * Gets the set of languages in the current repository
+ */
+async function getLanguagesInRepo(): Promise<string[]> {
+  // Translate between GitHub's API names for languages and ours
+  const codeqlLanguages = {
+    'C': 'cpp',
+    'C++': 'cpp',
+    'C#': 'csharp',
+    'Go': 'go',
+    'Java': 'java',
+    'JavaScript': 'javascript',
+    'TypeScript': 'javascript',
+    'Python': 'python',
+  };
+  let repo_nwo = process.env['GITHUB_REPOSITORY']?.split("/");
+  if (repo_nwo) {
+    let owner = repo_nwo[0];
+    let repo = repo_nwo[1];

-  const config = new Config();
+    core.debug(`GitHub repo ${owner} ${repo}`);
+    const response = await api.getApiClient().request("GET /repos/:owner/:repo/languages", ({
+      owner,
+      repo
+    }));

-  // If no config file was provided create an empty one
-  if (configFile === '') {
-    core.debug('No configuration file was provided');
-    return config;
+    core.debug("Languages API response: " + JSON.stringify(response));
+
+    // The GitHub API is going to return languages in order of popularity,
+    // When we pick a language to autobuild we want to pick the most popular traced language
+    // Since sets in javascript maintain insertion order, using a set here and then splatting it
+    // into an array gives us an array of languages ordered by popularity
+    let languages: Set<string> = new Set();
+    for (let lang in response.data) {
+      if (lang in codeqlLanguages) {
+        languages.add(codeqlLanguages[lang]);
+      }
+    }
+    return [...languages];
+  } else {
+    return [];
+  }
+}
+
+/**
+ * Get the languages to analyse.
+ *
+ * The result is obtained from the action input parameter 'languages' if that
+ * has been set, otherwise it is deduced as all languages in the repo that
+ * can be analysed.
+ */
+async function getLanguages(): Promise<string[]> {
+
+  // Obtain from action input 'languages' if set
+  let languages = core.getInput('languages', { required: false })
+    .split(',')
+    .map(x => x.trim())
+    .filter(x => x.length > 0);
+  core.info("Languages from configuration: " + JSON.stringify(languages));
+
+  if (languages.length === 0) {
+    // Obtain languages as all languages in the repo that can be analysed
+    languages = await getLanguagesInRepo();
+    core.info("Automatically detected languages: " + JSON.stringify(languages));
  }

+  return languages;
+}
+
+/**
+ * Get the default config for when the user has not supplied one.
+ */
+export async function getDefaultConfig(): Promise<Config> {
+  const languages = await getLanguages();
+  const queries = {};
+  await addDefaultQueries(languages, queries);
+  return {
+    languages: languages,
+    queries: queries,
+    pathsIgnore: [],
+    paths: []
+  };
+}
+
+/**
+ * Load the config from the given file.
+ */
+async function loadConfig(configFile: string): Promise<Config> {
  let parsedYAML;

  if (isLocal(configFile)) {
@@ -277,6 +480,8 @@ async function initConfig(): Promise<Config> {
    parsedYAML = await getRemoteConfig(configFile);
  }

+  // Validate that the 'name' property is syntactically correct,
+  // even though we don't use the value yet.
  if (NAME_PROPERTY in parsedYAML) {
    if (typeof parsedYAML[NAME_PROPERTY] !== "string") {
      throw new Error(getNameInvalid(configFile));
@@ -284,26 +489,40 @@ async function initConfig(): Promise<Config> {
    if (parsedYAML[NAME_PROPERTY].length === 0) {
      throw new Error(getNameInvalid(configFile));
    }
-    config.name = parsedYAML[NAME_PROPERTY];
  }

-  if (DISPLAY_DEFAULT_QUERIES_PROPERTY in parsedYAML) {
-    if (typeof parsedYAML[DISPLAY_DEFAULT_QUERIES_PROPERTY] !== "boolean") {
+  const languages = await getLanguages();
+  // If the languages parameter was not given and no languages were
+  // detected then fail here as this is a workflow configuration error.
+  if (languages.length === 0) {
+    throw new Error("Did not detect any languages to analyze. Please update input in workflow.");
+  }
+
+  const queries = {};
+  const pathsIgnore: string[] = [];
+  const paths: string[] = [];
+
+  let disableDefaultQueries = false;
+  if (DISABLE_DEFAULT_QUERIES_PROPERTY in parsedYAML) {
+    if (typeof parsedYAML[DISABLE_DEFAULT_QUERIES_PROPERTY] !== "boolean") {
      throw new Error(getDisableDefaultQueriesInvalid(configFile));
    }
-    config.disableDefaultQueries = parsedYAML[DISPLAY_DEFAULT_QUERIES_PROPERTY];
+    disableDefaultQueries = parsedYAML[DISABLE_DEFAULT_QUERIES_PROPERTY];
+  }
+  if (!disableDefaultQueries) {
+    await addDefaultQueries(languages, queries);
  }

  if (QUERIES_PROPERTY in parsedYAML) {
    if (!(parsedYAML[QUERIES_PROPERTY] instanceof Array)) {
      throw new Error(getQueriesInvalid(configFile));
    }
-    parsedYAML[QUERIES_PROPERTY].forEach(query => {
+    for (const query of parsedYAML[QUERIES_PROPERTY]) {
      if (!(QUERIES_USES_PROPERTY in query) || typeof query[QUERIES_USES_PROPERTY] !== "string") {
        throw new Error(getQueryUsesInvalid(configFile));
      }
-      config.addQuery(configFile, query[QUERIES_USES_PROPERTY]);
-    });
+      await parseQueryUses(configFile, languages, queries, query[QUERIES_USES_PROPERTY]);
+    }
  }

  if (PATHS_IGNORE_PROPERTY in parsedYAML) {
@@ -314,7 +533,7 @@ async function initConfig(): Promise<Config> {
      if (typeof path !== "string" || path === '') {
        throw new Error(getPathsIgnoreInvalid(configFile));
      }
-      config.pathsIgnore.push(validateAndSanitisePath(path, PATHS_IGNORE_PROPERTY, configFile));
+      pathsIgnore.push(validateAndSanitisePath(path, PATHS_IGNORE_PROPERTY, configFile));
    });
  }

@@ -326,10 +545,33 @@ async function initConfig(): Promise<Config> {
      if (typeof path !== "string" || path === '') {
        throw new Error(getPathsInvalid(configFile));
      }
-      config.paths.push(validateAndSanitisePath(path, PATHS_PROPERTY, configFile));
+      paths.push(validateAndSanitisePath(path, PATHS_PROPERTY, configFile));
    });
  }

+  return {languages, queries, pathsIgnore, paths};
+}
+
+/**
+ * Load and return the config.
+ *
+ * This will parse the config from the user input if present, or generate
+ * a default config. The parsed config is then stored to a known location.
+ */
+export async function initConfig(): Promise<Config> {
+  const configFile = core.getInput('config-file');
+  let config: Config;
+
+  // If no config file was provided create an empty one
+  if (configFile === '') {
+    core.debug('No configuration file was provided');
+    config = await getDefaultConfig();
+  } else {
+    config = await loadConfig(configFile);
+  }
+
+  // Save the config so we can easily access it again in the future
+  await saveConfig(config);
  return config;
 }

@@ -384,35 +626,46 @@ async function getRemoteConfig(configFile: string): Promise<any> {
  return yaml.safeLoad(Buffer.from(fileContents, 'base64').toString('binary'));
 }

-function getConfigFolder(): string {
+/**
+ * Get the directory where the parsed config will be stored.
+ */
+function getPathToParsedConfigFolder(): string {
  return util.getRequiredEnvParam('RUNNER_TEMP');
 }

-export function getConfigFile(): string {
-  return path.join(getConfigFolder(), 'config');
+/**
+ * Get the file path where the parsed config will be stored.
+ */
+export function getPathToParsedConfigFile(): string {
+  return path.join(getPathToParsedConfigFolder(), 'config');
 }

+/**
+ * Store the given config to the path returned from getPathToParsedConfigFile.
+ */
 async function saveConfig(config: Config) {
  const configString = JSON.stringify(config);
-  await io.mkdirP(getConfigFolder());
-  fs.writeFileSync(getConfigFile(), configString, 'utf8');
+  await io.mkdirP(getPathToParsedConfigFolder());
+  fs.writeFileSync(getPathToParsedConfigFile(), configString, 'utf8');
  core.debug('Saved config:');
  core.debug(configString);
 }

-export async function loadConfig(): Promise<Config> {
-  const configFile = getConfigFile();
-  if (fs.existsSync(configFile)) {
-    const configString = fs.readFileSync(configFile, 'utf8');
-    core.debug('Loaded config:');
-    core.debug(configString);
-    return JSON.parse(configString);
-
-  } else {
-    const config = await initConfig();
-    core.debug('Initialized config:');
-    core.debug(JSON.stringify(config));
-    await saveConfig(config);
-    return config;
+/**
+ * Get the config.
+ *
+ * If this is the first time in a workflow that this is being called then
+ * this will parse the config from the user input. The parsed config is then
+ * stored to a known location. On the second and further calls, this will
+ * return the contents of the parsed config from the known location.
+ */
+export async function getConfig(): Promise<Config> {
+  const configFile = getPathToParsedConfigFile();
+  if (!fs.existsSync(configFile)) {
+    throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
  }
+  const configString = fs.readFileSync(configFile, 'utf8');
+  core.debug('Loaded config:');
+  core.debug(configString);
+  return JSON.parse(configString);
 }
@@ -2,7 +2,6 @@ import test from 'ava';
 import * as fs from "fs";
 import * as path from "path";

-import * as configUtils from "./config-utils";
 import * as externalQueries from "./external-queries";
 import {setupTests} from './testing-utils';
 import * as util from "./util";
@@ -10,16 +9,11 @@ import * as util from "./util";
 setupTests(test);

 test("checkoutExternalQueries", async t => {
-  let config = new configUtils.Config();
-  config.externalQueries = [
-    new configUtils.ExternalQuery("github/codeql-go", "df4c6869212341b601005567381944ed90906b6b"),
-  ];
-
  await util.withTmpDir(async tmpDir => {
    process.env["RUNNER_TEMP"] = tmpDir;
-    await externalQueries.checkoutExternalQueries(config);
+    await externalQueries.checkoutExternalRepository("github/codeql-go", "df4c6869212341b601005567381944ed90906b6b");

-    // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in master
+    // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in the default branch
    t.true(fs.existsSync(path.join(tmpDir, "github", "codeql-go", "COPYRIGHT")));
  });
 });
@@ -3,26 +3,26 @@ import * as exec from '@actions/exec';
 import * as fs from 'fs';
 import * as path from 'path';

-import * as configUtils from './config-utils';
 import * as util from './util';

-export async function checkoutExternalQueries(config: configUtils.Config) {
+/**
+ * Check out repository at the given ref, and return the directory of the checkout.
+ */
+export async function checkoutExternalRepository(repository: string, ref: string): Promise<string> {
  const folder = util.getRequiredEnvParam('RUNNER_TEMP');

-  for (const externalQuery of config.externalQueries) {
-    core.info('Checking out ' + externalQuery.repository);
+  core.info('Checking out ' + repository);

-    const checkoutLocation = path.join(folder, externalQuery.repository);
-    if (!fs.existsSync(checkoutLocation)) {
-      const repoURL = 'https://github.com/' + externalQuery.repository + '.git';
-      await exec.exec('git', ['clone', repoURL, checkoutLocation]);
-      await exec.exec('git', [
-        '--work-tree=' + checkoutLocation,
-        '--git-dir=' + checkoutLocation + '/.git',
-        'checkout', externalQuery.ref,
-      ]);
-    }
-
-    config.additionalQueries.push(path.join(checkoutLocation, externalQuery.path));
+  const checkoutLocation = path.join(folder, repository);
+  if (!fs.existsSync(checkoutLocation)) {
+    const repoURL = 'https://github.com/' + repository + '.git';
+    await exec.exec('git', ['clone', repoURL, checkoutLocation]);
+    await exec.exec('git', [
+      '--work-tree=' + checkoutLocation,
+      '--git-dir=' + checkoutLocation + '/.git',
+      'checkout', ref,
+    ]);
  }
+
+  return checkoutLocation;
 }
@@ -1,34 +1,43 @@
 import * as core from '@actions/core';
+import * as exec from '@actions/exec';
 import * as io from '@actions/io';
 import * as fs from 'fs';
 import * as path from 'path';

 import { getCodeQL } from './codeql';
 import * as configUtils from './config-utils';
-import * as externalQueries from "./external-queries";
 import * as sharedEnv from './shared-environment';
 import * as upload_lib from './upload-lib';
 import * as util from './util';

-/**
- * A list of queries from https://github.com/github/codeql that
- * we don't want to run. Disabling them here is a quicker alternative to
- * disabling them in the code scanning query suites. Queries should also
- * be disabled in the suites, and removed from this list here once the
- * bundle is updated to make those suite changes live.
- *
- * Format is a map from language to an array of path suffixes of .ql files.
- */
-const DISABLED_BUILTIN_QUERIES: {[language: string]: string[]} = {
-  'csharp': [
-    'ql/src/Security Features/CWE-937/VulnerablePackage.ql',
-    'ql/src/Security Features/CWE-451/MissingXFrameOptions.ql',
-  ]
-};

-function queryIsDisabled(language, query): boolean {
-  return (DISABLED_BUILTIN_QUERIES[language] || [])
-    .some(disabledQuery => query.endsWith(disabledQuery));
+async function setupPythonExtractor() {
+  const codeqlPython = process.env["CODEQL_PYTHON"];
+  if (codeqlPython === undefined || codeqlPython.length === 0) {
+    // If CODEQL_PYTHON is not set, no dependencies were installed, so we don't need to do anything
+    return;
+  }
+
+  let output = '';
+  const options = {
+    listeners: {
+      stdout: (data: Buffer) => {
+        output += data.toString();
+      }
+    }
+  };
+
+  await exec.exec(
+    codeqlPython,
+    ['-c', 'import os; import pip; print(os.path.dirname(os.path.dirname(pip.__file__)))'],
+    options);
+  core.info('Setting LGTM_INDEX_IMPORT_PATH=' + output);
+  process.env['LGTM_INDEX_IMPORT_PATH'] = output;
+
+  output = '';
+  await exec.exec(codeqlPython, ['-c', 'import sys; print(sys.version_info[0])'], options);
+  core.info('Setting LGTM_PYTHON_SETUP_VERSION=' + output);
+  process.env['LGTM_PYTHON_SETUP_VERSION'] = output;
 }

 async function createdDBForScannedLanguages(databaseFolder: string) {
@@ -37,84 +46,35 @@ async function createdDBForScannedLanguages(databaseFolder: string) {
    const codeql = getCodeQL();
    for (const language of scannedLanguages.split(',')) {
      core.startGroup('Extracting ' + language);
+
+      if (language === 'python') {
+        await setupPythonExtractor();
+      }
+
      await codeql.extractScannedLanguage(path.join(databaseFolder, language), language);
      core.endGroup();
    }
  }
 }

-async function finalizeDatabaseCreation(databaseFolder: string) {
+async function finalizeDatabaseCreation(databaseFolder: string, config: configUtils.Config) {
  await createdDBForScannedLanguages(databaseFolder);

-  const languages = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES] || '';
  const codeql = getCodeQL();
-  for (const language of languages.split(',')) {
+  for (const language of config.languages) {
    core.startGroup('Finalizing ' + language);
    await codeql.finalizeDatabase(path.join(databaseFolder, language));
    core.endGroup();
  }
 }

-async function resolveQueryLanguages(config: configUtils.Config): Promise<Map<string, string[]>> {
-  let res = new Map();
-  const codeql = getCodeQL();
-
-  if (!config.disableDefaultQueries || config.additionalSuites.length !== 0) {
-    const suites: string[] = [];
-    for (const language of await util.getLanguages()) {
-      if (!config.disableDefaultQueries) {
-        suites.push(language + '-code-scanning.qls');
-      }
-      for (const additionalSuite of config.additionalSuites) {
-        suites.push(language + '-' + additionalSuite + '.qls');
-      }
-    }
-
-    const resolveQueriesOutputObject = await codeql.resolveQueries(suites);
-
-    for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
-      if (res[language] === undefined) {
-        res[language] = [];
-      }
-      res[language].push(...Object.keys(queries).filter(q => !queryIsDisabled(language, q)));
-    }
-  }
-
-  if (config.additionalQueries.length !== 0) {
-    const resolveQueriesOutputObject = await codeql.resolveQueries(config.additionalQueries);
-
-    for (const [language, queries] of Object.entries(resolveQueriesOutputObject.byLanguage)) {
-      if (res[language] === undefined) {
-        res[language] = [];
-      }
-      res[language].push(...Object.keys(queries));
-    }
-
-    const noDeclaredLanguage = resolveQueriesOutputObject.noDeclaredLanguage;
-    const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
-    if (noDeclaredLanguageQueries.length !== 0) {
-      throw new Error('Some queries do not declare a language, their qlpack.yml file is missing or is invalid');
-    }
-
-    const multipleDeclaredLanguages = resolveQueriesOutputObject.multipleDeclaredLanguages;
-    const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
-    if (multipleDeclaredLanguagesQueries.length !== 0) {
-      throw new Error('Some queries declare multiple languages, their qlpack.yml file is missing or is invalid');
-    }
-  }
-
-  return res;
-}
-
 // Runs queries and creates sarif files in the given folder
 async function runQueries(databaseFolder: string, sarifFolder: string, config: configUtils.Config) {
-  const queriesPerLanguage = await resolveQueryLanguages(config);
  const codeql = getCodeQL();
-
  for (let database of fs.readdirSync(databaseFolder)) {
    core.startGroup('Analyzing ' + database);

-    const queries = queriesPerLanguage[database] || [];
+    const queries = config.queries[database] || [];
    if (queries.length === 0) {
      throw new Error('Unable to analyse ' + database + ' as no queries were selected for this language');
    }
@@ -140,7 +100,7 @@ async function run() {
    if (util.should_abort('finish', true) || !await util.reportActionStarting('finish')) {
      return;
    }
-    const config = await configUtils.loadConfig();
+    const config = await configUtils.getConfig();

    core.exportVariable(sharedEnv.ODASA_TRACER_CONFIGURATION, '');
    delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
@@ -151,9 +111,7 @@ async function run() {
    await io.mkdirP(sarifFolder);

    core.info('Finalizing database creation');
-    await finalizeDatabaseCreation(databaseFolder);
-
-    await externalQueries.checkoutExternalQueries(config);
+    await finalizeDatabaseCreation(databaseFolder, config);

    core.info('Analyzing database');
    await runQueries(databaseFolder, sarifFolder, config);
@@ -1,6 +1,7 @@
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
 import * as io from '@actions/io';
+import * as toolcache from '@actions/tool-cache';
 import * as fs from 'fs';
 import * as path from 'path';

@@ -131,28 +132,59 @@ function concatTracerConfigs(configs: { [lang: string]: TracerConfig }): TracerC
  return { env, spec };
 }

+async function installPythonDeps(codeql: CodeQL) {
+  core.startGroup('Setup Python dependencies');
+
+  let scriptsFolder = '';
+  try {
+    const repoPath = await toolcache.downloadTool('https://github.com/Daverlo/codeql-python-autobuild/archive/master.zip');
+    const extracted = await toolcache.extractZip(repoPath);
+    scriptsFolder = path.join(extracted, 'codeql-python-autobuild-master');
+  } catch (e) {
+    // The download should not fail, but in case it fails we just abort trying to setup the python deps
+    core.warning('Unable to download and extract the scripts needed for installing the python dependecies');
+    core.endGroup();
+    return;
+  }
+
+  // Setup tools
+  try {
+    await exec.exec(path.join(scriptsFolder, 'install_tools.sh'));
+  } catch (e) {
+    // This script tries to install some needed tools in the runner. It should not fail, but if it does
+    // we just abort the process without failing the action
+    core.warning('Unable to download and extract the scripts needed for installing the python dependecies');
+    core.endGroup();
+    return;
+  }
+  // Install dependencies
+  try {
+    await exec.exec(path.join(scriptsFolder, 'auto_install_packages.py'), [codeql.getDir()]);
+  } catch (e) {
+    core.endGroup();
+    throw new Error('We were unable to install your python dependencies. You can call this action with "setup-python-dependencies: false" to disable this process');
+  }
+  core.endGroup();
+}
+
 async function run() {

-  let languages: string[];
+  let config: configUtils.Config;
+  let codeql: CodeQL;

  try {
    if (util.should_abort('init', false) || !await util.reportActionStarting('init')) {
      return;
    }

+    core.startGroup('Setup CodeQL tools');
+    codeql = await setupCodeQL();
+    await codeql.printVersion();
+    core.endGroup();
+
    core.startGroup('Load language configuration');
-
-    const config = await configUtils.loadConfig();
-
-    languages = await util.getLanguages();
-    // If the languages parameter was not given and no languages were
-    // detected then fail here as this is a workflow configuration error.
-    if (languages.length === 0) {
-      throw new Error("Did not detect any languages to analyze. Please update input in workflow.");
-    }
-
-    analysisPaths.includeAndExcludeAnalysisPaths(config, languages);
-
+    config = await configUtils.initConfig();
+    analysisPaths.includeAndExcludeAnalysisPaths(config);
    core.endGroup();

  } catch (e) {
@@ -165,11 +197,6 @@ async function run() {

    const sourceRoot = path.resolve();

-    core.startGroup('Setup CodeQL tools');
-    const codeql = await setupCodeQL();
-    await codeql.printVersion();
-    core.endGroup();
-
    // Forward Go flags
    const goFlags = process.env['GOFLAGS'];
    if (goFlags) {
@@ -177,6 +204,11 @@ async function run() {
      core.warning("Passing the GOFLAGS env parameter to the init action is deprecated. Please move this to the analyze action.");
    }

+    const setupPythonDependencies = core.getInput('setup-python-dependencies', { required: true });
+    if (config.languages.includes('python') && setupPythonDependencies === 'true') {
+      await installPythonDeps(codeql);
+    }
+
    // Setup CODEQL_RAM flag (todo improve this https://github.com/github/dsp-code-scanning/issues/935)
    const codeqlRam = process.env['CODEQL_RAM'] || '6500';
    core.exportVariable('CODEQL_RAM', codeqlRam);
@@ -187,7 +219,7 @@ async function run() {
    let tracedLanguages: { [key: string]: TracerConfig } = {};
    let scannedLanguages: string[] = [];
    // TODO: replace this code once CodeQL supports multi-language tracing
-    for (let language of languages) {
+    for (let language of config.languages) {
      const languageDatabase = path.join(databaseFolder, language);

      // Init language database
@@ -1,5 +1,4 @@
 export const CODEQL_ACTION_DATABASE_DIR = 'CODEQL_ACTION_DATABASE_DIR';
-export const CODEQL_ACTION_LANGUAGES = 'CODEQL_ACTION_LANGUAGES';
 export const CODEQL_ACTION_ANALYSIS_KEY = 'CODEQL_ACTION_ANALYSIS_KEY';
 export const ODASA_TRACER_CONFIGURATION = 'ODASA_TRACER_CONFIGURATION';
 export const CODEQL_ACTION_SCANNED_LANGUAGES = 'CODEQL_ACTION_SCANNED_LANGUAGES';
@@ -1,7 +1,9 @@
 import {TestInterface} from 'ava';
 import sinon from 'sinon';

-type TestContext = {stdoutWrite: any, stderrWrite: any, testOutput: string};
+import * as CodeQL from './codeql';
+
+type TestContext = {stdoutWrite: any, stderrWrite: any, testOutput: string, env: NodeJS.ProcessEnv};

 function wrapOutput(context: TestContext) {
  // Function signature taken from Socket.write.
@@ -35,27 +37,39 @@ export function setupTests(test: TestInterface<any>) {
  const typedTest = test as TestInterface<TestContext>;

  typedTest.beforeEach(t => {
-    t.context.testOutput = "";
+    // Set an empty CodeQL object so that all method calls will fail
+    // unless the test explicitly sets one up.
+    CodeQL.setCodeQL({});

+    // Replace stdout and stderr so we can record output during tests
+    t.context.testOutput = "";
    const processStdoutWrite = process.stdout.write.bind(process.stdout);
    t.context.stdoutWrite = processStdoutWrite;
    process.stdout.write = wrapOutput(t.context) as any;
-
    const processStderrWrite = process.stderr.write.bind(process.stderr);
    t.context.stderrWrite = processStderrWrite;
    process.stderr.write = wrapOutput(t.context) as any;
+
+    // Many tests modify environment variables. Take a copy now so that
+    // we reset them after the test to keep tests independent of each other.
+    // process.env only has strings fields, so a shallow copy is fine.
+    t.context.env = {};
+    Object.assign(t.context.env, process.env);
  });

  typedTest.afterEach.always(t => {
+    // Restore stdout and stderr
+    // The captured output is only replayed if the test failed
    process.stdout.write = t.context.stdoutWrite;
    process.stderr.write = t.context.stderrWrite;
-
    if (!t.passed) {
      process.stdout.write(t.context.testOutput);
    }
-  });

-  typedTest.afterEach.always(() => {
+    // Undo any modifications made by sinon
    sinon.restore();
+
+    // Undo any modifications to the env
+    process.env = t.context.env;
  });
 }
@@ -5,6 +5,7 @@ import * as os from 'os';
 import * as path from 'path';

 import * as api from './api-client';
+import * as configUtils from './config-utils';
 import * as sharedEnv from './shared-environment';

 /**
@@ -44,89 +45,6 @@ export function getRequiredEnvParam(paramName: string): string {
  return value;
 }

-/**
- * Gets the set of languages in the current repository
- */
-async function getLanguagesInRepo(): Promise<string[]> {
-  // Translate between GitHub's API names for languages and ours
-  const codeqlLanguages = {
-    'C': 'cpp',
-    'C++': 'cpp',
-    'C#': 'csharp',
-    'Go': 'go',
-    'Java': 'java',
-    'JavaScript': 'javascript',
-    'TypeScript': 'javascript',
-    'Python': 'python',
-  };
-  let repo_nwo = process.env['GITHUB_REPOSITORY']?.split("/");
-  if (repo_nwo) {
-    let owner = repo_nwo[0];
-    let repo = repo_nwo[1];
-
-    core.debug(`GitHub repo ${owner} ${repo}`);
-    const response = await api.getApiClient().request("GET /repos/:owner/:repo/languages", ({
-      owner,
-      repo
-    }));
-
-    core.debug("Languages API response: " + JSON.stringify(response));
-
-    // The GitHub API is going to return languages in order of popularity,
-    // When we pick a language to autobuild we want to pick the most popular traced language
-    // Since sets in javascript maintain insertion order, using a set here and then splatting it
-    // into an array gives us an array of languages ordered by popularity
-    let languages: Set<string> = new Set();
-    for (let lang in response.data) {
-      if (lang in codeqlLanguages) {
-        languages.add(codeqlLanguages[lang]);
-      }
-    }
-    return [...languages];
-  } else {
-    return [];
-  }
-}
-
-/**
- * Get the languages to analyse.
- *
- * The result is obtained from the environment parameter CODEQL_ACTION_LANGUAGES
- * if that has been set, otherwise it is obtained from the action input parameter
- * 'languages' if that has been set, otherwise it is deduced as all languages in the
- * repo that can be analysed.
- *
- * If the languages are obtained from either of the second choices, the
- * CODEQL_ACTION_LANGUAGES environment variable will be exported with the
- * deduced list.
- */
-export async function getLanguages(): Promise<string[]> {
-
-  // Obtain from CODEQL_ACTION_LANGUAGES if set
-  const langsVar = process.env[sharedEnv.CODEQL_ACTION_LANGUAGES];
-  if (langsVar) {
-    return langsVar.split(',')
-      .map(x => x.trim())
-      .filter(x => x.length > 0);
-  }
-  // Obtain from action input 'languages' if set
-  let languages = core.getInput('languages', { required: false })
-    .split(',')
-    .map(x => x.trim())
-    .filter(x => x.length > 0);
-  core.info("Languages from configuration: " + JSON.stringify(languages));
-
-  if (languages.length === 0) {
-    // Obtain languages as all languages in the repo that can be analysed
-    languages = await getLanguagesInRepo();
-    core.info("Automatically detected languages: " + JSON.stringify(languages));
-  }
-
-  core.exportVariable(sharedEnv.CODEQL_ACTION_LANGUAGES, languages.join(','));
-
-  return languages;
-}
-
 /**
 * Gets the SHA of the commit that is currently checked out.
 */
@@ -217,6 +135,9 @@ export function getRef(): string {
  }
 }

+type ActionName = 'init' | 'autobuild' | 'finish' | 'upload-sarif';
+type ActionStatus = 'starting' | 'aborted' | 'success' | 'failure';
+
 interface StatusReport {
  "workflow_run_id": number;
  "workflow_name": string;
@@ -226,11 +147,11 @@ interface StatusReport {
  "languages": string;
  "commit_oid": string;
  "ref": string;
-  "action_name": string;
+  "action_name": ActionName;
  "action_oid": string;
  "started_at": string;
  "completed_at"?: string;
-  "status": string;
+  "status": ActionStatus;
  "cause"?: string;
  "exception"?: string;
 }
@@ -244,12 +165,23 @@ interface StatusReport {
 * @param exception Exception (only supply if status is 'failure')
 */
 async function createStatusReport(
-  actionName: string,
-  status: string,
+  actionName: ActionName,
+  status: ActionStatus,
  cause?: string,
  exception?: string):
  Promise<StatusReport> {

+  // If this is not the init action starting up or aborting then try to load the config.
+  // If it fails then carry because it's important to still send the status report.
+  let config: configUtils.Config | undefined = undefined;
+  if (actionName !== 'init' || (status !== 'starting' && status !== 'aborted')) {
+    try {
+      config = await configUtils.getConfig();
+    } catch (e) {
+      core.error('Unable to load config: ' + e);
+    }
+  }
+
  const commitOid = process.env['GITHUB_SHA'] || '';
  const ref = getRef();
  const workflowRunIDStr = process.env['GITHUB_RUN_ID'];
@@ -260,7 +192,7 @@ async function createStatusReport(
  const workflowName = process.env['GITHUB_WORKFLOW'] || '';
  const jobName = process.env['GITHUB_JOB'] || '';
  const analysis_key = await getAnalysisKey();
-  const languages = (await getLanguages()).sort().join(',');
+  const languages = config?.languages?.join(',') || "";
  const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT] || new Date().toISOString();
  core.exportVariable(sharedEnv.CODEQL_ACTION_STARTED_AT, startedAt);

@@ -324,7 +256,7 @@ async function sendStatusReport(statusReport: StatusReport): Promise<number> {
 *
 * Returns true unless a problem occurred and the action should abort.
 */
-export async function reportActionStarting(action: string): Promise<boolean> {
+export async function reportActionStarting(action: ActionName): Promise<boolean> {
  const statusCode = await sendStatusReport(await createStatusReport(action, 'starting'));

  // If the status report request fails with a 403 or a 404, then this is a deliberate
@@ -351,7 +283,7 @@ export async function reportActionStarting(action: string): Promise<boolean> {
 * Note that the started_at date is always that of the `init` action, since
 * this is likely to give a more useful duration when inspecting events.
 */
-export async function reportActionFailed(action: string, cause?: string, exception?: string) {
+export async function reportActionFailed(action: ActionName, cause?: string, exception?: string) {
  await sendStatusReport(await createStatusReport(action, 'failure', cause, exception));
 }

@@ -361,7 +293,7 @@ export async function reportActionFailed(action: string, cause?: string, excepti
 * Note that the started_at date is always that of the `init` action, since
 * this is likely to give a more useful duration when inspecting events.
 */
-export async function reportActionSucceeded(action: string) {
+export async function reportActionSucceeded(action: ActionName) {
  await sendStatusReport(await createStatusReport(action, 'success'));
 }

@@ -371,7 +303,7 @@ export async function reportActionSucceeded(action: string) {
 * Note that the started_at date is always that of the `init` action, since
 * this is likely to give a more useful duration when inspecting events.
 */
-export async function reportActionAborted(action: string, cause?: string) {
+export async function reportActionAborted(action: ActionName, cause?: string) {
  await sendStatusReport(await createStatusReport(action, 'aborted', cause));
 }
Author	SHA1	Message	Date
David Verdeguer	f65b956f54	Catch auto_install_packages errors	2020-07-23 15:56:03 +02:00
David Verdeguer	42f07e2f87	Update python scripts download link	2020-07-23 13:12:47 +02:00
David Verdeguer	d190a018d6	Call core.endGroup() when doing an early return in installPythonDeps	2020-07-23 13:05:30 +02:00
David Verdeguer	4d4cc33d97	Setup python extractor for installed deps	2020-07-23 12:57:35 +02:00
David Verdeguer	1c95faf847	Add autoinstaller for python deps	2020-07-23 12:57:12 +02:00
Robert	9769e4a6df	Merge pull request #120 from github/default_queries_fix Default queries fix + reset env vars in tests	2020-07-21 13:11:49 +01:00
Robert	315a9f4b3c	fix typo	2020-07-21 12:46:19 +01:00
Robert	0446cb0aff	address comments	2020-07-21 12:19:37 +01:00
Robert	29cf06569d	reset environment variables between tests	2020-07-21 11:39:55 +01:00
Robert	ee63f4ee4b	fix parsing of disable-default-queries field	2020-07-21 11:05:23 +01:00
Robert	5b4f4e40af	introduce tests	2020-07-21 10:53:14 +01:00
Robert	58a0034549	Merge pull request #112 from github/undeclared-action-input Fix undeclared action inputs	2020-07-20 09:30:31 +01:00
Robert Brignull	c7c1aa8045	fix undeclared action inputs	2020-07-16 14:54:15 +01:00
Robert	b673c57b89	Merge pull request #109 from github/codeql_search_path Move config parsing earlier + add to codeql search path	2020-07-16 09:17:08 +01:00
Robert Brignull	d138b00811	await promise	2020-07-16 09:04:16 +01:00
Robert Brignull	b86c3701ed	address review comments	2020-07-15 17:37:37 +01:00
Robert Brignull	7bb6ac6c60	Merge branch 'main' into codeql_search_path	2020-07-15 17:14:38 +01:00
Sam Partington	d1d80761ef	Merge pull request #111 from github/vscode-debugging Add support for debugging from VSCode	2020-07-14 10:32:08 +01:00
Sam Partington	7a78ec0a54	Add support for debugging from VSCode https://github.com/avajs/ava/blob/master/docs/recipes/debugging-with-vscode.md recommends passing the `debug` option to Ava. However, in my experience Ava waits indefinitely when this option is used, without actually running any tests. The increased timeout setting is so that tests won't fail prematurely because you're slowly stepping through code.	2020-07-14 09:49:21 +01:00
Robert Brignull	da3d6d25eb	move config parsing earlier + add to codeql search path	2020-07-13 14:49:01 +01:00