Merge pull request #603 from github/mergeback/v1.0.4-to-main-03450ff6

Mergeback v1.0.4 refs/heads/v1 into main

CHANGELOG.md

@@ -2,7 +2,13 @@
 
 ## [UNRELEASED]
 
-- Fix `RUNNER_TEMP environment variable must be set` when using runner.
+No user facing changes.
+
+## 1.0.4 - 28 Jun 2021
+
+- Fix `RUNNER_TEMP environment variable must be set` when using runner. [#594](https://github.com/github/codeql-action/pull/594)
+- Fix couting of lines of code for C# projects. [#586](https://github.com/github/codeql-action/pull/586)
+
 ## 1.0.3 - 23 Jun 2021
 
 No user facing changes.

README.md

@@ -128,3 +128,11 @@ By default, this will override any queries specified in a config file. If you wi
 ## Troubleshooting
 
 Read about [troubleshooting code scanning](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning).
+
+### Note on "missing analysis" message
+
+The very first time code scanning is run and if it is on a pull request, you will probably get a message mentioning a "missing analysis". This is expected.
+
+After code scanning has analyzed the code in a pull request, it needs to compare the analysis of the topic branch (the merge commit of the branch you used to create the pull request) with the analysis of the base branch (the branch into which you want to merge the pull request). This allows code scanning to compute which alerts are newly introduced by the pull request, which alerts were already present in the base branch, and whether any existing alerts are fixed by the changes in the pull request. Initially, if you use a pull request to add code scanning to a repository, the base branch has not yet been analyzed, so it's not possible to compute these details. In this case, when you click through from the results check on the pull request you will see the "Missing analysis for base commit SHA-HASH" message.
+
+For more information and other causes of this message, see [Reasons for the "missing analysis" message](https://docs.github.com/en/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository#reasons-for-the-missing-analysis-message)

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

runner/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql-runner",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql-runner",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "private": true,
   "description": "CodeQL runner",
   "scripts": {

src/analyze.ts

@@ -120,20 +120,14 @@ async function createdDBForScannedLanguages(
     if (isScannedLanguage(language)) {
       logger.startGroup(`Extracting ${language}`);
 
-      let db = util.getCodeQLDatabasePath(config, language);
-      
-      if (fs.existsFileSync(db)){
-        console.log(`${db} exists already. I am assuming this is intentional...`);
-      else {
-        if (language === Language.python) {
-          await setupPythonExtractor(logger);
-        }
-
-        await codeql.extractScannedLanguage(
-          db,
-          language
-        );
+      if (language === Language.python) {
+        await setupPythonExtractor(logger);
       }
+
+      await codeql.extractScannedLanguage(
+        util.getCodeQLDatabasePath(config, language),
+        language
+      );
       logger.endGroup();
     }
   }
@@ -149,15 +143,10 @@ async function finalizeDatabaseCreation(
   const codeql = getCodeQL(config.codeQLCmd);
   for (const language of config.languages) {
     logger.startGroup(`Finalizing ${language}`);
-    let db = util.getCodeQLDatabasePath(config, language);
-    if (codeql.hasBeenFinalized(db)){
-      console.log(`${db} has already been finalized. I am assuming this is intentional...`);
-    } else {
-      await codeql.finalizeDatabase(
-        db,
-        threadsFlag
-      );
-    }
+    await codeql.finalizeDatabase(
+      util.getCodeQLDatabasePath(config, language),
+      threadsFlag
+    );
     logger.endGroup();
   }
 }