Merge pull request #1626 from github/henrymercer/diagnostics-ghes

Enable diagnostics functionality on GHES

.github/workflows/__swift-autobuild.yml

@@ -1,72 +0,0 @@
-# Warning: This file is generated automatically, and should not be modified.
-# Instead, please modify the template in the pr-checks directory and run:
-#     pip install ruamel.yaml && python3 sync.py
-# to regenerate this file.
-
-name: PR Check - Swift analysis using autobuild
-env:
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  GO111MODULE: auto
-  CODEQL_EXTRACTOR_JAVA_AGENT_DISABLE_KOTLIN: 'true'
-on:
-  push:
-    branches:
-    - main
-    - releases/v2
-  pull_request:
-    types:
-    - opened
-    - synchronize
-    - reopened
-    - ready_for_review
-  workflow_dispatch: {}
-jobs:
-  swift-autobuild:
-    strategy:
-      matrix:
-        include:
-        - os: macos-latest
-          version: latest
-        - os: macos-latest
-          version: cached
-        - os: macos-latest
-          version: nightly-latest
-    name: Swift analysis using autobuild
-    timeout-minutes: 45
-    runs-on: ${{ matrix.os }}
-    steps:
-    - name: Check out repository
-      uses: actions/checkout@v3
-    - name: Prepare test
-      id: prepare-test
-      uses: ./.github/prepare-test
-      with:
-        version: ${{ matrix.version }}
-    - uses: ./../action/init
-      id: init
-      with:
-        languages: swift
-        tools: ${{ steps.prepare-test.outputs.tools-url }}
-    - uses: ./../action/.github/setup-swift
-      with:
-        codeql-path: ${{steps.init.outputs.codeql-path}}
-    - name: Check working directory
-      shell: bash
-      run: pwd
-    - uses: ./../action/autobuild
-      timeout-minutes: 10
-    - uses: ./../action/analyze
-      id: analysis
-      with:
-        upload-database: false
-    - name: Check database
-      shell: bash
-      run: |
-        SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
-        if [[ ! -d "$SWIFT_DB" ]]; then
-          echo "Did not create a database for Swift."
-          exit 1
-        fi
-    env:
-      CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: 'true' # Remove when Swift is GA.
-      CODEQL_ACTION_TEST_MODE: true

lib/codeql.js

@@ -537,6 +537,9 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             if (shouldExportDiagnostics) {
                 codeqlArgs.push("--sarif-include-diagnostics");
             }
+            else if (await util.codeQlVersionAbove(this, "2.12.4")) {
+                codeqlArgs.push("--no-sarif-include-diagnostics");
+            }
             codeqlArgs.push(databasePath);
             if (querySuitePaths) {
                 codeqlArgs.push(...querySuitePaths);

lib/feature-flags.js

@@ -55,12 +55,12 @@ exports.featureConfig = {
     [Feature.ExportCodeScanningConfigEnabled]: {
         envVar: "CODEQL_ACTION_EXPORT_CODE_SCANNING_CONFIG",
         minimumVersion: "2.12.3",
-        defaultValue: false,
+        defaultValue: true,
     },
     [Feature.ExportDiagnosticsEnabled]: {
         envVar: "CODEQL_ACTION_EXPORT_DIAGNOSTICS",
         minimumVersion: "2.12.4",
-        defaultValue: false,
+        defaultValue: true,
     },
     [Feature.MlPoweredQueriesEnabled]: {
         envVar: "CODEQL_ML_POWERED_QUERIES",
@@ -70,7 +70,7 @@ exports.featureConfig = {
     [Feature.UploadFailedSarifEnabled]: {
         envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
         minimumVersion: "2.11.3",
-        defaultValue: false,
+        defaultValue: true,
     },
 };
 exports.FEATURE_FLAGS_FILE_NAME = "cached-feature-flags.json";

lib/workflow.js

@@ -84,8 +84,6 @@ function toCodedErrors(errors) {
 exports.WorkflowErrors = toCodedErrors({
     MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
     MissingPushHook: `Please specify an on.push hook so that Code Scanning can compare pull requests against the state of the base branch.`,
-    PathsSpecified: `Using on.push.paths can prevent Code Scanning annotating new alerts in your pull requests.`,
-    PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
     CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
 });
 function getWorkflowErrors(doc) {
@@ -130,19 +128,6 @@ function getWorkflowErrors(doc) {
         if (!hasPush && hasPullRequest) {
             missingPush = true;
         }
-        if (hasPush && hasPullRequest) {
-            const paths = doc.on.push?.paths;
-            // if you specify paths or paths-ignore you can end up with commits that have no baseline
-            // if they didn't change any files
-            // currently we cannot go back through the history and find the most recent baseline
-            if (Array.isArray(paths) && paths.length > 0) {
-                errors.push(exports.WorkflowErrors.PathsSpecified);
-            }
-            const pathsIgnore = doc.on.push?.["paths-ignore"];
-            if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
-                errors.push(exports.WorkflowErrors.PathsIgnoreSpecified);
-            }
-        }
         // if doc.on.pull_request is null that means 'all branches'
         // if doc.on.pull_request is undefined that means 'off'
         // we only want to check for mismatched branches if pull_request is on.

lib/workflow.test.js

@@ -58,15 +58,6 @@ function errorCodes(actual, expected) {
     });
     t.deepEqual(...errorCodes(errors, []));
 });
-(0, ava_1.default)("getWorkflowErrors() when on.push should not have a path", (t) => {
-    const errors = (0, workflow_1.getWorkflowErrors)({
-        on: {
-            push: { branches: ["main"], paths: ["test/*"] },
-            pull_request: { branches: ["main"] },
-        },
-    });
-    t.deepEqual(...errorCodes(errors, [workflow_1.WorkflowErrors.PathsSpecified]));
-});
 (0, ava_1.default)("getWorkflowErrors() when on.push is a correct object", (t) => {
     const errors = (0, workflow_1.getWorkflowErrors)({
         on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
@@ -227,7 +218,7 @@ function errorCodes(actual, expected) {
 (0, ava_1.default)("formatWorkflowErrors() when there are multiple errors", (t) => {
     const message = (0, workflow_1.formatWorkflowErrors)([
         workflow_1.WorkflowErrors.CheckoutWrongHead,
-        workflow_1.WorkflowErrors.PathsSpecified,
+        workflow_1.WorkflowErrors.MismatchedBranches,
     ]);
     t.true(message.startsWith("2 issues were detected with this workflow:"));
 });
@@ -238,9 +229,9 @@ function errorCodes(actual, expected) {
 (0, ava_1.default)("formatWorkflowCause()", (t) => {
     const message = (0, workflow_1.formatWorkflowCause)([
         workflow_1.WorkflowErrors.CheckoutWrongHead,
-        workflow_1.WorkflowErrors.PathsSpecified,
+        workflow_1.WorkflowErrors.MismatchedBranches,
     ]);
-    t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
+    t.deepEqual(message, "CheckoutWrongHead,MismatchedBranches");
     t.deepEqual((0, workflow_1.formatWorkflowCause)([]), undefined);
 });
 (0, ava_1.default)("patternIsSuperset()", (t) => {

pr-checks/checks/swift-autobuild.yml

@@ -1,33 +0,0 @@
-name: "Swift analysis using autobuild"
-description: "Tests creation of a Swift database using autobuild"
-versions: ["latest", "cached", "nightly-latest"]
-# Swift autobuilder is only supported on MacOS for private beta
-operatingSystems: ["macos"]
-env:
-  CODEQL_ENABLE_EXPERIMENTAL_FEATURES_SWIFT: "true" # Remove when Swift is GA.
-steps:
-  - uses: ./../action/init
-    id: init
-    with:
-      languages: swift
-      tools: ${{ steps.prepare-test.outputs.tools-url }}
-  - uses: ./../action/.github/setup-swift
-    with:
-      codeql-path: ${{steps.init.outputs.codeql-path}}
-  - name: Check working directory
-    shell: bash
-    run: pwd
-  - uses: ./../action/autobuild
-    timeout-minutes: 10
-  - uses: ./../action/analyze
-    id: analysis
-    with:
-      upload-database: false
-  - name: Check database
-    shell: bash
-    run: |
-      SWIFT_DB="${{ fromJson(steps.analysis.outputs.db-locations).swift }}"
-      if [[ ! -d "$SWIFT_DB" ]]; then
-        echo "Did not create a database for Swift."
-        exit 1
-      fi

src/codeql.ts

@@ -910,6 +910,8 @@ export async function getCodeQLForCmd(
       }
       if (shouldExportDiagnostics) {
         codeqlArgs.push("--sarif-include-diagnostics");
+      } else if (await util.codeQlVersionAbove(this, "2.12.4")) {
+        codeqlArgs.push("--no-sarif-include-diagnostics");
       }
       codeqlArgs.push(databasePath);
       if (querySuitePaths) {

src/feature-flags.ts

@@ -62,12 +62,12 @@ export const featureConfig: Record<
   [Feature.ExportCodeScanningConfigEnabled]: {
     envVar: "CODEQL_ACTION_EXPORT_CODE_SCANNING_CONFIG",
     minimumVersion: "2.12.3",
-    defaultValue: false,
+    defaultValue: true,
   },
   [Feature.ExportDiagnosticsEnabled]: {
     envVar: "CODEQL_ACTION_EXPORT_DIAGNOSTICS",
     minimumVersion: "2.12.4",
-    defaultValue: false,
+    defaultValue: true,
   },
 
   [Feature.MlPoweredQueriesEnabled]: {
@@ -78,7 +78,7 @@ export const featureConfig: Record<
   [Feature.UploadFailedSarifEnabled]: {
     envVar: "CODEQL_ACTION_UPLOAD_FAILED_SARIF",
     minimumVersion: "2.11.3",
-    defaultValue: false,
+    defaultValue: true,
   },
 };
 

src/workflow.test.ts

@@ -56,17 +56,6 @@ test("getWorkflowErrors() when on.push is a valid superset", (t) => {
   t.deepEqual(...errorCodes(errors, []));
 });
 
-test("getWorkflowErrors() when on.push should not have a path", (t) => {
-  const errors = getWorkflowErrors({
-    on: {
-      push: { branches: ["main"], paths: ["test/*"] },
-      pull_request: { branches: ["main"] },
-    },
-  });
-
-  t.deepEqual(...errorCodes(errors, [WorkflowErrors.PathsSpecified]));
-});
-
 test("getWorkflowErrors() when on.push is a correct object", (t) => {
   const errors = getWorkflowErrors({
     on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
@@ -317,7 +306,7 @@ test("formatWorkflowErrors() when there is one error", (t) => {
 test("formatWorkflowErrors() when there are multiple errors", (t) => {
   const message = formatWorkflowErrors([
     WorkflowErrors.CheckoutWrongHead,
-    WorkflowErrors.PathsSpecified,
+    WorkflowErrors.MismatchedBranches,
   ]);
   t.true(message.startsWith("2 issues were detected with this workflow:"));
 });
@@ -331,10 +320,10 @@ test("formatWorkflowCause() with no errors", (t) => {
 test("formatWorkflowCause()", (t) => {
   const message = formatWorkflowCause([
     WorkflowErrors.CheckoutWrongHead,
-    WorkflowErrors.PathsSpecified,
+    WorkflowErrors.MismatchedBranches,
   ]);
 
-  t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
+  t.deepEqual(message, "CheckoutWrongHead,MismatchedBranches");
   t.deepEqual(formatWorkflowCause([]), undefined);
 });
 

src/workflow.ts

@@ -108,8 +108,6 @@ function toCodedErrors(errors: {
 export const WorkflowErrors = toCodedErrors({
   MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
   MissingPushHook: `Please specify an on.push hook so that Code Scanning can compare pull requests against the state of the base branch.`,
-  PathsSpecified: `Using on.push.paths can prevent Code Scanning annotating new alerts in your pull requests.`,
-  PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
   CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
 });
 
@@ -162,19 +160,6 @@ export function getWorkflowErrors(doc: Workflow): CodedError[] {
     if (!hasPush && hasPullRequest) {
       missingPush = true;
     }
-    if (hasPush && hasPullRequest) {
-      const paths = doc.on.push?.paths;
-      // if you specify paths or paths-ignore you can end up with commits that have no baseline
-      // if they didn't change any files
-      // currently we cannot go back through the history and find the most recent baseline
-      if (Array.isArray(paths) && paths.length > 0) {
-        errors.push(WorkflowErrors.PathsSpecified);
-      }
-      const pathsIgnore = doc.on.push?.["paths-ignore"];
-      if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
-        errors.push(WorkflowErrors.PathsIgnoreSpecified);
-      }
-    }
 
     // if doc.on.pull_request is null that means 'all branches'
     // if doc.on.pull_request is undefined that means 'off'

tests/multi-language-repo/.github/codeql/custom-queries.yml

@@ -20,10 +20,10 @@ queries:
     uses: ./codeql-qlpacks/java-qlpack
 # External QL packs
   - name: Go queries
-    uses: Anthophila/go-querypack@master
+    uses: codeql-testing/go-querypack@master
   - name: Cpp queries
-    uses: Anthophila/cpp-querypack@second-branch
+    uses: codeql-testing/cpp-querypack@second-branch
   - name: JavaScript queries
-    uses: Anthophila/javascript-querypack/show_ifs2.ql@master
+    uses: codeql-testing/javascript-querypack/show_ifs2.ql@master
   - name: Python queries
-    uses: Anthophila/python-querypack/show_ifs2.ql@second-branch 
+    uses: codeql-testing/python-querypack/show_ifs2.ql@second-branch