Merge pull request #1141 from github/mergeback/v2.1.16-to-main-3e7e3b32

Mergeback v2.1.16 refs/heads/releases/v2 into main

.github/workflows/script/update-required-checks.sh

@@ -2,17 +2,19 @@
 # Update the required checks based on the current branch.
 # Typically, this will be main.
 
-if [ -z "$GITHUB_TOKEN" ]; then
-  echo "Failed: No GitHub token found. This script requires admin access to `github/codeql-action`."
+if ! gh auth status 2>/dev/null; then
+  gh auth status
+  echo "Failed: Not authorized. This script requires admin access to github/codeql-action through the gh CLI."
   exit 1
 fi
 
 if [ "$#" -eq 1 ]; then
-  # If we were passed an argument, pass it as a query to fzf
-  GITHUB_SHA="$@"
+  # If we were passed an argument, use that as the SHA
+  GITHUB_SHA="$0"
 elif [ "$#" -gt 1 ]; then
   echo "Usage: $0 [SHA]"
   echo "Update the required checks based on the SHA, or main."
+  exit 1
 elif [ -z "$GITHUB_SHA" ]; then
   # If we don't have a SHA, use main
   GITHUB_SHA="$(git rev-parse main)"
@@ -21,7 +23,7 @@ fi
 echo "Getting checks for $GITHUB_SHA"
 
 # Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
-CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") or contains("update") | not)] | unique | sort')"
+CHECKS="$(gh api repos/github/codeql-action/commits/"${GITHUB_SHA}"/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") or contains("update") | not)] | unique | sort')"
 
 echo "$CHECKS" | jq
 

CHANGELOG.md

@@ -4,6 +4,11 @@
 
 No user facing changes.
 
+## 2.1.16 - 13 Jul 2022
+
+- You can now quickly debug a job that uses the CodeQL Action by re-running the job from the GitHub UI and selecting the "Enable debug logging" option. [#1132](https://github.com/github/codeql-action/pull/1132)
+- You can now see diagnostic messages produced by the analysis in the logs of the `analyze` Action by enabling debug mode. To enable debug mode, pass `debug: true` to the `init` Action, or [enable step debug logging](https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/enabling-debug-logging#enabling-step-debug-logging). This feature is available for CodeQL CLI version 2.10.0 and later. [#1133](https://github.com/github/codeql-action/pull/1133)
+
 ## 2.1.15 - 28 Jun 2022
 
 - CodeQL query packs listed in the `packs` configuration field will be skipped if their target language is not being analyzed in the current Actions job. Previously, this would throw an error. [#1116](https://github.com/github/codeql-action/pull/1116)

init/action.yml

@@ -56,7 +56,10 @@ inputs:
       This input also sets the number of threads that can later be used by the "analyze" action.
     required: false
   debug:
-    description: Enable debugging mode. This will result in more output being produced which may be useful when debugging certain issues.
+    description: >-
+      Enable debugging mode.
+      This will result in more output being produced which may be useful when debugging certain issues.
+      Debugging mode is enabled automatically when step debug logging is turned on.
     required: false
     default: 'false'
   debug-artifact-name:

lib/analyze-action.js

@@ -91,13 +91,13 @@ async function run() {
         const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
         if (config.debugMode) {
             // Upload the logs as an Actions artifact for debugging
-            const toUpload = [];
+            let toUpload = [];
             for (const language of config.languages) {
-                toUpload.push(...listFolder(path.resolve(util.getCodeQLDatabasePath(config, language), "log")));
+                toUpload = toUpload.concat(listFolder(path.resolve(util.getCodeQLDatabasePath(config, language), "log")));
             }
             if (await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
                 // Multilanguage tracing: there are additional logs in the root of the cluster
-                toUpload.push(...listFolder(path.resolve(config.dbLocation, "log")));
+                toUpload = toUpload.concat(listFolder(path.resolve(config.dbLocation, "log")));
             }
             await uploadDebugArtifacts(toUpload, config.dbLocation, config.debugArtifactName);
             if (!(await (0, util_1.codeQlVersionAbove)(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING))) {
@@ -145,7 +145,7 @@ async function run() {
         return;
     }
     finally {
-        if (config !== undefined && config.debugMode) {
+        if (config === null || config === void 0 ? void 0 : config.debugMode) {
             try {
                 // Upload the database bundles as an Actions artifact for debugging
                 const toUpload = [];
@@ -158,7 +158,7 @@ async function run() {
                 console.log(`Failed to upload database debug bundles: ${error}`);
             }
         }
-        if (core.isDebug() && config !== undefined) {
+        if (config === null || config === void 0 ? void 0 : config.debugMode) {
             core.info("Debug mode is on. Printing CodeQL debug logs...");
             for (const language of config.languages) {
                 const databaseDirectory = util.getCodeQLDatabasePath(config, language);
@@ -204,13 +204,13 @@ async function uploadDebugArtifacts(toUpload, rootDir, artifactName) {
 }
 function listFolder(dir) {
     const entries = fs.readdirSync(dir, { withFileTypes: true });
-    const files = [];
+    let files = [];
     for (const entry of entries) {
         if (entry.isFile()) {
             files.push(path.resolve(dir, entry.name));
         }
         else if (entry.isDirectory()) {
-            files.push(...listFolder(path.resolve(dir, entry.name)));
+            files = files.concat(listFolder(path.resolve(dir, entry.name)));
         }
     }
     return files;

lib/analyze.js

@@ -115,10 +115,8 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
     const statusReport = {};
     let locPromise = Promise.resolve({});
     const cliCanCountBaseline = await cliCanCountLoC();
-    const debugMode = process.env["INTERNAL_CODEQL_ACTION_DEBUG_LOC"] ||
-        process.env["ACTIONS_RUNNER_DEBUG"] ||
-        process.env["ACTIONS_STEP_DEBUG"];
-    if (!cliCanCountBaseline || debugMode) {
+    const countLocDebugMode = process.env["INTERNAL_CODEQL_ACTION_DEBUG_LOC"] || config.debugMode;
+    if (!cliCanCountBaseline || countLocDebugMode) {
         // count the number of lines in the background
         locPromise = (0, count_loc_1.countLoc)(path.resolve(), 
         // config.paths specifies external directories. the current
@@ -174,14 +172,14 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
             logger.startGroup(`Interpreting results for ${language}`);
             const startTimeInterpretResults = new Date().getTime();
             const sarifFile = path.join(sarifFolder, `${language}.sarif`);
-            const analysisSummary = await runInterpretResults(language, querySuitePaths, sarifFile);
+            const analysisSummary = await runInterpretResults(language, querySuitePaths, sarifFile, config.debugMode);
             if (!cliCanCountBaseline)
                 await injectLinesOfCode(sarifFile, language, locPromise);
             statusReport[`interpret_results_${language}_duration_ms`] =
                 new Date().getTime() - startTimeInterpretResults;
             logger.endGroup();
             logger.info(analysisSummary);
-            if (!cliCanCountBaseline || debugMode)
+            if (!cliCanCountBaseline || countLocDebugMode)
                 printLinesOfCodeSummary(logger, language, await locPromise);
             if (cliCanCountBaseline)
                 logger.info(await runPrintLinesOfCode(language));
@@ -196,10 +194,10 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
         }
     }
     return statusReport;
-    async function runInterpretResults(language, queries, sarifFile) {
+    async function runInterpretResults(language, queries, sarifFile, enableDebugLogging) {
         const databasePath = util.getCodeQLDatabasePath(config, language);
         const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
-        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, automationDetailsId);
+        return await codeql.databaseInterpretResults(databasePath, queries, sarifFile, addSnippetsFlag, threadsFlag, enableDebugLogging ? "-vv" : "-v", automationDetailsId);
     }
     async function cliCanCountLoC() {
         return await util.codeQlVersionAbove(await (0, codeql_1.getCodeQL)(config.codeQLCmd), codeql_1.CODEQL_VERSION_COUNTS_LINES);
@@ -239,15 +237,6 @@ function createQuerySuiteContents(queries) {
     return queries.map((q) => `- query: ${q}`).join("\n");
 }
 async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger, featureFlags) {
-    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
-    if (await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
-        // Delete variables as specified by the end-tracing script
-        await (0, tracer_config_1.endTracingForCluster)(config);
-    }
-    else {
-        // Delete the tracer config env var to avoid tracing ourselves
-        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
-    }
     try {
         await (0, del_1.default)(outputDir, { force: true });
     }
@@ -258,6 +247,20 @@ async function runFinalize(outputDir, threadsFlag, memoryFlag, config, logger, f
     }
     await fs.promises.mkdir(outputDir, { recursive: true });
     await finalizeDatabaseCreation(config, threadsFlag, memoryFlag, logger, featureFlags);
+    const codeql = await (0, codeql_1.getCodeQL)(config.codeQLCmd);
+    // WARNING: This does not _really_ end tracing, as the tracer will restore its
+    // critical environment variables and it'll still be active for all processes
+    // launched from this build step.
+    // However, it will stop tracing for all steps past the codeql-action/analyze
+    // step.
+    if (await util.codeQlVersionAbove(codeql, codeql_1.CODEQL_VERSION_NEW_TRACING)) {
+        // Delete variables as specified by the end-tracing script
+        await (0, tracer_config_1.endTracingForCluster)(config);
+    }
+    else {
+        // Delete the tracer config env var to avoid tracing ourselves
+        delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
+    }
 }
 exports.runFinalize = runFinalize;
 async function runCleanup(config, cleanupLevel, logger) {

lib/api-client.js

@@ -30,6 +30,8 @@ const console_log_level_1 = __importDefault(require("console-log-level"));
 const actions_util_1 = require("./actions-util");
 const util = __importStar(require("./util"));
 const util_1 = require("./util");
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
 var DisallowedAPIVersionReason;
 (function (DisallowedAPIVersionReason) {
     DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_OLD"] = 0] = "ACTION_TOO_OLD";
@@ -40,7 +42,7 @@ const getApiClient = function (apiDetails, { allowExternal = false } = {}) {
     const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
     return new retryingOctokit(githubUtils.getOctokitOptions(auth, {
         baseUrl: getApiUrl(apiDetails.url),
-        userAgent: (0, util_1.getUserAgent)(),
+        userAgent: `CodeQL-${(0, util_1.getMode)()}/${pkg.version}`,
         log: (0, console_log_level_1.default)({ level: "debug" }),
     }));
 };

lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,uEAAyD;AACzD,6DAA+C;AAC/C,0EAAgD;AAEhD,iDAAkD;AAClD,6CAA+B;AAC/B,iCAA0E;AAE1E,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAeM,MAAM,YAAY,GAAG,UAC1B,UAAoC,EACpC,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,EAAE;IAE9B,MAAM,IAAI,GACR,CAAC,aAAa,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;IACpE,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,eAAe,CACxB,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAClC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,IAAA,mBAAY,GAAE;QACzB,GAAG,EAAE,IAAA,2BAAe,EAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAdW,QAAA,YAAY,gBAcvB;AAEF,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,uDAAuD;IACvD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,IAAI,EAAE,IAAA,+BAAgB,EAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,IAAA,0BAAmB,EAAC,mBAAmB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,qFAAqF;AACrF,+CAA+C;AAC/C,SAAgB,mBAAmB;IACjC,OAAO,IAAA,oBAAY,EAAC,aAAa,EAAE,CAAC,CAAC;AACvC,CAAC;AAFD,kDAEC;AAED,IAAI,mBAAmB,GAA8B,SAAS,CAAC;AAE/D;;;;;;;GAOG;AACI,KAAK,UAAU,2BAA2B;IAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;KAC1E;IACD,IAAI,mBAAmB,KAAK,SAAS,EAAE;QACrC,mBAAmB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;KACpE;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AARD,kEAQC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,uEAAyD;AACzD,6DAA+C;AAC/C,0EAAgD;AAEhD,iDAAkD;AAClD,6CAA+B;AAC/B,iCAAqE;AAErE,8CAA8C;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEvC,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAeM,MAAM,YAAY,GAAG,UAC1B,UAAoC,EACpC,EAAE,aAAa,GAAG,KAAK,EAAE,GAAG,EAAE;IAE9B,MAAM,IAAI,GACR,CAAC,aAAa,IAAI,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC;IACpE,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,IAAI,eAAe,CACxB,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE;QAClC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,UAAU,IAAA,cAAO,GAAE,IAAI,GAAG,CAAC,OAAO,EAAE;QAC/C,GAAG,EAAE,IAAA,2BAAe,EAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAdW,QAAA,YAAY,gBAcvB;AAEF,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,uDAAuD;IACvD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,IAAI,EAAE,IAAA,+BAAgB,EAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,IAAA,0BAAmB,EAAC,mBAAmB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,qFAAqF;AACrF,+CAA+C;AAC/C,SAAgB,mBAAmB;IACjC,OAAO,IAAA,oBAAY,EAAC,aAAa,EAAE,CAAC,CAAC;AACvC,CAAC;AAFD,kDAEC;AAED,IAAI,mBAAmB,GAA8B,SAAS,CAAC;AAE/D;;;;;;;GAOG;AACI,KAAK,UAAU,2BAA2B;IAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;KAC1E;IACD,IAAI,mBAAmB,KAAK,SAAS,EAAE;QACrC,mBAAmB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;KACpE;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AARD,kEAQC"}

lib/codeql.js

@@ -258,7 +258,6 @@ async function setupCodeQL(codeqlURL, apiDetails, tempDir, variant, logger, chec
                 const parsedQueryString = query_string_1.default.parse(parsedCodeQLURL.search);
                 const headers = {
                     accept: "application/octet-stream",
-                    "User-Agent": util.getUserAgent(),
                 };
                 // We only want to provide an authorization header if we are downloading
                 // from the same GitHub instance the Action is running on.
@@ -274,7 +273,8 @@ async function setupCodeQL(codeqlURL, apiDetails, tempDir, variant, logger, chec
                 }
                 logger.info(`Downloading CodeQL tools from ${codeqlURL}. This may take a while.`);
                 const dest = path.join(tempDir, (0, uuid_1.v4)());
-                const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, undefined, headers);
+                const finalHeaders = Object.assign({ "User-Agent": "CodeQL Action" }, headers);
+                const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, undefined, finalHeaders);
                 logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
                 const codeqlExtracted = await toolcache.extractTar(codeqlPath);
                 codeqlFolder = await toolcache.cacheDir(codeqlExtracted, "CodeQL", codeqlURLSemVer);
@@ -619,13 +619,13 @@ async function getCodeQLForCmd(cmd, checkVersion) {
             codeqlArgs.push(querySuitePath);
             await runTool(cmd, codeqlArgs);
         },
-        async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, addSnippetsFlag, threadsFlag, automationDetailsId) {
+        async databaseInterpretResults(databasePath, querySuitePaths, sarifFile, addSnippetsFlag, threadsFlag, verbosityFlag, automationDetailsId) {
             const codeqlArgs = [
                 "database",
                 "interpret-results",
                 threadsFlag,
                 "--format=sarif-latest",
-                "-v",
+                verbosityFlag,
                 `--output=${sarifFile}`,
                 addSnippetsFlag,
                 ...getExtraOptionsFromEnv(["database", "interpret-results"]),

lib/codeql.test.js

@@ -226,14 +226,14 @@ ava_1.default.beforeEach(() => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves("2.7.0");
-    await codeqlObject.databaseInterpretResults("", [], "", "", "", "");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
     t.false(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be absent, but it is present");
 });
 (0, ava_1.default)("databaseInterpretResults() sets --sarif-add-query-help for 2.7.1", async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
     sinon.stub(codeqlObject, "getVersion").resolves("2.7.1");
-    await codeqlObject.databaseInterpretResults("", [], "", "", "", "");
+    await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
     t.true(runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"), "--sarif-add-query-help should be present, but it is absent");
 });
 const stubConfig = {

lib/init-action.js

@@ -93,7 +93,12 @@ async function run() {
         codeql = initCodeQLResult.codeql;
         toolsVersion = initCodeQLResult.toolsVersion;
         await (0, util_1.enrichEnvironment)(util_1.Mode.actions, codeql);
-        config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), (0, actions_util_1.getOptionalInput)("debug") === "true", (0, actions_util_1.getOptionalInput)("debug-artifact-name") || util_1.DEFAULT_DEBUG_ARTIFACT_NAME, (0, actions_util_1.getOptionalInput)("debug-database-name") || util_1.DEFAULT_DEBUG_DATABASE_NAME, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), codeql, (0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), gitHubVersion, apiDetails, featureFlags, logger);
+        config = await (0, init_1.initConfig)((0, actions_util_1.getOptionalInput)("languages"), (0, actions_util_1.getOptionalInput)("queries"), (0, actions_util_1.getOptionalInput)("packs"), (0, actions_util_1.getOptionalInput)("config-file"), (0, actions_util_1.getOptionalInput)("db-location"), 
+        // Debug mode is enabled if:
+        // - The `init` Action is passed `debug: true`.
+        // - Actions step debugging is enabled (e.g. by [enabling debug logging for a rerun](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs#re-running-all-the-jobs-in-a-workflow),
+        //   or by setting the `ACTIONS_STEP_DEBUG` secret to `true`).
+        (0, actions_util_1.getOptionalInput)("debug") === "true" || core.isDebug(), (0, actions_util_1.getOptionalInput)("debug-artifact-name") || util_1.DEFAULT_DEBUG_ARTIFACT_NAME, (0, actions_util_1.getOptionalInput)("debug-database-name") || util_1.DEFAULT_DEBUG_DATABASE_NAME, repositoryNwo, (0, actions_util_1.getTemporaryDirectory)(), codeql, (0, util_1.getRequiredEnvParam)("GITHUB_WORKSPACE"), gitHubVersion, apiDetails, featureFlags, logger);
         if (config.languages.includes(languages_1.Language.python) &&
             (0, actions_util_1.getRequiredInput)("setup-python-dependencies") === "true") {
             try {

lib/util.js

@@ -22,7 +22,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserAgent = exports.isInTestMode = exports.checkActionVersion = exports.getMlPoweredJsQueriesStatus = exports.getMlPoweredJsQueriesPack = exports.ML_POWERED_JS_QUERIES_PACK_NAME = exports.isGoodVersion = exports.delay = exports.bundleDb = exports.codeQlVersionAbove = exports.getCachedCodeQlVersion = exports.cacheCodeQlVersion = exports.isGitHubGhesVersionBelow = exports.isHTTPError = exports.UserError = exports.HTTPError = exports.getRequiredEnvParam = exports.isActions = exports.getMode = exports.enrichEnvironment = exports.initializeEnvironment = exports.Mode = exports.assertNever = exports.getGitHubAuth = exports.apiVersionInRange = exports.DisallowedAPIVersionReason = exports.checkGitHubVersionInRange = exports.getGitHubVersion = exports.GitHubVariant = exports.parseGitHubUrl = exports.getCodeQLDatabasePath = exports.getThreadsFlag = exports.getThreadsFlagValue = exports.getAddSnippetsFlag = exports.getMemoryFlag = exports.getMemoryFlagValue = exports.withTmpDir = exports.getToolNames = exports.getExtraOptionsEnvParam = exports.DEFAULT_DEBUG_DATABASE_NAME = exports.DEFAULT_DEBUG_ARTIFACT_NAME = exports.GITHUB_DOTCOM_URL = void 0;
+exports.isInTestMode = exports.checkActionVersion = exports.getMlPoweredJsQueriesStatus = exports.getMlPoweredJsQueriesPack = exports.ML_POWERED_JS_QUERIES_PACK_NAME = exports.isGoodVersion = exports.delay = exports.bundleDb = exports.codeQlVersionAbove = exports.getCachedCodeQlVersion = exports.cacheCodeQlVersion = exports.isGitHubGhesVersionBelow = exports.isHTTPError = exports.UserError = exports.HTTPError = exports.getRequiredEnvParam = exports.isActions = exports.getMode = exports.enrichEnvironment = exports.initializeEnvironment = exports.Mode = exports.assertNever = exports.getGitHubAuth = exports.apiVersionInRange = exports.DisallowedAPIVersionReason = exports.checkGitHubVersionInRange = exports.getGitHubVersion = exports.GitHubVariant = exports.parseGitHubUrl = exports.getCodeQLDatabasePath = exports.getThreadsFlag = exports.getThreadsFlagValue = exports.getAddSnippetsFlag = exports.getMemoryFlag = exports.getMemoryFlagValue = exports.withTmpDir = exports.getToolNames = exports.getExtraOptionsEnvParam = exports.DEFAULT_DEBUG_DATABASE_NAME = exports.DEFAULT_DEBUG_ARTIFACT_NAME = exports.GITHUB_DOTCOM_URL = void 0;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -33,8 +33,6 @@ const api = __importStar(require("./api-client"));
 const api_client_1 = require("./api-client");
 const apiCompatibility = __importStar(require("./api-compatibility.json"));
 const codeql_1 = require("./codeql");
-// eslint-disable-next-line import/no-commonjs
-const pkg = require("../package.json");
 /**
  * Specifies bundle versions that are known to be broken
  * and will not be used if found in the toolcache.
@@ -640,11 +638,4 @@ function isInTestMode() {
     return process.env["TEST_MODE"] === "true" || false;
 }
 exports.isInTestMode = isInTestMode;
-/**
- * Gets a value to use as the user agent header in outgoing HTTP requests.
- */
-function getUserAgent() {
-    return `CodeQL-Action/${pkg.version}`;
-}
-exports.getUserAgent = getUserAgent;
 //# sourceMappingURL=util.js.map

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.1.16",
+  "version": "2.1.17",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.1.16",
+  "version": "2.1.17",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.1.16",
+      "version": "2.1.17",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.0.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.1.16",
+  "version": "2.1.17",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

src/analyze-action.ts

@@ -151,17 +151,19 @@ async function run() {
 
     if (config.debugMode) {
       // Upload the logs as an Actions artifact for debugging
-      const toUpload: string[] = [];
+      let toUpload: string[] = [];
       for (const language of config.languages) {
-        toUpload.push(
-          ...listFolder(
+        toUpload = toUpload.concat(
+          listFolder(
             path.resolve(util.getCodeQLDatabasePath(config, language), "log")
           )
         );
       }
       if (await codeQlVersionAbove(codeql, CODEQL_VERSION_NEW_TRACING)) {
         // Multilanguage tracing: there are additional logs in the root of the cluster
-        toUpload.push(...listFolder(path.resolve(config.dbLocation, "log")));
+        toUpload = toUpload.concat(
+          listFolder(path.resolve(config.dbLocation, "log"))
+        );
       }
       await uploadDebugArtifacts(
         toUpload,
@@ -236,7 +238,7 @@ async function run() {
 
     return;
   } finally {
-    if (config !== undefined && config.debugMode) {
+    if (config?.debugMode) {
       try {
         // Upload the database bundles as an Actions artifact for debugging
         const toUpload: string[] = [];
@@ -260,7 +262,7 @@ async function run() {
       }
     }
 
-    if (core.isDebug() && config !== undefined) {
+    if (config?.debugMode) {
       core.info("Debug mode is on. Printing CodeQL debug logs...");
       for (const language of config.languages) {
         const databaseDirectory = util.getCodeQLDatabasePath(config, language);
@@ -319,12 +321,12 @@ async function uploadDebugArtifacts(
 
 function listFolder(dir: string): string[] {
   const entries = fs.readdirSync(dir, { withFileTypes: true });
-  const files: string[] = [];
+  let files: string[] = [];
   for (const entry of entries) {
     if (entry.isFile()) {
       files.push(path.resolve(dir, entry.name));
     } else if (entry.isDirectory()) {
-      files.push(...listFolder(path.resolve(dir, entry.name)));
+      files = files.concat(listFolder(path.resolve(dir, entry.name)));
     }
   }
   return files;

src/analyze.ts

@@ -209,11 +209,9 @@ export async function runQueries(
     {}
   );
   const cliCanCountBaseline = await cliCanCountLoC();
-  const debugMode =
-    process.env["INTERNAL_CODEQL_ACTION_DEBUG_LOC"] ||
-    process.env["ACTIONS_RUNNER_DEBUG"] ||
-    process.env["ACTIONS_STEP_DEBUG"];
-  if (!cliCanCountBaseline || debugMode) {
+  const countLocDebugMode =
+    process.env["INTERNAL_CODEQL_ACTION_DEBUG_LOC"] || config.debugMode;
+  if (!cliCanCountBaseline || countLocDebugMode) {
     // count the number of lines in the background
     locPromise = countLoc(
       path.resolve(),
@@ -310,7 +308,8 @@ export async function runQueries(
       const analysisSummary = await runInterpretResults(
         language,
         querySuitePaths,
-        sarifFile
+        sarifFile,
+        config.debugMode
       );
       if (!cliCanCountBaseline)
         await injectLinesOfCode(sarifFile, language, locPromise);
@@ -318,7 +317,7 @@ export async function runQueries(
         new Date().getTime() - startTimeInterpretResults;
       logger.endGroup();
       logger.info(analysisSummary);
-      if (!cliCanCountBaseline || debugMode)
+      if (!cliCanCountBaseline || countLocDebugMode)
         printLinesOfCodeSummary(logger, language, await locPromise);
       if (cliCanCountBaseline) logger.info(await runPrintLinesOfCode(language));
     } catch (e) {
@@ -339,7 +338,8 @@ export async function runQueries(
   async function runInterpretResults(
     language: Language,
     queries: string[],
-    sarifFile: string
+    sarifFile: string,
+    enableDebugLogging: boolean
   ): Promise<string> {
     const databasePath = util.getCodeQLDatabasePath(config, language);
     const codeql = await getCodeQL(config.codeQLCmd);
@@ -349,6 +349,7 @@ export async function runQueries(
       sarifFile,
       addSnippetsFlag,
       threadsFlag,
+      enableDebugLogging ? "-vv" : "-v",
       automationDetailsId
     );
   }
@@ -433,15 +434,6 @@ export async function runFinalize(
   logger: Logger,
   featureFlags: FeatureFlags
 ) {
-  const codeql = await getCodeQL(config.codeQLCmd);
-  if (await util.codeQlVersionAbove(codeql, CODEQL_VERSION_NEW_TRACING)) {
-    // Delete variables as specified by the end-tracing script
-    await endTracingForCluster(config);
-  } else {
-    // Delete the tracer config env var to avoid tracing ourselves
-    delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
-  }
-
   try {
     await del(outputDir, { force: true });
   } catch (error: any) {
@@ -458,6 +450,20 @@ export async function runFinalize(
     logger,
     featureFlags
   );
+
+  const codeql = await getCodeQL(config.codeQLCmd);
+  // WARNING: This does not _really_ end tracing, as the tracer will restore its
+  // critical environment variables and it'll still be active for all processes
+  // launched from this build step.
+  // However, it will stop tracing for all steps past the codeql-action/analyze
+  // step.
+  if (await util.codeQlVersionAbove(codeql, CODEQL_VERSION_NEW_TRACING)) {
+    // Delete variables as specified by the end-tracing script
+    await endTracingForCluster(config);
+  } else {
+    // Delete the tracer config env var to avoid tracing ourselves
+    delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
+  }
 }
 
 export async function runCleanup(

src/api-client.ts

@@ -6,7 +6,10 @@ import consoleLogLevel from "console-log-level";
 
 import { getRequiredInput } from "./actions-util";
 import * as util from "./util";
-import { getRequiredEnvParam, getUserAgent, GitHubVersion } from "./util";
+import { getMode, getRequiredEnvParam, GitHubVersion } from "./util";
+
+// eslint-disable-next-line import/no-commonjs
+const pkg = require("../package.json");
 
 export enum DisallowedAPIVersionReason {
   ACTION_TOO_OLD,
@@ -36,7 +39,7 @@ export const getApiClient = function (
   return new retryingOctokit(
     githubUtils.getOctokitOptions(auth, {
       baseUrl: getApiUrl(apiDetails.url),
-      userAgent: getUserAgent(),
+      userAgent: `CodeQL-${getMode()}/${pkg.version}`,
       log: consoleLogLevel({ level: "debug" }),
     })
   );

src/codeql.test.ts

@@ -400,7 +400,7 @@ test("databaseInterpretResults() does not set --sarif-add-query-help for 2.7.0",
   const runnerConstructorStub = stubToolRunnerConstructor();
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves("2.7.0");
-  await codeqlObject.databaseInterpretResults("", [], "", "", "", "");
+  await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
   t.false(
     runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"),
     "--sarif-add-query-help should be absent, but it is present"
@@ -411,7 +411,7 @@ test("databaseInterpretResults() sets --sarif-add-query-help for 2.7.1", async (
   const runnerConstructorStub = stubToolRunnerConstructor();
   const codeqlObject = await codeql.getCodeQLForTesting();
   sinon.stub(codeqlObject, "getVersion").resolves("2.7.1");
-  await codeqlObject.databaseInterpretResults("", [], "", "", "", "");
+  await codeqlObject.databaseInterpretResults("", [], "", "", "", "-v", "");
   t.true(
     runnerConstructorStub.firstCall.args[1].includes("--sarif-add-query-help"),
     "--sarif-add-query-help should be present, but it is absent"

src/codeql.ts

@@ -157,6 +157,7 @@ export interface CodeQL {
     sarifFile: string,
     addSnippetsFlag: string,
     threadsFlag: string,
+    verbosityFlag: string | undefined,
     automationDetailsId: string | undefined
   ): Promise<string>;
   /**
@@ -452,7 +453,6 @@ export async function setupCodeQL(
         const parsedQueryString = queryString.parse(parsedCodeQLURL.search);
         const headers: OutgoingHttpHeaders = {
           accept: "application/octet-stream",
-          "User-Agent": util.getUserAgent(),
         };
         // We only want to provide an authorization header if we are downloading
         // from the same GitHub instance the Action is running on.
@@ -472,11 +472,15 @@ export async function setupCodeQL(
         );
 
         const dest = path.join(tempDir, uuidV4());
+        const finalHeaders = Object.assign(
+          { "User-Agent": "CodeQL Action" },
+          headers
+        );
         const codeqlPath = await toolcache.downloadTool(
           codeqlURL,
           dest,
           undefined,
-          headers
+          finalHeaders
         );
         logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
 
@@ -925,6 +929,7 @@ async function getCodeQLForCmd(
       sarifFile: string,
       addSnippetsFlag: string,
       threadsFlag: string,
+      verbosityFlag: string,
       automationDetailsId: string | undefined
     ): Promise<string> {
       const codeqlArgs = [
@@ -932,7 +937,7 @@ async function getCodeQLForCmd(
         "interpret-results",
         threadsFlag,
         "--format=sarif-latest",
-        "-v",
+        verbosityFlag,
         `--output=${sarifFile}`,
         addSnippetsFlag,
         ...getExtraOptionsFromEnv(["database", "interpret-results"]),

src/init-action.ts

@@ -183,7 +183,11 @@ async function run() {
       getOptionalInput("packs"),
       getOptionalInput("config-file"),
       getOptionalInput("db-location"),
-      getOptionalInput("debug") === "true",
+      // Debug mode is enabled if:
+      // - The `init` Action is passed `debug: true`.
+      // - Actions step debugging is enabled (e.g. by [enabling debug logging for a rerun](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs#re-running-all-the-jobs-in-a-workflow),
+      //   or by setting the `ACTIONS_STEP_DEBUG` secret to `true`).
+      getOptionalInput("debug") === "true" || core.isDebug(),
       getOptionalInput("debug-artifact-name") || DEFAULT_DEBUG_ARTIFACT_NAME,
       getOptionalInput("debug-database-name") || DEFAULT_DEBUG_DATABASE_NAME,
       repositoryNwo,

src/util.ts

@@ -15,9 +15,6 @@ import { Config } from "./config-utils";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 
-// eslint-disable-next-line import/no-commonjs
-const pkg = require("../package.json");
-
 /**
  * Specifies bundle versions that are known to be broken
  * and will not be used if found in the toolcache.
@@ -759,10 +756,3 @@ export async function checkActionVersion(version: string) {
 export function isInTestMode(): boolean {
   return process.env["TEST_MODE"] === "true" || false;
 }
-
-/**
- * Gets a value to use as the user agent header in outgoing HTTP requests.
- */
-export function getUserAgent(): string {
-  return `CodeQL-Action/${pkg.version}`;
-}