Temporarily use the latest version for testing

Fix the formatting of a warning message.

.eslintrc.json

@@ -44,7 +44,6 @@
             "@typescript-eslint/no-unsafe-call": "off",
             "@typescript-eslint/no-unsafe-member-access": "off",
             "@typescript-eslint/no-unsafe-return": "off",
-            "@typescript-eslint/no-unused-vars": "off",
             "@typescript-eslint/no-var-requires": "off",
             "@typescript-eslint/prefer-regexp-exec": "off",
             "@typescript-eslint/require-await": "off",

.github/workflows/codeql.yml

@@ -20,6 +20,7 @@ jobs:
       with:
         languages: javascript
         config-file: ./.github/codeql/codeql-config.yml
+        tools: latest
     # confirm steps.init.outputs.codeql-path points to the codeql binary
     - name: Print CodeQL Version
       run: ${{steps.init.outputs.codeql-path}} version --format=json

.github/workflows/integration-testing.yml

@@ -1,507 +0,0 @@
-name: "Integration Testing"
-
-on:
-  push:
-    branches: [main, v1]
-  pull_request:
-
-jobs:
-  multi-language-repo_test-autodetect-languages:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-    - uses: ./../action/init
-    - name: Build code
-      shell: bash
-      run: ./build.sh
-    - uses: ./../action/analyze
-      env:
-        TEST_MODE: true
-    - run: |
-        cd "$RUNNER_TEMP/codeql_databases"
-        # List all directories as there will be precisely one directory per database
-        # but there may be other files in this directory such as query suites.
-        if [ "$(ls -d */ | wc -l)" != 6 ] || \
-           [[ ! -d cpp ]] || \
-           [[ ! -d csharp ]] || \
-           [[ ! -d go ]] || \
-           [[ ! -d java ]] || \
-           [[ ! -d javascript ]] || \
-           [[ ! -d python ]]; then
-          echo "Did not find expected number of databases. Database dir contains: $(ls)"
-          exit 1
-        fi
-
-  multi-language-repo_test-custom-queries-and-remote-config:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        tools: [~, latest]
-    runs-on: ${{ matrix.os }}
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-    - uses: ./../action/init
-      with:
-        tools: ${{ matrix.tools }}
-        languages: cpp,csharp,java,javascript,python
-        config-file: github/codeql-action/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
-    - name: Build code
-      shell: bash
-      run: ./build.sh
-    - uses: ./../action/analyze
-      env:
-        TEST_MODE: true
-
-  # Currently is not possible to analyze Go in conjunction with other languages in macos
-  multi-language-repo_test-go-custom-queries:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-
-    steps:
-    - uses: actions/setup-go@v2
-      if: ${{ matrix.os ==  'macos-latest' }}
-      with:
-        go-version: '^1.13.1'
-    - uses: actions/checkout@v2
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-    - uses: ./../action/init
-      with:
-        languages: go
-        config-file: ./.github/codeql/custom-queries.yml
-    - name: Build code
-      shell: bash
-      run: ./build.sh
-    - uses: ./../action/analyze
-      env:
-        TEST_MODE: true
-
-  go-custom-tracing:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    env:
-      CODEQL_EXTRACTOR_GO_BUILD_TRACING: "on"
-
-    steps:
-    - uses: actions/setup-go@v2
-      if: ${{ matrix.os ==  'macos-latest' }}
-      with:
-        go-version: '^1.13.1'
-    - uses: actions/checkout@v2
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-    - uses: ./../action/init
-      with:
-        languages: go
-    - name: Build code
-      shell: bash
-      run: go build main.go
-    - uses: ./../action/analyze
-      env:
-        TEST_MODE: true
-
-  go-custom-tracing-autobuild:
-    # No need to test Go autobuild on multiple OSes since
-    # we're testing Go custom tracing with a manual build on all OSes.
-    runs-on: ubuntu-latest
-    env:
-      CODEQL_EXTRACTOR_GO_BUILD_TRACING: "on"
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-    - uses: ./../action/init
-      with:
-        languages: go
-    - uses: ./../action/autobuild
-    - uses: ./../action/analyze
-      env:
-        TEST_MODE: true
-
-  multi-language-repo_rubocop:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: 2.6
-    - name: Install Code Scanning integration
-      run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
-    - name: Install dependencies
-      run: bundle install
-    - name: Rubocop run
-      run: |
-        bash -c "
-          bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
-          [[ $? -ne 2 ]]
-        "
-    - uses: ./../action/upload-sarif
-      with:
-        sarif_file: rubocop.sarif
-      env:
-        TEST_MODE: true
-
-  test-proxy:
-    runs-on: ubuntu-latest
-    container:
-      image: ubuntu:18.04
-      options: --dns 127.0.0.1
-    services:
-      squid-proxy:
-        image: datadog/squid:latest
-        ports:
-          - 3128:3128
-    env:
-      https_proxy: http://squid-proxy:3128
-    steps:
-    - uses: actions/checkout@v2
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-    - uses: ./../action/init
-      with:
-        languages: javascript
-    - uses: ./../action/analyze
-      env:
-        TEST_MODE: true
-
-  runner-analyze-javascript-ubuntu:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Build runner
-      run: |
-        cd runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        # Pass --config-file here, but not for other jobs in this workflow.
-        # This means we're testing the config file parsing in the runner
-        # but not slowing down all jobs unnecessarily as it doesn't add much
-        # testing the parsing on different operating systems and languages.
-        runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Run analyze
-      run: |
-        runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-analyze-javascript-windows:
-    runs-on: windows-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Build runner
-      run: |
-        cd runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages javascript --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Run analyze
-      run: |
-        runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-analyze-javascript-macos:
-    runs-on: macos-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Build runner
-      run: |
-        cd runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Run analyze
-      run: |
-        runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-analyze-csharp-ubuntu:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-
-    - name: Build runner
-      run: |
-        cd ../action/runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Build code
-      run: |
-        . ./codeql-runner/codeql-env.sh
-        dotnet build
-
-    - name: Run analyze
-      run: |
-        ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-analyze-csharp-windows:
-    runs-on: windows-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-
-    - name: Build runner
-      run: |
-        cd ../action/runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Build code
-      shell: powershell
-      run: |
-        cat ./codeql-runner/codeql-env.sh | Invoke-Expression
-        dotnet build
-
-    - name: Run analyze
-      run: |
-        ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-analyze-csharp-macos:
-    runs-on: macos-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-
-    - name: Build runner
-      run: |
-        cd ../action/runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Build code
-      shell: bash
-      run: |
-        . ./codeql-runner/codeql-env.sh
-        dotnet build
-
-    - name: Run analyze
-      run: |
-        ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-
-  runner-analyze-csharp-autobuild-ubuntu:
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-
-    - name: Build runner
-      run: |
-        cd ../action/runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Build code
-      run: |
-        ../action/runner/dist/codeql-runner-linux autobuild
-
-    - name: Run analyze
-      run: |
-        ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-analyze-csharp-autobuild-windows:
-    runs-on: windows-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-
-    - name: Build runner
-      run: |
-        cd ../action/runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Build code
-      shell: powershell
-      run: |
-        ../action/runner/dist/codeql-runner-win.exe autobuild
-
-    - name: Run analyze
-      run: |
-        ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-analyze-csharp-autobuild-macos:
-    runs-on: macos-latest
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Move codeql-action
-      shell: bash
-      run: |
-        mkdir ../action
-        mv * .github ../action/
-        mv ../action/tests/multi-language-repo/{*,.github} .
-
-    - name: Build runner
-      run: |
-        cd ../action/runner
-        npm install
-        npm run build-runner
-
-    - name: Run init
-      run: |
-        ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-
-    - name: Build code
-      shell: bash
-      run: |
-        ../action/runner/dist/codeql-runner-macos autobuild
-
-    - name: Run analyze
-      run: |
-        ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
-      env:
-        TEST_MODE: true
-
-  runner-upload-sarif:
-    runs-on: ubuntu-latest
-
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.base.repo.id == github.event.pull_request.head.repo.id }}
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Build runner
-      run: |
-        cd runner
-        npm install
-        npm run build-runner
-
-    - name: Upload with runner
-      run: |
-        # Deliberately don't use TEST_MODE here. This is specifically testing
-        # the compatibility with the API.
-        runner/dist/codeql-runner-linux upload --sarif-file src/testdata/empty-sarif.sarif --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}

.github/workflows/pr-checks.yml

@@ -20,25 +20,7 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Check generated JavaScript
-      run: |
-        # Sanity check that repo is clean to start with
-        if [ ! -z "$(git status --porcelain)" ]; then
-          # If we get a fail here then this workflow needs attention...
-          >&2 echo "Failed: Repo should be clean before testing!"
-          exit 1
-        fi
-        # Wipe the lib directory incase there are extra unnecessary files in there
-        rm -rf lib
-        # Generate the JavaScript files
-        npm run-script build
-        # Check that repo is still clean
-        if [ ! -z "$(git status --porcelain)" ]; then
-          # If we get a fail here then the PR needs attention
-          >&2 echo "Failed: JavaScript files are not up to date. Run 'npm run-script build' to update"
-          git status
-          exit 1
-        fi
-        echo "Success: JavaScript files are up to date"
+      run: .github/workflows/script/check-js.sh
 
   check-node-modules:
     runs-on: ubuntu-latest
@@ -46,27 +28,10 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Check node modules up to date
-      run: |
-        # Sanity check that repo is clean to start with
-        if [ ! -z "$(git status --porcelain)" ]; then
-          # If we get a fail here then this workflow needs attention...
-          >&2 echo "Failed: Repo should be clean before testing!"
-          exit 1
-        fi
-        # Reinstall modules and then clean to remove absolute paths
-        # Use 'npm ci' instead of 'npm install' as this is intended to be reproducible
-        npm ci
-        npm run removeNPMAbsolutePaths
-        # Check that repo is still clean
-        if [ ! -z "$(git status --porcelain)" ]; then
-          # If we get a fail here then the PR needs attention
-          >&2 echo "Failed: node_modules are not up to date. Run 'npm ci' and 'npm run removeNPMAbsolutePaths' to update"
-          git status
-          exit 1
-        fi
-        echo "Success: node_modules are up to date"
+      run: .github/workflows/script/check-node-modules.sh
 
   npm-test:
+    needs: [check-js, check-node-modules]
     strategy:
       matrix:
         os: [ubuntu-latest,macos-latest]
@@ -76,3 +41,537 @@ jobs:
     - uses: actions/checkout@v2
     - name: npm run-script test
       run: npm run-script test
+
+  multi-language-repo_test-autodetect-languages:
+    needs: [check-js, check-node-modules]
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+    - uses: ./../action/init
+    - name: Build code
+      shell: bash
+      run: ./build.sh
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+    - run: |
+        cd "$RUNNER_TEMP/codeql_databases"
+        # List all directories as there will be precisely one directory per database
+        # but there may be other files in this directory such as query suites.
+        if [ "$(ls -d */ | wc -l)" != 6 ] || \
+           [[ ! -d cpp ]] || \
+           [[ ! -d csharp ]] || \
+           [[ ! -d go ]] || \
+           [[ ! -d java ]] || \
+           [[ ! -d javascript ]] || \
+           [[ ! -d python ]]; then
+          echo "Did not find expected number of databases. Database dir contains: $(ls)"
+          exit 1
+        fi
+
+  multi-language-repo_test-custom-queries-and-remote-config:
+    needs: [check-js, check-node-modules]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        tools: [~, latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+    - uses: ./../action/init
+      with:
+        tools: ${{ matrix.tools }}
+        languages: cpp,csharp,java,javascript,python
+        config-file: github/codeql-action/tests/multi-language-repo/.github/codeql/custom-queries.yml@${{ github.sha }}
+    - name: Build code
+      shell: bash
+      run: ./build.sh
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  # Currently is not possible to analyze Go in conjunction with other languages in macos
+  multi-language-repo_test-go-custom-queries:
+    needs: [check-js, check-node-modules]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/setup-go@v2
+      if: ${{ matrix.os ==  'macos-latest' }}
+      with:
+        go-version: '^1.13.1'
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+    - uses: ./../action/init
+      with:
+        languages: go
+        config-file: ./.github/codeql/custom-queries.yml
+        tools: latest
+    - name: Build code
+      shell: bash
+      run: ./build.sh
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  go-custom-tracing:
+    needs: [check-js, check-node-modules]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      CODEQL_EXTRACTOR_GO_BUILD_TRACING: "on"
+
+    steps:
+    - uses: actions/setup-go@v2
+      if: ${{ matrix.os ==  'macos-latest' }}
+      with:
+        go-version: '^1.13.1'
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+    - uses: ./../action/init
+      with:
+        languages: go
+        tools: latest
+    - name: Build code
+      shell: bash
+      run: go build main.go
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  go-custom-tracing-autobuild:
+    needs: [check-js, check-node-modules]
+    # No need to test Go autobuild on multiple OSes since
+    # we're testing Go custom tracing with a manual build on all OSes.
+    runs-on: ubuntu-latest
+    env:
+      CODEQL_EXTRACTOR_GO_BUILD_TRACING: "on"
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+    - uses: ./../action/init
+      with:
+        languages: go
+        tools: latest
+    - uses: ./../action/autobuild
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  multi-language-repo_rubocop:
+    needs: [check-js, check-node-modules]
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: 2.6
+    - name: Install Code Scanning integration
+      run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
+    - name: Install dependencies
+      run: bundle install
+    - name: Rubocop run
+      run: |
+        bash -c "
+          bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
+          [[ $? -ne 2 ]]
+        "
+    - uses: ./../action/upload-sarif
+      with:
+        sarif_file: rubocop.sarif
+      env:
+        TEST_MODE: true
+
+  test-proxy:
+    needs: [check-js, check-node-modules]
+    runs-on: ubuntu-latest
+    container:
+      image: ubuntu:18.04
+      options: --dns 127.0.0.1
+    services:
+      squid-proxy:
+        image: datadog/squid:latest
+        ports:
+          - 3128:3128
+    env:
+      https_proxy: http://squid-proxy:3128
+    steps:
+    - uses: actions/checkout@v2
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+    - uses: ./../action/init
+      with:
+        languages: javascript
+        tools: latest
+    - uses: ./../action/analyze
+      env:
+        TEST_MODE: true
+
+  runner-analyze-javascript-ubuntu:
+    needs: [check-js, check-node-modules]
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        # Pass --config-file here, but not for other jobs in this workflow.
+        # This means we're testing the config file parsing in the runner
+        # but not slowing down all jobs unnecessarily as it doesn't add much
+        # testing the parsing on different operating systems and languages.
+        runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Run analyze
+      run: |
+        runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-javascript-windows:
+    needs: [check-js, check-node-modules]
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages javascript --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Run analyze
+      run: |
+        runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-javascript-macos:
+    needs: [check-js, check-node-modules]
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages javascript --config-file ./.github/codeql/codeql-config.yml --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Run analyze
+      run: |
+        runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-ubuntu:
+    needs: [check-js, check-node-modules]
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      run: |
+        . ./codeql-runner/codeql-env.sh
+        $CODEQL_RUNNER dotnet build
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-windows:
+    needs: [check-js, check-node-modules]
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: powershell
+      run: |
+        cat ./codeql-runner/codeql-env.sh | Invoke-Expression
+        & $Env:CODEQL_RUNNER dotnet build
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-macos:
+    needs: [check-js, check-node-modules]
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: bash
+      run: |
+        . ./codeql-runner/codeql-env.sh
+        $CODEQL_RUNNER dotnet build
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+
+  runner-analyze-csharp-autobuild-ubuntu:
+    needs: [check-js, check-node-modules]
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-linux init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      run: |
+        ../action/runner/dist/codeql-runner-linux autobuild
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-linux analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-autobuild-windows:
+    needs: [check-js, check-node-modules]
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe init --repository $Env:GITHUB_REPOSITORY --languages csharp --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: powershell
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe autobuild
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-win.exe analyze --repository $Env:GITHUB_REPOSITORY --commit $Env:GITHUB_SHA --ref $Env:GITHUB_REF --github-url $Env:GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-analyze-csharp-autobuild-macos:
+    needs: [check-js, check-node-modules]
+    runs-on: macos-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Move codeql-action
+      shell: bash
+      run: |
+        mkdir ../action
+        mv * .github ../action/
+        mv ../action/tests/multi-language-repo/{*,.github} .
+        mv ../action/.github/workflows .github
+
+    - name: Build runner
+      run: |
+        cd ../action/runner
+        npm install
+        npm run build-runner
+
+    - name: Run init
+      run: |
+        ../action/runner/dist/codeql-runner-macos init --repository $GITHUB_REPOSITORY --languages csharp --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+
+    - name: Build code
+      shell: bash
+      run: |
+        ../action/runner/dist/codeql-runner-macos autobuild
+
+    - name: Run analyze
+      run: |
+        ../action/runner/dist/codeql-runner-macos analyze --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}
+      env:
+        TEST_MODE: true
+
+  runner-upload-sarif:
+    needs: [check-js, check-node-modules]
+    runs-on: ubuntu-latest
+
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.base.repo.id == github.event.pull_request.head.repo.id }}
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Build runner
+      run: |
+        cd runner
+        npm install
+        npm run build-runner
+
+    - name: Upload with runner
+      run: |
+        # Deliberately don't use TEST_MODE here. This is specifically testing
+        # the compatibility with the API.
+        runner/dist/codeql-runner-linux upload --sarif-file src/testdata/empty-sarif.sarif --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --ref $GITHUB_REF --github-url $GITHUB_SERVER_URL --github-auth ${{ github.token }}

.github/workflows/script/check-js.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -eu
+
+# Sanity check that repo is clean to start with
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then this workflow needs attention...
+    >&2 echo "Failed: Repo should be clean before testing!"
+    exit 1
+fi
+# Wipe the lib directory incase there are extra unnecessary files in there
+rm -rf lib
+# Generate the JavaScript files
+npm run-script build
+# Check that repo is still clean
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then the PR needs attention
+    >&2 echo "Failed: JavaScript files are not up to date. Run 'npm run-script build' to update"
+    git status
+    exit 1
+fi
+echo "Success: JavaScript files are up to date"

.github/workflows/script/check-node-modules.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -eu
+
+# Sanity check that repo is clean to start with
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then this workflow needs attention...
+    >&2 echo "Failed: Repo should be clean before testing!"
+    exit 1
+fi
+# Reinstall modules and then clean to remove absolute paths
+# Use 'npm ci' instead of 'npm install' as this is intended to be reproducible
+npm ci
+npm run removeNPMAbsolutePaths
+# Check that repo is still clean
+if [ ! -z "$(git status --porcelain)" ]; then
+    # If we get a fail here then the PR needs attention
+    >&2 echo "Failed: node_modules are not up to date. Run 'npm ci' and 'npm run removeNPMAbsolutePaths' to update"
+    git status
+    exit 1
+fi
+echo "Success: node_modules are up to date"

README.md

@@ -96,7 +96,16 @@ Use the `config-file` parameter of the `init` action to enable the configuration
     config-file: ./.github/codeql/codeql-config.yml
 ```
 
-The configuration file must be located within the local repository. For information on how to write a configuration file, see "[Using a custom configuration file](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#using-a-custom-configuration-file)."
+The configuration file can be located in a different repository. This is useful if you want to share the same configuration across multiple repositories. If the configuration file is in a private repository you can also specify an `external-repository-token` option. This should be a personal access token that has read access to any repositories containing referenced config files and queries.
+
+```yaml
+- uses: github/codeql-action/init@v1
+  with:
+    config-file: owner/repo/codeql-config.yml@branch
+    external-repository-token: ${{ secrets.EXTERNAL_REPOSITORY_TOKEN }}
+```
+
+For information on how to write a configuration file, see "[Using a custom configuration file](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#using-a-custom-configuration-file)."
 
 If you only want to customise the queries used, you can specify them in your workflow instead of creating a config file, using the `queries` property of the `init` action:
 

init/action.yml

@@ -19,6 +19,9 @@ inputs:
   queries:
     description: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
     required: false
+  external-repository-token:
+    description: A token for fetching external config files and queries if they reside in a private repository.
+    required: false
   setup-python-dependencies:
     description: Try to auto-install your python dependencies
     required: true

lib/actions-util.js

@@ -101,6 +101,46 @@ exports.getCommitOid = async function () {
 function isObject(o) {
     return o !== null && typeof o === "object";
 }
+const GLOB_PATTERN = new RegExp("(\\*\\*?)");
+function escapeRegExp(string) {
+    return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); // $& means the whole matched string
+}
+function patternToRegExp(value) {
+    return new RegExp(`^${value
+        .toString()
+        .split(GLOB_PATTERN)
+        .reduce(function (arr, cur) {
+        if (cur === "**") {
+            arr.push(".*?");
+        }
+        else if (cur === "*") {
+            arr.push("[^/]*?");
+        }
+        else if (cur) {
+            arr.push(escapeRegExp(cur));
+        }
+        return arr;
+    }, [])
+        .join("")}$`);
+}
+// this function should return true if patternA is a superset of patternB
+// e.g: * is a superset of main-* but main-* is not a superset of *.
+function patternIsSuperset(patternA, patternB) {
+    return patternToRegExp(patternA).test(patternB);
+}
+exports.patternIsSuperset = patternIsSuperset;
+function branchesToArray(branches) {
+    if (typeof branches === "string") {
+        return [branches];
+    }
+    if (Array.isArray(branches)) {
+        if (branches.length === 0) {
+            return "**";
+        }
+        return branches;
+    }
+    return "**";
+}
 var MissingTriggers;
 (function (MissingTriggers) {
     MissingTriggers[MissingTriggers["None"] = 0] = "None";
@@ -113,6 +153,8 @@ function toCodedErrors(errors) {
         return acc;
     }, {});
 }
+// code to send back via status report
+// message to add as a warning annotation to the run
 exports.WorkflowErrors = toCodedErrors({
     MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
     MissingHooks: `Please specify on.push and on.pull_request hooks so that Code Scanning can compare pull requests against the state of the base branch.`,
@@ -122,85 +164,90 @@ exports.WorkflowErrors = toCodedErrors({
     PathsIgnoreSpecified: `Using on.push.paths-ignore can prevent Code Scanning annotating new alerts in your pull requests.`,
     CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
 });
-function validateWorkflow(doc) {
-    var _a, _b, _c, _d, _e;
+function getWorkflowErrors(doc) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     const errors = [];
-    // .jobs[key].steps[].run
-    for (const job of Object.values(((_a = doc) === null || _a === void 0 ? void 0 : _a.jobs) || {})) {
-        for (const step of ((_b = job) === null || _b === void 0 ? void 0 : _b.steps) || []) {
-            // this was advice that we used to give in the README
-            // we actually want to run the analysis on the merge commit
-            // to produce results that are more inline with expectations
-            // (i.e: this is what will happen if you merge this PR)
-            // and avoid some race conditions
-            if (((_c = step) === null || _c === void 0 ? void 0 : _c.run) === "git checkout HEAD^2") {
-                errors.push(exports.WorkflowErrors.CheckoutWrongHead);
+    const jobName = process.env.GITHUB_JOB;
+    if (jobName) {
+        const job = (_b = (_a = doc) === null || _a === void 0 ? void 0 : _a.jobs) === null || _b === void 0 ? void 0 : _b[jobName];
+        const steps = (_c = job) === null || _c === void 0 ? void 0 : _c.steps;
+        if (Array.isArray(steps)) {
+            for (const step of steps) {
+                // this was advice that we used to give in the README
+                // we actually want to run the analysis on the merge commit
+                // to produce results that are more inline with expectations
+                // (i.e: this is what will happen if you merge this PR)
+                // and avoid some race conditions
+                if (((_d = step) === null || _d === void 0 ? void 0 : _d.run) === "git checkout HEAD^2") {
+                    errors.push(exports.WorkflowErrors.CheckoutWrongHead);
+                    break;
+                }
             }
         }
     }
     let missing = MissingTriggers.None;
     if (doc.on === undefined) {
-        missing = MissingTriggers.Push | MissingTriggers.PullRequest;
+        // this is not a valid config
     }
     else if (typeof doc.on === "string") {
-        switch (doc.on) {
-            case "push":
-                missing = MissingTriggers.PullRequest;
-                break;
-            case "pull_request":
-                missing = MissingTriggers.Push;
-                break;
-            default:
-                missing = MissingTriggers.Push | MissingTriggers.PullRequest;
-                break;
+        if (doc.on === "pull_request") {
+            missing = MissingTriggers.Push;
         }
     }
     else if (Array.isArray(doc.on)) {
-        if (!doc.on.includes("push")) {
+        const hasPush = doc.on.includes("push");
+        const hasPullRequest = doc.on.includes("pull_request");
+        if (hasPullRequest && !hasPush) {
             missing = missing | MissingTriggers.Push;
         }
-        if (!doc.on.includes("pull_request")) {
-            missing = missing | MissingTriggers.PullRequest;
-        }
     }
     else if (isObject(doc.on)) {
-        if (!Object.prototype.hasOwnProperty.call(doc.on, "pull_request")) {
-            missing = missing | MissingTriggers.PullRequest;
-        }
-        if (!Object.prototype.hasOwnProperty.call(doc.on, "push")) {
+        const hasPush = Object.prototype.hasOwnProperty.call(doc.on, "push");
+        const hasPullRequest = Object.prototype.hasOwnProperty.call(doc.on, "pull_request");
+        if (!hasPush && hasPullRequest) {
             missing = missing | MissingTriggers.Push;
         }
-        else {
-            const paths = (_d = doc.on.push) === null || _d === void 0 ? void 0 : _d.paths;
+        if (hasPush && hasPullRequest) {
+            const paths = (_e = doc.on.push) === null || _e === void 0 ? void 0 : _e.paths;
             // if you specify paths or paths-ignore you can end up with commits that have no baseline
             // if they didn't change any files
             // currently we cannot go back through the history and find the most recent baseline
             if (Array.isArray(paths) && paths.length > 0) {
                 errors.push(exports.WorkflowErrors.PathsSpecified);
             }
-            const pathsIgnore = (_e = doc.on.push) === null || _e === void 0 ? void 0 : _e["paths-ignore"];
+            const pathsIgnore = (_f = doc.on.push) === null || _f === void 0 ? void 0 : _f["paths-ignore"];
             if (Array.isArray(pathsIgnore) && pathsIgnore.length > 0) {
                 errors.push(exports.WorkflowErrors.PathsIgnoreSpecified);
             }
         }
-        if (doc.on.push) {
-            const push = doc.on.push.branches || [];
-            if (doc.on.pull_request) {
-                const pull_request = doc.on.pull_request.branches || [];
-                const difference = pull_request.filter((value) => !push.includes(value));
-                if (difference.length > 0) {
-                    // there are branches in pull_request that may not have a baseline
-                    // because we are not building them on push
+        // if doc.on.pull_request is null that means 'all branches'
+        // if doc.on.pull_request is undefined that means 'off'
+        // we only want to check for mismatched branches if pull_request is on.
+        if (doc.on.pull_request !== undefined) {
+            const push = branchesToArray((_g = doc.on.push) === null || _g === void 0 ? void 0 : _g.branches);
+            if (push !== "**") {
+                const pull_request = branchesToArray((_h = doc.on.pull_request) === null || _h === void 0 ? void 0 : _h.branches);
+                if (pull_request !== "**") {
+                    const difference = pull_request.filter((value) => !push.some((o) => patternIsSuperset(o, value)));
+                    if (difference.length > 0) {
+                        // there are branches in pull_request that may not have a baseline
+                        // because we are not building them on push
+                        errors.push(exports.WorkflowErrors.MismatchedBranches);
+                    }
+                }
+                else if (push.length > 0) {
+                    // push is set up to run on a subset of branches
+                    // and you could open a PR against a branch with no baseline
                     errors.push(exports.WorkflowErrors.MismatchedBranches);
                 }
             }
-            else if (push.length > 0) {
-                // push is set up to run on a subset of branches
-                // and you could open a PR against a branch with no baseline
-                errors.push(exports.WorkflowErrors.MismatchedBranches);
-            }
         }
     }
+    else {
+        // on is not a known type
+        // this workflow is likely malformed
+        missing = MissingTriggers.Push | MissingTriggers.PullRequest;
+    }
     switch (missing) {
         case MissingTriggers.PullRequest | MissingTriggers.Push:
             errors.push(exports.WorkflowErrors.MissingHooks);
@@ -214,15 +261,35 @@ function validateWorkflow(doc) {
     }
     return errors;
 }
-exports.validateWorkflow = validateWorkflow;
-async function getWorkflowErrors() {
-    const workflow = await getWorkflow();
-    if (workflow === undefined) {
-        return [];
-    }
-    return validateWorkflow(workflow);
-}
 exports.getWorkflowErrors = getWorkflowErrors;
+async function validateWorkflow() {
+    let workflow;
+    try {
+        workflow = await getWorkflow();
+    }
+    catch (e) {
+        return `error: getWorkflow() failed: ${e.toString()}`;
+    }
+    let workflowErrors;
+    try {
+        workflowErrors = getWorkflowErrors(workflow);
+    }
+    catch (e) {
+        return `error: getWorkflowErrors() failed: ${e.toString()}`;
+    }
+    if (workflowErrors.length > 0) {
+        let message;
+        try {
+            message = formatWorkflowErrors(workflowErrors);
+        }
+        catch (e) {
+            return `error: formatWorkflowErrors() failed: ${e.toString()}`;
+        }
+        core.warning(message);
+    }
+    return `warning: ${formatWorkflowCause(workflowErrors)}`;
+}
+exports.validateWorkflow = validateWorkflow;
 function formatWorkflowErrors(errors) {
     const issuesWere = errors.length === 1 ? "issue was" : "issues were";
     const errorsList = errors.map((e) => e.message).join(" ");
@@ -239,13 +306,7 @@ exports.formatWorkflowCause = formatWorkflowCause;
 async function getWorkflow() {
     const relativePath = await getWorkflowPath();
     const absolutePath = path.join(getRequiredEnvParam("GITHUB_WORKSPACE"), relativePath);
-    try {
-        return yaml.safeLoad(fs.readFileSync(absolutePath, "utf-8"));
-    }
-    catch (e) {
-        core.warning(`Could not read workflow: ${e.toString()}`);
-        return undefined;
-    }
+    return yaml.safeLoad(fs.readFileSync(absolutePath, "utf-8"));
 }
 exports.getWorkflow = getWorkflow;
 /**
@@ -428,10 +489,10 @@ async function sendStatusReport(statusReport) {
                     // this means that this action version is no longer compatible with the API
                     // we still want to continue as it is likely the analysis endpoint will work
                     if (getRequiredEnvParam("GITHUB_SERVER_URL") !== util_1.GITHUB_DOTCOM_URL) {
-                        core.warning("CodeQL Action version is incompatible with the code scanning endpoint. Please update to a compatible version of codeql-action.");
+                        core.debug("CodeQL Action version is incompatible with the code scanning endpoint. Please update to a compatible version of codeql-action.");
                     }
                     else {
-                        core.warning("CodeQL Action is out-of-date. Please upgrade to the latest version of codeql-action.");
+                        core.debug("CodeQL Action is out-of-date. Please upgrade to the latest version of codeql-action.");
                     }
                     return true;
             }

lib/actions-util.test.js

@@ -11,9 +11,13 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const ava_1 = __importDefault(require("ava"));
+const yaml = __importStar(require("js-yaml"));
 const sinon_1 = __importDefault(require("sinon"));
 const actionsutil = __importStar(require("./actions-util"));
 const testing_utils_1 = require("./testing-utils");
+function errorCodes(actual, expected) {
+    return [actual.map(({ code }) => code), expected.map(({ code }) => code)];
+}
 testing_utils_1.setupTests(ava_1.default);
 ava_1.default("getRef() throws on the empty string", async (t) => {
     process.env["GITHUB_REF"] = "";
@@ -68,99 +72,181 @@ ava_1.default("prepareEnvironment() when a local run", (t) => {
     t.deepEqual(process.env.GITHUB_JOB, "UNKNOWN-JOB");
     t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "LOCAL-RUN:UNKNOWN-JOB");
 });
-ava_1.default("validateWorkflow() when on is missing", (t) => {
-    const errors = actionsutil.validateWorkflow({});
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+ava_1.default("getWorkflowErrors() when on is empty", (t) => {
+    const errors = actionsutil.getWorkflowErrors({ on: {} });
+    t.deepEqual(...errorCodes(errors, []));
 });
-ava_1.default("validateWorkflow() when on.push is missing", (t) => {
-    const errors = actionsutil.validateWorkflow({ on: {} });
-    console.log(errors);
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+ava_1.default("getWorkflowErrors() when on.push is an array missing pull_request", (t) => {
+    const errors = actionsutil.getWorkflowErrors({ on: ["push"] });
+    t.deepEqual(...errorCodes(errors, []));
 });
-ava_1.default("validateWorkflow() when on.push is an array missing pull_request", (t) => {
-    const errors = actionsutil.validateWorkflow({ on: ["push"] });
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPullRequestHook]);
+ava_1.default("getWorkflowErrors() when on.push is an array missing push", (t) => {
+    const errors = actionsutil.getWorkflowErrors({ on: ["pull_request"] });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MissingPushHook]));
 });
-ava_1.default("validateWorkflow() when on.push is an array missing push", (t) => {
-    const errors = actionsutil.validateWorkflow({ on: ["pull_request"] });
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPushHook]);
-});
-ava_1.default("validateWorkflow() when on.push is valid", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.push is valid", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
         on: ["push", "pull_request"],
     });
-    t.deepEqual(errors.length, 0);
+    t.deepEqual(...errorCodes(errors, []));
 });
-ava_1.default("validateWorkflow() when on.push is a valid superset", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.push is a valid superset", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
         on: ["push", "pull_request", "schedule"],
     });
-    t.deepEqual(errors.length, 0);
+    t.deepEqual(...errorCodes(errors, []));
 });
-ava_1.default("validateWorkflow() when on.push should not have a path", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.push should not have a path", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
         on: {
             push: { branches: ["main"], paths: ["test/*"] },
             pull_request: { branches: ["main"] },
         },
     });
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.PathsSpecified]);
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.PathsSpecified]));
 });
-ava_1.default("validateWorkflow() when on.push is a correct object", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.push is a correct object", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
         on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
     });
-    t.deepEqual(errors.length, 0);
+    t.deepEqual(...errorCodes(errors, []));
 });
-ava_1.default("validateWorkflow() when on.push is correct with empty objects", (t) => {
-    const errors = actionsutil.validateWorkflow({
-        on: { push: undefined, pull_request: undefined },
+ava_1.default("getWorkflowErrors() when on.pull_requests is a string", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: { push: { branches: ["main"] }, pull_request: { branches: "*" } },
     });
-    console.log(errors);
-    t.deepEqual(errors.length, 0);
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
 });
-ava_1.default("validateWorkflow() when on.push is mismatched", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.pull_requests is a string and correct", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: { push: { branches: "*" }, pull_request: { branches: "*" } },
+    });
+    t.deepEqual(...errorCodes(errors, []));
+});
+ava_1.default("getWorkflowErrors() when on.push is correct with empty objects", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.safeLoad(`
+on:
+  push:
+  pull_request:
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+ava_1.default("getWorkflowErrors() when on.push is mismatched", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
         on: {
             push: { branches: ["main"] },
             pull_request: { branches: ["feature"] },
         },
     });
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
 });
-ava_1.default("validateWorkflow() when on.push is not mismatched", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.push is not mismatched", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
         on: {
             push: { branches: ["main", "feature"] },
             pull_request: { branches: ["main"] },
         },
     });
-    t.deepEqual(errors.length, 0);
+    t.deepEqual(...errorCodes(errors, []));
 });
-ava_1.default("validateWorkflow() when on.push is mismatched for pull_request", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.push is mismatched for pull_request", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
         on: {
             push: { branches: ["main"] },
             pull_request: { branches: ["main", "feature"] },
         },
     });
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
 });
-ava_1.default("validateWorkflow() when on.pull_request for every branch but push specifies branches", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() for a range of malformed workflows", (t) => {
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
         on: {
-            push: { branches: ["main"] },
-            pull_request: null,
+            push: 1,
+            pull_request: 1,
+        },
+    }), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: 1,
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: [1],
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { 1: 1 },
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: 1 },
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: [1] },
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: { steps: 1 } },
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: { steps: [{ notrun: "git checkout HEAD^2" }] } },
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: [undefined] },
+    }), [actionsutil.WorkflowErrors.MissingHooks]));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(1), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors({
+        on: {
+            push: {
+                branches: 1,
+            },
+            pull_request: {
+                branches: 1,
+            },
+        },
+    }), []));
+});
+ava_1.default("getWorkflowErrors() when on.pull_request for every branch but push specifies branches", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+`));
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
+});
+ava_1.default("getWorkflowErrors() when on.pull_request for wildcard branches", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["feature/*"] },
+            pull_request: { branches: "feature/moose" },
         },
     });
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+    t.deepEqual(...errorCodes(errors, []));
 });
-ava_1.default("validateWorkflow() when HEAD^2 is checked out", (t) => {
-    const errors = actionsutil.validateWorkflow({
+ava_1.default("getWorkflowErrors() when on.pull_request for mismatched wildcard branches", (t) => {
+    const errors = actionsutil.getWorkflowErrors({
+        on: {
+            push: { branches: ["feature/moose"] },
+            pull_request: { branches: "feature/*" },
+        },
+    });
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches]));
+});
+ava_1.default("getWorkflowErrors() when HEAD^2 is checked out", (t) => {
+    process.env.GITHUB_JOB = "test";
+    const errors = actionsutil.getWorkflowErrors({
         on: ["push", "pull_request"],
         jobs: { test: { steps: [{ run: "git checkout HEAD^2" }] } },
     });
-    t.deepEqual(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]);
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]));
 });
 ava_1.default("formatWorkflowErrors() when there is one error", (t) => {
     const message = actionsutil.formatWorkflowErrors([
@@ -183,4 +269,130 @@ ava_1.default("formatWorkflowCause()", (t) => {
     t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
     t.deepEqual(actionsutil.formatWorkflowCause([]), undefined);
 });
+ava_1.default("patternIsSuperset()", (t) => {
+    t.false(actionsutil.patternIsSuperset("main-*", "main"));
+    t.true(actionsutil.patternIsSuperset("*", "*"));
+    t.true(actionsutil.patternIsSuperset("*", "main-*"));
+    t.false(actionsutil.patternIsSuperset("main-*", "*"));
+    t.false(actionsutil.patternIsSuperset("main-*", "main"));
+    t.true(actionsutil.patternIsSuperset("main", "main"));
+    t.false(actionsutil.patternIsSuperset("*", "feature/*"));
+    t.true(actionsutil.patternIsSuperset("**", "feature/*"));
+    t.false(actionsutil.patternIsSuperset("feature-*", "**"));
+    t.false(actionsutil.patternIsSuperset("a/**/c", "a/**/d"));
+    t.false(actionsutil.patternIsSuperset("a/**/c", "a/**"));
+    t.true(actionsutil.patternIsSuperset("a/**", "a/**/c"));
+    t.true(actionsutil.patternIsSuperset("a/**/c", "a/main-**/c"));
+    t.false(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/d/**/c"));
+    t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/c/**/c"));
+    t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/d/**/c"));
+    t.false(actionsutil.patternIsSuperset("a/**/c/d/**/c", "a/**/b/**/c"));
+    t.false(actionsutil.patternIsSuperset("a/main-**/c", "a/**/c"));
+    t.true(actionsutil.patternIsSuperset("/robin/*/release/*", "/robin/moose/release/goose"));
+    t.false(actionsutil.patternIsSuperset("/robin/moose/release/goose", "/robin/*/release/*"));
+});
+ava_1.default("getWorkflowErrors() when branches contain dots", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.safeLoad(`
+  on:
+    push:
+      branches: [4.1, master]
+    pull_request:
+      # The branches below must be a subset of the branches above
+      branches: [4.1, master]
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+ava_1.default("getWorkflowErrors() when on.push has a trailing comma", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master, ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+ava_1.default("getWorkflowErrors() should only report the current job's CheckoutWrongHead", (t) => {
+    process.env.GITHUB_JOB = "test";
+    const errors = actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+jobs:
+  test:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test2:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test3:
+    steps: []
+`));
+    t.deepEqual(...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]));
+});
+ava_1.default("getWorkflowErrors() should not report a different job's CheckoutWrongHead", (t) => {
+    process.env.GITHUB_JOB = "test3";
+    const errors = actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+jobs:
+  test:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test2:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test3:
+    steps: []
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+ava_1.default("getWorkflowErrors() when on is missing", (t) => {
+    const errors = actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+`));
+    t.deepEqual(...errorCodes(errors, []));
+});
+ava_1.default("getWorkflowErrors() with a different on setup", (t) => {
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on: "workflow_dispatch"
+`)), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on: [workflow_dispatch]
+`)), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on:
+  workflow_dispatch: {}
+`)), []));
+});
+ava_1.default("getWorkflowErrors() should not report an error if PRs are totally unconfigured", (t) => {
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+`)), []));
+    t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(yaml.safeLoad(`
+name: "CodeQL"
+on: ["push"]
+`)), []));
+});
 //# sourceMappingURL=actions-util.test.js.map

lib/analysis-paths.test.js

@@ -27,6 +27,7 @@ ava_1.default("emptyPaths", async (t) => {
             tempDir: tmpDir,
             toolCacheDir: tmpDir,
             codeQLCmd: "",
+            gitHubVersion: { type: "dotcom" },
         };
         analysisPaths.includeAndExcludeAnalysisPaths(config);
         t.is(process.env["LGTM_INDEX_INCLUDE"], undefined);
@@ -45,6 +46,7 @@ ava_1.default("nonEmptyPaths", async (t) => {
             tempDir: tmpDir,
             toolCacheDir: tmpDir,
             codeQLCmd: "",
+            gitHubVersion: { type: "dotcom" },
         };
         analysisPaths.includeAndExcludeAnalysisPaths(config);
         t.is(process.env["LGTM_INDEX_INCLUDE"], "path1\npath2");
@@ -64,6 +66,7 @@ ava_1.default("exclude temp dir", async (t) => {
             tempDir,
             toolCacheDir,
             codeQLCmd: "",
+            gitHubVersion: { type: "dotcom" },
         };
         analysisPaths.includeAndExcludeAnalysisPaths(config);
         t.is(process.env["LGTM_INDEX_INCLUDE"], undefined);

lib/analysis-paths.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AAEvB,gEAAkD;AAClD,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YACrC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3C,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CACF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACjC,gGAAgG,CACjG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO;YACP,YAAY;YACZ,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAC9D,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analysis-paths.test.js","sourceRoot":"","sources":["../src/analysis-paths.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6B;AAE7B,8CAAuB;AAEvB,gEAAkD;AAClD,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAwB;SACxD,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YACrC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;YAC3C,iBAAiB,EAAE,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAwB;SACxD,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CACF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACjC,gGAAgG,CACjG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO;YACP,YAAY;YACZ,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAwB;SACxD,CAAC;QACF,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAC9D,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/analyze-action.js

@@ -7,12 +7,15 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
 const actionsUtil = __importStar(require("./actions-util"));
 const analyze_1 = require("./analyze");
 const config_utils_1 = require("./config-utils");
 const logging_1 = require("./logging");
 const repository_1 = require("./repository");
+const upload_lib = __importStar(require("./upload-lib"));
 const util = __importStar(require("./util"));
 async function sendStatusReport(startedAt, stats, error) {
     var _a, _b, _c;
@@ -29,13 +32,14 @@ async function sendStatusReport(startedAt, stats, error) {
 async function run() {
     const startedAt = new Date();
     let stats = undefined;
+    let config = undefined;
     try {
         actionsUtil.prepareLocalRunEnvironment();
         if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("finish", "starting", startedAt)))) {
             return;
         }
         const logger = logging_1.getActionsLogger();
-        const config = await config_utils_1.getConfig(actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), logger);
+        config = await config_utils_1.getConfig(actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), logger);
         if (config === undefined) {
             throw new Error("Config file could not be found at expected location. Has the 'init' action been called?");
         }
@@ -43,7 +47,16 @@ async function run() {
             auth: actionsUtil.getRequiredInput("token"),
             url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
         };
-        stats = await analyze_1.runAnalyze(repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), apiDetails, actionsUtil.getRequiredInput("upload") === "true", "actions", actionsUtil.getRequiredInput("output"), util.getMemoryFlag(actionsUtil.getOptionalInput("ram")), util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), util.getThreadsFlag(actionsUtil.getOptionalInput("threads"), logger), config, logger);
+        const outputDir = actionsUtil.getRequiredInput("output");
+        const queriesStats = await analyze_1.runAnalyze(outputDir, util.getMemoryFlag(actionsUtil.getOptionalInput("ram")), util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")), util.getThreadsFlag(actionsUtil.getOptionalInput("threads"), logger), config, logger);
+        if (actionsUtil.getRequiredInput("upload") === "true") {
+            const uploadStats = await upload_lib.uploadFromActions(outputDir, repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), config.gitHubVersion, apiDetails, logger);
+            stats = { ...queriesStats, ...uploadStats };
+        }
+        else {
+            logger.info("Not uploading results");
+            stats = { ...queriesStats };
+        }
     }
     catch (error) {
         core.setFailed(error.message);
@@ -54,6 +67,29 @@ async function run() {
         await sendStatusReport(startedAt, stats, error);
         return;
     }
+    finally {
+        if (core.isDebug() && config !== undefined) {
+            core.info("Debug mode is on. Printing CodeQL debug logs...");
+            for (const language of config.languages) {
+                const databaseDirectory = util.getCodeQLDatabasePath(config.tempDir, language);
+                const logsDirectory = path.join(databaseDirectory, "log");
+                const walkLogFiles = (dir) => {
+                    const entries = fs.readdirSync(dir, { withFileTypes: true });
+                    for (const entry of entries) {
+                        if (entry.isFile()) {
+                            core.startGroup(`CodeQL Debug Logs - ${language} - ${entry.name}`);
+                            process.stdout.write(fs.readFileSync(path.resolve(dir, entry.name)));
+                            core.endGroup();
+                        }
+                        else if (entry.isDirectory()) {
+                            walkLogFiles(path.resolve(dir, entry.name));
+                        }
+                    }
+                };
+                walkLogFiles(logsDirectory);
+            }
+        }
+    }
     await sendStatusReport(startedAt, stats);
 }
 async function runWrapper() {

lib/analyze-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze-action.js","sourceRoot":"","sources":["../src/analyze-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAImB;AACnB,iDAA2C;AAC3C,uCAA6C;AAC7C,6CAAkD;AAClD,6CAA+B;AAM/B,KAAK,UAAU,gBAAgB,CAC7B,SAAe,EACf,KAAuC,EACvC,KAAa;;IAEb,MAAM,MAAM,GACV,OAAA,KAAK,0CAAE,wBAAwB,MAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,QAAQ,EACR,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAAuB;QACvC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAqC,SAAS,CAAC;IACxD,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,QAAQ,EACR,UAAU,EACV,SAAS,CACV,CACF,CAAC,EACF;YACA,OAAO;SACR;QACD,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,wBAAS,CAC5B,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QACF,KAAK,GAAG,MAAM,oBAAU,CACtB,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,UAAU,EACV,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,MAAM,EACjD,SAAS,EACT,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACvD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,EACrE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EACpE,MAAM,EACN,MAAM,CACP,CAAC;KACH;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,IAAI,KAAK,YAAY,6BAAmB,EAAE;YACxC,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;SAC1C;QAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO;KACR;IAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"analyze-action.js","sourceRoot":"","sources":["../src/analyze-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAImB;AACnB,iDAAmD;AACnD,uCAA6C;AAC7C,6CAAkD;AAClD,yDAA2C;AAC3C,6CAA+B;AAU/B,KAAK,UAAU,gBAAgB,CAC7B,SAAe,EACf,KAAuC,EACvC,KAAa;;IAEb,MAAM,MAAM,GACV,OAAA,KAAK,0CAAE,wBAAwB,MAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAClE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,QAAQ,EACR,MAAM,EACN,SAAS,QACT,KAAK,0CAAE,OAAO,QACd,KAAK,0CAAE,KAAK,CACb,CAAC;IACF,MAAM,YAAY,GAAuB;QACvC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAqC,SAAS,CAAC;IACxD,IAAI,MAAM,GAAuB,SAAS,CAAC;IAC3C,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QACzC,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,QAAQ,EACR,UAAU,EACV,SAAS,CACV,CACF,CAAC,EACF;YACA,OAAO;SACR;QACD,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;QAClC,MAAM,GAAG,MAAM,wBAAS,CACtB,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;SACH;QACD,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,MAAM,oBAAU,CACnC,SAAS,EACT,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,EACvD,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,EACrE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EACpE,MAAM,EACN,MAAM,CACP,CAAC;QAEF,IAAI,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,MAAM,EAAE;YACrD,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,iBAAiB,CACpD,SAAS,EACT,+BAAkB,CAChB,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CACrD,EACD,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,MAAM,CAAC,aAAa,EACpB,UAAU,EACV,MAAM,CACP,CAAC;YACF,KAAK,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,EAAE,CAAC;SAC7C;aAAM;YACL,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACrC,KAAK,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;SAC7B;KACF;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,IAAI,KAAK,YAAY,6BAAmB,EAAE;YACxC,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;SAC1C;QAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO;KACR;YAAS;QACR,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,MAAM,KAAK,SAAS,EAAE;YAC1C,IAAI,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC7D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;gBACvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAClD,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;gBACF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBAE1D,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE;oBACnC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;wBAC3B,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE;4BAClB,IAAI,CAAC,UAAU,CACb,uBAAuB,QAAQ,MAAM,KAAK,CAAC,IAAI,EAAE,CAClD,CAAC;4BACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAC/C,CAAC;4BACF,IAAI,CAAC,QAAQ,EAAE,CAAC;yBACjB;6BAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE;4BAC9B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;yBAC7C;qBACF;gBACH,CAAC,CAAC;gBACF,YAAY,CAAC,aAAa,CAAC,CAAC;aAC7B;SACF;KACF;IAED,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/analyze.js

@@ -14,7 +14,6 @@ const analysisPaths = __importStar(require("./analysis-paths"));
 const codeql_1 = require("./codeql");
 const languages_1 = require("./languages");
 const sharedEnv = __importStar(require("./shared-environment"));
-const upload_lib = __importStar(require("./upload-lib"));
 const util = __importStar(require("./util"));
 class CodeQLAnalysisError extends Error {
     constructor(queriesStatusReport, message) {
@@ -117,7 +116,7 @@ async function runQueries(sarifFolder, memoryFlag, addSnippetsFlag, threadsFlag,
     return statusReport;
 }
 exports.runQueries = runQueries;
-async function runAnalyze(repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, doUpload, mode, outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger) {
+async function runAnalyze(outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger) {
     // Delete the tracer config env var to avoid tracing ourselves
     delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
     fs.mkdirSync(outputDir, { recursive: true });
@@ -125,12 +124,7 @@ async function runAnalyze(repositoryNwo, commitOid, ref, analysisKey, analysisNa
     await finalizeDatabaseCreation(config, threadsFlag, logger);
     logger.info("Analyzing database");
     const queriesStats = await runQueries(outputDir, memoryFlag, addSnippetsFlag, threadsFlag, config, logger);
-    if (!doUpload) {
-        logger.info("Not uploading results");
-        return { ...queriesStats };
-    }
-    const uploadStats = await upload_lib.upload(outputDir, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger);
-    return { ...queriesStats, ...uploadStats };
+    return { ...queriesStats };
 }
 exports.runAnalyze = runAnalyze;
 //# sourceMappingURL=analyze.js.map

lib/analyze.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAE3D,gEAAkD;AAElD,qCAAqC;AAErC,2CAA0D;AAG1D,gEAAkD;AAClD,yDAA2C;AAC3C,6CAA+B;AAE/B,MAAa,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,mBAAwC,EAAE,OAAe;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;CACF;AATD,kDASC;AAmCD,KAAK,UAAU,oBAAoB,CAAC,MAAc;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3D,+FAA+F;QAC/F,OAAO;KACR;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG;QACd,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;SACF;KACF,CAAC;IAEF,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,YAAY,EACZ;QACE,IAAI;QACJ,8EAA8E;KAC/E,EACD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC;IAE/C,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,YAAY,EACZ,CAAC,IAAI,EAAE,wCAAwC,CAAC,EAChD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAA0B,EAC1B,MAAc;IAEd,sEAAsE;IACtE,oCAAoC;IACpC,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI,6BAAiB,CAAC,QAAQ,CAAC,EAAE;YAC/B,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;YAE5C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,MAAM,EAAE;gBAChC,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;aACpC;YAED,MAAM,MAAM,CAAC,sBAAsB,CACjC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,CACT,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,CAAC;SACnB;KACF;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,gBAAgB,CAC3B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,WAAW,CACZ,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,CAAC;KACnB;AACH,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;YAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,gDAAgD,CAC9E,CAAC;SACH;QAED,IAAI;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACxC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBAEvC,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAC7C,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;oBACF,uEAAuE;oBACvE,2EAA2E;oBAC3E,MAAM,cAAc,GAAG,GAAG,YAAY,YAAY,IAAI,MAAM,CAAC;oBAC7D,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;yBACrC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;yBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACrD,MAAM,CAAC,KAAK,CACV,wBAAwB,QAAQ,QAAQ,kBAAkB,EAAE,CAC7D,CAAC;oBAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,IAAI,IAAI,QAAQ,CAAC,CAAC;oBAEtE,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,MAAM,CAAC,eAAe,CAC1B,YAAY,EACZ,SAAS,EACT,cAAc,EACd,UAAU,EACV,eAAe,EACf,WAAW,CACZ,CAAC;oBAEF,MAAM,CAAC,KAAK,CACV,8BAA8B,QAAQ,gBAAgB,SAAS,GAAG,CACnE,CAAC;oBACF,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAElB,yBAAyB;oBACzB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBACrC,YAAY,CAAC,WAAW,IAAI,YAAY,QAAQ,cAAc,CAAC;wBAC7D,OAAO,GAAG,SAAS,CAAC;iBACvB;aACF;SACF;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,YAAY,CAAC,wBAAwB,GAAG,QAAQ,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,8BAA8B,QAAQ,KAAK,CAAC,EAAE,CAC/C,CAAC;SACH;KACF;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AA1ED,gCA0EC;AAEM,KAAK,UAAU,UAAU,CAC9B,aAA4B,EAC5B,SAAiB,EACjB,GAAW,EACX,WAA+B,EAC/B,YAAgC,EAChC,aAAiC,EACjC,YAAoB,EACpB,WAA+B,EAC/B,UAA4B,EAC5B,QAAiB,EACjB,IAAe,EACf,SAAiB,EACjB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,8DAA8D;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAEzD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC5C,MAAM,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAE5D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,SAAS,EACT,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,MAAM,CACP,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;KAC5B;IAED,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CACzC,SAAS,EACT,aAAa,EACb,SAAS,EACT,GAAG,EACH,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;IAEF,OAAO,EAAE,GAAG,YAAY,EAAE,GAAG,WAAW,EAAE,CAAC;AAC7C,CAAC;AA1DD,gCA0DC"}
+{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../src/analyze.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAE3D,gEAAkD;AAClD,qCAAqC;AAErC,2CAA0D;AAE1D,gEAAkD;AAClD,6CAA+B;AAE/B,MAAa,mBAAoB,SAAQ,KAAK;IAG5C,YAAY,mBAAwC,EAAE,OAAe;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACjD,CAAC;CACF;AATD,kDASC;AA+BD,KAAK,UAAU,oBAAoB,CAAC,MAAc;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3D,+FAA+F;QAC/F,OAAO;KACR;IAED,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG;QACd,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;SACF;KACF,CAAC;IAEF,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,YAAY,EACZ;QACE,IAAI;QACJ,8EAA8E;KAC/E,EACD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC;IAE/C,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,YAAY,EACZ,CAAC,IAAI,EAAE,wCAAwC,CAAC,EAChD,OAAO,CACR,CAAC,IAAI,EAAE,CAAC;IACT,MAAM,CAAC,IAAI,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,MAA0B,EAC1B,MAAc;IAEd,sEAAsE;IACtE,oCAAoC;IACpC,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,IAAI,6BAAiB,CAAC,QAAQ,CAAC,EAAE;YAC/B,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;YAE5C,IAAI,QAAQ,KAAK,oBAAQ,CAAC,MAAM,EAAE;gBAChC,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;aACpC;YAED,MAAM,MAAM,CAAC,sBAAsB,CACjC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,CACT,CAAC;YACF,MAAM,CAAC,QAAQ,EAAE,CAAC;SACnB;KACF;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,gBAAgB,CAC3B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,WAAW,CACZ,CAAC;QACF,MAAM,CAAC,QAAQ,EAAE,CAAC;KACnB;AACH,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,MAAM,YAAY,GAAwB,EAAE,CAAC;IAE7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,MAAM,CAAC,UAAU,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE;YAC/D,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,gDAAgD,CAC9E,CAAC;SACH;QAED,IAAI;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACxC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBAEvC,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,CAC7C,MAAM,CAAC,OAAO,EACd,QAAQ,CACT,CAAC;oBACF,uEAAuE;oBACvE,2EAA2E;oBAC3E,MAAM,cAAc,GAAG,GAAG,YAAY,YAAY,IAAI,MAAM,CAAC;oBAC7D,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;yBACrC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;yBACnC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBACrD,MAAM,CAAC,KAAK,CACV,wBAAwB,QAAQ,QAAQ,kBAAkB,EAAE,CAC7D,CAAC;oBAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,IAAI,IAAI,QAAQ,CAAC,CAAC;oBAEtE,MAAM,MAAM,GAAG,kBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3C,MAAM,MAAM,CAAC,eAAe,CAC1B,YAAY,EACZ,SAAS,EACT,cAAc,EACd,UAAU,EACV,eAAe,EACf,WAAW,CACZ,CAAC;oBAEF,MAAM,CAAC,KAAK,CACV,8BAA8B,QAAQ,gBAAgB,SAAS,GAAG,CACnE,CAAC;oBACF,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAElB,yBAAyB;oBACzB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;oBACrC,YAAY,CAAC,WAAW,IAAI,YAAY,QAAQ,cAAc,CAAC;wBAC7D,OAAO,GAAG,SAAS,CAAC;iBACvB;aACF;SACF;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,YAAY,CAAC,wBAAwB,GAAG,QAAQ,CAAC;YACjD,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,8BAA8B,QAAQ,KAAK,CAAC,EAAE,CAC/C,CAAC;SACH;KACF;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AA1ED,gCA0EC;AAEM,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,UAAkB,EAClB,eAAuB,EACvB,WAAmB,EACnB,MAA0B,EAC1B,MAAc;IAEd,8DAA8D;IAC9D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAEzD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC5C,MAAM,wBAAwB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAE5D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,SAAS,EACT,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,MAAM,CACP,CAAC;IAEF,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;AAC7B,CAAC;AA3BD,gCA2BC"}

lib/analyze.test.js

@@ -39,6 +39,7 @@ ava_1.default("status report fields", async (t) => {
                 tempDir: tmpDir,
                 toolCacheDir: tmpDir,
                 codeQLCmd: "",
+                gitHubVersion: { type: "dotcom" },
             };
             fs.mkdirSync(util.getCodeQLDatabasePath(config.tempDir, language), {
                 recursive: true,

lib/analyze.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"analyze.test.js","sourceRoot":"","sources":["../src/analyze.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uCAAyB;AAEzB,8CAAuB;AAEvB,uCAAuC;AACvC,qCAAqC;AAErC,2CAAuC;AACvC,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,yEAAyE;AACzE,yCAAyC;AACzC,aAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,kBAAS,CAAC;YACR,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACvC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,MAAM,eAAe,GAAG,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,oBAAQ,CAAC,EAAE;YAC9C,MAAM,MAAM,GAAW;gBACrB,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,EAAE;gBACT,iBAAiB,EAAE,EAAE;gBACrB,OAAO,EAAE,MAAM;gBACf,YAAY,EAAE,MAAM;gBACpB,SAAS,EAAE,EAAE;aACd,CAAC;YACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACjE,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBACzB,OAAO,EAAE,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,EAAE;aACX,CAAC;YACF,MAAM,mBAAmB,GAAG,MAAM,oBAAU,CAC1C,MAAM,EACN,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC,CAAC,IAAI,CACJ,2BAA2B,QAAQ,cAAc,IAAI,mBAAmB,CACzE,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBACzB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,CAAC,QAAQ,CAAC;aACnB,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,oBAAU,CACzC,MAAM,EACN,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CACJ,0BAA0B,QAAQ,cAAc,IAAI,kBAAkB,CACvE,CAAC;SACH;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"analyze.test.js","sourceRoot":"","sources":["../src/analyze.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uCAAyB;AAEzB,8CAAuB;AAEvB,uCAAuC;AACvC,qCAAqC;AAErC,2CAAuC;AACvC,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,yEAAyE;AACzE,yCAAyC;AACzC,aAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,kBAAS,CAAC;YACR,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACvC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,EAAE,CAAC;QACtB,MAAM,eAAe,GAAG,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,oBAAQ,CAAC,EAAE;YAC9C,MAAM,MAAM,GAAW;gBACrB,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,EAAE;gBACT,iBAAiB,EAAE,EAAE;gBACrB,OAAO,EAAE,MAAM;gBACf,YAAY,EAAE,MAAM;gBACpB,SAAS,EAAE,EAAE;gBACb,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAwB;aACxD,CAAC;YACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACjE,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBACzB,OAAO,EAAE,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,EAAE;aACX,CAAC;YACF,MAAM,mBAAmB,GAAG,MAAM,oBAAU,CAC1C,MAAM,EACN,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxD,CAAC,CAAC,IAAI,CACJ,2BAA2B,QAAQ,cAAc,IAAI,mBAAmB,CACzE,CAAC;YAEF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBACzB,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,CAAC,QAAQ,CAAC;aACnB,CAAC;YACF,MAAM,kBAAkB,GAAG,MAAM,oBAAU,CACzC,MAAM,EACN,UAAU,EACV,eAAe,EACf,WAAW,EACX,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;YACF,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CACJ,0BAA0B,QAAQ,cAAc,IAAI,kBAAkB,CACvE,CAAC;SACH;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/api-client.js

@@ -11,54 +11,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path = __importStar(require("path"));
-const core_1 = require("@actions/core");
 const githubUtils = __importStar(require("@actions/github/lib/utils"));
-const retry = __importStar(require("@octokit/plugin-retry"));
 const console_log_level_1 = __importDefault(require("console-log-level"));
-const semver = __importStar(require("semver"));
 const actions_util_1 = require("./actions-util");
-const apiCompatibility = __importStar(require("./api-compatibility.json"));
-const logging_1 = require("./logging");
 const util_1 = require("./util");
 var DisallowedAPIVersionReason;
 (function (DisallowedAPIVersionReason) {
     DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_OLD"] = 0] = "ACTION_TOO_OLD";
     DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_NEW"] = 1] = "ACTION_TOO_NEW";
 })(DisallowedAPIVersionReason = exports.DisallowedAPIVersionReason || (exports.DisallowedAPIVersionReason = {}));
-const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
-const CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR = "CODEQL_ACTION_WARNED_ABOUT_VERSION";
-let hasBeenWarnedAboutVersion = false;
-exports.getApiClient = function (apiDetails, mode, logger, allowLocalRun = false, possibleFailureExpected = false) {
+exports.getApiClient = function (apiDetails, allowLocalRun = false) {
     if (util_1.isLocalRun() && !allowLocalRun) {
         throw new Error("Invalid API call in local run");
     }
-    const customOctokit = githubUtils.GitHub.plugin(retry.retry, (octokit, _) => {
-        octokit.hook.after("request", (response, __) => {
-            if (response.status < 400 && !possibleFailureExpected) {
-                if (hasBeenWarnedAboutVersion) {
-                    return;
-                }
-            }
-            if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined ||
-                process.env[CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR] === undefined) {
-                return;
-            }
-            const installedVersion = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER];
-            const disallowedAPIVersionReason = apiVersionInRange(installedVersion, apiCompatibility.minimumVersion, apiCompatibility.maximumVersion);
-            const toolName = mode === "actions" ? "Action" : "Runner";
-            if (disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_OLD) {
-                logger.warning(`The CodeQL ${toolName} version you are using is too old to be compatible with GitHub Enterprise ${installedVersion}. If you experience issues, please upgrade to a more recent version of the CodeQL ${toolName}.`);
-            }
-            if (disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_NEW) {
-                logger.warning(`GitHub Enterprise ${installedVersion} is too old to be compatible with this version of the CodeQL ${toolName}. If you experience issues, please upgrade to a more recent version of GitHub Enterprise or use an older version of the CodeQL ${toolName}.`);
-            }
-            hasBeenWarnedAboutVersion = true;
-            if (mode === "actions") {
-                core_1.exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
-            }
-        });
-    });
-    return new customOctokit(githubUtils.getOctokitOptions(apiDetails.auth, {
+    return new githubUtils.GitHub(githubUtils.getOctokitOptions(apiDetails.auth, {
         baseUrl: getApiUrl(apiDetails.url),
         userAgent: "CodeQL Action",
         log: console_log_level_1.default({ level: "debug" }),
@@ -66,7 +32,7 @@ exports.getApiClient = function (apiDetails, mode, logger, allowLocalRun = false
 };
 function getApiUrl(githubUrl) {
     const url = new URL(githubUrl);
-    // If we detect this is trying to be to github.com
+    // If we detect this is trying to connect to github.com
     // then return with a fixed canonical URL.
     if (url.hostname === "github.com" || url.hostname === "api.github.com") {
         return "https://api.github.com";
@@ -83,17 +49,7 @@ function getActionsApiClient(allowLocalRun = false) {
         auth: actions_util_1.getRequiredInput("token"),
         url: actions_util_1.getRequiredEnvParam("GITHUB_SERVER_URL"),
     };
-    return exports.getApiClient(apiDetails, "actions", logging_1.getActionsLogger(), allowLocalRun);
+    return exports.getApiClient(apiDetails, allowLocalRun);
 }
 exports.getActionsApiClient = getActionsApiClient;
-function apiVersionInRange(version, minimumVersion, maximumVersion) {
-    if (!semver.satisfies(version, `>=${minimumVersion}`)) {
-        return DisallowedAPIVersionReason.ACTION_TOO_NEW;
-    }
-    if (!semver.satisfies(version, `<=${maximumVersion}`)) {
-        return DisallowedAPIVersionReason.ACTION_TOO_OLD;
-    }
-    return undefined;
-}
-exports.apiVersionInRange = apiVersionInRange;
 //# sourceMappingURL=api-client.js.map

lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6B;AAE7B,wCAA+C;AAC/C,uEAAyD;AACzD,6DAA+C;AAE/C,0EAAgD;AAChD,+CAAiC;AAEjC,iDAAuE;AACvE,2EAA6D;AAC7D,uCAAqD;AACrD,iCAA0C;AAE1C,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAOD,MAAM,gCAAgC,GAAG,6BAA6B,CAAC;AACvE,MAAM,0CAA0C,GAC9C,oCAAoC,CAAC;AACvC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEzB,QAAA,YAAY,GAAG,UAC1B,UAA4B,EAC5B,IAAU,EACV,MAAc,EACd,aAAa,GAAG,KAAK,EACrB,uBAAuB,GAAG,KAAK;IAE/B,IAAI,iBAAU,EAAE,IAAI,CAAC,aAAa,EAAE;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;KAClD;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QAC1E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,QAA8B,EAAE,EAAE,EAAE,EAAE;YACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,uBAAuB,EAAE;gBACrD,IAAI,yBAAyB,EAAE;oBAC7B,OAAO;iBACR;aACF;YACD,IACE,QAAQ,CAAC,OAAO,CAAC,gCAAgC,CAAC,KAAK,SAAS;gBAChE,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,KAAK,SAAS,EACrE;gBACA,OAAO;aACR;YACD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CACvC,gCAAgC,CACvB,CAAC;YACZ,MAAM,0BAA0B,GAAG,iBAAiB,CAClD,gBAAgB,EAChB,gBAAgB,CAAC,cAAc,EAC/B,gBAAgB,CAAC,cAAc,CAChC,CAAC;YAEF,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE1D,IACE,0BAA0B,KAAK,0BAA0B,CAAC,cAAc,EACxE;gBACA,MAAM,CAAC,OAAO,CACZ,cAAc,QAAQ,6EAA6E,gBAAgB,qFAAqF,QAAQ,GAAG,CACpN,CAAC;aACH;YACD,IACE,0BAA0B,KAAK,0BAA0B,CAAC,cAAc,EACxE;gBACA,MAAM,CAAC,OAAO,CACZ,qBAAqB,gBAAgB,gEAAgE,QAAQ,kIAAkI,QAAQ,GAAG,CAC3P,CAAC;aACH;YACD,yBAAyB,GAAG,IAAI,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,EAAE;gBACtB,qBAAc,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;aAClE;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,aAAa,CACtB,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE;QAC7C,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,eAAe;QAC1B,GAAG,EAAE,2BAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,kDAAkD;IAClD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,uFAAuF;AACvF,qFAAqF;AACrF,+CAA+C;AAC/C,SAAgB,mBAAmB,CAAC,aAAa,GAAG,KAAK;IACvD,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,+BAAgB,CAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,kCAAmB,CAAC,mBAAmB,CAAC;KAC9C,CAAC;IAEF,OAAO,oBAAY,CAAC,UAAU,EAAE,SAAS,EAAE,0BAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AAChF,CAAC;AAPD,kDAOC;AAED,SAAgB,iBAAiB,CAC/B,OAAe,EACf,cAAsB,EACtB,cAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,cAAc,EAAE,CAAC,EAAE;QACrD,OAAO,0BAA0B,CAAC,cAAc,CAAC;KAClD;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,cAAc,EAAE,CAAC,EAAE;QACrD,OAAO,0BAA0B,CAAC,cAAc,CAAC;KAClD;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAZD,8CAYC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6B;AAE7B,uEAAyD;AACzD,0EAAgD;AAEhD,iDAAuE;AACvE,iCAAoC;AAEpC,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,+FAAc,CAAA;IACd,+FAAc,CAAA;AAChB,CAAC,EAHW,0BAA0B,GAA1B,kCAA0B,KAA1B,kCAA0B,QAGrC;AAeY,QAAA,YAAY,GAAG,UAC1B,UAA4B,EAC5B,aAAa,GAAG,KAAK;IAErB,IAAI,iBAAU,EAAE,IAAI,CAAC,aAAa,EAAE;QAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;KAClD;IACD,OAAO,IAAI,WAAW,CAAC,MAAM,CAC3B,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE;QAC7C,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAClC,SAAS,EAAE,eAAe;QAC1B,GAAG,EAAE,2BAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,SAAiB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAE/B,uDAAuD;IACvD,0CAA0C;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE;QACtE,OAAO,wBAAwB,CAAC;KACjC;IAED,6BAA6B;IAC7B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,uFAAuF;AACvF,qFAAqF;AACrF,+CAA+C;AAC/C,SAAgB,mBAAmB,CAAC,aAAa,GAAG,KAAK;IACvD,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,+BAAgB,CAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,kCAAmB,CAAC,mBAAmB,CAAC;KAC9C,CAAC;IAEF,OAAO,oBAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAPD,kDAOC"}

lib/api-client.test.js

@@ -1,17 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const ava_1 = __importDefault(require("ava"));
-const api_client_1 = require("./api-client");
-ava_1.default("allowed API versions", async (t) => {
-    t.is(api_client_1.apiVersionInRange("1.33.0", "1.33", "2.0"), undefined);
-    t.is(api_client_1.apiVersionInRange("1.33.1", "1.33", "2.0"), undefined);
-    t.is(api_client_1.apiVersionInRange("1.34.0", "1.33", "2.0"), undefined);
-    t.is(api_client_1.apiVersionInRange("2.0.0", "1.33", "2.0"), undefined);
-    t.is(api_client_1.apiVersionInRange("2.0.1", "1.33", "2.0"), undefined);
-    t.is(api_client_1.apiVersionInRange("1.32.0", "1.33", "2.0"), api_client_1.DisallowedAPIVersionReason.ACTION_TOO_NEW);
-    t.is(api_client_1.apiVersionInRange("2.1.0", "1.33", "2.0"), api_client_1.DisallowedAPIVersionReason.ACTION_TOO_OLD);
-});
-//# sourceMappingURL=api-client.test.js.map

lib/api-client.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-client.test.js","sourceRoot":"","sources":["../src/api-client.test.ts"],"names":[],"mappings":";;;;;AAAA,8CAAuB;AAEvB,6CAA6E;AAE7E,aAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,EAAE,CAAC,8BAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,EAAE,CACF,8BAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAC1C,uCAA0B,CAAC,cAAc,CAC1C,CAAC;IACF,CAAC,CAAC,EAAE,CACF,8BAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EACzC,uCAA0B,CAAC,cAAc,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC"}

lib/codeql.js

@@ -6,6 +6,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     result["default"] = mod;
     return result;
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -14,6 +17,7 @@ const globalutil = __importStar(require("util"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const http = __importStar(require("@actions/http-client"));
 const toolcache = __importStar(require("@actions/tool-cache"));
+const fast_deep_equal_1 = __importDefault(require("fast-deep-equal"));
 const semver = __importStar(require("semver"));
 const uuid_1 = require("uuid");
 const actions_util_1 = require("./actions-util");
@@ -76,7 +80,9 @@ async function getCodeQLBundleDownloadURL(apiDetails, mode, logger) {
     ];
     // We now filter out any duplicates.
     // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
-    const uniqueDownloadSources = potentialDownloadSources.filter((url, index, self) => index === self.indexOf(url));
+    const uniqueDownloadSources = potentialDownloadSources.filter((source, index, self) => {
+        return !self.slice(0, index).some((other) => fast_deep_equal_1.default(source, other));
+    });
     const codeQLBundleName = getCodeQLBundleName();
     for (const downloadSource of uniqueDownloadSources) {
         const [apiURL, repository] = downloadSource;
@@ -87,9 +93,7 @@ async function getCodeQLBundleDownloadURL(apiDetails, mode, logger) {
         }
         const [repositoryOwner, repositoryName] = repository.split("/");
         try {
-            const release = await api
-                .getApiClient(apiDetails, mode, logger, false, true)
-                .repos.getReleaseByTag({
+            const release = await api.getApiClient(apiDetails).repos.getReleaseByTag({
                 owner: repositoryOwner,
                 repo: repositoryName,
                 tag: CODEQL_BUNDLE_VERSION,

lib/config-utils.js

@@ -128,7 +128,7 @@ async function addLocalQueries(codeQL, resultMap, localQueryPath, checkoutPath,
 /**
  * Retrieve the set of queries at the referenced remote repo and add them to resultMap.
  */
-async function addRemoteQueries(codeQL, resultMap, queryUses, tempDir, githubUrl, logger, configFile) {
+async function addRemoteQueries(codeQL, resultMap, queryUses, tempDir, apiDetails, logger, configFile) {
     let tok = queryUses.split("@");
     if (tok.length !== 2) {
         throw new Error(getQueryUsesInvalid(configFile, queryUses));
@@ -147,7 +147,7 @@ async function addRemoteQueries(codeQL, resultMap, queryUses, tempDir, githubUrl
     }
     const nwo = `${tok[0]}/${tok[1]}`;
     // Checkout the external repository
-    const checkoutPath = await externalQueries.checkoutExternalRepository(nwo, ref, githubUrl, tempDir, logger);
+    const checkoutPath = await externalQueries.checkoutExternalRepository(nwo, ref, apiDetails, tempDir, logger);
     const queryPath = tok.length > 2
         ? path.join(checkoutPath, tok.slice(2).join("/"))
         : checkoutPath;
@@ -161,7 +161,7 @@ async function addRemoteQueries(codeQL, resultMap, queryUses, tempDir, githubUrl
  * local paths starting with './', or references to remote repos, or
  * a finite set of hardcoded terms for builtin suites.
  */
-async function parseQueryUses(languages, codeQL, resultMap, queryUses, tempDir, checkoutPath, githubUrl, logger, configFile) {
+async function parseQueryUses(languages, codeQL, resultMap, queryUses, tempDir, checkoutPath, apiDetails, logger, configFile) {
     queryUses = queryUses.trim();
     if (queryUses === "") {
         throw new Error(getQueryUsesInvalid(configFile));
@@ -177,7 +177,7 @@ async function parseQueryUses(languages, codeQL, resultMap, queryUses, tempDir,
         return;
     }
     // Otherwise, must be a reference to another repo
-    await addRemoteQueries(codeQL, resultMap, queryUses, tempDir, githubUrl, logger, configFile);
+    await addRemoteQueries(codeQL, resultMap, queryUses, tempDir, apiDetails, logger, configFile);
 }
 // Regex validating stars in paths or paths-ignore entries.
 // The intention is to only allow ** to appear when immediately
@@ -301,10 +301,10 @@ exports.getUnknownLanguagesError = getUnknownLanguagesError;
 /**
  * Gets the set of languages in the current repository
  */
-async function getLanguagesInRepo(repository, apiDetails, mode, logger) {
+async function getLanguagesInRepo(repository, apiDetails, logger) {
     logger.debug(`GitHub repo ${repository.owner} ${repository.repo}`);
     const response = await api
-        .getApiClient(apiDetails, mode, logger, true)
+        .getApiClient(apiDetails, true)
         .repos.listLanguages({
         owner: repository.owner,
         repo: repository.repo,
@@ -333,7 +333,7 @@ async function getLanguagesInRepo(repository, apiDetails, mode, logger) {
  * If no languages could be detected from either the workflow or the repository
  * then throw an error.
  */
-async function getLanguages(languagesInput, repository, apiDetails, mode, logger) {
+async function getLanguages(languagesInput, repository, apiDetails, logger) {
     // Obtain from action input 'languages' if set
     let languages = (languagesInput || "")
         .split(",")
@@ -342,7 +342,7 @@ async function getLanguages(languagesInput, repository, apiDetails, mode, logger
     logger.info(`Languages from configuration: ${JSON.stringify(languages)}`);
     if (languages.length === 0) {
         // Obtain languages as all languages in the repo that can be analysed
-        languages = await getLanguagesInRepo(repository, apiDetails, mode, logger);
+        languages = await getLanguagesInRepo(repository, apiDetails, logger);
         logger.info(`Automatically detected languages: ${JSON.stringify(languages)}`);
     }
     // If the languages parameter was not given and no languages were
@@ -367,12 +367,12 @@ async function getLanguages(languagesInput, repository, apiDetails, mode, logger
     }
     return parsedLanguages;
 }
-async function addQueriesFromWorkflow(codeQL, queriesInput, languages, resultMap, tempDir, checkoutPath, githubUrl, logger) {
+async function addQueriesFromWorkflow(codeQL, queriesInput, languages, resultMap, tempDir, checkoutPath, apiDetails, logger) {
     queriesInput = queriesInput.trim();
     // "+" means "don't override config file" - see shouldAddConfigFileQueries
     queriesInput = queriesInput.replace(/^\+/, "");
     for (const query of queriesInput.split(",")) {
-        await parseQueryUses(languages, codeQL, resultMap, query, tempDir, checkoutPath, githubUrl, logger);
+        await parseQueryUses(languages, codeQL, resultMap, query, tempDir, checkoutPath, apiDetails, logger);
     }
 }
 // Returns true if either no queries were provided in the workflow.
@@ -388,12 +388,12 @@ function shouldAddConfigFileQueries(queriesInput) {
 /**
  * Get the default config for when the user has not supplied one.
  */
-async function getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
-    const languages = await getLanguages(languagesInput, repository, apiDetails, mode, logger);
+async function getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, gitHubVersion, apiDetails, logger) {
+    const languages = await getLanguages(languagesInput, repository, apiDetails, logger);
     const queries = {};
     await addDefaultQueries(codeQL, languages, queries);
     if (queriesInput) {
-        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, apiDetails.url, logger);
+        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, apiDetails, logger);
     }
     return {
         languages,
@@ -404,13 +404,14 @@ async function getDefaultConfig(languagesInput, queriesInput, repository, tempDi
         tempDir,
         toolCacheDir,
         codeQLCmd: codeQL.getPath(),
+        gitHubVersion,
     };
 }
 exports.getDefaultConfig = getDefaultConfig;
 /**
  * Load the config from the given file.
  */
-async function loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
+async function loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, gitHubVersion, apiDetails, logger) {
     let parsedYAML;
     if (isLocal(configFile)) {
         // Treat the config file as relative to the workspace
@@ -418,7 +419,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
         parsedYAML = getLocalConfig(configFile, checkoutPath);
     }
     else {
-        parsedYAML = await getRemoteConfig(configFile, apiDetails, mode, logger);
+        parsedYAML = await getRemoteConfig(configFile, apiDetails);
     }
     // Validate that the 'name' property is syntactically correct,
     // even though we don't use the value yet.
@@ -430,7 +431,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
             throw new Error(getNameInvalid(configFile));
         }
     }
-    const languages = await getLanguages(languagesInput, repository, apiDetails, mode, logger);
+    const languages = await getLanguages(languagesInput, repository, apiDetails, logger);
     const queries = {};
     const pathsIgnore = [];
     const paths = [];
@@ -449,7 +450,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
     // unless they're prefixed with "+", in which case they supplement those
     // in the config file.
     if (queriesInput) {
-        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, apiDetails.url, logger);
+        await addQueriesFromWorkflow(codeQL, queriesInput, languages, queries, tempDir, checkoutPath, apiDetails, logger);
     }
     if (shouldAddConfigFileQueries(queriesInput) &&
         QUERIES_PROPERTY in parsedYAML) {
@@ -461,7 +462,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
                 typeof query[QUERIES_USES_PROPERTY] !== "string") {
                 throw new Error(getQueryUsesInvalid(configFile));
             }
-            await parseQueryUses(languages, codeQL, queries, query[QUERIES_USES_PROPERTY], tempDir, checkoutPath, apiDetails.url, logger, configFile);
+            await parseQueryUses(languages, codeQL, queries, query[QUERIES_USES_PROPERTY], tempDir, checkoutPath, apiDetails, logger, configFile);
         }
     }
     if (PATHS_IGNORE_PROPERTY in parsedYAML) {
@@ -505,6 +506,7 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
         tempDir,
         toolCacheDir,
         codeQLCmd: codeQL.getPath(),
+        gitHubVersion,
     };
 }
 /**
@@ -513,15 +515,15 @@ async function loadConfig(languagesInput, queriesInput, configFile, repository,
  * This will parse the config from the user input if present, or generate
  * a default config. The parsed config is then stored to a known location.
  */
-async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
+async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, gitHubVersion, apiDetails, logger) {
     let config;
     // If no config file was provided create an empty one
     if (!configFile) {
         logger.debug("No configuration file was provided");
-        config = await getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger);
+        config = await getDefaultConfig(languagesInput, queriesInput, repository, tempDir, toolCacheDir, codeQL, checkoutPath, gitHubVersion, apiDetails, logger);
     }
     else {
-        config = await loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger);
+        config = await loadConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, gitHubVersion, apiDetails, logger);
     }
     // Save the config so we can easily access it again in the future
     await saveConfig(config, logger);
@@ -546,7 +548,7 @@ function getLocalConfig(configFile, checkoutPath) {
     }
     return yaml.safeLoad(fs.readFileSync(configFile, "utf8"));
 }
-async function getRemoteConfig(configFile, apiDetails, mode, logger) {
+async function getRemoteConfig(configFile, apiDetails) {
     // retrieve the various parts of the config location, and ensure they're present
     const format = new RegExp("(?<owner>[^/]+)/(?<repo>[^/]+)/(?<path>[^@]+)@(?<ref>.*)");
     const pieces = format.exec(configFile);
@@ -554,9 +556,7 @@ async function getRemoteConfig(configFile, apiDetails, mode, logger) {
     if (pieces === null || pieces.groups === undefined || pieces.length < 5) {
         throw new Error(getConfigFileRepoFormatInvalidMessage(configFile));
     }
-    const response = await api
-        .getApiClient(apiDetails, mode, logger, true)
-        .repos.getContent({
+    const response = await api.getApiClient(apiDetails, true).repos.getContent({
         owner: pieces.groups.owner,
         repo: pieces.groups.repo,
         path: pieces.groups.path,

lib/config-utils.test.js

@@ -25,8 +25,10 @@ const util = __importStar(require("./util"));
 testing_utils_1.setupTests(ava_1.default);
 const sampleApiDetails = {
     auth: "token",
+    externalRepoAuth: "token",
     url: "https://github.example.com",
 };
+const gitHubVersion = { type: "dotcom" };
 // Returns the filepath of the newly-created file
 function createConfigFile(inputFileContents, tmpDir) {
     const configFilePath = path.join(tmpDir, "input");
@@ -70,8 +72,8 @@ ava_1.default("load empty config", async (t) => {
                 };
             },
         });
-        const config = await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logger);
-        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logger));
+        const config = await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logger);
+        t.deepEqual(config, await configUtils.getDefaultConfig(languages, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logger));
     });
 });
 ava_1.default("loading config saves config", async (t) => {
@@ -90,7 +92,7 @@ ava_1.default("loading config saves config", async (t) => {
         t.false(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // Sanity check that getConfig returns undefined before we have called initConfig
         t.deepEqual(await configUtils.getConfig(tmpDir, logger), undefined);
-        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logger);
+        const config1 = await configUtils.initConfig("javascript,python", undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logger);
         // The saved config file should now exist
         t.true(fs.existsSync(configUtils.getPathToParsedConfigFile(tmpDir)));
         // And that same newly-initialised config should now be returned by getConfig
@@ -101,7 +103,7 @@ ava_1.default("loading config saves config", async (t) => {
 ava_1.default("load input outside of workspace", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         try {
-            await configUtils.initConfig(undefined, undefined, "../input", { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, "../input", { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -114,7 +116,7 @@ ava_1.default("load non-local input with invalid repo syntax", async (t) => {
         // no filename given, just a repo
         const configFile = "octo-org/codeql-config@main";
         try {
-            await configUtils.initConfig(undefined, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -128,7 +130,7 @@ ava_1.default("load non-existent input", async (t) => {
         const configFile = "input";
         t.false(fs.existsSync(path.join(tmpDir, configFile)));
         try {
-            await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -185,10 +187,11 @@ ava_1.default("load non-empty input", async (t) => {
             tempDir: tmpDir,
             toolCacheDir: tmpDir,
             codeQLCmd: codeQL.getPath(),
+            gitHubVersion,
         };
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        const actualConfig = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        const actualConfig = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         // Should exactly equal the object we constructed earlier
         t.deepEqual(actualConfig, expectedConfig);
     });
@@ -224,7 +227,7 @@ ava_1.default("Default queries are used", async (t) => {
         fs.mkdirSync(path.join(tmpDir, "foo"));
         const languages = "javascript";
         const configFilePath = createConfigFile(inputFileContents, tmpDir);
-        await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         // Check resolve queries was called correctly
         t.deepEqual(resolveQueriesArgs.length, 1);
         t.deepEqual(resolveQueriesArgs[0].queries, [
@@ -267,7 +270,7 @@ ava_1.default("Queries can be specified in config file", async (t) => {
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, undefined, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries
         // and once for `./foo` from the config file.
@@ -300,7 +303,7 @@ ava_1.default("Queries from config file can be overridden in workflow file", asy
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries and once for `./override`,
         // but won't be called for './foo' from the config file.
@@ -332,7 +335,7 @@ ava_1.default("Queries in workflow file can be used in tandem with the 'disable
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for `./workflow-query`,
         // but won't be called for the default one since that was disabled
@@ -358,7 +361,7 @@ ava_1.default("Multiple queries can be specified in workflow file, no config fil
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly:
         // It'll be called once for the default queries,
         // and then once for each of the two queries from the workflow
@@ -397,7 +400,7 @@ ava_1.default("Queries in workflow file can be added to the set of queries witho
             },
         });
         const languages = "javascript";
-        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        const config = await configUtils.initConfig(languages, testQueries, configFilePath, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         // Check resolveQueries was called correctly
         // It'll be called once for the default queries,
         // once for each of additional1 and additional2,
@@ -425,7 +428,7 @@ ava_1.default("Invalid queries in workflow file handled correctly", async (t) =>
         // This function just needs to be type-correct; it doesn't need to do anything,
         // since we're deliberately passing in invalid data
         const codeQL = codeql_1.setCodeQL({
-            async resolveQueries(_queries, _extraSearchPath) {
+            async resolveQueries() {
                 return {
                     byLanguage: {
                         javascript: {},
@@ -436,7 +439,7 @@ ava_1.default("Invalid queries in workflow file handled correctly", async (t) =>
             },
         });
         try {
-            await configUtils.initConfig(languages, queries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(languages, queries, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             t.fail("initConfig did not throw error");
         }
         catch (err) {
@@ -479,7 +482,7 @@ ava_1.default("API client used when reading remote config", async (t) => {
         fs.mkdirSync(path.join(tmpDir, "foo/bar/dev"), { recursive: true });
         const configFile = "octo-org/codeql-config/config.yaml@main";
         const languages = "javascript";
-        await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+        await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
         t.assert(spyGetContents.called);
     });
 });
@@ -489,7 +492,7 @@ ava_1.default("Remote config handles the case where a directory is provided", as
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -505,7 +508,7 @@ ava_1.default("Invalid format of remote config handled correctly", async (t) =>
         mockGetContents(dummyResponse);
         const repoReference = "octo-org/codeql-config/config.yaml@main";
         try {
-            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, repoReference, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -517,7 +520,7 @@ ava_1.default("No detected languages", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         mockListLanguages([]);
         try {
-            await configUtils.initConfig(undefined, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(undefined, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -529,7 +532,7 @@ ava_1.default("Unknown languages", async (t) => {
     return await util.withTmpDir(async (tmpDir) => {
         const languages = "ruby,english";
         try {
-            await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+            await configUtils.initConfig(languages, undefined, undefined, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeql_1.getCachedCodeQL(), tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
             throw new Error("initConfig did not throw error");
         }
         catch (err) {
@@ -554,7 +557,7 @@ function doInvalidInputTest(testName, inputFileContents, expectedErrorMessageGen
             const inputFile = path.join(tmpDir, configFile);
             fs.writeFileSync(inputFile, inputFileContents, "utf8");
             try {
-                await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, sampleApiDetails, "runner", logging_1.getRunnerLogger(true));
+                await configUtils.initConfig(languages, undefined, configFile, { owner: "github", repo: "example " }, tmpDir, tmpDir, codeQL, tmpDir, gitHubVersion, sampleApiDetails, logging_1.getRunnerLogger(true));
                 throw new Error("initConfig did not throw error");
             }
             catch (err) {

lib/defaults.json

@@ -1,3 +1,3 @@
 {
-    "bundleVersion": "codeql-bundle-20201127"
+    "bundleVersion": "codeql-bundle-20210127"
 }

lib/external-queries.js

@@ -14,7 +14,7 @@ const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 /**
  * Check out repository at the given ref, and return the directory of the checkout.
  */
-async function checkoutExternalRepository(repository, ref, githubUrl, tempDir, logger) {
+async function checkoutExternalRepository(repository, ref, apiDetails, tempDir, logger) {
     logger.info(`Checking out ${repository}`);
     const checkoutLocation = path.join(tempDir, repository, ref);
     if (!checkoutLocation.startsWith(tempDir)) {
@@ -22,10 +22,10 @@ async function checkoutExternalRepository(repository, ref, githubUrl, tempDir, l
         throw new Error(`'${repository}@${ref}' is not a valid repository and reference.`);
     }
     if (!fs.existsSync(checkoutLocation)) {
-        const repoURL = `${githubUrl}/${repository}`;
+        const repoCloneURL = buildCheckoutURL(repository, apiDetails);
         await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
             "clone",
-            repoURL,
+            repoCloneURL,
             checkoutLocation,
         ]).exec();
         await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
@@ -38,4 +38,17 @@ async function checkoutExternalRepository(repository, ref, githubUrl, tempDir, l
     return checkoutLocation;
 }
 exports.checkoutExternalRepository = checkoutExternalRepository;
+function buildCheckoutURL(repository, apiDetails) {
+    const repoCloneURL = new URL(apiDetails.url);
+    if (apiDetails.externalRepoAuth !== undefined) {
+        repoCloneURL.username = "x-access-token";
+        repoCloneURL.password = apiDetails.externalRepoAuth;
+    }
+    if (!repoCloneURL.pathname.endsWith("/")) {
+        repoCloneURL.pathname += "/";
+    }
+    repoCloneURL.pathname += `${repository}`;
+    return repoCloneURL.toString();
+}
+exports.buildCheckoutURL = buildCheckoutURL;
 //# sourceMappingURL=external-queries.js.map

lib/external-queries.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAIpD;;GAEG;AACI,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,OAAe,EACf,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAE1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACzC,wGAAwG;QACxG,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,IAAI,GAAG,4CAA4C,CAClE,CAAC;KACH;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;QACpC,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,OAAO;YACP,OAAO;YACP,gBAAgB;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,eAAe,gBAAgB,EAAE;YACjC,aAAa,gBAAgB,OAAO;YACpC,UAAU;YACV,GAAG;SACJ,CAAC,CAAC,IAAI,EAAE,CAAC;KACX;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAlCD,gEAkCC"}
+{"version":3,"file":"external-queries.js","sourceRoot":"","sources":["../src/external-queries.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAKpD;;GAEG;AACI,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,GAAW,EACX,UAAwC,EACxC,OAAe,EACf,MAAc;IAEd,MAAM,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAE1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACzC,wGAAwG;QACxG,MAAM,IAAI,KAAK,CACb,IAAI,UAAU,IAAI,GAAG,4CAA4C,CAClE,CAAC;KACH;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE;QACpC,MAAM,YAAY,GAAG,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,OAAO;YACP,YAAY;YACZ,gBAAgB;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YAChE,eAAe,gBAAgB,EAAE;YACjC,aAAa,gBAAgB,OAAO;YACpC,UAAU;YACV,GAAG;SACJ,CAAC,CAAC,IAAI,EAAE,CAAC;KACX;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAlCD,gEAkCC;AAED,SAAgB,gBAAgB,CAC9B,UAAkB,EAClB,UAAwC;IAExC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS,EAAE;QAC7C,YAAY,CAAC,QAAQ,GAAG,gBAAgB,CAAC;QACzC,YAAY,CAAC,QAAQ,GAAG,UAAU,CAAC,gBAAgB,CAAC;KACrD;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;QACxC,YAAY,CAAC,QAAQ,IAAI,GAAG,CAAC;KAC9B;IACD,YAAY,CAAC,QAAQ,IAAI,GAAG,UAAU,EAAE,CAAC;IACzC,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC;AACjC,CAAC;AAdD,4CAcC"}

lib/external-queries.test.js

@@ -81,17 +81,35 @@ ava_1.default("checkoutExternalQueries", async (t) => {
         const commit2Sha = await runGit(["rev-parse", "HEAD"]);
         // Checkout the first commit, which should contain 'a' and 'b'
         t.false(fs.existsSync(path.join(tmpDir, repoName)));
-        await externalQueries.checkoutExternalRepository(repoName, commit1Sha, `file://${testRepoBaseDir}`, tmpDir, logging_1.getRunnerLogger(true));
+        await externalQueries.checkoutExternalRepository(repoName, commit1Sha, { url: `file://${testRepoBaseDir}`, externalRepoAuth: "" }, tmpDir, logging_1.getRunnerLogger(true));
         t.true(fs.existsSync(path.join(tmpDir, repoName)));
         t.true(fs.existsSync(path.join(tmpDir, repoName, commit1Sha)));
         t.true(fs.existsSync(path.join(tmpDir, repoName, commit1Sha, "a")));
         t.true(fs.existsSync(path.join(tmpDir, repoName, commit1Sha, "b")));
         // Checkout the second commit as well, which should only contain 'a'
         t.false(fs.existsSync(path.join(tmpDir, repoName, commit2Sha)));
-        await externalQueries.checkoutExternalRepository(repoName, commit2Sha, `file://${testRepoBaseDir}`, tmpDir, logging_1.getRunnerLogger(true));
+        await externalQueries.checkoutExternalRepository(repoName, commit2Sha, { url: `file://${testRepoBaseDir}`, externalRepoAuth: "" }, tmpDir, logging_1.getRunnerLogger(true));
         t.true(fs.existsSync(path.join(tmpDir, repoName, commit2Sha)));
         t.true(fs.existsSync(path.join(tmpDir, repoName, commit2Sha, "a")));
         t.false(fs.existsSync(path.join(tmpDir, repoName, commit2Sha, "b")));
     });
 });
+ava_1.default("buildCheckoutURL", (t) => {
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.com",
+        externalRepoAuth: undefined,
+    }), "https://github.com/foo/bar");
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.example.com/",
+        externalRepoAuth: undefined,
+    }), "https://github.example.com/foo/bar");
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.com",
+        externalRepoAuth: "abc",
+    }), "https://x-access-token:abc@github.com/foo/bar");
+    t.deepEqual(externalQueries.buildCheckoutURL("foo/bar", {
+        url: "https://github.example.com/",
+        externalRepoAuth: "abc",
+    }), "https://x-access-token:abc@github.example.com/foo/bar");
+});
 //# sourceMappingURL=external-queries.test.js.map

lib/external-queries.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AACpD,8CAAuB;AAEvB,oEAAsD;AACtD,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,kDAAkD;QAClD,mFAAmF;QACnF,gDAAgD;QAChD,wCAAwC;QACxC,8EAA8E;QAC9E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE/C,oDAAoD;QACpD,oCAAoC;QACpC,2DAA2D;QAC3D,MAAM,MAAM,GAAG,KAAK,WAAW,OAAiB;YAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG;gBACR,aAAa,UAAU,EAAE;gBACzB,eAAe,QAAQ,EAAE;gBACzB,GAAG,OAAO;aACX,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI;gBACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAChC,OAAO,EACP;oBACE,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE;wBACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;wBACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;qBACF;iBACF,CACF,CAAC,IAAI,EAAE,CAAC;aACV;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,CAAC;aACT;YACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QAEF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAE1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,8DAA8D;QAC9D,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,UAAU,eAAe,EAAE,EAC3B,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpE,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,UAAU,eAAe,EAAE,EAC3B,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"external-queries.test.js","sourceRoot":"","sources":["../src/external-queries.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AACpD,8CAAuB;AAEvB,oEAAsD;AACtD,uCAA4C;AAC5C,mDAA6C;AAC7C,6CAA+B;AAE/B,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACrC,kDAAkD;QAClD,mFAAmF;QACnF,gDAAgD;QAChD,wCAAwC;QACxC,8EAA8E;QAC9E,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE/C,oDAAoD;QACpD,oCAAoC;QACpC,2DAA2D;QAC3D,MAAM,MAAM,GAAG,KAAK,WAAW,OAAiB;YAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG;gBACR,aAAa,UAAU,EAAE;gBACzB,eAAe,QAAQ,EAAE;gBACzB,GAAG,OAAO;aACX,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjD,IAAI;gBACF,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAChC,OAAO,EACP;oBACE,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE;wBACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;wBACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;4BACf,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC5B,CAAC;qBACF;iBACF,CACF,CAAC,IAAI,EAAE,CAAC;aACV;YAAC,OAAO,CAAC,EAAE;gBACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,CAAC;aACT;YACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC,CAAC;QAEF,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAE1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvD,8DAA8D;QAC9D,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,EAAE,GAAG,EAAE,UAAU,eAAe,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAC1D,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpE,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,eAAe,CAAC,0BAA0B,CAC9C,QAAQ,EACR,UAAU,EACV,EAAE,GAAG,EAAE,UAAU,eAAe,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAC1D,MAAM,EACN,yBAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;IAC7B,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,oBAAoB;QACzB,gBAAgB,EAAE,SAAS;KAC5B,CAAC,EACF,4BAA4B,CAC7B,CAAC;IACF,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,6BAA6B;QAClC,gBAAgB,EAAE,SAAS;KAC5B,CAAC,EACF,oCAAoC,CACrC,CAAC;IAEF,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,oBAAoB;QACzB,gBAAgB,EAAE,KAAK;KACxB,CAAC,EACF,+CAA+C,CAChD,CAAC;IACF,CAAC,CAAC,SAAS,CACT,eAAe,CAAC,gBAAgB,CAAC,SAAS,EAAE;QAC1C,GAAG,EAAE,6BAA6B;QAClC,gBAAgB,EAAE,KAAK;KACxB,CAAC,EACF,uDAAuD,CACxD,CAAC;AACJ,CAAC,CAAC,CAAC"}

lib/init-action.js

@@ -13,6 +13,7 @@ const init_1 = require("./init");
 const languages_1 = require("./languages");
 const logging_1 = require("./logging");
 const repository_1 = require("./repository");
+const util_1 = require("./util");
 async function sendSuccessStatusReport(startedAt, config, toolsVersion) {
     var _a;
     const statusReportBase = await actionsUtil.createStatusReportBase("init", "success", startedAt);
@@ -53,23 +54,25 @@ async function run() {
     let config;
     let codeql;
     let toolsVersion;
+    const apiDetails = {
+        auth: actionsUtil.getRequiredInput("token"),
+        externalRepoAuth: actionsUtil.getOptionalInput("external-repository-token"),
+        url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
+    };
+    const gitHubVersion = await util_1.getGitHubVersion(apiDetails);
+    if (gitHubVersion !== undefined) {
+        util_1.checkGitHubVersionInRange(gitHubVersion, "actions", logger);
+    }
     try {
         actionsUtil.prepareLocalRunEnvironment();
-        const workflowErrors = await actionsUtil.getWorkflowErrors();
-        if (workflowErrors.length > 0) {
-            core.warning(actionsUtil.formatWorkflowErrors(workflowErrors));
-        }
-        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("init", "starting", startedAt, actionsUtil.formatWorkflowCause(workflowErrors))))) {
+        const workflowErrors = await actionsUtil.validateWorkflow();
+        if (!(await actionsUtil.sendStatusReport(await actionsUtil.createStatusReportBase("init", "starting", startedAt, workflowErrors)))) {
             return;
         }
-        const apiDetails = {
-            auth: actionsUtil.getRequiredInput("token"),
-            url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
-        };
         const initCodeQLResult = await init_1.initCodeQL(actionsUtil.getOptionalInput("tools"), apiDetails, actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"), "actions", logger);
         codeql = initCodeQLResult.codeql;
         toolsVersion = initCodeQLResult.toolsVersion;
-        config = await init_1.initConfig(actionsUtil.getOptionalInput("languages"), actionsUtil.getOptionalInput("queries"), actionsUtil.getOptionalInput("config-file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"), codeql, actionsUtil.getRequiredEnvParam("GITHUB_WORKSPACE"), apiDetails, "actions", logger);
+        config = await init_1.initConfig(actionsUtil.getOptionalInput("languages"), actionsUtil.getOptionalInput("queries"), actionsUtil.getOptionalInput("config-file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), actionsUtil.getRequiredEnvParam("RUNNER_TEMP"), actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"), codeql, actionsUtil.getRequiredEnvParam("GITHUB_WORKSPACE"), gitHubVersion, apiDetails, logger);
         if (config.languages.includes(languages_1.Language.python) &&
             actionsUtil.getRequiredInput("setup-python-dependencies") === "true") {
             try {

lib/init-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"init-action.js","sourceRoot":"","sources":["../src/init-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAG9C,iCAMgB;AAChB,2CAAuC;AACvC,uCAA6C;AAC7C,6CAAkD;AAsBlD,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,MAA0B,EAC1B,YAAoB;;IAEpB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,MAAM,EACN,SAAS,EACT,SAAS,CACV,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACvE,GAAG,CACJ,CAAC;IACF,MAAM,qBAAqB,GAAG,MAAM,CAAC,iBAAiB,CACpD,yBAAyB,CAC1B;QACC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY,SAAG,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,0CAAE,IAAI,EAAE,CAAC;IACnE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QAC9D,OAAO,CAAC,IAAI,CACV,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/D,CAAC;KACH;IACD,IAAI,YAAY,KAAK,SAAS,EAAE;QAC9B,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YACzC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACxB,CAAC,CAAC,YAAY,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C;IAED,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,SAAS;QACT,kBAAkB,EAAE,iBAAiB,IAAI,EAAE;QAC3C,KAAK;QACL,YAAY,EAAE,WAAW;QACzB,uBAAuB,EAAE,qBAAqB;QAC9C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,WAAW,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE;QACxD,sBAAsB,EAAE,YAAY;KACrC,CAAC;IAEF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,IAAI,MAAc,CAAC;IACnB,IAAI,YAAoB,CAAC;IAEzB,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QAEzC,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,iBAAiB,EAAE,CAAC;QAE7D,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;SAChE;QAED,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAChD,CACF,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QAEF,MAAM,gBAAgB,GAAG,MAAM,iBAAU,CACvC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,UAAU,EACV,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;QACjC,YAAY,GAAG,gBAAgB,CAAC,YAAY,CAAC;QAE7C,MAAM,GAAG,MAAM,iBAAU,CACvB,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,EACzC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EACvC,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAC3C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,MAAM,EACN,WAAW,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EACnD,UAAU,EACV,SAAS,EACT,MAAM,CACP,CAAC;QAEF,IACE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAQ,CAAC,MAAM,CAAC;YAC1C,WAAW,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,KAAK,MAAM,EACpE;YACA,IAAI;gBACF,MAAM,wBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,CAAC,OAAO,CACZ,GAAG,GAAG,CAAC,OAAO,2FAA2F,CAC1G,CAAC;aACH;SACF;KACF;IAAC,OAAO,CAAC,EAAE;QACV,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,CAAC,CAAC,OAAO,CACV,CACF,CAAC;QACF,OAAO;KACR;IAED,IAAI;QACF,mBAAmB;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE;YACX,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,CACV,6GAA6G,CAC9G,CAAC;SACH;QAED,mGAAmG;QACnG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAE7C,MAAM,YAAY,GAAG,MAAM,cAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,SAAS,EAAE;YAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBAC3D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;aACjC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,0BAAmB,CACvB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,MAAM,EACN,YAAY,CACb,CAAC;aACH;SACF;QAED,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;KACjD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;IACD,MAAM,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"init-action.js","sourceRoot":"","sources":["../src/init-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAG9C,iCAMgB;AAChB,2CAAuC;AACvC,uCAA6C;AAC7C,6CAAkD;AAClD,iCAAqE;AAsBrE,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,MAA0B,EAC1B,YAAoB;;IAEpB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,MAAM,EACN,SAAS,EACT,SAAS,CACV,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACvE,GAAG,CACJ,CAAC;IACF,MAAM,qBAAqB,GAAG,MAAM,CAAC,iBAAiB,CACpD,yBAAyB,CAC1B;QACC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY,SAAG,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,0CAAE,IAAI,EAAE,CAAC;IACnE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QAC9D,OAAO,CAAC,IAAI,CACV,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC/D,CAAC;KACH;IACD,IAAI,YAAY,KAAK,SAAS,EAAE;QAC9B,YAAY,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YACzC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACxB,CAAC,CAAC,YAAY,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1C;IAED,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,SAAS;QACT,kBAAkB,EAAE,iBAAiB,IAAI,EAAE;QAC3C,KAAK;QACL,YAAY,EAAE,WAAW;QACzB,uBAAuB,EAAE,qBAAqB;QAC9C,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,WAAW,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE;QACxD,sBAAsB,EAAE,YAAY;KACrC,CAAC;IAEF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,0BAAgB,EAAE,CAAC;IAClC,IAAI,MAA0B,CAAC;IAC/B,IAAI,MAAc,CAAC;IACnB,IAAI,YAAoB,CAAC;IAEzB,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAC3C,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAC3E,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;KAC1D,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,uBAAgB,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,aAAa,KAAK,SAAS,EAAE;QAC/B,gCAAyB,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;KAC7D;IAED,IAAI;QACF,WAAW,CAAC,0BAA0B,EAAE,CAAC;QAEzC,MAAM,cAAc,GAAG,MAAM,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAE5D,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,UAAU,EACV,SAAS,EACT,cAAc,CACf,CACF,CAAC,EACF;YACA,OAAO;SACR;QAED,MAAM,gBAAgB,GAAG,MAAM,iBAAU,CACvC,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,EACrC,UAAU,EACV,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC;QACjC,YAAY,GAAG,gBAAgB,CAAC,YAAY,CAAC;QAE7C,MAAM,GAAG,MAAM,iBAAU,CACvB,WAAW,CAAC,gBAAgB,CAAC,WAAW,CAAC,EACzC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,EACvC,WAAW,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAC3C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,WAAW,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAC9C,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,EACpD,MAAM,EACN,WAAW,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,EACnD,aAAa,EACb,UAAU,EACV,MAAM,CACP,CAAC;QAEF,IACE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,oBAAQ,CAAC,MAAM,CAAC;YAC1C,WAAW,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,KAAK,MAAM,EACpE;YACA,IAAI;gBACF,MAAM,wBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,CAAC,OAAO,CACZ,GAAG,GAAG,CAAC,OAAO,2FAA2F,CAC1G,CAAC;aACH;SACF;KACF;IAAC,OAAO,CAAC,EAAE;QACV,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,CAAC,CAAC,OAAO,CACV,CACF,CAAC;QACF,OAAO;KACR;IAED,IAAI;QACF,mBAAmB;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE;YACX,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,CACV,6GAA6G,CAC9G,CAAC;SACH;QAED,mGAAmG;QACnG,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAE7C,MAAM,YAAY,GAAG,MAAM,cAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,SAAS,EAAE;YAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE;gBAC3D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;aACjC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,0BAAmB,CACvB,mBAAmB,EACnB,SAAS,EACT,MAAM,EACN,MAAM,EACN,YAAY,CACb,CAAC;aACH;SACF;QAED,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;KACjD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,MAAM,EACN,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;IACD,MAAM,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/init.js

@@ -24,9 +24,9 @@ async function initCodeQL(codeqlURL, apiDetails, tempDir, toolsDir, mode, logger
     return { codeql, toolsVersion };
 }
 exports.initCodeQL = initCodeQL;
-async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger) {
+async function initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, gitHubVersion, apiDetails, logger) {
     logger.startGroup("Load language configuration");
-    const config = await configUtils.initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, apiDetails, mode, logger);
+    const config = await configUtils.initConfig(languagesInput, queriesInput, configFile, repository, tempDir, toolCacheDir, codeQL, checkoutPath, gitHubVersion, apiDetails, logger);
     analysisPaths.printPathFiltersWarning(config, logger);
     logger.endGroup();
     return config;

lib/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAEpD,gEAAkD;AAElD,qCAA+C;AAC/C,4DAA8C;AAG9C,mDAAwE;AACxE,6CAA+B;AAExB,KAAK,UAAU,UAAU,CAC9B,SAA6B,EAC7B,UAA4B,EAC5B,OAAe,EACf,QAAgB,EAChB,IAAe,EACf,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAW,CAChD,SAAS,EACT,UAAU,EACV,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,MAAM,CACP,CAAC;IACF,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC;AApBD,gCAoBC;AAEM,KAAK,UAAU,UAAU,CAC9B,cAAkC,EAClC,YAAgC,EAChC,UAA8B,EAC9B,UAAyB,EACzB,OAAe,EACf,YAAoB,EACpB,MAAc,EACd,YAAoB,EACpB,UAA4B,EAC5B,IAAe,EACf,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,cAAc,EACd,YAAY,EACZ,UAAU,EACV,UAAU,EACV,OAAO,EACP,YAAY,EACZ,MAAM,EACN,YAAY,EACZ,UAAU,EACV,IAAI,EACJ,MAAM,CACP,CAAC;IACF,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AA9BD,gCA8BC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAElC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9E,sEAAsE;IACtE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,yBAAyB;QACzB,MAAM,MAAM,CAAC,YAAY,CACvB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,EACR,UAAU,CACX,CAAC;KACH;IAED,OAAO,MAAM,uCAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAnBD,0BAmBC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+CAA+C;AACxC,KAAK,UAAU,mBAAmB,CACvC,WAA+B,EAC/B,YAAgC,EAChC,MAA0B,EAC1B,MAAc,EACd,YAA0B;IAE1B,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,KAAK,SAAS,EAAE;QAC7B,MAAM,GAAG;;;;;;;;;;;;uCAY0B,WAAW;;8BAEpB,WAAW;;;;;;;;gDAQO,CAAC;KAC9C;SAAM;QACL,oEAAoE;QACpE,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,6EAA6E;QAC7E,oFAAoF;QACpF,6CAA6C;QAC7C,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG;;;;;;;;4BAQe,YAAY;;;;;;;;;;;;;;;;;;;;;gDAqBQ,CAAC;KAC9C;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxE,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EACvC;QACE,kBAAkB;QAClB,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,IAAI,CAAC,OAAO,CACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAC9B,OAAO,EACP,OAAO,EACP,YAAY,CACb;KACF,EACD,EAAE,GAAG,EAAE,EAAE,0BAA0B,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AA5FD,kDA4FC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEjE,2CAA2C;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE;QACxC,IAAI;YACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EACvC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAChD,CAAC,IAAI,EAAE,CAAC;aACV;iBAAM;gBACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAC7C,CAAC,IAAI,EAAE,CAAC;aACV;SACF;QAAC,OAAO,CAAC,EAAE;YACV,mGAAmG;YACnG,uDAAuD;YACvD,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,CACZ,mLAAmL,CACpL,CAAC;YACF,OAAO;SACR;KACF;IAED,uBAAuB;IACvB,IAAI;QACF,MAAM,MAAM,GAAG,0BAA0B,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;YAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBAC/D,IAAI;gBACJ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;aAAM;YACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE;gBAChE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,CACZ,+IAA+I,CAChJ,CAAC;QACF,OAAO;KACR;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AAnDD,8CAmDC"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,yEAA2D;AAC3D,kEAAoD;AAEpD,gEAAkD;AAElD,qCAA+C;AAC/C,4DAA8C;AAG9C,mDAAwE;AACxE,6CAA+B;AAExB,KAAK,UAAU,UAAU,CAC9B,SAA6B,EAC7B,UAA4B,EAC5B,OAAe,EACf,QAAgB,EAChB,IAAe,EACf,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAW,CAChD,SAAS,EACT,UAAU,EACV,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,MAAM,CACP,CAAC;IACF,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC5B,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC;AApBD,gCAoBC;AAEM,KAAK,UAAU,UAAU,CAC9B,cAAkC,EAClC,YAAgC,EAChC,UAA8B,EAC9B,UAAyB,EACzB,OAAe,EACf,YAAoB,EACpB,MAAc,EACd,YAAoB,EACpB,aAAiC,EACjC,UAAoC,EACpC,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CACzC,cAAc,EACd,YAAY,EACZ,UAAU,EACV,UAAU,EACV,OAAO,EACP,YAAY,EACZ,MAAM,EACN,YAAY,EACZ,aAAa,EACb,UAAU,EACV,MAAM,CACP,CAAC;IACF,aAAa,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AA9BD,gCA8BC;AAEM,KAAK,UAAU,OAAO,CAC3B,MAAc,EACd,MAA0B;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAElC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9E,sEAAsE;IACtE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE;QACvC,yBAAyB;QACzB,MAAM,MAAM,CAAC,YAAY,CACvB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EACpD,QAAQ,EACR,UAAU,CACX,CAAC;KACH;IAED,OAAO,MAAM,uCAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAnBD,0BAmBC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,+CAA+C;AACxC,KAAK,UAAU,mBAAmB,CACvC,WAA+B,EAC/B,YAAgC,EAChC,MAA0B,EAC1B,MAAc,EACd,YAA0B;IAE1B,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,KAAK,SAAS,EAAE;QAC7B,MAAM,GAAG;;;;;;;;;;;;uCAY0B,WAAW;;8BAEpB,WAAW;;;;;;;;gDAQO,CAAC;KAC9C;SAAM;QACL,oEAAoE;QACpE,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,6EAA6E;QAC7E,oFAAoF;QACpF,6CAA6C;QAC7C,YAAY,GAAG,YAAY,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG;;;;;;;;4BAQe,YAAY;;;;;;;;;;;;;;;;;;;;;gDAqBQ,CAAC;KAC9C;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxE,EAAE,CAAC,aAAa,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EACvC;QACE,kBAAkB;QAClB,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,IAAI,CAAC,OAAO,CACV,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAC9B,OAAO,EACP,OAAO,EACP,YAAY,CACb;KACF,EACD,EAAE,GAAG,EAAE,EAAE,0BAA0B,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AA5FD,kDA4FC;AAEM,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IACpE,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAE/C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEjE,2CAA2C;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE;QACxC,IAAI;YACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;gBAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,EACvC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAChD,CAAC,IAAI,EAAE,CAAC;aACV;iBAAM;gBACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAC7B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAC7C,CAAC,IAAI,EAAE,CAAC;aACV;SACF;QAAC,OAAO,CAAC,EAAE;YACV,mGAAmG;YACnG,uDAAuD;YACvD,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,CACZ,mLAAmL,CACpL,CAAC;YACF,OAAO;SACR;KACF;IAED,uBAAuB;IACvB,IAAI;QACF,MAAM,MAAM,GAAG,0BAA0B,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE;YAChC,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBAC/D,IAAI;gBACJ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;aAAM;YACL,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE;gBAChE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;aAC/B,CAAC,CAAC,IAAI,EAAE,CAAC;SACX;KACF;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO,CACZ,+IAA+I,CAChJ,CAAC;QACF,OAAO;KACR;IACD,MAAM,CAAC,QAAQ,EAAE,CAAC;AACpB,CAAC;AAnDD,8CAmDC"}

lib/runner.js

@@ -83,6 +83,7 @@ program
     .requiredOption("--repository <repository>", "Repository name. (Required)")
     .requiredOption("--github-url <url>", "URL of GitHub instance. (Required)")
     .requiredOption("--github-auth <auth>", "GitHub Apps token or personal access token. (Required)")
+    .option("--external-repository-token <token>", "A token for fetching external config files and queries if they reside in a private repository.")
     .option("--languages <languages>", "Comma-separated list of languages to analyze. Otherwise detects and analyzes all supported languages from the repo.")
     .option("--queries <queries>", "Comma-separated list of additional queries to run. This overrides the same setting in a configuration file.")
     .option("--config-file <file>", "Path to config file.")
@@ -105,8 +106,13 @@ program
         fs.mkdirSync(tempDir, { recursive: true });
         const apiDetails = {
             auth: cmd.githubAuth,
+            externalRepoAuth: cmd.externalRepositoryToken,
             url: util_1.parseGithubUrl(cmd.githubUrl),
         };
+        const gitHubVersion = await util_1.getGitHubVersion(apiDetails);
+        if (gitHubVersion !== undefined) {
+            util_1.checkGitHubVersionInRange(gitHubVersion, "runner", logger);
+        }
         let codeql;
         if (cmd.codeqlPath !== undefined) {
             codeql = codeql_1.getCodeQL(cmd.codeqlPath);
@@ -114,7 +120,7 @@ program
         else {
             codeql = (await init_1.initCodeQL(undefined, apiDetails, tempDir, toolsDir, "runner", logger)).codeql;
         }
-        const config = await init_1.initConfig(cmd.languages, cmd.queries, cmd.configFile, repository_1.parseRepositoryNwo(cmd.repository), tempDir, toolsDir, codeql, cmd.checkoutPath || process.cwd(), apiDetails, "runner", logger);
+        const config = await init_1.initConfig(cmd.languages, cmd.queries, cmd.configFile, repository_1.parseRepositoryNwo(cmd.repository), tempDir, toolsDir, codeql, cmd.checkoutPath || process.cwd(), gitHubVersion, apiDetails, logger);
         const tracerConfig = await init_1.runInit(codeql, config);
         if (tracerConfig === undefined) {
             return;
@@ -227,7 +233,12 @@ program
             auth: cmd.githubAuth,
             url: util_1.parseGithubUrl(cmd.githubUrl),
         };
-        await analyze_1.runAnalyze(repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), undefined, undefined, undefined, cmd.checkoutPath || process.cwd(), undefined, apiDetails, cmd.upload, "runner", outputDir, util_1.getMemoryFlag(cmd.ram), util_1.getAddSnippetsFlag(cmd.addSnippets), util_1.getThreadsFlag(cmd.threads, logger), config, logger);
+        await analyze_1.runAnalyze(outputDir, util_1.getMemoryFlag(cmd.ram), util_1.getAddSnippetsFlag(cmd.addSnippets), util_1.getThreadsFlag(cmd.threads, logger), config, logger);
+        if (!cmd.upload) {
+            logger.info("Not uploading results");
+            return;
+        }
+        await upload_lib.uploadFromRunner(outputDir, repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), cmd.checkoutPath || process.cwd(), config.gitHubVersion, apiDetails, logger);
     }
     catch (e) {
         logger.error("Analyze failed");
@@ -253,7 +264,8 @@ program
         url: util_1.parseGithubUrl(cmd.githubUrl),
     };
     try {
-        await upload_lib.upload(cmd.sarifFile, repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), undefined, undefined, undefined, cmd.checkoutPath || process.cwd(), undefined, apiDetails, "runner", logger);
+        const gitHubVersion = await util_1.getGitHubVersion(apiDetails);
+        await upload_lib.uploadFromRunner(cmd.sarifFile, repository_1.parseRepositoryNwo(cmd.repository), cmd.commit, parseRef(cmd.ref), cmd.checkoutPath || process.cwd(), gitHubVersion, apiDetails, logger);
     }
     catch (e) {
         logger.error("Upload failed");

lib/tracer-config.js

@@ -141,6 +141,12 @@ async function getCombinedTracerConfig(config, codeql) {
     else if (process.platform !== "win32") {
         mainTracerConfig.env["LD_PRELOAD"] = path.join(codeQLDir, "tools", "linux64", "${LIB}trace.so");
     }
+    // On macos it's necessary to prefix the build command with the runner exectuable
+    // on order to trace when System Integrity Protection is enabled.
+    // The exectuable also exists and works for other platforms so we output this env
+    // var with a path to the runner regardless so it's always available.
+    const runnerExeName = process.platform === "win32" ? "runner.exe" : "runner";
+    mainTracerConfig.env["CODEQL_RUNNER"] = path.join(mainTracerConfig.env["CODEQL_DIST"], "tools", mainTracerConfig.env["CODEQL_PLATFORM"], runnerExeName);
     return mainTracerConfig;
 }
 exports.getCombinedTracerConfig = getCombinedTracerConfig;

lib/tracer-config.test.js

@@ -29,6 +29,7 @@ function getTestConfig(tmpDir) {
         tempDir: tmpDir,
         toolCacheDir: tmpDir,
         codeQLCmd: "",
+        gitHubVersion: { type: "dotcom" },
     };
 }
 // A very minimal setup
@@ -237,6 +238,7 @@ ava_1.default("getCombinedTracerConfig - return undefined when no languages are
             async getTracerEnv() {
                 return {
                     ODASA_TRACER_CONFIGURATION: "abc",
+                    CODEQL_DIST: "/",
                     foo: "bar",
                 };
             },
@@ -249,17 +251,28 @@ ava_1.default("getCombinedTracerConfig - valid spec file", async (t) => {
         const config = getTestConfig(tmpDir);
         const spec = path.join(tmpDir, "spec");
         fs.writeFileSync(spec, "foo.log\n2\nabc\ndef");
+        const bundlePath = path.join(tmpDir, "bundle");
+        const codeqlPlatform = process.platform === "win32"
+            ? "win64"
+            : process.platform === "darwin"
+                ? "osx64"
+                : "linux64";
         const codeQL = codeql_1.setCodeQL({
             async getTracerEnv() {
                 return {
                     ODASA_TRACER_CONFIGURATION: spec,
+                    CODEQL_DIST: bundlePath,
+                    CODEQL_PLATFORM: codeqlPlatform,
                     foo: "bar",
                 };
             },
         });
         const result = await tracer_config_1.getCombinedTracerConfig(config, codeQL);
+        t.notDeepEqual(result, undefined);
         const expectedEnv = {
             foo: "bar",
+            CODEQL_DIST: bundlePath,
+            CODEQL_PLATFORM: codeqlPlatform,
             ODASA_TRACER_CONFIGURATION: result.spec,
         };
         if (process.platform === "darwin") {
@@ -268,6 +281,15 @@ ava_1.default("getCombinedTracerConfig - valid spec file", async (t) => {
         else if (process.platform !== "win32") {
             expectedEnv["LD_PRELOAD"] = path.join(path.dirname(codeQL.getPath()), "tools", "linux64", "${LIB}trace.so");
         }
+        if (process.platform === "win32") {
+            expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/win64/runner.exe");
+        }
+        else if (process.platform === "darwin") {
+            expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/osx64/runner");
+        }
+        else {
+            expectedEnv["CODEQL_RUNNER"] = path.join(bundlePath, "tools/linux64/runner");
+        }
         t.deepEqual(result, {
             spec: path.join(tmpDir, "compound-spec"),
             env: expectedEnv,

lib/upload-lib.js

@@ -16,6 +16,7 @@ const zlib_1 = __importDefault(require("zlib"));
 const core = __importStar(require("@actions/core"));
 const file_url_1 = __importDefault(require("file-url"));
 const jsonschema = __importStar(require("jsonschema"));
+const semver = __importStar(require("semver"));
 const api = __importStar(require("./api-client"));
 const fingerprints = __importStar(require("./fingerprints"));
 const sharedEnv = __importStar(require("./shared-environment"));
@@ -50,7 +51,7 @@ async function uploadPayload(payload, repositoryNwo, apiDetails, mode, logger) {
     if (testMode) {
         return;
     }
-    const client = api.getApiClient(apiDetails, mode, logger);
+    const client = api.getApiClient(apiDetails);
     const reqURL = mode === "actions"
         ? "PUT /repos/:owner/:repo/code-scanning/analysis"
         : "POST /repos/:owner/:repo/code-scanning/sarifs";
@@ -62,32 +63,55 @@ async function uploadPayload(payload, repositoryNwo, apiDetails, mode, logger) {
     logger.debug(`response status: ${response.status}`);
     logger.info("Successfully uploaded results");
 }
+// Recursively walks a directory and returns all SARIF files it finds.
+// Does not follow symlinks.
+function findSarifFilesInDir(sarifPath) {
+    const sarifFiles = [];
+    const walkSarifFiles = (dir) => {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.isFile() && entry.name.endsWith(".sarif")) {
+                sarifFiles.push(path.resolve(dir, entry.name));
+            }
+            else if (entry.isDirectory()) {
+                walkSarifFiles(path.resolve(dir, entry.name));
+            }
+        }
+    };
+    walkSarifFiles(sarifPath);
+    return sarifFiles;
+}
+exports.findSarifFilesInDir = findSarifFilesInDir;
 // Uploads a single sarif file or a directory of sarif files
 // depending on what the path happens to refer to.
 // Returns true iff the upload occurred and succeeded
-async function upload(sarifPath, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger) {
-    const sarifFiles = [];
+async function uploadFromActions(sarifPath, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, gitHubVersion, apiDetails, logger) {
+    return await uploadFiles(getSarifFilePaths(sarifPath), repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, gitHubVersion, apiDetails, "actions", logger);
+}
+exports.uploadFromActions = uploadFromActions;
+// Uploads a single sarif file or a directory of sarif files
+// depending on what the path happens to refer to.
+// Returns true iff the upload occurred and succeeded
+async function uploadFromRunner(sarifPath, repositoryNwo, commitOid, ref, checkoutPath, gitHubVersion, apiDetails, logger) {
+    return await uploadFiles(getSarifFilePaths(sarifPath), repositoryNwo, commitOid, ref, undefined, undefined, undefined, checkoutPath, undefined, gitHubVersion, apiDetails, "runner", logger);
+}
+exports.uploadFromRunner = uploadFromRunner;
+function getSarifFilePaths(sarifPath) {
     if (!fs.existsSync(sarifPath)) {
         throw new Error(`Path does not exist: ${sarifPath}`);
     }
+    let sarifFiles;
     if (fs.lstatSync(sarifPath).isDirectory()) {
-        const paths = fs
-            .readdirSync(sarifPath)
-            .filter((f) => f.endsWith(".sarif"))
-            .map((f) => path.resolve(sarifPath, f));
-        for (const filepath of paths) {
-            sarifFiles.push(filepath);
-        }
+        sarifFiles = findSarifFilesInDir(sarifPath);
         if (sarifFiles.length === 0) {
             throw new Error(`No SARIF files found to upload in "${sarifPath}".`);
         }
     }
     else {
-        sarifFiles.push(sarifPath);
+        sarifFiles = [sarifPath];
     }
-    return await uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger);
+    return sarifFiles;
 }
-exports.upload = upload;
 // Counts the number of results in the given SARIF file
 function countResultsInSarif(sarif) {
     let numResults = 0;
@@ -117,9 +141,50 @@ function validateSarifFileSchema(sarifFilePath, logger) {
     }
 }
 exports.validateSarifFileSchema = validateSarifFileSchema;
+// buildPayload constructs a map ready to be uploaded to the API from the given
+// parameters, respecting the current mode and target GitHub instance version.
+function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, workflowRunID, checkoutURI, environment, toolNames, gitHubVersion, mode) {
+    if (mode === "actions") {
+        const payloadObj = {
+            commit_oid: commitOid,
+            ref,
+            analysis_key: analysisKey,
+            analysis_name: analysisName,
+            sarif: zippedSarif,
+            workflow_run_id: workflowRunID,
+            checkout_uri: checkoutURI,
+            environment,
+            started_at: process.env[sharedEnv.CODEQL_WORKFLOW_STARTED_AT],
+            tool_names: toolNames,
+            base_ref: undefined,
+            base_sha: undefined,
+        };
+        // This behaviour can be made the default when support for GHES 3.0 is discontinued.
+        if (gitHubVersion.type === "dotcom" ||
+            semver.satisfies(gitHubVersion.version, `>=3.1`)) {
+            if (process.env.GITHUB_EVENT_NAME === "pull_request" &&
+                process.env.GITHUB_EVENT_PATH) {
+                const githubEvent = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8"));
+                payloadObj.base_ref = `refs/heads/${githubEvent.pull_request.base.ref}`;
+                payloadObj.base_sha = githubEvent.pull_request.base.sha;
+            }
+        }
+        return payloadObj;
+    }
+    else {
+        return {
+            commit_sha: commitOid,
+            ref,
+            sarif: zippedSarif,
+            checkout_uri: checkoutURI,
+            tool_name: toolNames[0],
+        };
+    }
+}
+exports.buildPayload = buildPayload;
 // Uploads the given set of sarif files.
 // Returns true iff the upload occurred and succeeded
-async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, apiDetails, mode, logger) {
+async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKey, analysisName, workflowRunID, checkoutPath, environment, gitHubVersion, apiDetails, mode, logger) {
     logger.info(`Uploading sarif files: ${JSON.stringify(sarifFiles)}`);
     if (mode === "actions") {
         // This check only works on actions as env vars don't persist between calls to the runner
@@ -135,37 +200,14 @@ async function uploadFiles(sarifFiles, repositoryNwo, commitOid, ref, analysisKe
     }
     let sarifPayload = combineSarifFiles(sarifFiles);
     sarifPayload = fingerprints.addFingerprints(sarifPayload, checkoutPath, logger);
-    const zipped_sarif = zlib_1.default.gzipSync(sarifPayload).toString("base64");
+    const zippedSarif = zlib_1.default.gzipSync(sarifPayload).toString("base64");
     const checkoutURI = file_url_1.default(checkoutPath);
     const toolNames = util.getToolNames(sarifPayload);
-    let payload;
-    if (mode === "actions") {
-        payload = JSON.stringify({
-            commit_oid: commitOid,
-            ref,
-            analysis_key: analysisKey,
-            analysis_name: analysisName,
-            sarif: zipped_sarif,
-            workflow_run_id: workflowRunID,
-            checkout_uri: checkoutURI,
-            environment,
-            started_at: process.env[sharedEnv.CODEQL_WORKFLOW_STARTED_AT],
-            tool_names: toolNames,
-        });
-    }
-    else {
-        payload = JSON.stringify({
-            commit_sha: commitOid,
-            ref,
-            sarif: zipped_sarif,
-            checkout_uri: checkoutURI,
-            tool_name: toolNames[0],
-        });
-    }
+    const payload = buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, workflowRunID, checkoutURI, environment, toolNames, gitHubVersion, mode);
     // Log some useful debug info about the info
     const rawUploadSizeBytes = sarifPayload.length;
     logger.debug(`Raw upload size: ${rawUploadSizeBytes} bytes`);
-    const zippedUploadSizeBytes = zipped_sarif.length;
+    const zippedUploadSizeBytes = zippedSarif.length;
     logger.debug(`Base64 zipped upload size: ${zippedUploadSizeBytes} bytes`);
     const numResultInSarif = countResultsInSarif(sarifPayload);
     logger.debug(`Number of results in upload: ${numResultInSarif}`);

lib/upload-lib.test.js

@@ -1,7 +1,4 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 var __importStar = (this && this.__importStar) || function (mod) {
     if (mod && mod.__esModule) return mod;
     var result = {};
@@ -9,11 +6,17 @@ var __importStar = (this && this.__importStar) || function (mod) {
     result["default"] = mod;
     return result;
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const ava_1 = __importDefault(require("ava"));
 const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
 const uploadLib = __importStar(require("./upload-lib"));
+const util_1 = require("./util");
 testing_utils_1.setupTests(ava_1.default);
 ava_1.default("validateSarifFileSchema - valid", (t) => {
     const inputFile = `${__dirname}/../src/testdata/valid-sarif.sarif`;
@@ -23,4 +26,60 @@ ava_1.default("validateSarifFileSchema - invalid", (t) => {
     const inputFile = `${__dirname}/../src/testdata/invalid-sarif.sarif`;
     t.throws(() => uploadLib.validateSarifFileSchema(inputFile, logging_1.getRunnerLogger(true)));
 });
+ava_1.default("validate correct payload used per version", async (t) => {
+    const newVersions = [
+        { type: "dotcom" },
+        { type: "ghes", version: "3.1.0" },
+    ];
+    const oldVersions = [
+        { type: "ghes", version: "2.22.1" },
+        { type: "ghes", version: "3.0.0" },
+    ];
+    const allVersions = newVersions.concat(oldVersions);
+    process.env["GITHUB_EVENT_NAME"] = "push";
+    for (const version of allVersions) {
+        const payload = uploadLib.buildPayload("commit", "refs/heads/master", "key", undefined, "", undefined, "/opt/src", undefined, ["CodeQL", "eslint"], version, "actions");
+        // Not triggered by a pull request
+        t.falsy(payload.base_ref);
+        t.falsy(payload.base_sha);
+    }
+    process.env["GITHUB_EVENT_NAME"] = "pull_request";
+    process.env["GITHUB_EVENT_PATH"] = `${__dirname}/../src/testdata/pull_request.json`;
+    for (const version of newVersions) {
+        const payload = uploadLib.buildPayload("commit", "refs/pull/123/merge", "key", undefined, "", undefined, "/opt/src", undefined, ["CodeQL", "eslint"], version, "actions");
+        t.deepEqual(payload.base_ref, "refs/heads/master");
+        t.deepEqual(payload.base_sha, "f95f852bd8fca8fcc58a9a2d6c842781e32a215e");
+    }
+    for (const version of oldVersions) {
+        const payload = uploadLib.buildPayload("commit", "refs/pull/123/merge", "key", undefined, "", undefined, "/opt/src", undefined, ["CodeQL", "eslint"], version, "actions");
+        // These older versions won't expect these values
+        t.falsy(payload.base_ref);
+        t.falsy(payload.base_sha);
+    }
+});
+ava_1.default("finding SARIF files", async (t) => {
+    await util_1.withTmpDir(async (tmpDir) => {
+        // include a couple of sarif files
+        fs.writeFileSync(path.join(tmpDir, "a.sarif"), "");
+        fs.writeFileSync(path.join(tmpDir, "b.sarif"), "");
+        // other random files shouldn't be returned
+        fs.writeFileSync(path.join(tmpDir, "c.foo"), "");
+        // we should recursively look in subdirectories
+        fs.mkdirSync(path.join(tmpDir, "dir1"));
+        fs.writeFileSync(path.join(tmpDir, "dir1", "d.sarif"), "");
+        fs.mkdirSync(path.join(tmpDir, "dir1", "dir2"));
+        fs.writeFileSync(path.join(tmpDir, "dir1", "dir2", "e.sarif"), "");
+        // we should ignore symlinks
+        fs.mkdirSync(path.join(tmpDir, "dir3"));
+        fs.symlinkSync(tmpDir, path.join(tmpDir, "dir3", "symlink1"), "dir");
+        fs.symlinkSync(path.join(tmpDir, "a.sarif"), path.join(tmpDir, "dir3", "symlink2.sarif"), "file");
+        const sarifFiles = uploadLib.findSarifFilesInDir(tmpDir);
+        t.deepEqual(sarifFiles, [
+            path.join(tmpDir, "a.sarif"),
+            path.join(tmpDir, "b.sarif"),
+            path.join(tmpDir, "dir1", "d.sarif"),
+            path.join(tmpDir, "dir1", "dir2", "e.sarif"),
+        ]);
+    });
+});
 //# sourceMappingURL=upload-lib.test.js.map

lib/upload-lib.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload-lib.test.js","sourceRoot":"","sources":["../src/upload-lib.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,8CAAuB;AAEvB,uCAA4C;AAC5C,mDAA6C;AAC7C,wDAA0C;AAE1C,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE;IAC5C,MAAM,SAAS,GAAG,GAAG,SAAS,oCAAoC,CAAC;IACnE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CACf,SAAS,CAAC,uBAAuB,CAAC,SAAS,EAAE,yBAAe,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;IAC9C,MAAM,SAAS,GAAG,GAAG,SAAS,sCAAsC,CAAC;IACrE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CACZ,SAAS,CAAC,uBAAuB,CAAC,SAAS,EAAE,yBAAe,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"upload-lib.test.js","sourceRoot":"","sources":["../src/upload-lib.test.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAE7B,8CAAuB;AAEvB,uCAA4C;AAC5C,mDAA6C;AAC7C,wDAA0C;AAC1C,iCAAmD;AAEnD,0BAAU,CAAC,aAAI,CAAC,CAAC;AAEjB,aAAI,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE;IAC5C,MAAM,SAAS,GAAG,GAAG,SAAS,oCAAoC,CAAC;IACnE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CACf,SAAS,CAAC,uBAAuB,CAAC,SAAS,EAAE,yBAAe,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE;IAC9C,MAAM,SAAS,GAAG,GAAG,SAAS,sCAAsC,CAAC;IACrE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CACZ,SAAS,CAAC,uBAAuB,CAAC,SAAS,EAAE,yBAAe,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,2CAA2C,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC5D,MAAM,WAAW,GAAoB;QACnC,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;KACnC,CAAC;IACF,MAAM,WAAW,GAAoB;QACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;KACnC,CAAC;IACF,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEpD,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE;QACjC,MAAM,OAAO,GAAQ,SAAS,CAAC,YAAY,CACzC,QAAQ,EACR,mBAAmB,EACnB,KAAK,EACL,SAAS,EACT,EAAE,EACF,SAAS,EACT,UAAU,EACV,SAAS,EACT,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpB,OAAO,EACP,SAAS,CACV,CAAC;QACF,kCAAkC;QAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B;IAED,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,cAAc,CAAC;IAClD,OAAO,CAAC,GAAG,CACT,mBAAmB,CACpB,GAAG,GAAG,SAAS,oCAAoC,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE;QACjC,MAAM,OAAO,GAAQ,SAAS,CAAC,YAAY,CACzC,QAAQ,EACR,qBAAqB,EACrB,KAAK,EACL,SAAS,EACT,EAAE,EACF,SAAS,EACT,UAAU,EACV,SAAS,EACT,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpB,OAAO,EACP,SAAS,CACV,CAAC;QACF,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACnD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;KAC3E;IAED,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE;QACjC,MAAM,OAAO,GAAQ,SAAS,CAAC,YAAY,CACzC,QAAQ,EACR,qBAAqB,EACrB,KAAK,EACL,SAAS,EACT,EAAE,EACF,SAAS,EACT,UAAU,EACV,SAAS,EACT,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpB,OAAO,EACP,SAAS,CACV,CAAC;QACF,iDAAiD;QACjD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC3B;AACH,CAAC,CAAC,CAAC;AAEH,aAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACtC,MAAM,iBAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAChC,kCAAkC;QAClC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAEnD,2CAA2C;QAC3C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAEjD,+CAA+C;QAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAEnE,4BAA4B;QAC5B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QACrE,EAAE,CAAC,WAAW,CACZ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CACP,CAAC;QAEF,MAAM,UAAU,GAAG,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEzD,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

lib/upload-sarif-action.js

@@ -12,6 +12,7 @@ const actionsUtil = __importStar(require("./actions-util"));
 const logging_1 = require("./logging");
 const repository_1 = require("./repository");
 const upload_lib = __importStar(require("./upload-lib"));
+const util_1 = require("./util");
 async function sendSuccessStatusReport(startedAt, uploadStats) {
     const statusReportBase = await actionsUtil.createStatusReportBase("upload-sarif", "success", startedAt);
     const statusReport = {
@@ -30,7 +31,8 @@ async function run() {
             auth: actionsUtil.getRequiredInput("token"),
             url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
         };
-        const uploadStats = await upload_lib.upload(actionsUtil.getRequiredInput("sarif_file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), apiDetails, "actions", logging_1.getActionsLogger());
+        const gitHubVersion = await util_1.getGitHubVersion(apiDetails);
+        const uploadStats = await upload_lib.uploadFromActions(actionsUtil.getRequiredInput("sarif_file"), repository_1.parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")), await actionsUtil.getCommitOid(), await actionsUtil.getRef(), await actionsUtil.getAnalysisKey(), actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"), actionsUtil.getWorkflowRunID(), actionsUtil.getRequiredInput("checkout_path"), actionsUtil.getRequiredInput("matrix"), gitHubVersion, apiDetails, logging_1.getActionsLogger());
         await sendSuccessStatusReport(startedAt, uploadStats);
     }
     catch (error) {

lib/upload-sarif-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload-sarif-action.js","sourceRoot":"","sources":["../src/upload-sarif-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAA6C;AAC7C,6CAAkD;AAClD,yDAA2C;AAM3C,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,WAA0C;IAE1C,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,cAAc,EACd,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,GAAG,WAAW;KACf,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,UAAU,EACV,SAAS,CACV,CACF,CAAC,EACF;QACA,OAAO;KACR;IAED,IAAI;QACF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,MAAM,CACzC,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAC1C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,UAAU,EACV,SAAS,EACT,0BAAgB,EAAE,CACnB,CAAC;QACF,MAAM,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KACvD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}
+{"version":3,"file":"upload-sarif-action.js","sourceRoot":"","sources":["../src/upload-sarif-action.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAsC;AAEtC,4DAA8C;AAC9C,uCAA6C;AAC7C,6CAAkD;AAClD,yDAA2C;AAC3C,iCAA0C;AAM1C,KAAK,UAAU,uBAAuB,CACpC,SAAe,EACf,WAA0C;IAE1C,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAC/D,cAAc,EACd,SAAS,EACT,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAA4B;QAC5C,GAAG,gBAAgB;QACnB,GAAG,WAAW;KACf,CAAC;IACF,MAAM,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,gBAAgB,CAClC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,UAAU,EACV,SAAS,CACV,CACF,CAAC,EACF;QACA,OAAO;KACR;IAED,IAAI;QACF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,GAAG,EAAE,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC;SAC1D,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,uBAAgB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,iBAAiB,CACpD,WAAW,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAC1C,+BAAkB,CAAC,WAAW,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC,EACxE,MAAM,WAAW,CAAC,YAAY,EAAE,EAChC,MAAM,WAAW,CAAC,MAAM,EAAE,EAC1B,MAAM,WAAW,CAAC,cAAc,EAAE,EAClC,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAClD,WAAW,CAAC,gBAAgB,EAAE,EAC9B,WAAW,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAC7C,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EACtC,aAAa,EACb,UAAU,EACV,0BAAgB,EAAE,CACnB,CAAC;QACF,MAAM,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;KACvD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,WAAW,CAAC,gBAAgB,CAChC,MAAM,WAAW,CAAC,sBAAsB,CACtC,cAAc,EACd,SAAS,EACT,SAAS,EACT,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,KAAK,CACZ,CACF,CAAC;QACF,OAAO;KACR;AACH,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI;QACF,MAAM,GAAG,EAAE,CAAC;KACb;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,CAAC,SAAS,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;KACpB;AACH,CAAC;AAED,KAAK,UAAU,EAAE,CAAC"}

lib/util.js

@@ -10,6 +10,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const core = __importStar(require("@actions/core"));
+const semver = __importStar(require("semver"));
+const api_client_1 = require("./api-client");
+const apiCompatibility = __importStar(require("./api-compatibility.json"));
 /**
  * The URL for github.com.
  */
@@ -190,4 +194,58 @@ function parseGithubUrl(inputUrl) {
     return url.toString();
 }
 exports.parseGithubUrl = parseGithubUrl;
+const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+const CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR = "CODEQL_ACTION_WARNED_ABOUT_VERSION";
+let hasBeenWarnedAboutVersion = false;
+async function getGitHubVersion(apiDetails) {
+    // We can avoid making an API request in the standard dotcom case
+    if (parseGithubUrl(apiDetails.url) === exports.GITHUB_DOTCOM_URL) {
+        return { type: "dotcom" };
+    }
+    // Doesn't strictly have to be the meta endpoint as we're only
+    // using the response headers which are available on every request.
+    const apiClient = api_client_1.getApiClient(apiDetails);
+    const response = await apiClient.meta.get();
+    // This happens on dotcom, although we expect to have already returned in that
+    // case. This can also serve as a fallback in cases we haven't foreseen.
+    if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
+        return { type: "dotcom" };
+    }
+    const version = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER];
+    return { type: "ghes", version };
+}
+exports.getGitHubVersion = getGitHubVersion;
+function checkGitHubVersionInRange(version, mode, logger) {
+    if (hasBeenWarnedAboutVersion || version.type !== "ghes") {
+        return;
+    }
+    const disallowedAPIVersionReason = apiVersionInRange(version.version, apiCompatibility.minimumVersion, apiCompatibility.maximumVersion);
+    const toolName = mode === "actions" ? "Action" : "Runner";
+    if (disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_OLD) {
+        logger.warning(`The CodeQL ${toolName} version you are using is too old to be compatible with GitHub Enterprise ${version.version}. If you experience issues, please upgrade to a more recent version of the CodeQL ${toolName}.`);
+    }
+    if (disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_NEW) {
+        logger.warning(`GitHub Enterprise ${version.version} is too old to be compatible with this version of the CodeQL ${toolName}. If you experience issues, please upgrade to a more recent version of GitHub Enterprise or use an older version of the CodeQL ${toolName}.`);
+    }
+    hasBeenWarnedAboutVersion = true;
+    if (mode === "actions") {
+        core.exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
+    }
+}
+exports.checkGitHubVersionInRange = checkGitHubVersionInRange;
+var DisallowedAPIVersionReason;
+(function (DisallowedAPIVersionReason) {
+    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_OLD"] = 0] = "ACTION_TOO_OLD";
+    DisallowedAPIVersionReason[DisallowedAPIVersionReason["ACTION_TOO_NEW"] = 1] = "ACTION_TOO_NEW";
+})(DisallowedAPIVersionReason = exports.DisallowedAPIVersionReason || (exports.DisallowedAPIVersionReason = {}));
+function apiVersionInRange(version, minimumVersion, maximumVersion) {
+    if (!semver.satisfies(version, `>=${minimumVersion}`)) {
+        return DisallowedAPIVersionReason.ACTION_TOO_NEW;
+    }
+    if (!semver.satisfies(version, `<=${maximumVersion}`)) {
+        return DisallowedAPIVersionReason.ACTION_TOO_OLD;
+    }
+    return undefined;
+}
+exports.apiVersionInRange = apiVersionInRange;
 //# sourceMappingURL=util.js.map

lib/util.test.js

@@ -12,7 +12,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
+const github = __importStar(require("@actions/github"));
 const ava_1 = __importDefault(require("ava"));
+const sinon_1 = __importDefault(require("sinon"));
+const api = __importStar(require("./api-client"));
 const logging_1 = require("./logging");
 const testing_utils_1 = require("./testing-utils");
 const util = __importStar(require("./util"));
@@ -121,4 +124,46 @@ ava_1.default("parseGithubUrl", (t) => {
         message: '"http:///::::433" is not a valid URL',
     });
 });
+ava_1.default("allowed API versions", async (t) => {
+    t.is(util.apiVersionInRange("1.33.0", "1.33", "2.0"), undefined);
+    t.is(util.apiVersionInRange("1.33.1", "1.33", "2.0"), undefined);
+    t.is(util.apiVersionInRange("1.34.0", "1.33", "2.0"), undefined);
+    t.is(util.apiVersionInRange("2.0.0", "1.33", "2.0"), undefined);
+    t.is(util.apiVersionInRange("2.0.1", "1.33", "2.0"), undefined);
+    t.is(util.apiVersionInRange("1.32.0", "1.33", "2.0"), util.DisallowedAPIVersionReason.ACTION_TOO_NEW);
+    t.is(util.apiVersionInRange("2.1.0", "1.33", "2.0"), util.DisallowedAPIVersionReason.ACTION_TOO_OLD);
+});
+function mockGetMetaVersionHeader(versionHeader) {
+    // Passing an auth token is required, so we just use a dummy value
+    const client = github.getOctokit("123");
+    const response = {
+        headers: {
+            "x-github-enterprise-version": versionHeader,
+        },
+    };
+    const spyGetContents = sinon_1.default
+        .stub(client.meta, "get")
+        .resolves(response);
+    sinon_1.default.stub(api, "getApiClient").value(() => client);
+    return spyGetContents;
+}
+ava_1.default("getGitHubVersion", async (t) => {
+    const v = await util.getGitHubVersion({
+        auth: "",
+        url: "https://github.com",
+    });
+    t.deepEqual("dotcom", v.type);
+    mockGetMetaVersionHeader("2.0");
+    const v2 = await util.getGitHubVersion({
+        auth: "",
+        url: "https://ghe.example.com",
+    });
+    t.deepEqual({ type: "ghes", version: "2.0" }, v2);
+    mockGetMetaVersionHeader(undefined);
+    const v3 = await util.getGitHubVersion({
+        auth: "",
+        url: "https://ghe.example.com",
+    });
+    t.deepEqual({ type: "dotcom" }, v3);
+});
 //# sourceMappingURL=util.test.js.map

node_modules/ini/ini.js

@@ -15,7 +15,7 @@ function encode (obj, opt) {
   if (typeof opt === 'string') {
     opt = {
       section: opt,
-      whitespace: false
+      whitespace: false,
     }
   } else {
     opt = opt || {}
@@ -30,27 +30,25 @@ function encode (obj, opt) {
       val.forEach(function (item) {
         out += safe(k + '[]') + separator + safe(item) + '\n'
       })
-    } else if (val && typeof val === 'object') {
+    } else if (val && typeof val === 'object')
       children.push(k)
-    } else {
+    else
       out += safe(k) + separator + safe(val) + eol
-    }
   })
 
-  if (opt.section && out.length) {
+  if (opt.section && out.length)
     out = '[' + safe(opt.section) + ']' + eol + out
-  }
 
   children.forEach(function (k, _, __) {
     var nk = dotSplit(k).join('\\.')
     var section = (opt.section ? opt.section + '.' : '') + nk
     var child = encode(obj[k], {
       section: section,
-      whitespace: opt.whitespace
+      whitespace: opt.whitespace,
     })
-    if (out.length && child.length) {
+    if (out.length && child.length)
       out += eol
-    }
+
     out += child
   })
 
@@ -62,7 +60,7 @@ function dotSplit (str) {
     .replace(/\\\./g, '\u0001')
     .split(/\./).map(function (part) {
       return part.replace(/\1/g, '\\.')
-      .replace(/\2LITERAL\\1LITERAL\2/g, '\u0001')
+        .replace(/\2LITERAL\\1LITERAL\2/g, '\u0001')
     })
 }
 
@@ -75,15 +73,25 @@ function decode (str) {
   var lines = str.split(/[\r\n]+/g)
 
   lines.forEach(function (line, _, __) {
-    if (!line || line.match(/^\s*[;#]/)) return
+    if (!line || line.match(/^\s*[;#]/))
+      return
     var match = line.match(re)
-    if (!match) return
+    if (!match)
+      return
     if (match[1] !== undefined) {
       section = unsafe(match[1])
+      if (section === '__proto__') {
+        // not allowed
+        // keep parsing the section, but don't attach it.
+        p = {}
+        return
+      }
       p = out[section] = out[section] || {}
       return
     }
     var key = unsafe(match[2])
+    if (key === '__proto__')
+      return
     var value = match[3] ? unsafe(match[4]) : true
     switch (value) {
       case 'true':
@@ -94,20 +102,20 @@ function decode (str) {
     // Convert keys with '[]' suffix to an array
     if (key.length > 2 && key.slice(-2) === '[]') {
       key = key.substring(0, key.length - 2)
-      if (!p[key]) {
+      if (key === '__proto__')
+        return
+      if (!p[key])
         p[key] = []
-      } else if (!Array.isArray(p[key])) {
+      else if (!Array.isArray(p[key]))
         p[key] = [p[key]]
-      }
     }
 
     // safeguard against resetting a previously defined
     // array by accidentally forgetting the brackets
-    if (Array.isArray(p[key])) {
+    if (Array.isArray(p[key]))
       p[key].push(value)
-    } else {
+    else
       p[key] = value
-    }
   })
 
   // {a:{y:1},"a.b":{x:2}} --> {a:{y:1,b:{x:2}}}
@@ -115,9 +123,9 @@ function decode (str) {
   Object.keys(out).filter(function (k, _, __) {
     if (!out[k] ||
       typeof out[k] !== 'object' ||
-      Array.isArray(out[k])) {
+      Array.isArray(out[k]))
       return false
-    }
+
     // see if the parent section is also an object.
     // if so, add it to that, and mark this one for deletion
     var parts = dotSplit(k)
@@ -125,12 +133,15 @@ function decode (str) {
     var l = parts.pop()
     var nl = l.replace(/\\\./g, '.')
     parts.forEach(function (part, _, __) {
-      if (!p[part] || typeof p[part] !== 'object') p[part] = {}
+      if (part === '__proto__')
+        return
+      if (!p[part] || typeof p[part] !== 'object')
+        p[part] = {}
       p = p[part]
     })
-    if (p === out && nl === l) {
+    if (p === out && nl === l)
       return false
-    }
+
     p[nl] = out[k]
     return true
   }).forEach(function (del, _, __) {
@@ -152,18 +163,20 @@ function safe (val) {
     (val.length > 1 &&
      isQuoted(val)) ||
     val !== val.trim())
-      ? JSON.stringify(val)
-      : val.replace(/;/g, '\\;').replace(/#/g, '\\#')
+    ? JSON.stringify(val)
+    : val.replace(/;/g, '\\;').replace(/#/g, '\\#')
 }
 
 function unsafe (val, doUnesc) {
   val = (val || '').trim()
   if (isQuoted(val)) {
     // remove the single quotes before calling JSON.parse
-    if (val.charAt(0) === "'") {
+    if (val.charAt(0) === "'")
       val = val.substr(1, val.length - 2)
-    }
-    try { val = JSON.parse(val) } catch (_) {}
+
+    try {
+      val = JSON.parse(val)
+    } catch (_) {}
   } else {
     // walk the val to find the first not-escaped ; character
     var esc = false
@@ -171,23 +184,22 @@ function unsafe (val, doUnesc) {
     for (var i = 0, l = val.length; i < l; i++) {
       var c = val.charAt(i)
       if (esc) {
-        if ('\\;#'.indexOf(c) !== -1) {
+        if ('\\;#'.indexOf(c) !== -1)
           unesc += c
-        } else {
+        else
           unesc += '\\' + c
-        }
+
         esc = false
-      } else if (';#'.indexOf(c) !== -1) {
+      } else if (';#'.indexOf(c) !== -1)
         break
-      } else if (c === '\\') {
+      else if (c === '\\')
         esc = true
-      } else {
+      else
         unesc += c
-      }
     }
-    if (esc) {
+    if (esc)
       unesc += '\\'
-    }
+
     return unesc.trim()
   }
   return val

node_modules/ini/package.json

@@ -2,26 +2,29 @@
   "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",
   "name": "ini",
   "description": "An ini encoder/decoder for node",
-  "version": "1.3.5",
+  "version": "1.3.8",
   "repository": {
     "type": "git",
     "url": "git://github.com/isaacs/ini.git"
   },
   "main": "ini.js",
   "scripts": {
-    "pretest": "standard ini.js",
-    "test": "tap test/*.js --100 -J",
+    "eslint": "eslint",
+    "lint": "npm run eslint -- ini.js test/*.js",
+    "lintfix": "npm run lint -- --fix",
+    "test": "tap",
+    "posttest": "npm run lint",
     "preversion": "npm test",
     "postversion": "npm publish",
-    "postpublish": "git push origin --all; git push origin --tags"
+    "prepublishOnly": "git push origin --follow-tags"
   },
-  "engines": {
-    "node": "*"
-  },
-  "dependencies": {},
   "devDependencies": {
-    "standard": "^10.0.3",
-    "tap": "^10.7.3 || 11"
+    "eslint": "^7.9.0",
+    "eslint-plugin-import": "^2.22.0",
+    "eslint-plugin-node": "^11.1.0",
+    "eslint-plugin-promise": "^4.2.1",
+    "eslint-plugin-standard": "^4.0.1",
+    "tap": "14"
   },
   "license": "ISC",
   "files": [

package-lock.json

@@ -2077,8 +2077,7 @@
     "fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "dev": true
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="
     },
     "fast-diff": {
       "version": "1.2.0",
@@ -2435,9 +2434,9 @@
       "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4="
     },
     "ini": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.5.tgz",
-      "integrity": "sha512-RZY5huIKCMRWDUqZlEi72f/lmXKMvuszcMBduliQ3nnWbx9X/ZBQO7DijMEYS9EhHBb2qacRUMtC7svLwe0lcw==",
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
       "dev": true
     },
     "irregular-plurals": {

package.json

@@ -29,6 +29,7 @@
     "@octokit/types": "^5.5.0",
     "commander": "^6.0.0",
     "console-log-level": "^1.4.1",
+    "fast-deep-equal": "^3.1.3",
     "file-url": "^3.0.0",
     "fs": "0.0.1-security",
     "js-yaml": "^3.13.1",

python-setup/install_tools.sh

@@ -10,16 +10,11 @@ set -e
 # subsequent actions in the current job, and not the current action.
 export PATH="$HOME/.local/bin:$PATH"
 
-# The Ubuntu 20.04 GHA environment does not come with a Python 2 pip
-curl https://bootstrap.pypa.io/get-pip.py --output get-pip.py
-python2 get-pip.py
-
-python2 -m pip install --user --upgrade pip setuptools wheel
+# Setup Python 3 dependency installation tools.
 python3 -m pip install --user --upgrade pip setuptools wheel
 
 # virtualenv is a bit nicer for setting up virtual environment, since it will provide up-to-date versions of
 # pip/setuptools/wheel which basic `python3 -m venv venv` won't
-python2 -m pip install --user virtualenv
 python3 -m pip install --user virtualenv
 
 # We install poetry with pip instead of the recommended way, since the recommended way
@@ -32,3 +27,13 @@ python3 -m pip install --user virtualenv
 # poetry 1.0.10 has error (https://github.com/python-poetry/poetry/issues/2711)
 python3 -m pip install --user poetry!=1.0.10
 python3 -m pip install --user pipenv
+
+if command -v python2 &> /dev/null; then
+	# Setup Python 2 dependency installation tools.
+	# The Ubuntu 20.04 GHA environment does not come with a Python 2 pip
+	curl --location --fail https://bootstrap.pypa.io/get-pip.py | python2
+
+	python2 -m pip install --user --upgrade pip setuptools wheel
+
+	python2 -m pip install --user virtualenv
+fi

runner/package-lock.json

@@ -2072,9 +2072,9 @@
       "dev": true
     },
     "ini": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.5.tgz",
-      "integrity": "sha512-RZY5huIKCMRWDUqZlEi72f/lmXKMvuszcMBduliQ3nnWbx9X/ZBQO7DijMEYS9EhHBb2qacRUMtC7svLwe0lcw==",
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
       "dev": true
     },
     "interpret": {

src/actions-util.test.ts

@@ -1,9 +1,17 @@
 import test from "ava";
+import * as yaml from "js-yaml";
 import sinon from "sinon";
 
 import * as actionsutil from "./actions-util";
 import { setupTests } from "./testing-utils";
 
+function errorCodes(
+  actual: actionsutil.CodedError[],
+  expected: actionsutil.CodedError[]
+): [string[], string[]] {
+  return [actual.map(({ code }) => code), expected.map(({ code }) => code)];
+}
+
 setupTests(test);
 
 test("getRef() throws on the empty string", async (t) => {
@@ -82,128 +90,302 @@ test("prepareEnvironment() when a local run", (t) => {
   t.deepEqual(process.env.CODEQL_ACTION_ANALYSIS_KEY, "LOCAL-RUN:UNKNOWN-JOB");
 });
 
-test("validateWorkflow() when on is missing", (t) => {
-  const errors = actionsutil.validateWorkflow({});
+test("getWorkflowErrors() when on is empty", (t) => {
+  const errors = actionsutil.getWorkflowErrors({ on: {} });
 
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+  t.deepEqual(...errorCodes(errors, []));
 });
 
-test("validateWorkflow() when on.push is missing", (t) => {
-  const errors = actionsutil.validateWorkflow({ on: {} });
+test("getWorkflowErrors() when on.push is an array missing pull_request", (t) => {
+  const errors = actionsutil.getWorkflowErrors({ on: ["push"] });
 
-  console.log(errors);
-
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingHooks]);
+  t.deepEqual(...errorCodes(errors, []));
 });
 
-test("validateWorkflow() when on.push is an array missing pull_request", (t) => {
-  const errors = actionsutil.validateWorkflow({ on: ["push"] });
+test("getWorkflowErrors() when on.push is an array missing push", (t) => {
+  const errors = actionsutil.getWorkflowErrors({ on: ["pull_request"] });
 
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPullRequestHook]);
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.MissingPushHook])
+  );
 });
 
-test("validateWorkflow() when on.push is an array missing push", (t) => {
-  const errors = actionsutil.validateWorkflow({ on: ["pull_request"] });
-
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.MissingPushHook]);
-});
-
-test("validateWorkflow() when on.push is valid", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.push is valid", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: ["push", "pull_request"],
   });
 
-  t.deepEqual(errors.length, 0);
+  t.deepEqual(...errorCodes(errors, []));
 });
 
-test("validateWorkflow() when on.push is a valid superset", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.push is a valid superset", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: ["push", "pull_request", "schedule"],
   });
 
-  t.deepEqual(errors.length, 0);
+  t.deepEqual(...errorCodes(errors, []));
 });
 
-test("validateWorkflow() when on.push should not have a path", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.push should not have a path", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: {
       push: { branches: ["main"], paths: ["test/*"] },
       pull_request: { branches: ["main"] },
     },
   });
 
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.PathsSpecified]);
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.PathsSpecified])
+  );
 });
 
-test("validateWorkflow() when on.push is a correct object", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.push is a correct object", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: { push: { branches: ["main"] }, pull_request: { branches: ["main"] } },
   });
 
-  t.deepEqual(errors.length, 0);
+  t.deepEqual(...errorCodes(errors, []));
 });
 
-test("validateWorkflow() when on.push is correct with empty objects", (t) => {
-  const errors = actionsutil.validateWorkflow({
-    on: { push: undefined, pull_request: undefined },
+test("getWorkflowErrors() when on.pull_requests is a string", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
+    on: { push: { branches: ["main"] }, pull_request: { branches: "*" } },
   });
 
-  console.log(errors);
-
-  t.deepEqual(errors.length, 0);
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
+  );
 });
 
-test("validateWorkflow() when on.push is mismatched", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.pull_requests is a string and correct", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
+    on: { push: { branches: "*" }, pull_request: { branches: "*" } },
+  });
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
+test("getWorkflowErrors() when on.push is correct with empty objects", (t) => {
+  const errors = actionsutil.getWorkflowErrors(
+    yaml.safeLoad(`
+on:
+  push:
+  pull_request:
+`)
+  );
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
+test("getWorkflowErrors() when on.push is mismatched", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: {
       push: { branches: ["main"] },
       pull_request: { branches: ["feature"] },
     },
   });
 
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
+  );
 });
 
-test("validateWorkflow() when on.push is not mismatched", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.push is not mismatched", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: {
       push: { branches: ["main", "feature"] },
       pull_request: { branches: ["main"] },
     },
   });
 
-  t.deepEqual(errors.length, 0);
+  t.deepEqual(...errorCodes(errors, []));
 });
 
-test("validateWorkflow() when on.push is mismatched for pull_request", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.push is mismatched for pull_request", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: {
       push: { branches: ["main"] },
       pull_request: { branches: ["main", "feature"] },
     },
   });
 
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
+  );
 });
 
-test("validateWorkflow() when on.pull_request for every branch but push specifies branches", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() for a range of malformed workflows", (t) => {
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: {
+          push: 1,
+          pull_request: 1,
+        },
+      } as any),
+      []
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: 1,
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: [1],
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { 1: 1 },
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: 1 },
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: [1] },
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: { steps: 1 } },
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: { steps: [{ notrun: "git checkout HEAD^2" }] } },
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: 1,
+        jobs: { test: [undefined] },
+      } as any),
+      [actionsutil.WorkflowErrors.MissingHooks]
+    )
+  );
+
+  t.deepEqual(...errorCodes(actionsutil.getWorkflowErrors(1 as any), []));
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors({
+        on: {
+          push: {
+            branches: 1,
+          },
+          pull_request: {
+            branches: 1,
+          },
+        },
+      } as any),
+      []
+    )
+  );
+});
+
+test("getWorkflowErrors() when on.pull_request for every branch but push specifies branches", (t) => {
+  const errors = actionsutil.getWorkflowErrors(
+    yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+`)
+  );
+
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
+  );
+});
+
+test("getWorkflowErrors() when on.pull_request for wildcard branches", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
     on: {
-      push: { branches: ["main"] },
-      pull_request: null,
+      push: { branches: ["feature/*"] },
+      pull_request: { branches: "feature/moose" },
     },
   });
 
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.MismatchedBranches]);
+  t.deepEqual(...errorCodes(errors, []));
 });
 
-test("validateWorkflow() when HEAD^2 is checked out", (t) => {
-  const errors = actionsutil.validateWorkflow({
+test("getWorkflowErrors() when on.pull_request for mismatched wildcard branches", (t) => {
+  const errors = actionsutil.getWorkflowErrors({
+    on: {
+      push: { branches: ["feature/moose"] },
+      pull_request: { branches: "feature/*" },
+    },
+  });
+
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.MismatchedBranches])
+  );
+});
+
+test("getWorkflowErrors() when HEAD^2 is checked out", (t) => {
+  process.env.GITHUB_JOB = "test";
+
+  const errors = actionsutil.getWorkflowErrors({
     on: ["push", "pull_request"],
     jobs: { test: { steps: [{ run: "git checkout HEAD^2" }] } },
   });
 
-  t.deepEqual(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead]);
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead])
+  );
 });
 
 test("formatWorkflowErrors() when there is one error", (t) => {
@@ -230,3 +412,204 @@ test("formatWorkflowCause()", (t) => {
   t.deepEqual(message, "CheckoutWrongHead,PathsSpecified");
   t.deepEqual(actionsutil.formatWorkflowCause([]), undefined);
 });
+
+test("patternIsSuperset()", (t) => {
+  t.false(actionsutil.patternIsSuperset("main-*", "main"));
+  t.true(actionsutil.patternIsSuperset("*", "*"));
+  t.true(actionsutil.patternIsSuperset("*", "main-*"));
+  t.false(actionsutil.patternIsSuperset("main-*", "*"));
+  t.false(actionsutil.patternIsSuperset("main-*", "main"));
+  t.true(actionsutil.patternIsSuperset("main", "main"));
+  t.false(actionsutil.patternIsSuperset("*", "feature/*"));
+  t.true(actionsutil.patternIsSuperset("**", "feature/*"));
+  t.false(actionsutil.patternIsSuperset("feature-*", "**"));
+  t.false(actionsutil.patternIsSuperset("a/**/c", "a/**/d"));
+  t.false(actionsutil.patternIsSuperset("a/**/c", "a/**"));
+  t.true(actionsutil.patternIsSuperset("a/**", "a/**/c"));
+  t.true(actionsutil.patternIsSuperset("a/**/c", "a/main-**/c"));
+  t.false(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/d/**/c"));
+  t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/c/**/c"));
+  t.true(actionsutil.patternIsSuperset("a/**/b/**/c", "a/**/b/d/**/c"));
+  t.false(actionsutil.patternIsSuperset("a/**/c/d/**/c", "a/**/b/**/c"));
+  t.false(actionsutil.patternIsSuperset("a/main-**/c", "a/**/c"));
+  t.true(
+    actionsutil.patternIsSuperset(
+      "/robin/*/release/*",
+      "/robin/moose/release/goose"
+    )
+  );
+  t.false(
+    actionsutil.patternIsSuperset(
+      "/robin/moose/release/goose",
+      "/robin/*/release/*"
+    )
+  );
+});
+
+test("getWorkflowErrors() when branches contain dots", (t) => {
+  const errors = actionsutil.getWorkflowErrors(
+    yaml.safeLoad(`
+  on:
+    push:
+      branches: [4.1, master]
+    pull_request:
+      # The branches below must be a subset of the branches above
+      branches: [4.1, master]
+`)
+  );
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
+test("getWorkflowErrors() when on.push has a trailing comma", (t) => {
+  const errors = actionsutil.getWorkflowErrors(
+    yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master, ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+`)
+  );
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
+test("getWorkflowErrors() should only report the current job's CheckoutWrongHead", (t) => {
+  process.env.GITHUB_JOB = "test";
+
+  const errors = actionsutil.getWorkflowErrors(
+    yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+jobs:
+  test:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test2:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test3:
+    steps: []
+`)
+  );
+
+  t.deepEqual(
+    ...errorCodes(errors, [actionsutil.WorkflowErrors.CheckoutWrongHead])
+  );
+});
+
+test("getWorkflowErrors() should not report a different job's CheckoutWrongHead", (t) => {
+  process.env.GITHUB_JOB = "test3";
+
+  const errors = actionsutil.getWorkflowErrors(
+    yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+jobs:
+  test:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test2:
+    steps:
+      - run: "git checkout HEAD^2"
+
+  test3:
+    steps: []
+`)
+  );
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
+test("getWorkflowErrors() when on is missing", (t) => {
+  const errors = actionsutil.getWorkflowErrors(
+    yaml.safeLoad(`
+name: "CodeQL"
+`)
+  );
+
+  t.deepEqual(...errorCodes(errors, []));
+});
+
+test("getWorkflowErrors() with a different on setup", (t) => {
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors(
+        yaml.safeLoad(`
+name: "CodeQL"
+on: "workflow_dispatch"
+`)
+      ),
+      []
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors(
+        yaml.safeLoad(`
+name: "CodeQL"
+on: [workflow_dispatch]
+`)
+      ),
+      []
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors(
+        yaml.safeLoad(`
+name: "CodeQL"
+on:
+  workflow_dispatch: {}
+`)
+      ),
+      []
+    )
+  );
+});
+
+test("getWorkflowErrors() should not report an error if PRs are totally unconfigured", (t) => {
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors(
+        yaml.safeLoad(`
+name: "CodeQL"
+on:
+  push:
+    branches: [master]
+`)
+      ),
+      []
+    )
+  );
+
+  t.deepEqual(
+    ...errorCodes(
+      actionsutil.getWorkflowErrors(
+        yaml.safeLoad(`
+name: "CodeQL"
+on: ["push"]
+`)
+      ),
+      []
+    )
+  );
+});

src/actions-util.ts

@@ -111,7 +111,7 @@ interface WorkflowJob {
 }
 
 interface WorkflowTrigger {
-  branches?: string[];
+  branches?: string[] | string;
   paths?: string[];
 }
 
@@ -134,26 +134,69 @@ function isObject(o: unknown): o is object {
   return o !== null && typeof o === "object";
 }
 
+const GLOB_PATTERN = new RegExp("(\\*\\*?)");
+
+function escapeRegExp(string) {
+  return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); // $& means the whole matched string
+}
+
+function patternToRegExp(value) {
+  return new RegExp(
+    `^${value
+      .toString()
+      .split(GLOB_PATTERN)
+      .reduce(function (arr, cur) {
+        if (cur === "**") {
+          arr.push(".*?");
+        } else if (cur === "*") {
+          arr.push("[^/]*?");
+        } else if (cur) {
+          arr.push(escapeRegExp(cur));
+        }
+        return arr;
+      }, [])
+      .join("")}$`
+  );
+}
+
+// this function should return true if patternA is a superset of patternB
+// e.g: * is a superset of main-* but main-* is not a superset of *.
+export function patternIsSuperset(patternA: string, patternB: string): boolean {
+  return patternToRegExp(patternA).test(patternB);
+}
+
+function branchesToArray(branches?: string | null | string[]): string[] | "**" {
+  if (typeof branches === "string") {
+    return [branches];
+  }
+  if (Array.isArray(branches)) {
+    if (branches.length === 0) {
+      return "**";
+    }
+    return branches;
+  }
+  return "**";
+}
+
 enum MissingTriggers {
   None = 0,
   Push = 1,
   PullRequest = 2,
 }
 
-interface CodedError {
+export interface CodedError {
   message: string;
   code: string;
 }
-
-function toCodedErrors(errors: {
-  [key: string]: string;
-}): { [key: string]: CodedError } {
+function toCodedErrors<T>(errors: T): Record<keyof T, CodedError> {
   return Object.entries(errors).reduce((acc, [key, value]) => {
     acc[key] = { message: value, code: key };
     return acc;
-  }, {} as ReturnType<typeof toCodedErrors>);
+  }, {} as Record<keyof T, CodedError>);
 }
 
+// code to send back via status report
+// message to add as a warning annotation to the run
 export const WorkflowErrors = toCodedErrors({
   MismatchedBranches: `Please make sure that every branch in on.pull_request is also in on.push so that Code Scanning can compare pull requests against the state of the base branch.`,
   MissingHooks: `Please specify on.push and on.pull_request hooks so that Code Scanning can compare pull requests against the state of the base branch.`,
@@ -164,19 +207,27 @@ export const WorkflowErrors = toCodedErrors({
   CheckoutWrongHead: `git checkout HEAD^2 is no longer necessary. Please remove this step as Code Scanning recommends analyzing the merge commit for best results.`,
 });
 
-export function validateWorkflow(doc: Workflow): CodedError[] {
+export function getWorkflowErrors(doc: Workflow): CodedError[] {
   const errors: CodedError[] = [];
 
-  // .jobs[key].steps[].run
-  for (const job of Object.values(doc?.jobs || {})) {
-    for (const step of job?.steps || []) {
-      // this was advice that we used to give in the README
-      // we actually want to run the analysis on the merge commit
-      // to produce results that are more inline with expectations
-      // (i.e: this is what will happen if you merge this PR)
-      // and avoid some race conditions
-      if (step?.run === "git checkout HEAD^2") {
-        errors.push(WorkflowErrors.CheckoutWrongHead);
+  const jobName = process.env.GITHUB_JOB;
+
+  if (jobName) {
+    const job = doc?.jobs?.[jobName];
+
+    const steps = job?.steps;
+
+    if (Array.isArray(steps)) {
+      for (const step of steps) {
+        // this was advice that we used to give in the README
+        // we actually want to run the analysis on the merge commit
+        // to produce results that are more inline with expectations
+        // (i.e: this is what will happen if you merge this PR)
+        // and avoid some race conditions
+        if (step?.run === "git checkout HEAD^2") {
+          errors.push(WorkflowErrors.CheckoutWrongHead);
+          break;
+        }
       }
     }
   }
@@ -184,33 +235,28 @@ export function validateWorkflow(doc: Workflow): CodedError[] {
   let missing = MissingTriggers.None;
 
   if (doc.on === undefined) {
-    missing = MissingTriggers.Push | MissingTriggers.PullRequest;
+    // this is not a valid config
   } else if (typeof doc.on === "string") {
-    switch (doc.on) {
-      case "push":
-        missing = MissingTriggers.PullRequest;
-        break;
-      case "pull_request":
-        missing = MissingTriggers.Push;
-        break;
-      default:
-        missing = MissingTriggers.Push | MissingTriggers.PullRequest;
-        break;
+    if (doc.on === "pull_request") {
+      missing = MissingTriggers.Push;
     }
   } else if (Array.isArray(doc.on)) {
-    if (!doc.on.includes("push")) {
+    const hasPush = doc.on.includes("push");
+    const hasPullRequest = doc.on.includes("pull_request");
+    if (hasPullRequest && !hasPush) {
       missing = missing | MissingTriggers.Push;
     }
-    if (!doc.on.includes("pull_request")) {
-      missing = missing | MissingTriggers.PullRequest;
-    }
   } else if (isObject(doc.on)) {
-    if (!Object.prototype.hasOwnProperty.call(doc.on, "pull_request")) {
-      missing = missing | MissingTriggers.PullRequest;
-    }
-    if (!Object.prototype.hasOwnProperty.call(doc.on, "push")) {
+    const hasPush = Object.prototype.hasOwnProperty.call(doc.on, "push");
+    const hasPullRequest = Object.prototype.hasOwnProperty.call(
+      doc.on,
+      "pull_request"
+    );
+
+    if (!hasPush && hasPullRequest) {
       missing = missing | MissingTriggers.Push;
-    } else {
+    }
+    if (hasPush && hasPullRequest) {
       const paths = doc.on.push?.paths;
       // if you specify paths or paths-ignore you can end up with commits that have no baseline
       // if they didn't change any files
@@ -224,25 +270,35 @@ export function validateWorkflow(doc: Workflow): CodedError[] {
       }
     }
 
-    if (doc.on.push) {
-      const push = doc.on.push.branches || [];
+    // if doc.on.pull_request is null that means 'all branches'
+    // if doc.on.pull_request is undefined that means 'off'
+    // we only want to check for mismatched branches if pull_request is on.
+    if (doc.on.pull_request !== undefined) {
+      const push = branchesToArray(doc.on.push?.branches);
 
-      if (doc.on.pull_request) {
-        const pull_request = doc.on.pull_request.branches || [];
-        const difference = pull_request.filter(
-          (value) => !push.includes(value)
-        );
-        if (difference.length > 0) {
-          // there are branches in pull_request that may not have a baseline
-          // because we are not building them on push
+      if (push !== "**") {
+        const pull_request = branchesToArray(doc.on.pull_request?.branches);
+
+        if (pull_request !== "**") {
+          const difference = pull_request.filter(
+            (value) => !push.some((o) => patternIsSuperset(o, value))
+          );
+          if (difference.length > 0) {
+            // there are branches in pull_request that may not have a baseline
+            // because we are not building them on push
+            errors.push(WorkflowErrors.MismatchedBranches);
+          }
+        } else if (push.length > 0) {
+          // push is set up to run on a subset of branches
+          // and you could open a PR against a branch with no baseline
           errors.push(WorkflowErrors.MismatchedBranches);
         }
-      } else if (push.length > 0) {
-        // push is set up to run on a subset of branches
-        // and you could open a PR against a branch with no baseline
-        errors.push(WorkflowErrors.MismatchedBranches);
       }
     }
+  } else {
+    // on is not a known type
+    // this workflow is likely malformed
+    missing = MissingTriggers.Push | MissingTriggers.PullRequest;
   }
 
   switch (missing) {
@@ -260,14 +316,31 @@ export function validateWorkflow(doc: Workflow): CodedError[] {
   return errors;
 }
 
-export async function getWorkflowErrors(): Promise<CodedError[]> {
-  const workflow = await getWorkflow();
-
-  if (workflow === undefined) {
-    return [];
+export async function validateWorkflow(): Promise<undefined | string> {
+  let workflow: Workflow;
+  try {
+    workflow = await getWorkflow();
+  } catch (e) {
+    return `error: getWorkflow() failed: ${e.toString()}`;
+  }
+  let workflowErrors: CodedError[];
+  try {
+    workflowErrors = getWorkflowErrors(workflow);
+  } catch (e) {
+    return `error: getWorkflowErrors() failed: ${e.toString()}`;
   }
 
-  return validateWorkflow(workflow);
+  if (workflowErrors.length > 0) {
+    let message: string;
+    try {
+      message = formatWorkflowErrors(workflowErrors);
+    } catch (e) {
+      return `error: formatWorkflowErrors() failed: ${e.toString()}`;
+    }
+    core.warning(message);
+  }
+
+  return `warning: ${formatWorkflowCause(workflowErrors)}`;
 }
 
 export function formatWorkflowErrors(errors: CodedError[]): string {
@@ -285,19 +358,14 @@ export function formatWorkflowCause(errors: CodedError[]): undefined | string {
   return errors.map((e) => e.code).join(",");
 }
 
-export async function getWorkflow(): Promise<Workflow | undefined> {
+export async function getWorkflow(): Promise<Workflow> {
   const relativePath = await getWorkflowPath();
   const absolutePath = path.join(
     getRequiredEnvParam("GITHUB_WORKSPACE"),
     relativePath
   );
 
-  try {
-    return yaml.safeLoad(fs.readFileSync(absolutePath, "utf-8"));
-  } catch (e) {
-    core.warning(`Could not read workflow: ${e.toString()}`);
-    return undefined;
-  }
+  return yaml.safeLoad(fs.readFileSync(absolutePath, "utf-8"));
 }
 
 /**
@@ -560,11 +628,11 @@ export async function sendStatusReport<S extends StatusReportBase>(
           // this means that this action version is no longer compatible with the API
           // we still want to continue as it is likely the analysis endpoint will work
           if (getRequiredEnvParam("GITHUB_SERVER_URL") !== GITHUB_DOTCOM_URL) {
-            core.warning(
+            core.debug(
               "CodeQL Action version is incompatible with the code scanning endpoint. Please update to a compatible version of codeql-action."
             );
           } else {
-            core.warning(
+            core.debug(
               "CodeQL Action is out-of-date. Please upgrade to the latest version of codeql-action."
             );
           }

src/analysis-paths.test.ts

@@ -19,6 +19,7 @@ test("emptyPaths", async (t) => {
       tempDir: tmpDir,
       toolCacheDir: tmpDir,
       codeQLCmd: "",
+      gitHubVersion: { type: "dotcom" } as util.GitHubVersion,
     };
     analysisPaths.includeAndExcludeAnalysisPaths(config);
     t.is(process.env["LGTM_INDEX_INCLUDE"], undefined);
@@ -38,6 +39,7 @@ test("nonEmptyPaths", async (t) => {
       tempDir: tmpDir,
       toolCacheDir: tmpDir,
       codeQLCmd: "",
+      gitHubVersion: { type: "dotcom" } as util.GitHubVersion,
     };
     analysisPaths.includeAndExcludeAnalysisPaths(config);
     t.is(process.env["LGTM_INDEX_INCLUDE"], "path1\npath2");
@@ -61,6 +63,7 @@ test("exclude temp dir", async (t) => {
       tempDir,
       toolCacheDir,
       codeQLCmd: "",
+      gitHubVersion: { type: "dotcom" } as util.GitHubVersion,
     };
     analysisPaths.includeAndExcludeAnalysisPaths(config);
     t.is(process.env["LGTM_INDEX_INCLUDE"], undefined);

src/analyze-action.ts

@@ -1,16 +1,24 @@
+import * as fs from "fs";
+import * as path from "path";
+
 import * as core from "@actions/core";
 
 import * as actionsUtil from "./actions-util";
 import {
-  AnalysisStatusReport,
   runAnalyze,
   CodeQLAnalysisError,
+  QueriesStatusReport,
 } from "./analyze";
-import { getConfig } from "./config-utils";
+import { Config, getConfig } from "./config-utils";
 import { getActionsLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
+import * as upload_lib from "./upload-lib";
 import * as util from "./util";
 
+interface AnalysisStatusReport
+  extends upload_lib.UploadStatusReport,
+    QueriesStatusReport {}
+
 interface FinishStatusReport
   extends actionsUtil.StatusReportBase,
     AnalysisStatusReport {}
@@ -41,6 +49,7 @@ async function sendStatusReport(
 async function run() {
   const startedAt = new Date();
   let stats: AnalysisStatusReport | undefined = undefined;
+  let config: Config | undefined = undefined;
   try {
     actionsUtil.prepareLocalRunEnvironment();
     if (
@@ -55,7 +64,7 @@ async function run() {
       return;
     }
     const logger = getActionsLogger();
-    const config = await getConfig(
+    config = await getConfig(
       actionsUtil.getRequiredEnvParam("RUNNER_TEMP"),
       logger
     );
@@ -68,25 +77,38 @@ async function run() {
       auth: actionsUtil.getRequiredInput("token"),
       url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
     };
-    stats = await runAnalyze(
-      parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")),
-      await actionsUtil.getCommitOid(),
-      await actionsUtil.getRef(),
-      await actionsUtil.getAnalysisKey(),
-      actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"),
-      actionsUtil.getWorkflowRunID(),
-      actionsUtil.getRequiredInput("checkout_path"),
-      actionsUtil.getRequiredInput("matrix"),
-      apiDetails,
-      actionsUtil.getRequiredInput("upload") === "true",
-      "actions",
-      actionsUtil.getRequiredInput("output"),
+    const outputDir = actionsUtil.getRequiredInput("output");
+    const queriesStats = await runAnalyze(
+      outputDir,
       util.getMemoryFlag(actionsUtil.getOptionalInput("ram")),
       util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")),
       util.getThreadsFlag(actionsUtil.getOptionalInput("threads"), logger),
       config,
       logger
     );
+
+    if (actionsUtil.getRequiredInput("upload") === "true") {
+      const uploadStats = await upload_lib.uploadFromActions(
+        outputDir,
+        parseRepositoryNwo(
+          actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")
+        ),
+        await actionsUtil.getCommitOid(),
+        await actionsUtil.getRef(),
+        await actionsUtil.getAnalysisKey(),
+        actionsUtil.getRequiredEnvParam("GITHUB_WORKFLOW"),
+        actionsUtil.getWorkflowRunID(),
+        actionsUtil.getRequiredInput("checkout_path"),
+        actionsUtil.getRequiredInput("matrix"),
+        config.gitHubVersion,
+        apiDetails,
+        logger
+      );
+      stats = { ...queriesStats, ...uploadStats };
+    } else {
+      logger.info("Not uploading results");
+      stats = { ...queriesStats };
+    }
   } catch (error) {
     core.setFailed(error.message);
     console.log(error);
@@ -97,6 +119,35 @@ async function run() {
 
     await sendStatusReport(startedAt, stats, error);
     return;
+  } finally {
+    if (core.isDebug() && config !== undefined) {
+      core.info("Debug mode is on. Printing CodeQL debug logs...");
+      for (const language of config.languages) {
+        const databaseDirectory = util.getCodeQLDatabasePath(
+          config.tempDir,
+          language
+        );
+        const logsDirectory = path.join(databaseDirectory, "log");
+
+        const walkLogFiles = (dir: string) => {
+          const entries = fs.readdirSync(dir, { withFileTypes: true });
+          for (const entry of entries) {
+            if (entry.isFile()) {
+              core.startGroup(
+                `CodeQL Debug Logs - ${language} - ${entry.name}`
+              );
+              process.stdout.write(
+                fs.readFileSync(path.resolve(dir, entry.name))
+              );
+              core.endGroup();
+            } else if (entry.isDirectory()) {
+              walkLogFiles(path.resolve(dir, entry.name));
+            }
+          }
+        };
+        walkLogFiles(logsDirectory);
+      }
+    }
   }
 
   await sendStatusReport(startedAt, stats);

src/analyze.test.ts

@@ -34,6 +34,7 @@ test("status report fields", async (t) => {
         tempDir: tmpDir,
         toolCacheDir: tmpDir,
         codeQLCmd: "",
+        gitHubVersion: { type: "dotcom" } as util.GitHubVersion,
       };
       fs.mkdirSync(util.getCodeQLDatabasePath(config.tempDir, language), {
         recursive: true,

src/analyze.ts

@@ -4,14 +4,11 @@ import * as path from "path";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 
 import * as analysisPaths from "./analysis-paths";
-import { GitHubApiDetails } from "./api-client";
 import { getCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { isScannedLanguage, Language } from "./languages";
 import { Logger } from "./logging";
-import { RepositoryNwo } from "./repository";
 import * as sharedEnv from "./shared-environment";
-import * as upload_lib from "./upload-lib";
 import * as util from "./util";
 
 export class CodeQLAnalysisError extends Error {
@@ -54,10 +51,6 @@ export interface QueriesStatusReport {
   analyze_failure_language?: string;
 }
 
-export interface AnalysisStatusReport
-  extends upload_lib.UploadStatusReport,
-    QueriesStatusReport {}
-
 async function setupPythonExtractor(logger: Logger) {
   const codeqlPython = process.env["CODEQL_PYTHON"];
   if (codeqlPython === undefined || codeqlPython.length === 0) {
@@ -217,24 +210,13 @@ export async function runQueries(
 }
 
 export async function runAnalyze(
-  repositoryNwo: RepositoryNwo,
-  commitOid: string,
-  ref: string,
-  analysisKey: string | undefined,
-  analysisName: string | undefined,
-  workflowRunID: number | undefined,
-  checkoutPath: string,
-  environment: string | undefined,
-  apiDetails: GitHubApiDetails,
-  doUpload: boolean,
-  mode: util.Mode,
   outputDir: string,
   memoryFlag: string,
   addSnippetsFlag: string,
   threadsFlag: string,
   config: configUtils.Config,
   logger: Logger
-): Promise<AnalysisStatusReport> {
+): Promise<QueriesStatusReport> {
   // Delete the tracer config env var to avoid tracing ourselves
   delete process.env[sharedEnv.ODASA_TRACER_CONFIGURATION];
 
@@ -253,25 +235,5 @@ export async function runAnalyze(
     logger
   );
 
-  if (!doUpload) {
-    logger.info("Not uploading results");
-    return { ...queriesStats };
-  }
-
-  const uploadStats = await upload_lib.upload(
-    outputDir,
-    repositoryNwo,
-    commitOid,
-    ref,
-    analysisKey,
-    analysisName,
-    workflowRunID,
-    checkoutPath,
-    environment,
-    apiDetails,
-    mode,
-    logger
-  );
-
-  return { ...queriesStats, ...uploadStats };
+  return { ...queriesStats };
 }

src/api-client.test.ts

@@ -1,19 +0,0 @@
-import test from "ava";
-
-import { apiVersionInRange, DisallowedAPIVersionReason } from "./api-client";
-
-test("allowed API versions", async (t) => {
-  t.is(apiVersionInRange("1.33.0", "1.33", "2.0"), undefined);
-  t.is(apiVersionInRange("1.33.1", "1.33", "2.0"), undefined);
-  t.is(apiVersionInRange("1.34.0", "1.33", "2.0"), undefined);
-  t.is(apiVersionInRange("2.0.0", "1.33", "2.0"), undefined);
-  t.is(apiVersionInRange("2.0.1", "1.33", "2.0"), undefined);
-  t.is(
-    apiVersionInRange("1.32.0", "1.33", "2.0"),
-    DisallowedAPIVersionReason.ACTION_TOO_NEW
-  );
-  t.is(
-    apiVersionInRange("2.1.0", "1.33", "2.0"),
-    DisallowedAPIVersionReason.ACTION_TOO_OLD
-  );
-});

src/api-client.ts

@@ -1,87 +1,37 @@
 import * as path from "path";
 
-import { exportVariable } from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
-import * as retry from "@octokit/plugin-retry";
-import { OctokitResponse } from "@octokit/types";
 import consoleLogLevel from "console-log-level";
-import * as semver from "semver";
 
 import { getRequiredEnvParam, getRequiredInput } from "./actions-util";
-import * as apiCompatibility from "./api-compatibility.json";
-import { Logger, getActionsLogger } from "./logging";
-import { isLocalRun, Mode } from "./util";
+import { isLocalRun } from "./util";
 
 export enum DisallowedAPIVersionReason {
   ACTION_TOO_OLD,
   ACTION_TOO_NEW,
 }
 
+export type GitHubApiCombinedDetails = GitHubApiDetails &
+  GitHubApiExternalRepoDetails;
+
 export interface GitHubApiDetails {
   auth: string;
   url: string;
 }
 
-const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
-const CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR =
-  "CODEQL_ACTION_WARNED_ABOUT_VERSION";
-let hasBeenWarnedAboutVersion = false;
+export interface GitHubApiExternalRepoDetails {
+  externalRepoAuth: string | undefined;
+  url: string;
+}
 
 export const getApiClient = function (
   apiDetails: GitHubApiDetails,
-  mode: Mode,
-  logger: Logger,
-  allowLocalRun = false,
-  possibleFailureExpected = false
+  allowLocalRun = false
 ) {
   if (isLocalRun() && !allowLocalRun) {
     throw new Error("Invalid API call in local run");
   }
-  const customOctokit = githubUtils.GitHub.plugin(retry.retry, (octokit, _) => {
-    octokit.hook.after("request", (response: OctokitResponse<any>, __) => {
-      if (response.status < 400 && !possibleFailureExpected) {
-        if (hasBeenWarnedAboutVersion) {
-          return;
-        }
-      }
-      if (
-        response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined ||
-        process.env[CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR] === undefined
-      ) {
-        return;
-      }
-      const installedVersion = response.headers[
-        GITHUB_ENTERPRISE_VERSION_HEADER
-      ] as string;
-      const disallowedAPIVersionReason = apiVersionInRange(
-        installedVersion,
-        apiCompatibility.minimumVersion,
-        apiCompatibility.maximumVersion
-      );
-
-      const toolName = mode === "actions" ? "Action" : "Runner";
-
-      if (
-        disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_OLD
-      ) {
-        logger.warning(
-          `The CodeQL ${toolName} version you are using is too old to be compatible with GitHub Enterprise ${installedVersion}. If you experience issues, please upgrade to a more recent version of the CodeQL ${toolName}.`
-        );
-      }
-      if (
-        disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_NEW
-      ) {
-        logger.warning(
-          `GitHub Enterprise ${installedVersion} is too old to be compatible with this version of the CodeQL ${toolName}. If you experience issues, please upgrade to a more recent version of GitHub Enterprise or use an older version of the CodeQL ${toolName}.`
-        );
-      }
-      hasBeenWarnedAboutVersion = true;
-      if (mode === "actions") {
-        exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
-      }
-    });
-  });
-  return new customOctokit(
+  return new githubUtils.GitHub(
     githubUtils.getOctokitOptions(apiDetails.auth, {
       baseUrl: getApiUrl(apiDetails.url),
       userAgent: "CodeQL Action",
@@ -93,7 +43,7 @@ export const getApiClient = function (
 function getApiUrl(githubUrl: string): string {
   const url = new URL(githubUrl);
 
-  // If we detect this is trying to be to github.com
+  // If we detect this is trying to connect to github.com
   // then return with a fixed canonical URL.
   if (url.hostname === "github.com" || url.hostname === "api.github.com") {
     return "https://api.github.com";
@@ -113,19 +63,5 @@ export function getActionsApiClient(allowLocalRun = false) {
     url: getRequiredEnvParam("GITHUB_SERVER_URL"),
   };
 
-  return getApiClient(apiDetails, "actions", getActionsLogger(), allowLocalRun);
-}
-
-export function apiVersionInRange(
-  version: string,
-  minimumVersion: string,
-  maximumVersion: string
-): DisallowedAPIVersionReason | undefined {
-  if (!semver.satisfies(version, `>=${minimumVersion}`)) {
-    return DisallowedAPIVersionReason.ACTION_TOO_NEW;
-  }
-  if (!semver.satisfies(version, `<=${maximumVersion}`)) {
-    return DisallowedAPIVersionReason.ACTION_TOO_OLD;
-  }
-  return undefined;
+  return getApiClient(apiDetails, allowLocalRun);
 }

src/codeql.ts

@@ -7,6 +7,7 @@ import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as http from "@actions/http-client";
 import { IHeaders } from "@actions/http-client/interfaces";
 import * as toolcache from "@actions/tool-cache";
+import { default as deepEqual } from "fast-deep-equal";
 import * as semver from "semver";
 import { v4 as uuidV4 } from "uuid";
 
@@ -176,7 +177,9 @@ async function getCodeQLBundleDownloadURL(
   // We now filter out any duplicates.
   // Duplicates will happen either because the GitHub instance is GitHub.com, or because the Action is not a fork.
   const uniqueDownloadSources = potentialDownloadSources.filter(
-    (url, index, self) => index === self.indexOf(url)
+    (source, index, self) => {
+      return !self.slice(0, index).some((other) => deepEqual(source, other));
+    }
   );
   const codeQLBundleName = getCodeQLBundleName();
   for (const downloadSource of uniqueDownloadSources) {
@@ -190,13 +193,11 @@ async function getCodeQLBundleDownloadURL(
     }
     const [repositoryOwner, repositoryName] = repository.split("/");
     try {
-      const release = await api
-        .getApiClient(apiDetails, mode, logger, false, true)
-        .repos.getReleaseByTag({
-          owner: repositoryOwner,
-          repo: repositoryName,
-          tag: CODEQL_BUNDLE_VERSION,
-        });
+      const release = await api.getApiClient(apiDetails).repos.getReleaseByTag({
+        owner: repositoryOwner,
+        repo: repositoryName,
+        tag: CODEQL_BUNDLE_VERSION,
+      });
       for (const asset of release.data.assets) {
         if (asset.name === codeQLBundleName) {
           logger.info(

src/config-utils.test.ts

@@ -17,9 +17,12 @@ setupTests(test);
 
 const sampleApiDetails = {
   auth: "token",
+  externalRepoAuth: "token",
   url: "https://github.example.com",
 };
 
+const gitHubVersion = { type: "dotcom" } as util.GitHubVersion;
+
 // Returns the filepath of the newly-created file
 function createConfigFile(inputFileContents: string, tmpDir: string): string {
   const configFilePath = path.join(tmpDir, "input");
@@ -81,8 +84,8 @@ test("load empty config", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       logger
     );
 
@@ -96,8 +99,8 @@ test("load empty config", async (t) => {
         tmpDir,
         codeQL,
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         logger
       )
     );
@@ -133,8 +136,8 @@ test("loading config saves config", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       logger
     );
 
@@ -159,8 +162,8 @@ test("load input outside of workspace", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -192,8 +195,8 @@ test("load non-local input with invalid repo syntax", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -226,8 +229,8 @@ test("load non-existent input", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -296,6 +299,7 @@ test("load non-empty input", async (t) => {
       tempDir: tmpDir,
       toolCacheDir: tmpDir,
       codeQLCmd: codeQL.getPath(),
+      gitHubVersion,
     };
 
     const languages = "javascript";
@@ -310,8 +314,8 @@ test("load non-empty input", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
 
@@ -371,8 +375,8 @@ test("Default queries are used", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
 
@@ -440,8 +444,8 @@ test("Queries can be specified in config file", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
 
@@ -503,8 +507,8 @@ test("Queries from config file can be overridden in workflow file", async (t) =>
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
 
@@ -564,8 +568,8 @@ test("Queries in workflow file can be used in tandem with the 'disable default q
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
 
@@ -615,8 +619,8 @@ test("Multiple queries can be specified in workflow file, no config file require
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
 
@@ -684,8 +688,8 @@ test("Queries in workflow file can be added to the set of queries without overri
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
 
@@ -722,10 +726,7 @@ test("Invalid queries in workflow file handled correctly", async (t) => {
     // This function just needs to be type-correct; it doesn't need to do anything,
     // since we're deliberately passing in invalid data
     const codeQL = setCodeQL({
-      async resolveQueries(
-        _queries: string[],
-        _extraSearchPath: string | undefined
-      ) {
+      async resolveQueries() {
         return {
           byLanguage: {
             javascript: {},
@@ -746,8 +747,8 @@ test("Invalid queries in workflow file handled correctly", async (t) => {
         tmpDir,
         codeQL,
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       t.fail("initConfig did not throw error");
@@ -808,8 +809,8 @@ test("API client used when reading remote config", async (t) => {
       tmpDir,
       codeQL,
       tmpDir,
+      gitHubVersion,
       sampleApiDetails,
-      "runner",
       getRunnerLogger(true)
     );
     t.assert(spyGetContents.called);
@@ -832,8 +833,8 @@ test("Remote config handles the case where a directory is provided", async (t) =
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -864,8 +865,8 @@ test("Invalid format of remote config handled correctly", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -892,8 +893,8 @@ test("No detected languages", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -917,8 +918,8 @@ test("Unknown languages", async (t) => {
         tmpDir,
         getCachedCodeQL(),
         tmpDir,
+        gitHubVersion,
         sampleApiDetails,
-        "runner",
         getRunnerLogger(true)
       );
       throw new Error("initConfig did not throw error");
@@ -963,8 +964,8 @@ function doInvalidInputTest(
           tmpDir,
           codeQL,
           tmpDir,
+          gitHubVersion,
           sampleApiDetails,
-          "runner",
           getRunnerLogger(true)
         );
         throw new Error("initConfig did not throw error");

src/config-utils.ts

@@ -9,7 +9,7 @@ import * as externalQueries from "./external-queries";
 import { Language, parseLanguage } from "./languages";
 import { Logger } from "./logging";
 import { RepositoryNwo } from "./repository";
-import { Mode } from "./util";
+import { GitHubVersion } from "./util";
 
 // Property names from the user-supplied config file.
 const NAME_PROPERTY = "name";
@@ -93,6 +93,11 @@ export interface Config {
    * Path of the CodeQL executable.
    */
   codeQLCmd: string;
+  /**
+   * Version of GHES that we have determined that we are talking to, or undefined
+   * if talking to github.com.
+   */
+  gitHubVersion: GitHubVersion;
 }
 
 /**
@@ -269,7 +274,7 @@ async function addRemoteQueries(
   resultMap: Queries,
   queryUses: string,
   tempDir: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiExternalRepoDetails,
   logger: Logger,
   configFile?: string
 ) {
@@ -297,7 +302,7 @@ async function addRemoteQueries(
   const checkoutPath = await externalQueries.checkoutExternalRepository(
     nwo,
     ref,
-    githubUrl,
+    apiDetails,
     tempDir,
     logger
   );
@@ -325,7 +330,7 @@ async function parseQueryUses(
   queryUses: string,
   tempDir: string,
   checkoutPath: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiExternalRepoDetails,
   logger: Logger,
   configFile?: string
 ) {
@@ -364,7 +369,7 @@ async function parseQueryUses(
     resultMap,
     queryUses,
     tempDir,
-    githubUrl,
+    apiDetails,
     logger,
     configFile
   );
@@ -592,12 +597,11 @@ export function getUnknownLanguagesError(languages: string[]): string {
 async function getLanguagesInRepo(
   repository: RepositoryNwo,
   apiDetails: api.GitHubApiDetails,
-  mode: Mode,
   logger: Logger
 ): Promise<Language[]> {
   logger.debug(`GitHub repo ${repository.owner} ${repository.repo}`);
   const response = await api
-    .getApiClient(apiDetails, mode, logger, true)
+    .getApiClient(apiDetails, true)
     .repos.listLanguages({
       owner: repository.owner,
       repo: repository.repo,
@@ -633,7 +637,6 @@ async function getLanguages(
   languagesInput: string | undefined,
   repository: RepositoryNwo,
   apiDetails: api.GitHubApiDetails,
-  mode: Mode,
   logger: Logger
 ): Promise<Language[]> {
   // Obtain from action input 'languages' if set
@@ -645,7 +648,7 @@ async function getLanguages(
 
   if (languages.length === 0) {
     // Obtain languages as all languages in the repo that can be analysed
-    languages = await getLanguagesInRepo(repository, apiDetails, mode, logger);
+    languages = await getLanguagesInRepo(repository, apiDetails, logger);
     logger.info(
       `Automatically detected languages: ${JSON.stringify(languages)}`
     );
@@ -682,7 +685,7 @@ async function addQueriesFromWorkflow(
   resultMap: Queries,
   tempDir: string,
   checkoutPath: string,
-  githubUrl: string,
+  apiDetails: api.GitHubApiExternalRepoDetails,
   logger: Logger
 ) {
   queriesInput = queriesInput.trim();
@@ -697,7 +700,7 @@ async function addQueriesFromWorkflow(
       query,
       tempDir,
       checkoutPath,
-      githubUrl,
+      apiDetails,
       logger
     );
   }
@@ -726,15 +729,14 @@ export async function getDefaultConfig(
   toolCacheDir: string,
   codeQL: CodeQL,
   checkoutPath: string,
-  apiDetails: api.GitHubApiDetails,
-  mode: Mode,
+  gitHubVersion: GitHubVersion,
+  apiDetails: api.GitHubApiCombinedDetails,
   logger: Logger
 ): Promise<Config> {
   const languages = await getLanguages(
     languagesInput,
     repository,
     apiDetails,
-    mode,
     logger
   );
   const queries: Queries = {};
@@ -747,7 +749,7 @@ export async function getDefaultConfig(
       queries,
       tempDir,
       checkoutPath,
-      apiDetails.url,
+      apiDetails,
       logger
     );
   }
@@ -761,6 +763,7 @@ export async function getDefaultConfig(
     tempDir,
     toolCacheDir,
     codeQLCmd: codeQL.getPath(),
+    gitHubVersion,
   };
 }
 
@@ -776,8 +779,8 @@ async function loadConfig(
   toolCacheDir: string,
   codeQL: CodeQL,
   checkoutPath: string,
-  apiDetails: api.GitHubApiDetails,
-  mode: Mode,
+  gitHubVersion: GitHubVersion,
+  apiDetails: api.GitHubApiCombinedDetails,
   logger: Logger
 ): Promise<Config> {
   let parsedYAML: UserConfig;
@@ -787,7 +790,7 @@ async function loadConfig(
     configFile = path.resolve(checkoutPath, configFile);
     parsedYAML = getLocalConfig(configFile, checkoutPath);
   } else {
-    parsedYAML = await getRemoteConfig(configFile, apiDetails, mode, logger);
+    parsedYAML = await getRemoteConfig(configFile, apiDetails);
   }
 
   // Validate that the 'name' property is syntactically correct,
@@ -805,7 +808,6 @@ async function loadConfig(
     languagesInput,
     repository,
     apiDetails,
-    mode,
     logger
   );
 
@@ -836,7 +838,7 @@ async function loadConfig(
       queries,
       tempDir,
       checkoutPath,
-      apiDetails.url,
+      apiDetails,
       logger
     );
   }
@@ -861,7 +863,7 @@ async function loadConfig(
         query[QUERIES_USES_PROPERTY],
         tempDir,
         checkoutPath,
-        apiDetails.url,
+        apiDetails,
         logger,
         configFile
       );
@@ -925,6 +927,7 @@ async function loadConfig(
     tempDir,
     toolCacheDir,
     codeQLCmd: codeQL.getPath(),
+    gitHubVersion,
   };
 }
 
@@ -943,8 +946,8 @@ export async function initConfig(
   toolCacheDir: string,
   codeQL: CodeQL,
   checkoutPath: string,
-  apiDetails: api.GitHubApiDetails,
-  mode: Mode,
+  gitHubVersion: GitHubVersion,
+  apiDetails: api.GitHubApiCombinedDetails,
   logger: Logger
 ): Promise<Config> {
   let config: Config;
@@ -960,8 +963,8 @@ export async function initConfig(
       toolCacheDir,
       codeQL,
       checkoutPath,
+      gitHubVersion,
       apiDetails,
-      mode,
       logger
     );
   } else {
@@ -974,8 +977,8 @@ export async function initConfig(
       toolCacheDir,
       codeQL,
       checkoutPath,
+      gitHubVersion,
       apiDetails,
-      mode,
       logger
     );
   }
@@ -1010,9 +1013,7 @@ function getLocalConfig(configFile: string, checkoutPath: string): UserConfig {
 
 async function getRemoteConfig(
   configFile: string,
-  apiDetails: api.GitHubApiDetails,
-  mode: Mode,
-  logger: Logger
+  apiDetails: api.GitHubApiDetails
 ): Promise<UserConfig> {
   // retrieve the various parts of the config location, and ensure they're present
   const format = new RegExp(
@@ -1024,14 +1025,12 @@ async function getRemoteConfig(
     throw new Error(getConfigFileRepoFormatInvalidMessage(configFile));
   }
 
-  const response = await api
-    .getApiClient(apiDetails, mode, logger, true)
-    .repos.getContent({
-      owner: pieces.groups.owner,
-      repo: pieces.groups.repo,
-      path: pieces.groups.path,
-      ref: pieces.groups.ref,
-    });
+  const response = await api.getApiClient(apiDetails, true).repos.getContent({
+    owner: pieces.groups.owner,
+    repo: pieces.groups.repo,
+    path: pieces.groups.path,
+    ref: pieces.groups.ref,
+  });
 
   let fileContents: string;
   if ("content" in response.data && response.data.content !== undefined) {

src/defaults.json

@@ -1,3 +1,3 @@
 {
-	"bundleVersion": "codeql-bundle-20201127"
+	"bundleVersion": "codeql-bundle-20210127"
 }

src/external-queries.test.ts

@@ -85,7 +85,7 @@ test("checkoutExternalQueries", async (t) => {
     await externalQueries.checkoutExternalRepository(
       repoName,
       commit1Sha,
-      `file://${testRepoBaseDir}`,
+      { url: `file://${testRepoBaseDir}`, externalRepoAuth: "" },
       tmpDir,
       getRunnerLogger(true)
     );
@@ -99,7 +99,7 @@ test("checkoutExternalQueries", async (t) => {
     await externalQueries.checkoutExternalRepository(
       repoName,
       commit2Sha,
-      `file://${testRepoBaseDir}`,
+      { url: `file://${testRepoBaseDir}`, externalRepoAuth: "" },
       tmpDir,
       getRunnerLogger(true)
     );
@@ -108,3 +108,35 @@ test("checkoutExternalQueries", async (t) => {
     t.false(fs.existsSync(path.join(tmpDir, repoName, commit2Sha, "b")));
   });
 });
+
+test("buildCheckoutURL", (t) => {
+  t.deepEqual(
+    externalQueries.buildCheckoutURL("foo/bar", {
+      url: "https://github.com",
+      externalRepoAuth: undefined,
+    }),
+    "https://github.com/foo/bar"
+  );
+  t.deepEqual(
+    externalQueries.buildCheckoutURL("foo/bar", {
+      url: "https://github.example.com/",
+      externalRepoAuth: undefined,
+    }),
+    "https://github.example.com/foo/bar"
+  );
+
+  t.deepEqual(
+    externalQueries.buildCheckoutURL("foo/bar", {
+      url: "https://github.com",
+      externalRepoAuth: "abc",
+    }),
+    "https://x-access-token:abc@github.com/foo/bar"
+  );
+  t.deepEqual(
+    externalQueries.buildCheckoutURL("foo/bar", {
+      url: "https://github.example.com/",
+      externalRepoAuth: "abc",
+    }),
+    "https://x-access-token:abc@github.example.com/foo/bar"
+  );
+});

src/external-queries.ts

@@ -4,6 +4,7 @@ import * as path from "path";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as safeWhich from "@chrisgavin/safe-which";
 
+import { GitHubApiExternalRepoDetails } from "./api-client";
 import { Logger } from "./logging";
 
 /**
@@ -12,7 +13,7 @@ import { Logger } from "./logging";
 export async function checkoutExternalRepository(
   repository: string,
   ref: string,
-  githubUrl: string,
+  apiDetails: GitHubApiExternalRepoDetails,
   tempDir: string,
   logger: Logger
 ): Promise<string> {
@@ -28,10 +29,10 @@ export async function checkoutExternalRepository(
   }
 
   if (!fs.existsSync(checkoutLocation)) {
-    const repoURL = `${githubUrl}/${repository}`;
+    const repoCloneURL = buildCheckoutURL(repository, apiDetails);
     await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
       "clone",
-      repoURL,
+      repoCloneURL,
       checkoutLocation,
     ]).exec();
     await new toolrunner.ToolRunner(await safeWhich.safeWhich("git"), [
@@ -44,3 +45,19 @@ export async function checkoutExternalRepository(
 
   return checkoutLocation;
 }
+
+export function buildCheckoutURL(
+  repository: string,
+  apiDetails: GitHubApiExternalRepoDetails
+): string {
+  const repoCloneURL = new URL(apiDetails.url);
+  if (apiDetails.externalRepoAuth !== undefined) {
+    repoCloneURL.username = "x-access-token";
+    repoCloneURL.password = apiDetails.externalRepoAuth;
+  }
+  if (!repoCloneURL.pathname.endsWith("/")) {
+    repoCloneURL.pathname += "/";
+  }
+  repoCloneURL.pathname += `${repository}`;
+  return repoCloneURL.toString();
+}

src/init-action.ts

@@ -13,6 +13,7 @@ import {
 import { Language } from "./languages";
 import { getActionsLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
+import { checkGitHubVersionInRange, getGitHubVersion } from "./util";
 
 interface InitSuccessStatusReport extends actionsUtil.StatusReportBase {
   // Comma-separated list of languages that analysis was run for
@@ -93,14 +94,21 @@ async function run() {
   let codeql: CodeQL;
   let toolsVersion: string;
 
+  const apiDetails = {
+    auth: actionsUtil.getRequiredInput("token"),
+    externalRepoAuth: actionsUtil.getOptionalInput("external-repository-token"),
+    url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
+  };
+
+  const gitHubVersion = await getGitHubVersion(apiDetails);
+  if (gitHubVersion !== undefined) {
+    checkGitHubVersionInRange(gitHubVersion, "actions", logger);
+  }
+
   try {
     actionsUtil.prepareLocalRunEnvironment();
 
-    const workflowErrors = await actionsUtil.getWorkflowErrors();
-
-    if (workflowErrors.length > 0) {
-      core.warning(actionsUtil.formatWorkflowErrors(workflowErrors));
-    }
+    const workflowErrors = await actionsUtil.validateWorkflow();
 
     if (
       !(await actionsUtil.sendStatusReport(
@@ -108,18 +116,13 @@ async function run() {
           "init",
           "starting",
           startedAt,
-          actionsUtil.formatWorkflowCause(workflowErrors)
+          workflowErrors
         )
       ))
     ) {
       return;
     }
 
-    const apiDetails = {
-      auth: actionsUtil.getRequiredInput("token"),
-      url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
-    };
-
     const initCodeQLResult = await initCodeQL(
       actionsUtil.getOptionalInput("tools"),
       apiDetails,
@@ -140,8 +143,8 @@ async function run() {
       actionsUtil.getRequiredEnvParam("RUNNER_TOOL_CACHE"),
       codeql,
       actionsUtil.getRequiredEnvParam("GITHUB_WORKSPACE"),
+      gitHubVersion,
       apiDetails,
-      "actions",
       logger
     );
 

src/init.ts

@@ -5,7 +5,7 @@ import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as safeWhich from "@chrisgavin/safe-which";
 
 import * as analysisPaths from "./analysis-paths";
-import { GitHubApiDetails } from "./api-client";
+import { GitHubApiCombinedDetails, GitHubApiDetails } from "./api-client";
 import { CodeQL, setupCodeQL } from "./codeql";
 import * as configUtils from "./config-utils";
 import { Logger } from "./logging";
@@ -44,8 +44,8 @@ export async function initConfig(
   toolCacheDir: string,
   codeQL: CodeQL,
   checkoutPath: string,
-  apiDetails: GitHubApiDetails,
-  mode: util.Mode,
+  gitHubVersion: util.GitHubVersion,
+  apiDetails: GitHubApiCombinedDetails,
   logger: Logger
 ): Promise<configUtils.Config> {
   logger.startGroup("Load language configuration");
@@ -58,8 +58,8 @@ export async function initConfig(
     toolCacheDir,
     codeQL,
     checkoutPath,
+    gitHubVersion,
     apiDetails,
-    mode,
     logger
   );
   analysisPaths.printPathFiltersWarning(config, logger);

src/runner.ts

@@ -14,7 +14,9 @@ import { getRunnerLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
 import * as upload_lib from "./upload-lib";
 import {
+  checkGitHubVersionInRange,
   getAddSnippetsFlag,
+  getGitHubVersion,
   getMemoryFlag,
   getThreadsFlag,
   parseGithubUrl,
@@ -94,6 +96,7 @@ interface InitArgs {
   repository: string;
   githubUrl: string;
   githubAuth: string;
+  externalRepositoryToken: string | undefined;
   debug: boolean;
 }
 
@@ -106,6 +109,10 @@ program
     "--github-auth <auth>",
     "GitHub Apps token or personal access token. (Required)"
   )
+  .option(
+    "--external-repository-token <token>",
+    "A token for fetching external config files and queries if they reside in a private repository."
+  )
   .option(
     "--languages <languages>",
     "Comma-separated list of languages to analyze. Otherwise detects and analyzes all supported languages from the repo."
@@ -148,9 +155,15 @@ program
 
       const apiDetails = {
         auth: cmd.githubAuth,
+        externalRepoAuth: cmd.externalRepositoryToken,
         url: parseGithubUrl(cmd.githubUrl),
       };
 
+      const gitHubVersion = await getGitHubVersion(apiDetails);
+      if (gitHubVersion !== undefined) {
+        checkGitHubVersionInRange(gitHubVersion, "runner", logger);
+      }
+
       let codeql: CodeQL;
       if (cmd.codeqlPath !== undefined) {
         codeql = getCodeQL(cmd.codeqlPath);
@@ -176,8 +189,8 @@ program
         toolsDir,
         codeql,
         cmd.checkoutPath || process.cwd(),
+        gitHubVersion,
         apiDetails,
-        "runner",
         logger
       );
 
@@ -372,17 +385,6 @@ program
       };
 
       await runAnalyze(
-        parseRepositoryNwo(cmd.repository),
-        cmd.commit,
-        parseRef(cmd.ref),
-        undefined,
-        undefined,
-        undefined,
-        cmd.checkoutPath || process.cwd(),
-        undefined,
-        apiDetails,
-        cmd.upload,
-        "runner",
         outputDir,
         getMemoryFlag(cmd.ram),
         getAddSnippetsFlag(cmd.addSnippets),
@@ -390,6 +392,22 @@ program
         config,
         logger
       );
+
+      if (!cmd.upload) {
+        logger.info("Not uploading results");
+        return;
+      }
+
+      await upload_lib.uploadFromRunner(
+        outputDir,
+        parseRepositoryNwo(cmd.repository),
+        cmd.commit,
+        parseRef(cmd.ref),
+        cmd.checkoutPath || process.cwd(),
+        config.gitHubVersion,
+        apiDetails,
+        logger
+      );
     } catch (e) {
       logger.error("Analyze failed");
       logger.error(e);
@@ -440,18 +458,15 @@ program
       url: parseGithubUrl(cmd.githubUrl),
     };
     try {
-      await upload_lib.upload(
+      const gitHubVersion = await getGitHubVersion(apiDetails);
+      await upload_lib.uploadFromRunner(
         cmd.sarifFile,
         parseRepositoryNwo(cmd.repository),
         cmd.commit,
         parseRef(cmd.ref),
-        undefined,
-        undefined,
-        undefined,
         cmd.checkoutPath || process.cwd(),
-        undefined,
+        gitHubVersion,
         apiDetails,
-        "runner",
         logger
       );
     } catch (e) {

src/testdata/pull_request.json

@@ -0,0 +1,446 @@
+{
+    "action": "opened",
+    "number": 2,
+    "pull_request": {
+        "url": "https://api.github.com/repos/Codertocat/Hello-World/pulls/2",
+        "id": 279147437,
+        "node_id": "MDExOlB1bGxSZXF1ZXN0Mjc5MTQ3NDM3",
+        "html_url": "https://github.com/Codertocat/Hello-World/pull/2",
+        "diff_url": "https://github.com/Codertocat/Hello-World/pull/2.diff",
+        "patch_url": "https://github.com/Codertocat/Hello-World/pull/2.patch",
+        "issue_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/2",
+        "number": 2,
+        "state": "open",
+        "locked": false,
+        "title": "Update the README with new information.",
+        "user": {
+            "login": "Codertocat",
+            "id": 21031067,
+            "node_id": "MDQ6VXNlcjIxMDMxMDY3",
+            "avatar_url": "https://avatars1.githubusercontent.com/u/21031067?v=4",
+            "gravatar_id": "",
+            "url": "https://api.github.com/users/Codertocat",
+            "html_url": "https://github.com/Codertocat",
+            "followers_url": "https://api.github.com/users/Codertocat/followers",
+            "following_url": "https://api.github.com/users/Codertocat/following{/other_user}",
+            "gists_url": "https://api.github.com/users/Codertocat/gists{/gist_id}",
+            "starred_url": "https://api.github.com/users/Codertocat/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/Codertocat/subscriptions",
+            "organizations_url": "https://api.github.com/users/Codertocat/orgs",
+            "repos_url": "https://api.github.com/users/Codertocat/repos",
+            "events_url": "https://api.github.com/users/Codertocat/events{/privacy}",
+            "received_events_url": "https://api.github.com/users/Codertocat/received_events",
+            "type": "User",
+            "site_admin": false
+        },
+        "body": "This is a pretty simple change that we need to pull into master.",
+        "created_at": "2019-05-15T15:20:33Z",
+        "updated_at": "2019-05-15T15:20:33Z",
+        "closed_at": null,
+        "merged_at": null,
+        "merge_commit_sha": null,
+        "assignee": null,
+        "assignees": [],
+        "requested_reviewers": [],
+        "requested_teams": [],
+        "labels": [],
+        "milestone": null,
+        "commits_url": "https://api.github.com/repos/Codertocat/Hello-World/pulls/2/commits",
+        "review_comments_url": "https://api.github.com/repos/Codertocat/Hello-World/pulls/2/comments",
+        "review_comment_url": "https://api.github.com/repos/Codertocat/Hello-World/pulls/comments{/number}",
+        "comments_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/2/comments",
+        "statuses_url": "https://api.github.com/repos/Codertocat/Hello-World/statuses/ec26c3e57ca3a959ca5aad62de7213c562f8c821",
+        "head": {
+            "label": "Codertocat:changes",
+            "ref": "changes",
+            "sha": "ec26c3e57ca3a959ca5aad62de7213c562f8c821",
+            "user": {
+                "login": "Codertocat",
+                "id": 21031067,
+                "node_id": "MDQ6VXNlcjIxMDMxMDY3",
+                "avatar_url": "https://avatars1.githubusercontent.com/u/21031067?v=4",
+                "gravatar_id": "",
+                "url": "https://api.github.com/users/Codertocat",
+                "html_url": "https://github.com/Codertocat",
+                "followers_url": "https://api.github.com/users/Codertocat/followers",
+                "following_url": "https://api.github.com/users/Codertocat/following{/other_user}",
+                "gists_url": "https://api.github.com/users/Codertocat/gists{/gist_id}",
+                "starred_url": "https://api.github.com/users/Codertocat/starred{/owner}{/repo}",
+                "subscriptions_url": "https://api.github.com/users/Codertocat/subscriptions",
+                "organizations_url": "https://api.github.com/users/Codertocat/orgs",
+                "repos_url": "https://api.github.com/users/Codertocat/repos",
+                "events_url": "https://api.github.com/users/Codertocat/events{/privacy}",
+                "received_events_url": "https://api.github.com/users/Codertocat/received_events",
+                "type": "User",
+                "site_admin": false
+            },
+            "repo": {
+                "id": 186853002,
+                "node_id": "MDEwOlJlcG9zaXRvcnkxODY4NTMwMDI=",
+                "name": "Hello-World",
+                "full_name": "Codertocat/Hello-World",
+                "private": false,
+                "owner": {
+                    "login": "Codertocat",
+                    "id": 21031067,
+                    "node_id": "MDQ6VXNlcjIxMDMxMDY3",
+                    "avatar_url": "https://avatars1.githubusercontent.com/u/21031067?v=4",
+                    "gravatar_id": "",
+                    "url": "https://api.github.com/users/Codertocat",
+                    "html_url": "https://github.com/Codertocat",
+                    "followers_url": "https://api.github.com/users/Codertocat/followers",
+                    "following_url": "https://api.github.com/users/Codertocat/following{/other_user}",
+                    "gists_url": "https://api.github.com/users/Codertocat/gists{/gist_id}",
+                    "starred_url": "https://api.github.com/users/Codertocat/starred{/owner}{/repo}",
+                    "subscriptions_url": "https://api.github.com/users/Codertocat/subscriptions",
+                    "organizations_url": "https://api.github.com/users/Codertocat/orgs",
+                    "repos_url": "https://api.github.com/users/Codertocat/repos",
+                    "events_url": "https://api.github.com/users/Codertocat/events{/privacy}",
+                    "received_events_url": "https://api.github.com/users/Codertocat/received_events",
+                    "type": "User",
+                    "site_admin": false
+                },
+                "html_url": "https://github.com/Codertocat/Hello-World",
+                "description": null,
+                "fork": false,
+                "url": "https://api.github.com/repos/Codertocat/Hello-World",
+                "forks_url": "https://api.github.com/repos/Codertocat/Hello-World/forks",
+                "keys_url": "https://api.github.com/repos/Codertocat/Hello-World/keys{/key_id}",
+                "collaborators_url": "https://api.github.com/repos/Codertocat/Hello-World/collaborators{/collaborator}",
+                "teams_url": "https://api.github.com/repos/Codertocat/Hello-World/teams",
+                "hooks_url": "https://api.github.com/repos/Codertocat/Hello-World/hooks",
+                "issue_events_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/events{/number}",
+                "events_url": "https://api.github.com/repos/Codertocat/Hello-World/events",
+                "assignees_url": "https://api.github.com/repos/Codertocat/Hello-World/assignees{/user}",
+                "branches_url": "https://api.github.com/repos/Codertocat/Hello-World/branches{/branch}",
+                "tags_url": "https://api.github.com/repos/Codertocat/Hello-World/tags",
+                "blobs_url": "https://api.github.com/repos/Codertocat/Hello-World/git/blobs{/sha}",
+                "git_tags_url": "https://api.github.com/repos/Codertocat/Hello-World/git/tags{/sha}",
+                "git_refs_url": "https://api.github.com/repos/Codertocat/Hello-World/git/refs{/sha}",
+                "trees_url": "https://api.github.com/repos/Codertocat/Hello-World/git/trees{/sha}",
+                "statuses_url": "https://api.github.com/repos/Codertocat/Hello-World/statuses/{sha}",
+                "languages_url": "https://api.github.com/repos/Codertocat/Hello-World/languages",
+                "stargazers_url": "https://api.github.com/repos/Codertocat/Hello-World/stargazers",
+                "contributors_url": "https://api.github.com/repos/Codertocat/Hello-World/contributors",
+                "subscribers_url": "https://api.github.com/repos/Codertocat/Hello-World/subscribers",
+                "subscription_url": "https://api.github.com/repos/Codertocat/Hello-World/subscription",
+                "commits_url": "https://api.github.com/repos/Codertocat/Hello-World/commits{/sha}",
+                "git_commits_url": "https://api.github.com/repos/Codertocat/Hello-World/git/commits{/sha}",
+                "comments_url": "https://api.github.com/repos/Codertocat/Hello-World/comments{/number}",
+                "issue_comment_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/comments{/number}",
+                "contents_url": "https://api.github.com/repos/Codertocat/Hello-World/contents/{+path}",
+                "compare_url": "https://api.github.com/repos/Codertocat/Hello-World/compare/{base}...{head}",
+                "merges_url": "https://api.github.com/repos/Codertocat/Hello-World/merges",
+                "archive_url": "https://api.github.com/repos/Codertocat/Hello-World/{archive_format}{/ref}",
+                "downloads_url": "https://api.github.com/repos/Codertocat/Hello-World/downloads",
+                "issues_url": "https://api.github.com/repos/Codertocat/Hello-World/issues{/number}",
+                "pulls_url": "https://api.github.com/repos/Codertocat/Hello-World/pulls{/number}",
+                "milestones_url": "https://api.github.com/repos/Codertocat/Hello-World/milestones{/number}",
+                "notifications_url": "https://api.github.com/repos/Codertocat/Hello-World/notifications{?since,all,participating}",
+                "labels_url": "https://api.github.com/repos/Codertocat/Hello-World/labels{/name}",
+                "releases_url": "https://api.github.com/repos/Codertocat/Hello-World/releases{/id}",
+                "deployments_url": "https://api.github.com/repos/Codertocat/Hello-World/deployments",
+                "created_at": "2019-05-15T15:19:25Z",
+                "updated_at": "2019-05-15T15:19:27Z",
+                "pushed_at": "2019-05-15T15:20:32Z",
+                "git_url": "git://github.com/Codertocat/Hello-World.git",
+                "ssh_url": "git@github.com:Codertocat/Hello-World.git",
+                "clone_url": "https://github.com/Codertocat/Hello-World.git",
+                "svn_url": "https://github.com/Codertocat/Hello-World",
+                "homepage": null,
+                "size": 0,
+                "stargazers_count": 0,
+                "watchers_count": 0,
+                "language": null,
+                "has_issues": true,
+                "has_projects": true,
+                "has_downloads": true,
+                "has_wiki": true,
+                "has_pages": true,
+                "forks_count": 0,
+                "mirror_url": null,
+                "archived": false,
+                "disabled": false,
+                "open_issues_count": 2,
+                "license": null,
+                "forks": 0,
+                "open_issues": 2,
+                "watchers": 0,
+                "default_branch": "master"
+            }
+        },
+        "base": {
+            "label": "Codertocat:master",
+            "ref": "master",
+            "sha": "f95f852bd8fca8fcc58a9a2d6c842781e32a215e",
+            "user": {
+                "login": "Codertocat",
+                "id": 21031067,
+                "node_id": "MDQ6VXNlcjIxMDMxMDY3",
+                "avatar_url": "https://avatars1.githubusercontent.com/u/21031067?v=4",
+                "gravatar_id": "",
+                "url": "https://api.github.com/users/Codertocat",
+                "html_url": "https://github.com/Codertocat",
+                "followers_url": "https://api.github.com/users/Codertocat/followers",
+                "following_url": "https://api.github.com/users/Codertocat/following{/other_user}",
+                "gists_url": "https://api.github.com/users/Codertocat/gists{/gist_id}",
+                "starred_url": "https://api.github.com/users/Codertocat/starred{/owner}{/repo}",
+                "subscriptions_url": "https://api.github.com/users/Codertocat/subscriptions",
+                "organizations_url": "https://api.github.com/users/Codertocat/orgs",
+                "repos_url": "https://api.github.com/users/Codertocat/repos",
+                "events_url": "https://api.github.com/users/Codertocat/events{/privacy}",
+                "received_events_url": "https://api.github.com/users/Codertocat/received_events",
+                "type": "User",
+                "site_admin": false
+            },
+            "repo": {
+                "id": 186853002,
+                "node_id": "MDEwOlJlcG9zaXRvcnkxODY4NTMwMDI=",
+                "name": "Hello-World",
+                "full_name": "Codertocat/Hello-World",
+                "private": false,
+                "owner": {
+                    "login": "Codertocat",
+                    "id": 21031067,
+                    "node_id": "MDQ6VXNlcjIxMDMxMDY3",
+                    "avatar_url": "https://avatars1.githubusercontent.com/u/21031067?v=4",
+                    "gravatar_id": "",
+                    "url": "https://api.github.com/users/Codertocat",
+                    "html_url": "https://github.com/Codertocat",
+                    "followers_url": "https://api.github.com/users/Codertocat/followers",
+                    "following_url": "https://api.github.com/users/Codertocat/following{/other_user}",
+                    "gists_url": "https://api.github.com/users/Codertocat/gists{/gist_id}",
+                    "starred_url": "https://api.github.com/users/Codertocat/starred{/owner}{/repo}",
+                    "subscriptions_url": "https://api.github.com/users/Codertocat/subscriptions",
+                    "organizations_url": "https://api.github.com/users/Codertocat/orgs",
+                    "repos_url": "https://api.github.com/users/Codertocat/repos",
+                    "events_url": "https://api.github.com/users/Codertocat/events{/privacy}",
+                    "received_events_url": "https://api.github.com/users/Codertocat/received_events",
+                    "type": "User",
+                    "site_admin": false
+                },
+                "html_url": "https://github.com/Codertocat/Hello-World",
+                "description": null,
+                "fork": false,
+                "url": "https://api.github.com/repos/Codertocat/Hello-World",
+                "forks_url": "https://api.github.com/repos/Codertocat/Hello-World/forks",
+                "keys_url": "https://api.github.com/repos/Codertocat/Hello-World/keys{/key_id}",
+                "collaborators_url": "https://api.github.com/repos/Codertocat/Hello-World/collaborators{/collaborator}",
+                "teams_url": "https://api.github.com/repos/Codertocat/Hello-World/teams",
+                "hooks_url": "https://api.github.com/repos/Codertocat/Hello-World/hooks",
+                "issue_events_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/events{/number}",
+                "events_url": "https://api.github.com/repos/Codertocat/Hello-World/events",
+                "assignees_url": "https://api.github.com/repos/Codertocat/Hello-World/assignees{/user}",
+                "branches_url": "https://api.github.com/repos/Codertocat/Hello-World/branches{/branch}",
+                "tags_url": "https://api.github.com/repos/Codertocat/Hello-World/tags",
+                "blobs_url": "https://api.github.com/repos/Codertocat/Hello-World/git/blobs{/sha}",
+                "git_tags_url": "https://api.github.com/repos/Codertocat/Hello-World/git/tags{/sha}",
+                "git_refs_url": "https://api.github.com/repos/Codertocat/Hello-World/git/refs{/sha}",
+                "trees_url": "https://api.github.com/repos/Codertocat/Hello-World/git/trees{/sha}",
+                "statuses_url": "https://api.github.com/repos/Codertocat/Hello-World/statuses/{sha}",
+                "languages_url": "https://api.github.com/repos/Codertocat/Hello-World/languages",
+                "stargazers_url": "https://api.github.com/repos/Codertocat/Hello-World/stargazers",
+                "contributors_url": "https://api.github.com/repos/Codertocat/Hello-World/contributors",
+                "subscribers_url": "https://api.github.com/repos/Codertocat/Hello-World/subscribers",
+                "subscription_url": "https://api.github.com/repos/Codertocat/Hello-World/subscription",
+                "commits_url": "https://api.github.com/repos/Codertocat/Hello-World/commits{/sha}",
+                "git_commits_url": "https://api.github.com/repos/Codertocat/Hello-World/git/commits{/sha}",
+                "comments_url": "https://api.github.com/repos/Codertocat/Hello-World/comments{/number}",
+                "issue_comment_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/comments{/number}",
+                "contents_url": "https://api.github.com/repos/Codertocat/Hello-World/contents/{+path}",
+                "compare_url": "https://api.github.com/repos/Codertocat/Hello-World/compare/{base}...{head}",
+                "merges_url": "https://api.github.com/repos/Codertocat/Hello-World/merges",
+                "archive_url": "https://api.github.com/repos/Codertocat/Hello-World/{archive_format}{/ref}",
+                "downloads_url": "https://api.github.com/repos/Codertocat/Hello-World/downloads",
+                "issues_url": "https://api.github.com/repos/Codertocat/Hello-World/issues{/number}",
+                "pulls_url": "https://api.github.com/repos/Codertocat/Hello-World/pulls{/number}",
+                "milestones_url": "https://api.github.com/repos/Codertocat/Hello-World/milestones{/number}",
+                "notifications_url": "https://api.github.com/repos/Codertocat/Hello-World/notifications{?since,all,participating}",
+                "labels_url": "https://api.github.com/repos/Codertocat/Hello-World/labels{/name}",
+                "releases_url": "https://api.github.com/repos/Codertocat/Hello-World/releases{/id}",
+                "deployments_url": "https://api.github.com/repos/Codertocat/Hello-World/deployments",
+                "created_at": "2019-05-15T15:19:25Z",
+                "updated_at": "2019-05-15T15:19:27Z",
+                "pushed_at": "2019-05-15T15:20:32Z",
+                "git_url": "git://github.com/Codertocat/Hello-World.git",
+                "ssh_url": "git@github.com:Codertocat/Hello-World.git",
+                "clone_url": "https://github.com/Codertocat/Hello-World.git",
+                "svn_url": "https://github.com/Codertocat/Hello-World",
+                "homepage": null,
+                "size": 0,
+                "stargazers_count": 0,
+                "watchers_count": 0,
+                "language": null,
+                "has_issues": true,
+                "has_projects": true,
+                "has_downloads": true,
+                "has_wiki": true,
+                "has_pages": true,
+                "forks_count": 0,
+                "mirror_url": null,
+                "archived": false,
+                "disabled": false,
+                "open_issues_count": 2,
+                "license": null,
+                "forks": 0,
+                "open_issues": 2,
+                "watchers": 0,
+                "default_branch": "master"
+            }
+        },
+        "_links": {
+            "self": {
+                "href": "https://api.github.com/repos/Codertocat/Hello-World/pulls/2"
+            },
+            "html": {
+                "href": "https://github.com/Codertocat/Hello-World/pull/2"
+            },
+            "issue": {
+                "href": "https://api.github.com/repos/Codertocat/Hello-World/issues/2"
+            },
+            "comments": {
+                "href": "https://api.github.com/repos/Codertocat/Hello-World/issues/2/comments"
+            },
+            "review_comments": {
+                "href": "https://api.github.com/repos/Codertocat/Hello-World/pulls/2/comments"
+            },
+            "review_comment": {
+                "href": "https://api.github.com/repos/Codertocat/Hello-World/pulls/comments{/number}"
+            },
+            "commits": {
+                "href": "https://api.github.com/repos/Codertocat/Hello-World/pulls/2/commits"
+            },
+            "statuses": {
+                "href": "https://api.github.com/repos/Codertocat/Hello-World/statuses/ec26c3e57ca3a959ca5aad62de7213c562f8c821"
+            }
+        },
+        "author_association": "OWNER",
+        "draft": false,
+        "merged": false,
+        "mergeable": null,
+        "rebaseable": null,
+        "mergeable_state": "unknown",
+        "merged_by": null,
+        "comments": 0,
+        "review_comments": 0,
+        "maintainer_can_modify": false,
+        "commits": 1,
+        "additions": 1,
+        "deletions": 1,
+        "changed_files": 1
+    },
+    "repository": {
+        "id": 186853002,
+        "node_id": "MDEwOlJlcG9zaXRvcnkxODY4NTMwMDI=",
+        "name": "Hello-World",
+        "full_name": "Codertocat/Hello-World",
+        "private": false,
+        "owner": {
+            "login": "Codertocat",
+            "id": 21031067,
+            "node_id": "MDQ6VXNlcjIxMDMxMDY3",
+            "avatar_url": "https://avatars1.githubusercontent.com/u/21031067?v=4",
+            "gravatar_id": "",
+            "url": "https://api.github.com/users/Codertocat",
+            "html_url": "https://github.com/Codertocat",
+            "followers_url": "https://api.github.com/users/Codertocat/followers",
+            "following_url": "https://api.github.com/users/Codertocat/following{/other_user}",
+            "gists_url": "https://api.github.com/users/Codertocat/gists{/gist_id}",
+            "starred_url": "https://api.github.com/users/Codertocat/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/Codertocat/subscriptions",
+            "organizations_url": "https://api.github.com/users/Codertocat/orgs",
+            "repos_url": "https://api.github.com/users/Codertocat/repos",
+            "events_url": "https://api.github.com/users/Codertocat/events{/privacy}",
+            "received_events_url": "https://api.github.com/users/Codertocat/received_events",
+            "type": "User",
+            "site_admin": false
+        },
+        "html_url": "https://github.com/Codertocat/Hello-World",
+        "description": null,
+        "fork": false,
+        "url": "https://api.github.com/repos/Codertocat/Hello-World",
+        "forks_url": "https://api.github.com/repos/Codertocat/Hello-World/forks",
+        "keys_url": "https://api.github.com/repos/Codertocat/Hello-World/keys{/key_id}",
+        "collaborators_url": "https://api.github.com/repos/Codertocat/Hello-World/collaborators{/collaborator}",
+        "teams_url": "https://api.github.com/repos/Codertocat/Hello-World/teams",
+        "hooks_url": "https://api.github.com/repos/Codertocat/Hello-World/hooks",
+        "issue_events_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/events{/number}",
+        "events_url": "https://api.github.com/repos/Codertocat/Hello-World/events",
+        "assignees_url": "https://api.github.com/repos/Codertocat/Hello-World/assignees{/user}",
+        "branches_url": "https://api.github.com/repos/Codertocat/Hello-World/branches{/branch}",
+        "tags_url": "https://api.github.com/repos/Codertocat/Hello-World/tags",
+        "blobs_url": "https://api.github.com/repos/Codertocat/Hello-World/git/blobs{/sha}",
+        "git_tags_url": "https://api.github.com/repos/Codertocat/Hello-World/git/tags{/sha}",
+        "git_refs_url": "https://api.github.com/repos/Codertocat/Hello-World/git/refs{/sha}",
+        "trees_url": "https://api.github.com/repos/Codertocat/Hello-World/git/trees{/sha}",
+        "statuses_url": "https://api.github.com/repos/Codertocat/Hello-World/statuses/{sha}",
+        "languages_url": "https://api.github.com/repos/Codertocat/Hello-World/languages",
+        "stargazers_url": "https://api.github.com/repos/Codertocat/Hello-World/stargazers",
+        "contributors_url": "https://api.github.com/repos/Codertocat/Hello-World/contributors",
+        "subscribers_url": "https://api.github.com/repos/Codertocat/Hello-World/subscribers",
+        "subscription_url": "https://api.github.com/repos/Codertocat/Hello-World/subscription",
+        "commits_url": "https://api.github.com/repos/Codertocat/Hello-World/commits{/sha}",
+        "git_commits_url": "https://api.github.com/repos/Codertocat/Hello-World/git/commits{/sha}",
+        "comments_url": "https://api.github.com/repos/Codertocat/Hello-World/comments{/number}",
+        "issue_comment_url": "https://api.github.com/repos/Codertocat/Hello-World/issues/comments{/number}",
+        "contents_url": "https://api.github.com/repos/Codertocat/Hello-World/contents/{+path}",
+        "compare_url": "https://api.github.com/repos/Codertocat/Hello-World/compare/{base}...{head}",
+        "merges_url": "https://api.github.com/repos/Codertocat/Hello-World/merges",
+        "archive_url": "https://api.github.com/repos/Codertocat/Hello-World/{archive_format}{/ref}",
+        "downloads_url": "https://api.github.com/repos/Codertocat/Hello-World/downloads",
+        "issues_url": "https://api.github.com/repos/Codertocat/Hello-World/issues{/number}",
+        "pulls_url": "https://api.github.com/repos/Codertocat/Hello-World/pulls{/number}",
+        "milestones_url": "https://api.github.com/repos/Codertocat/Hello-World/milestones{/number}",
+        "notifications_url": "https://api.github.com/repos/Codertocat/Hello-World/notifications{?since,all,participating}",
+        "labels_url": "https://api.github.com/repos/Codertocat/Hello-World/labels{/name}",
+        "releases_url": "https://api.github.com/repos/Codertocat/Hello-World/releases{/id}",
+        "deployments_url": "https://api.github.com/repos/Codertocat/Hello-World/deployments",
+        "created_at": "2019-05-15T15:19:25Z",
+        "updated_at": "2019-05-15T15:19:27Z",
+        "pushed_at": "2019-05-15T15:20:32Z",
+        "git_url": "git://github.com/Codertocat/Hello-World.git",
+        "ssh_url": "git@github.com:Codertocat/Hello-World.git",
+        "clone_url": "https://github.com/Codertocat/Hello-World.git",
+        "svn_url": "https://github.com/Codertocat/Hello-World",
+        "homepage": null,
+        "size": 0,
+        "stargazers_count": 0,
+        "watchers_count": 0,
+        "language": null,
+        "has_issues": true,
+        "has_projects": true,
+        "has_downloads": true,
+        "has_wiki": true,
+        "has_pages": true,
+        "forks_count": 0,
+        "mirror_url": null,
+        "archived": false,
+        "disabled": false,
+        "open_issues_count": 2,
+        "license": null,
+        "forks": 0,
+        "open_issues": 2,
+        "watchers": 0,
+        "default_branch": "master"
+    },
+    "sender": {
+        "login": "Codertocat",
+        "id": 21031067,
+        "node_id": "MDQ6VXNlcjIxMDMxMDY3",
+        "avatar_url": "https://avatars1.githubusercontent.com/u/21031067?v=4",
+        "gravatar_id": "",
+        "url": "https://api.github.com/users/Codertocat",
+        "html_url": "https://github.com/Codertocat",
+        "followers_url": "https://api.github.com/users/Codertocat/followers",
+        "following_url": "https://api.github.com/users/Codertocat/following{/other_user}",
+        "gists_url": "https://api.github.com/users/Codertocat/gists{/gist_id}",
+        "starred_url": "https://api.github.com/users/Codertocat/starred{/owner}{/repo}",
+        "subscriptions_url": "https://api.github.com/users/Codertocat/subscriptions",
+        "organizations_url": "https://api.github.com/users/Codertocat/orgs",
+        "repos_url": "https://api.github.com/users/Codertocat/repos",
+        "events_url": "https://api.github.com/users/Codertocat/events{/privacy}",
+        "received_events_url": "https://api.github.com/users/Codertocat/received_events",
+        "type": "User",
+        "site_admin": false
+    }
+}

src/tracer-config.test.ts

@@ -26,6 +26,7 @@ function getTestConfig(tmpDir: string): configUtils.Config {
     tempDir: tmpDir,
     toolCacheDir: tmpDir,
     codeQLCmd: "",
+    gitHubVersion: { type: "dotcom" } as util.GitHubVersion,
   };
 }
 
@@ -301,6 +302,7 @@ test("getCombinedTracerConfig - return undefined when no languages are traced la
       async getTracerEnv() {
         return {
           ODASA_TRACER_CONFIGURATION: "abc",
+          CODEQL_DIST: "/",
           foo: "bar",
         };
       },
@@ -317,21 +319,35 @@ test("getCombinedTracerConfig - valid spec file", async (t) => {
     const spec = path.join(tmpDir, "spec");
     fs.writeFileSync(spec, "foo.log\n2\nabc\ndef");
 
+    const bundlePath = path.join(tmpDir, "bundle");
+    const codeqlPlatform =
+      process.platform === "win32"
+        ? "win64"
+        : process.platform === "darwin"
+        ? "osx64"
+        : "linux64";
+
     const codeQL = setCodeQL({
       async getTracerEnv() {
         return {
           ODASA_TRACER_CONFIGURATION: spec,
+          CODEQL_DIST: bundlePath,
+          CODEQL_PLATFORM: codeqlPlatform,
           foo: "bar",
         };
       },
     });
 
     const result = await getCombinedTracerConfig(config, codeQL);
+    t.notDeepEqual(result, undefined);
 
     const expectedEnv = {
       foo: "bar",
+      CODEQL_DIST: bundlePath,
+      CODEQL_PLATFORM: codeqlPlatform,
       ODASA_TRACER_CONFIGURATION: result!.spec,
     };
+
     if (process.platform === "darwin") {
       expectedEnv["DYLD_INSERT_LIBRARIES"] = path.join(
         path.dirname(codeQL.getPath()),
@@ -348,6 +364,23 @@ test("getCombinedTracerConfig - valid spec file", async (t) => {
       );
     }
 
+    if (process.platform === "win32") {
+      expectedEnv["CODEQL_RUNNER"] = path.join(
+        bundlePath,
+        "tools/win64/runner.exe"
+      );
+    } else if (process.platform === "darwin") {
+      expectedEnv["CODEQL_RUNNER"] = path.join(
+        bundlePath,
+        "tools/osx64/runner"
+      );
+    } else {
+      expectedEnv["CODEQL_RUNNER"] = path.join(
+        bundlePath,
+        "tools/linux64/runner"
+      );
+    }
+
     t.deepEqual(result, {
       spec: path.join(tmpDir, "compound-spec"),
       env: expectedEnv,

src/tracer-config.ts

@@ -185,5 +185,17 @@ export async function getCombinedTracerConfig(
     );
   }
 
+  // On macos it's necessary to prefix the build command with the runner exectuable
+  // on order to trace when System Integrity Protection is enabled.
+  // The exectuable also exists and works for other platforms so we output this env
+  // var with a path to the runner regardless so it's always available.
+  const runnerExeName = process.platform === "win32" ? "runner.exe" : "runner";
+  mainTracerConfig.env["CODEQL_RUNNER"] = path.join(
+    mainTracerConfig.env["CODEQL_DIST"],
+    "tools",
+    mainTracerConfig.env["CODEQL_PLATFORM"],
+    runnerExeName
+  );
+
   return mainTracerConfig;
 }

src/upload-lib.test.ts

@@ -1,8 +1,12 @@
+import * as fs from "fs";
+import * as path from "path";
+
 import test from "ava";
 
 import { getRunnerLogger } from "./logging";
 import { setupTests } from "./testing-utils";
 import * as uploadLib from "./upload-lib";
+import { GitHubVersion, withTmpDir } from "./util";
 
 setupTests(test);
 
@@ -19,3 +23,111 @@ test("validateSarifFileSchema - invalid", (t) => {
     uploadLib.validateSarifFileSchema(inputFile, getRunnerLogger(true))
   );
 });
+
+test("validate correct payload used per version", async (t) => {
+  const newVersions: GitHubVersion[] = [
+    { type: "dotcom" },
+    { type: "ghes", version: "3.1.0" },
+  ];
+  const oldVersions: GitHubVersion[] = [
+    { type: "ghes", version: "2.22.1" },
+    { type: "ghes", version: "3.0.0" },
+  ];
+  const allVersions = newVersions.concat(oldVersions);
+
+  process.env["GITHUB_EVENT_NAME"] = "push";
+  for (const version of allVersions) {
+    const payload: any = uploadLib.buildPayload(
+      "commit",
+      "refs/heads/master",
+      "key",
+      undefined,
+      "",
+      undefined,
+      "/opt/src",
+      undefined,
+      ["CodeQL", "eslint"],
+      version,
+      "actions"
+    );
+    // Not triggered by a pull request
+    t.falsy(payload.base_ref);
+    t.falsy(payload.base_sha);
+  }
+
+  process.env["GITHUB_EVENT_NAME"] = "pull_request";
+  process.env[
+    "GITHUB_EVENT_PATH"
+  ] = `${__dirname}/../src/testdata/pull_request.json`;
+  for (const version of newVersions) {
+    const payload: any = uploadLib.buildPayload(
+      "commit",
+      "refs/pull/123/merge",
+      "key",
+      undefined,
+      "",
+      undefined,
+      "/opt/src",
+      undefined,
+      ["CodeQL", "eslint"],
+      version,
+      "actions"
+    );
+    t.deepEqual(payload.base_ref, "refs/heads/master");
+    t.deepEqual(payload.base_sha, "f95f852bd8fca8fcc58a9a2d6c842781e32a215e");
+  }
+
+  for (const version of oldVersions) {
+    const payload: any = uploadLib.buildPayload(
+      "commit",
+      "refs/pull/123/merge",
+      "key",
+      undefined,
+      "",
+      undefined,
+      "/opt/src",
+      undefined,
+      ["CodeQL", "eslint"],
+      version,
+      "actions"
+    );
+    // These older versions won't expect these values
+    t.falsy(payload.base_ref);
+    t.falsy(payload.base_sha);
+  }
+});
+
+test("finding SARIF files", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    // include a couple of sarif files
+    fs.writeFileSync(path.join(tmpDir, "a.sarif"), "");
+    fs.writeFileSync(path.join(tmpDir, "b.sarif"), "");
+
+    // other random files shouldn't be returned
+    fs.writeFileSync(path.join(tmpDir, "c.foo"), "");
+
+    // we should recursively look in subdirectories
+    fs.mkdirSync(path.join(tmpDir, "dir1"));
+    fs.writeFileSync(path.join(tmpDir, "dir1", "d.sarif"), "");
+    fs.mkdirSync(path.join(tmpDir, "dir1", "dir2"));
+    fs.writeFileSync(path.join(tmpDir, "dir1", "dir2", "e.sarif"), "");
+
+    // we should ignore symlinks
+    fs.mkdirSync(path.join(tmpDir, "dir3"));
+    fs.symlinkSync(tmpDir, path.join(tmpDir, "dir3", "symlink1"), "dir");
+    fs.symlinkSync(
+      path.join(tmpDir, "a.sarif"),
+      path.join(tmpDir, "dir3", "symlink2.sarif"),
+      "file"
+    );
+
+    const sarifFiles = uploadLib.findSarifFilesInDir(tmpDir);
+
+    t.deepEqual(sarifFiles, [
+      path.join(tmpDir, "a.sarif"),
+      path.join(tmpDir, "b.sarif"),
+      path.join(tmpDir, "dir1", "d.sarif"),
+      path.join(tmpDir, "dir1", "dir2", "e.sarif"),
+    ]);
+  });
+});

src/upload-lib.ts

@@ -5,6 +5,7 @@ import zlib from "zlib";
 import * as core from "@actions/core";
 import fileUrl from "file-url";
 import * as jsonschema from "jsonschema";
+import * as semver from "semver";
 
 import * as api from "./api-client";
 import * as fingerprints from "./fingerprints";
@@ -55,7 +56,7 @@ async function uploadPayload(
     return;
   }
 
-  const client = api.getApiClient(apiDetails, mode, logger);
+  const client = api.getApiClient(apiDetails);
 
   const reqURL =
     mode === "actions"
@@ -80,44 +81,43 @@ export interface UploadStatusReport {
   num_results_in_sarif?: number;
 }
 
+// Recursively walks a directory and returns all SARIF files it finds.
+// Does not follow symlinks.
+export function findSarifFilesInDir(sarifPath: string): string[] {
+  const sarifFiles: string[] = [];
+  const walkSarifFiles = (dir: string) => {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isFile() && entry.name.endsWith(".sarif")) {
+        sarifFiles.push(path.resolve(dir, entry.name));
+      } else if (entry.isDirectory()) {
+        walkSarifFiles(path.resolve(dir, entry.name));
+      }
+    }
+  };
+  walkSarifFiles(sarifPath);
+  return sarifFiles;
+}
+
 // Uploads a single sarif file or a directory of sarif files
 // depending on what the path happens to refer to.
 // Returns true iff the upload occurred and succeeded
-export async function upload(
+export async function uploadFromActions(
   sarifPath: string,
   repositoryNwo: RepositoryNwo,
   commitOid: string,
   ref: string,
-  analysisKey: string | undefined,
-  analysisName: string | undefined,
-  workflowRunID: number | undefined,
+  analysisKey: string,
+  analysisName: string,
+  workflowRunID: number,
   checkoutPath: string,
-  environment: string | undefined,
+  environment: string,
+  gitHubVersion: util.GitHubVersion,
   apiDetails: api.GitHubApiDetails,
-  mode: util.Mode,
   logger: Logger
 ): Promise<UploadStatusReport> {
-  const sarifFiles: string[] = [];
-  if (!fs.existsSync(sarifPath)) {
-    throw new Error(`Path does not exist: ${sarifPath}`);
-  }
-  if (fs.lstatSync(sarifPath).isDirectory()) {
-    const paths = fs
-      .readdirSync(sarifPath)
-      .filter((f) => f.endsWith(".sarif"))
-      .map((f) => path.resolve(sarifPath, f));
-    for (const filepath of paths) {
-      sarifFiles.push(filepath);
-    }
-    if (sarifFiles.length === 0) {
-      throw new Error(`No SARIF files found to upload in "${sarifPath}".`);
-    }
-  } else {
-    sarifFiles.push(sarifPath);
-  }
-
   return await uploadFiles(
-    sarifFiles,
+    getSarifFilePaths(sarifPath),
     repositoryNwo,
     commitOid,
     ref,
@@ -126,12 +126,60 @@ export async function upload(
     workflowRunID,
     checkoutPath,
     environment,
+    gitHubVersion,
     apiDetails,
-    mode,
+    "actions",
     logger
   );
 }
 
+// Uploads a single sarif file or a directory of sarif files
+// depending on what the path happens to refer to.
+// Returns true iff the upload occurred and succeeded
+export async function uploadFromRunner(
+  sarifPath: string,
+  repositoryNwo: RepositoryNwo,
+  commitOid: string,
+  ref: string,
+  checkoutPath: string,
+  gitHubVersion: util.GitHubVersion,
+  apiDetails: api.GitHubApiDetails,
+  logger: Logger
+): Promise<UploadStatusReport> {
+  return await uploadFiles(
+    getSarifFilePaths(sarifPath),
+    repositoryNwo,
+    commitOid,
+    ref,
+    undefined,
+    undefined,
+    undefined,
+    checkoutPath,
+    undefined,
+    gitHubVersion,
+    apiDetails,
+    "runner",
+    logger
+  );
+}
+
+function getSarifFilePaths(sarifPath: string) {
+  if (!fs.existsSync(sarifPath)) {
+    throw new Error(`Path does not exist: ${sarifPath}`);
+  }
+
+  let sarifFiles: string[];
+  if (fs.lstatSync(sarifPath).isDirectory()) {
+    sarifFiles = findSarifFilesInDir(sarifPath);
+    if (sarifFiles.length === 0) {
+      throw new Error(`No SARIF files found to upload in "${sarifPath}".`);
+    }
+  } else {
+    sarifFiles = [sarifPath];
+  }
+  return sarifFiles;
+}
+
 // Counts the number of results in the given SARIF file
 export function countResultsInSarif(sarif: string): number {
   let numResults = 0;
@@ -167,6 +215,65 @@ export function validateSarifFileSchema(sarifFilePath: string, logger: Logger) {
   }
 }
 
+// buildPayload constructs a map ready to be uploaded to the API from the given
+// parameters, respecting the current mode and target GitHub instance version.
+export function buildPayload(
+  commitOid: string,
+  ref: string,
+  analysisKey: string | undefined,
+  analysisName: string | undefined,
+  zippedSarif: string,
+  workflowRunID: number | undefined,
+  checkoutURI: string,
+  environment: string | undefined,
+  toolNames: string[],
+  gitHubVersion: util.GitHubVersion,
+  mode: util.Mode
+) {
+  if (mode === "actions") {
+    const payloadObj = {
+      commit_oid: commitOid,
+      ref,
+      analysis_key: analysisKey,
+      analysis_name: analysisName,
+      sarif: zippedSarif,
+      workflow_run_id: workflowRunID,
+      checkout_uri: checkoutURI,
+      environment,
+      started_at: process.env[sharedEnv.CODEQL_WORKFLOW_STARTED_AT],
+      tool_names: toolNames,
+      base_ref: undefined as undefined | string,
+      base_sha: undefined as undefined | string,
+    };
+
+    // This behaviour can be made the default when support for GHES 3.0 is discontinued.
+    if (
+      gitHubVersion.type === "dotcom" ||
+      semver.satisfies(gitHubVersion.version, `>=3.1`)
+    ) {
+      if (
+        process.env.GITHUB_EVENT_NAME === "pull_request" &&
+        process.env.GITHUB_EVENT_PATH
+      ) {
+        const githubEvent = JSON.parse(
+          fs.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8")
+        );
+        payloadObj.base_ref = `refs/heads/${githubEvent.pull_request.base.ref}`;
+        payloadObj.base_sha = githubEvent.pull_request.base.sha;
+      }
+    }
+    return payloadObj;
+  } else {
+    return {
+      commit_sha: commitOid,
+      ref,
+      sarif: zippedSarif,
+      checkout_uri: checkoutURI,
+      tool_name: toolNames[0],
+    };
+  }
+}
+
 // Uploads the given set of sarif files.
 // Returns true iff the upload occurred and succeeded
 async function uploadFiles(
@@ -179,6 +286,7 @@ async function uploadFiles(
   workflowRunID: number | undefined,
   checkoutPath: string,
   environment: string | undefined,
+  gitHubVersion: util.GitHubVersion,
   apiDetails: api.GitHubApiDetails,
   mode: util.Mode,
   logger: Logger
@@ -208,39 +316,29 @@ async function uploadFiles(
     logger
   );
 
-  const zipped_sarif = zlib.gzipSync(sarifPayload).toString("base64");
+  const zippedSarif = zlib.gzipSync(sarifPayload).toString("base64");
   const checkoutURI = fileUrl(checkoutPath);
 
   const toolNames = util.getToolNames(sarifPayload);
 
-  let payload: string;
-  if (mode === "actions") {
-    payload = JSON.stringify({
-      commit_oid: commitOid,
-      ref,
-      analysis_key: analysisKey,
-      analysis_name: analysisName,
-      sarif: zipped_sarif,
-      workflow_run_id: workflowRunID,
-      checkout_uri: checkoutURI,
-      environment,
-      started_at: process.env[sharedEnv.CODEQL_WORKFLOW_STARTED_AT],
-      tool_names: toolNames,
-    });
-  } else {
-    payload = JSON.stringify({
-      commit_sha: commitOid,
-      ref,
-      sarif: zipped_sarif,
-      checkout_uri: checkoutURI,
-      tool_name: toolNames[0],
-    });
-  }
+  const payload = buildPayload(
+    commitOid,
+    ref,
+    analysisKey,
+    analysisName,
+    zippedSarif,
+    workflowRunID,
+    checkoutURI,
+    environment,
+    toolNames,
+    gitHubVersion,
+    mode
+  );
 
   // Log some useful debug info about the info
   const rawUploadSizeBytes = sarifPayload.length;
   logger.debug(`Raw upload size: ${rawUploadSizeBytes} bytes`);
-  const zippedUploadSizeBytes = zipped_sarif.length;
+  const zippedUploadSizeBytes = zippedSarif.length;
   logger.debug(`Base64 zipped upload size: ${zippedUploadSizeBytes} bytes`);
   const numResultInSarif = countResultsInSarif(sarifPayload);
   logger.debug(`Number of results in upload: ${numResultInSarif}`);

src/upload-sarif-action.ts

@@ -4,6 +4,7 @@ import * as actionsUtil from "./actions-util";
 import { getActionsLogger } from "./logging";
 import { parseRepositoryNwo } from "./repository";
 import * as upload_lib from "./upload-lib";
+import { getGitHubVersion } from "./util";
 
 interface UploadSarifStatusReport
   extends actionsUtil.StatusReportBase,
@@ -45,7 +46,9 @@ async function run() {
       url: actionsUtil.getRequiredEnvParam("GITHUB_SERVER_URL"),
     };
 
-    const uploadStats = await upload_lib.upload(
+    const gitHubVersion = await getGitHubVersion(apiDetails);
+
+    const uploadStats = await upload_lib.uploadFromActions(
       actionsUtil.getRequiredInput("sarif_file"),
       parseRepositoryNwo(actionsUtil.getRequiredEnvParam("GITHUB_REPOSITORY")),
       await actionsUtil.getCommitOid(),
@@ -55,8 +58,8 @@ async function run() {
       actionsUtil.getWorkflowRunID(),
       actionsUtil.getRequiredInput("checkout_path"),
       actionsUtil.getRequiredInput("matrix"),
+      gitHubVersion,
       apiDetails,
-      "actions",
       getActionsLogger()
     );
     await sendSuccessStatusReport(startedAt, uploadStats);

src/util.test.ts

@@ -1,8 +1,11 @@
 import * as fs from "fs";
 import * as os from "os";
 
+import * as github from "@actions/github";
 import test from "ava";
+import sinon from "sinon";
 
+import * as api from "./api-client";
 import { getRunnerLogger } from "./logging";
 import { setupTests } from "./testing-utils";
 import * as util from "./util";
@@ -179,3 +182,58 @@ test("parseGithubUrl", (t) => {
     message: '"http:///::::433" is not a valid URL',
   });
 });
+
+test("allowed API versions", async (t) => {
+  t.is(util.apiVersionInRange("1.33.0", "1.33", "2.0"), undefined);
+  t.is(util.apiVersionInRange("1.33.1", "1.33", "2.0"), undefined);
+  t.is(util.apiVersionInRange("1.34.0", "1.33", "2.0"), undefined);
+  t.is(util.apiVersionInRange("2.0.0", "1.33", "2.0"), undefined);
+  t.is(util.apiVersionInRange("2.0.1", "1.33", "2.0"), undefined);
+  t.is(
+    util.apiVersionInRange("1.32.0", "1.33", "2.0"),
+    util.DisallowedAPIVersionReason.ACTION_TOO_NEW
+  );
+  t.is(
+    util.apiVersionInRange("2.1.0", "1.33", "2.0"),
+    util.DisallowedAPIVersionReason.ACTION_TOO_OLD
+  );
+});
+
+function mockGetMetaVersionHeader(
+  versionHeader: string | undefined
+): sinon.SinonStub<any, any> {
+  // Passing an auth token is required, so we just use a dummy value
+  const client = github.getOctokit("123");
+  const response = {
+    headers: {
+      "x-github-enterprise-version": versionHeader,
+    },
+  };
+  const spyGetContents = sinon
+    .stub(client.meta, "get")
+    .resolves(response as any);
+  sinon.stub(api, "getApiClient").value(() => client);
+  return spyGetContents;
+}
+
+test("getGitHubVersion", async (t) => {
+  const v = await util.getGitHubVersion({
+    auth: "",
+    url: "https://github.com",
+  });
+  t.deepEqual("dotcom", v.type);
+
+  mockGetMetaVersionHeader("2.0");
+  const v2 = await util.getGitHubVersion({
+    auth: "",
+    url: "https://ghe.example.com",
+  });
+  t.deepEqual({ type: "ghes", version: "2.0" }, v2);
+
+  mockGetMetaVersionHeader(undefined);
+  const v3 = await util.getGitHubVersion({
+    auth: "",
+    url: "https://ghe.example.com",
+  });
+  t.deepEqual({ type: "dotcom" }, v3);
+});

src/util.ts

@@ -2,6 +2,11 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 
+import * as core from "@actions/core";
+import * as semver from "semver";
+
+import { getApiClient, GitHubApiDetails } from "./api-client";
+import * as apiCompatibility from "./api-compatibility.json";
 import { Language } from "./languages";
 import { Logger } from "./logging";
 
@@ -208,3 +213,91 @@ export function parseGithubUrl(inputUrl: string): string {
 
   return url.toString();
 }
+
+const GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
+const CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR =
+  "CODEQL_ACTION_WARNED_ABOUT_VERSION";
+let hasBeenWarnedAboutVersion = false;
+
+export type GitHubVersion =
+  | { type: "dotcom" }
+  | { type: "ghes"; version: string };
+
+export async function getGitHubVersion(
+  apiDetails: GitHubApiDetails
+): Promise<GitHubVersion> {
+  // We can avoid making an API request in the standard dotcom case
+  if (parseGithubUrl(apiDetails.url) === GITHUB_DOTCOM_URL) {
+    return { type: "dotcom" };
+  }
+
+  // Doesn't strictly have to be the meta endpoint as we're only
+  // using the response headers which are available on every request.
+  const apiClient = getApiClient(apiDetails);
+  const response = await apiClient.meta.get();
+
+  // This happens on dotcom, although we expect to have already returned in that
+  // case. This can also serve as a fallback in cases we haven't foreseen.
+  if (response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] === undefined) {
+    return { type: "dotcom" };
+  }
+
+  const version = response.headers[GITHUB_ENTERPRISE_VERSION_HEADER] as string;
+  return { type: "ghes", version };
+}
+
+export function checkGitHubVersionInRange(
+  version: GitHubVersion,
+  mode: Mode,
+  logger: Logger
+) {
+  if (hasBeenWarnedAboutVersion || version.type !== "ghes") {
+    return;
+  }
+
+  const disallowedAPIVersionReason = apiVersionInRange(
+    version.version,
+    apiCompatibility.minimumVersion,
+    apiCompatibility.maximumVersion
+  );
+
+  const toolName = mode === "actions" ? "Action" : "Runner";
+
+  if (
+    disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_OLD
+  ) {
+    logger.warning(
+      `The CodeQL ${toolName} version you are using is too old to be compatible with GitHub Enterprise ${version.version}. If you experience issues, please upgrade to a more recent version of the CodeQL ${toolName}.`
+    );
+  }
+  if (
+    disallowedAPIVersionReason === DisallowedAPIVersionReason.ACTION_TOO_NEW
+  ) {
+    logger.warning(
+      `GitHub Enterprise ${version.version} is too old to be compatible with this version of the CodeQL ${toolName}. If you experience issues, please upgrade to a more recent version of GitHub Enterprise or use an older version of the CodeQL ${toolName}.`
+    );
+  }
+  hasBeenWarnedAboutVersion = true;
+  if (mode === "actions") {
+    core.exportVariable(CODEQL_ACTION_WARNED_ABOUT_VERSION_ENV_VAR, true);
+  }
+}
+
+export enum DisallowedAPIVersionReason {
+  ACTION_TOO_OLD,
+  ACTION_TOO_NEW,
+}
+
+export function apiVersionInRange(
+  version: string,
+  minimumVersion: string,
+  maximumVersion: string
+): DisallowedAPIVersionReason | undefined {
+  if (!semver.satisfies(version, `>=${minimumVersion}`)) {
+    return DisallowedAPIVersionReason.ACTION_TOO_NEW;
+  }
+  if (!semver.satisfies(version, `<=${maximumVersion}`)) {
+    return DisallowedAPIVersionReason.ACTION_TOO_OLD;
+  }
+  return undefined;
+}

upload-sarif/action.yml

@@ -3,7 +3,7 @@ description: 'Upload the analysis results'
 author: 'GitHub'
 inputs:
   sarif_file:
-    description: The SARIF file or directory of SARIF files to be uploaded.
+    description: The SARIF file or directory of SARIF files to be uploaded. Each upload should contain a maximum of 1000 results, any additional results are ignored.
     required: false
     default: '../results'
   checkout_path: