Merge pull request #1516 from aibaars/auth-parameter

Supply authorization parameter to toolcache.downloadTool()

CHANGELOG.md

@@ -1,5 +1,13 @@
 # CodeQL Action Changelog
 
+## [UNRELEASED]
+
+No user facing changes.
+
+## 2.2.1 - 27 Jan 2023
+
+No user facing changes.
+
 ## 2.2.0 - 26 Jan 2023
 
 - Improve stability when choosing the default version of CodeQL to use in code scanning workflow runs on Actions on GitHub.com. [#1475](https://github.com/github/codeql-action/pull/1475)

lib/codeql.test.js

@@ -157,7 +157,7 @@ function mockApiDetails(apiDetails) {
             t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
             t.is(result.toolsVersion, `0.0.0-${version}`);
             t.is(result.toolsSource, init_1.ToolsSource.Download);
-            t.is(typeof result.toolsDownloadDurationMs, "number");
+            t.assert(Number.isInteger(result.toolsDownloadDurationMs));
         }
         t.is(toolcache.findAllVersions("CodeQL").length, 2);
     });
@@ -177,7 +177,7 @@ function mockApiDetails(apiDetails) {
         t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
         t.deepEqual(result.toolsVersion, "0.0.0-20200610");
         t.is(result.toolsSource, init_1.ToolsSource.Download);
-        t.not(result.toolsDownloadDurationMs, undefined);
+        t.assert(Number.isInteger(result.toolsDownloadDurationMs));
     });
 });
 const EXPLICITLY_REQUESTED_BUNDLE_TEST_CASES = [
@@ -212,7 +212,7 @@ for (const { cliVersion, expectedToolcacheVersion, } of EXPLICITLY_REQUESTED_BUN
             t.assert(toolcache.find("CodeQL", expectedToolcacheVersion));
             t.deepEqual(result.toolsVersion, cliVersion);
             t.is(result.toolsSource, init_1.ToolsSource.Download);
-            t.not(result.toolsDownloadDurationMs, undefined);
+            t.assert(Number.isInteger(result.toolsDownloadDurationMs));
         });
     });
 }
@@ -302,7 +302,7 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
             }, (0, logging_1.getRunnerLogger)(true), false);
             t.deepEqual(result.toolsVersion, defaults.cliVersion);
             t.is(result.toolsSource, init_1.ToolsSource.Download);
-            t.is(typeof result.toolsDownloadDurationMs, "number");
+            t.assert(Number.isInteger(result.toolsDownloadDurationMs));
             const cachedVersions = toolcache.findAllVersions("CodeQL");
             t.is(cachedVersions.length, 2);
         });
@@ -322,7 +322,7 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
         const result = await codeql.setupCodeQL("latest", sampleApiDetails, tmpDir, util.GitHubVariant.DOTCOM, false, SAMPLE_DEFAULT_CLI_VERSION, (0, logging_1.getRunnerLogger)(true), false);
         t.deepEqual(result.toolsVersion, defaults.cliVersion);
         t.is(result.toolsSource, init_1.ToolsSource.Download);
-        t.is(typeof result.toolsDownloadDurationMs, "number");
+        t.assert(Number.isInteger(result.toolsDownloadDurationMs));
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 2);
     });
@@ -359,7 +359,7 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
             variant: util.GitHubVariant.GHAE,
         }, (0, logging_1.getRunnerLogger)(true), false);
         t.is(result.toolsSource, init_1.ToolsSource.Download);
-        t.is(typeof result.toolsDownloadDurationMs, "number");
+        t.assert(Number.isInteger(result.toolsDownloadDurationMs));
         const cachedVersions = toolcache.findAllVersions("CodeQL");
         t.is(cachedVersions.length, 1);
     });

lib/setup-codeql.js

@@ -411,12 +411,13 @@ async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, t
     // from the same GitHub instance the Action is running on.
     // This avoids leaking Enterprise tokens to dotcom.
     // We also don't want to send an authorization header if there's already a token provided in the URL.
+    let authorization = undefined;
     if (searchParams.has("token")) {
         logger.debug("CodeQL tools URL contains an authorization token.");
     }
     else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
         logger.debug("Providing an authorization token to download CodeQL tools.");
-        headers.authorization = `token ${apiDetails.auth}`;
+        authorization = `token ${apiDetails.auth}`;
     }
     else {
         logger.debug("Downloading CodeQL tools without an authorization token.");
@@ -425,8 +426,8 @@ async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, t
     const dest = path.join(tempDir, (0, uuid_1.v4)());
     const finalHeaders = Object.assign({ "User-Agent": "CodeQL Action" }, headers);
     const toolsDownloadStart = perf_hooks_1.performance.now();
-    const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, undefined, finalHeaders);
-    const toolsDownloadDurationMs = perf_hooks_1.performance.now() - toolsDownloadStart;
+    const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, authorization, finalHeaders);
+    const toolsDownloadDurationMs = Math.round(perf_hooks_1.performance.now() - toolsDownloadStart);
     logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
     const codeqlExtracted = await toolcache.extractTar(codeqlPath);
     const bundleVersion = getBundleVersionFromUrl(codeqlURL);

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.2.0",
+      "version": "2.2.2",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

src/codeql.test.ts

@@ -208,7 +208,7 @@ test("downloads and caches explicitly requested bundles that aren't in the toolc
       t.assert(toolcache.find("CodeQL", `0.0.0-${version}`));
       t.is(result.toolsVersion, `0.0.0-${version}`);
       t.is(result.toolsSource, ToolsSource.Download);
-      t.is(typeof result.toolsDownloadDurationMs, "number");
+      t.assert(Number.isInteger(result.toolsDownloadDurationMs));
     }
 
     t.is(toolcache.findAllVersions("CodeQL").length, 2);
@@ -241,7 +241,7 @@ test("downloads an explicitly requested bundle even if a different version is ca
     t.assert(toolcache.find("CodeQL", "0.0.0-20200610"));
     t.deepEqual(result.toolsVersion, "0.0.0-20200610");
     t.is(result.toolsSource, ToolsSource.Download);
-    t.not(result.toolsDownloadDurationMs, undefined);
+    t.assert(Number.isInteger(result.toolsDownloadDurationMs));
   });
 });
 
@@ -293,7 +293,7 @@ for (const {
       t.assert(toolcache.find("CodeQL", expectedToolcacheVersion));
       t.deepEqual(result.toolsVersion, cliVersion);
       t.is(result.toolsSource, ToolsSource.Download);
-      t.not(result.toolsDownloadDurationMs, undefined);
+      t.assert(Number.isInteger(result.toolsDownloadDurationMs));
     });
   });
 }
@@ -428,7 +428,7 @@ for (const variant of [util.GitHubVariant.GHAE, util.GitHubVariant.GHES]) {
       );
       t.deepEqual(result.toolsVersion, defaults.cliVersion);
       t.is(result.toolsSource, ToolsSource.Download);
-      t.is(typeof result.toolsDownloadDurationMs, "number");
+      t.assert(Number.isInteger(result.toolsDownloadDurationMs));
 
       const cachedVersions = toolcache.findAllVersions("CodeQL");
       t.is(cachedVersions.length, 2);
@@ -461,7 +461,7 @@ test('downloads bundle if "latest" tools specified but not cached', async (t) =>
     );
     t.deepEqual(result.toolsVersion, defaults.cliVersion);
     t.is(result.toolsSource, ToolsSource.Download);
-    t.is(typeof result.toolsDownloadDurationMs, "number");
+    t.assert(Number.isInteger(result.toolsDownloadDurationMs));
 
     const cachedVersions = toolcache.findAllVersions("CodeQL");
     t.is(cachedVersions.length, 2);
@@ -527,7 +527,7 @@ test("download codeql bundle from github ae endpoint", async (t) => {
     );
 
     t.is(result.toolsSource, ToolsSource.Download);
-    t.is(typeof result.toolsDownloadDurationMs, "number");
+    t.assert(Number.isInteger(result.toolsDownloadDurationMs));
 
     const cachedVersions = toolcache.findAllVersions("CodeQL");
     t.is(cachedVersions.length, 1);

src/setup-codeql.ts

@@ -543,11 +543,12 @@ export async function downloadCodeQL(
   // from the same GitHub instance the Action is running on.
   // This avoids leaking Enterprise tokens to dotcom.
   // We also don't want to send an authorization header if there's already a token provided in the URL.
+  let authorization: string | undefined = undefined;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
   } else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
     logger.debug("Providing an authorization token to download CodeQL tools.");
-    headers.authorization = `token ${apiDetails.auth}`;
+    authorization = `token ${apiDetails.auth}`;
   } else {
     logger.debug("Downloading CodeQL tools without an authorization token.");
   }
@@ -565,10 +566,12 @@ export async function downloadCodeQL(
   const codeqlPath = await toolcache.downloadTool(
     codeqlURL,
     dest,
-    undefined,
+    authorization,
     finalHeaders
   );
-  const toolsDownloadDurationMs = performance.now() - toolsDownloadStart;
+  const toolsDownloadDurationMs = Math.round(
+    performance.now() - toolsDownloadStart
+  );
 
   logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);