Disable SIP disablement check

Add testing trigger
2026-08-05 13:02:04 -05:00 · 2025-10-28 12:27:34 +00:00 · 2025-10-28 12:26:18 +00:00
58 changed files with 73890 additions and 13714 deletions
@@ -16,5 +16,5 @@ inputs:
      Comma separated list of query ids that should NOT be included in this SARIF file.

 runs:
-  using: node20
+  using: node24
  main: index.js
@@ -79,7 +79,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.os }}-zstd-bundle.sarif
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -67,7 +67,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -78,7 +78,7 @@ jobs:
          output: ${{ runner.temp }}/results
          upload-database: false
      - name: Upload SARIF
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -85,7 +85,7 @@ jobs:
        with:
          output: ${{ runner.temp }}/results
      - name: Upload SARIF
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -64,7 +64,7 @@ jobs:
        with:
          output: ${{ runner.temp }}/results
      - name: Upload SARIF
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
          path: ${{ runner.temp }}/results/javascript.sarif
@@ -9,9 +9,6 @@ env:
  GO111MODULE: auto
 on:
  push:
-    branches:
-      - main
-      - releases/v*
  pull_request:
    types:
      - opened
@@ -56,42 +53,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - os: macos-latest
-            version: stable-v2.17.6
-          - os: ubuntu-latest
-            version: stable-v2.17.6
-          - os: macos-latest
-            version: stable-v2.18.4
-          - os: ubuntu-latest
-            version: stable-v2.18.4
-          - os: macos-latest
-            version: stable-v2.19.4
-          - os: ubuntu-latest
-            version: stable-v2.19.4
-          - os: macos-latest
-            version: stable-v2.20.7
-          - os: ubuntu-latest
-            version: stable-v2.20.7
-          - os: macos-latest
-            version: stable-v2.21.4
-          - os: ubuntu-latest
-            version: stable-v2.21.4
-          - os: macos-latest
-            version: stable-v2.22.4
-          - os: ubuntu-latest
-            version: stable-v2.22.4
-          - os: macos-latest
-            version: default
-          - os: ubuntu-latest
-            version: default
          - os: macos-latest
            version: linked
-          - os: ubuntu-latest
-            version: linked
-          - os: macos-latest
-            version: nightly-latest
-          - os: ubuntu-latest
-            version: nightly-latest
    name: Multi-language repository
    if: github.triggering_actor != 'dependabot[bot]'
    permissions:
@@ -185,6 +148,3 @@ jobs:
            echo "Did not create a database for Swift, or created it in the wrong location."
            exit 1
          fi
-    env:
-      CODEQL_ACTION_RESOLVE_SUPPORTED_LANGUAGES_USING_CLI: true
-      CODEQL_ACTION_TEST_MODE: true
@@ -83,7 +83,7 @@ jobs:
          post-processed-sarif-path: ${{ runner.temp }}/post-processed
      - name: Upload security SARIF
        if: contains(matrix.analysis-kinds, 'code-scanning')
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: |
            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -91,14 +91,14 @@ jobs:
          retention-days: 7
      - name: Upload quality SARIF
        if: contains(matrix.analysis-kinds, 'code-quality')
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: |
            quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
          path: ${{ runner.temp }}/results/javascript.quality.sarif
          retention-days: 7
      - name: Upload post-processed SARIF
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v4
        with:
          name: |
            post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -56,7 +56,7 @@ jobs:
          use-all-platform-bundle: 'false'
          setup-kotlin: 'true'
      - name: Set up Ruby
-        uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0
+        uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
        with:
          ruby-version: 2.6
      - name: Install Code Scanning integration
@@ -2,27 +2,27 @@

 See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.

-## 3.31.1 - 30 Oct 2025
+## [UNRELEASED]

- The `add-snippets` input has been removed from the `analyze` action. This input has been deprecated since CodeQL Action 3.26.4 in August 2024 when this removal was announced.
+No user facing changes.

-## 3.31.0 - 24 Oct 2025
+## 4.31.0 - 24 Oct 2025

 - Bump minimum CodeQL bundle version to 2.17.6. [#3223](https://github.com/github/codeql-action/pull/3223)
 - When SARIF files are uploaded by the `analyze` or `upload-sarif` actions, the CodeQL Action automatically performs post-processing steps to prepare the data for the upload. Previously, these post-processing steps were only performed before an upload took place. We are now changing this so that the post-processing steps will always be performed, even when the SARIF files are not uploaded. This does not change anything for the `upload-sarif` action. For `analyze`, this may affect Advanced Setup for CodeQL users who specify a value other than `always` for the `upload` input. [#3222](https://github.com/github/codeql-action/pull/3222)

-## 3.30.9 - 17 Oct 2025
+## 4.30.9 - 17 Oct 2025

 - Update default CodeQL bundle version to 2.23.3. [#3205](https://github.com/github/codeql-action/pull/3205)
 - Experimental: A new `setup-codeql` action has been added which is similar to `init`, except it only installs the CodeQL CLI and does not initialize a database. Do not use this in production as it is part of an internal experiment and subject to change at any time. [#3204](https://github.com/github/codeql-action/pull/3204)

-## 3.30.8 - 10 Oct 2025
+## 4.30.8 - 10 Oct 2025

 No user facing changes.

-## 3.30.7 - 06 Oct 2025
+## 4.30.7 - 06 Oct 2025

-No user facing changes.
+- [v4+ only] The CodeQL Action now runs on Node.js v24. [#3169](https://github.com/github/codeql-action/pull/3169)

 ## 3.30.6 - 02 Oct 2025

@@ -258,13 +258,17 @@ No user facing changes.
 ## 3.26.12 - 07 Oct 2024

 - _Upcoming breaking change_: Add a deprecation warning for customers using CodeQL version 2.14.5 and earlier. These versions of CodeQL were discontinued on 24 September 2024 alongside GitHub Enterprise Server 3.10, and will be unsupported by CodeQL Action versions 3.27.0 and later and versions 2.27.0 and later. [#2520](https://github.com/github/codeql-action/pull/2520)
+
  - If you are using one of these versions, please update to CodeQL CLI version 2.14.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
+
  - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.13.5 and 2.14.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.26.11` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.26.11` in your code scanning workflow to ensure you continue using this version of the CodeQL Action.

 ## 3.26.11 - 03 Oct 2024

 - _Upcoming breaking change_: Add support for using `actions/download-artifact@v4` to programmatically consume CodeQL Action debug artifacts.
+
  Starting November 30, 2024, GitHub.com customers will [no longer be able to use `actions/download-artifact@v3`](https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/). Therefore, to avoid breakage, customers who programmatically download the CodeQL Action debug artifacts should set the `CODEQL_ACTION_ARTIFACT_V4_UPGRADE` environment variable to `true` and bump `actions/download-artifact@v3` to `actions/download-artifact@v4` in their workflows. The CodeQL Action will enable this behavior by default in early November and workflows that have not yet bumped `actions/download-artifact@v3` to `actions/download-artifact@v4` will begin failing then.
+
  This change is currently unavailable for GitHub Enterprise Server customers, as `actions/upload-artifact@v4` and `actions/download-artifact@v4` are not yet compatible with GHES.
 - Update default CodeQL bundle version to 2.19.1. [#2519](https://github.com/github/codeql-action/pull/2519)

@@ -387,9 +391,12 @@ No user facing changes.
 ## 3.25.0 - 15 Apr 2024

 - The deprecated feature for extracting dependencies for a Python analysis has been removed. [#2224](https://github.com/github/codeql-action/pull/2224)
+
  As a result, the following inputs and environment variables are now ignored:
+
  - The `setup-python-dependencies` input to the `init` Action
  - The `CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION` environment variable
+
  We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.
 - Automatically overwrite an existing database if found on the filesystem. [#2229](https://github.com/github/codeql-action/pull/2229)
 - Bump the minimum CodeQL bundle version to 2.12.6. [#2232](https://github.com/github/codeql-action/pull/2232)
@@ -32,10 +32,14 @@ inputs:
      and 13GB for macOS).
    required: false
  add-snippets:
-    description: Does not have any effect.
+    description: Specify whether or not to add code snippets to the output sarif file.
    required: false
+    default: "false"
    deprecationMessage: >-
-      The input "add-snippets" has been removed and no longer has any effect.
+      The input "add-snippets" is deprecated and will be removed on the first release in August 2025.
+      When this input is set to true it is expected to add code snippets with an alert to the SARIF file.
+      However, since Code Scanning ignores code snippets provided as part of a SARIF file this is currently
+      a no operation. No alternative is available.
  skip-queries:
    description: If this option is set, the CodeQL database will be built but no queries will be run on it. Thus, no results will be produced.
    required: false
@@ -94,6 +98,6 @@ outputs:
  sarif-id:
    description: The ID of the uploaded SARIF file.
 runs:
-  using: node20
+  using: node24
  main: "../lib/analyze-action.js"
  post: "../lib/analyze-action-post.js"
@@ -15,5 +15,5 @@ inputs:
      $GITHUB_WORKSPACE as its working directory.
    required: false
 runs:
-  using: node20
+  using: node24
  main: '../lib/autobuild-action.js'
@@ -165,6 +165,6 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary used for analysis
 runs:
-  using: node20
+  using: node24
  main: '../lib/init-action.js'
  post: '../lib/init-action-post.js'
@@ -1,6 +1,6 @@
 {
  "name": "codeql",
-  "version": "3.31.1",
+  "version": "4.31.1",
  "private": true,
  "description": "CodeQL action",
  "scripts": {
@@ -24,7 +24,7 @@
  },
  "license": "MIT",
  "dependencies": {
-    "@actions/artifact": "^4.0.0",
+    "@actions/artifact": "^2.3.1",
    "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2",
    "@actions/cache": "^4.1.0",
    "@actions/core": "^1.11.1",
@@ -39,6 +39,7 @@
    "@schemastore/package": "0.0.10",
    "archiver": "^7.0.1",
    "console-log-level": "^1.4.1",
+    "del": "^8.0.0",
    "fast-deep-equal": "^3.1.3",
    "follow-redirects": "^1.15.11",
    "get-folder-size": "^5.0.0",
@@ -56,8 +57,8 @@
    "@eslint/eslintrc": "^3.3.1",
    "@eslint/js": "^9.38.0",
    "@microsoft/eslint-formatter-sarif": "^3.1.0",
-    "@octokit/types": "^15.0.1",
-    "@types/archiver": "^6.0.4",
+    "@octokit/types": "^15.0.0",
+    "@types/archiver": "^6.0.3",
    "@types/console-log-level": "^1.4.5",
    "@types/follow-redirects": "^1.14.4",
    "@types/js-yaml": "^4.0.9",
@@ -65,7 +66,7 @@
    "@types/node-forge": "^1.3.14",
    "@types/semver": "^7.7.1",
    "@types/sinon": "^17.0.4",
-    "@typescript-eslint/eslint-plugin": "^8.46.2",
+    "@typescript-eslint/eslint-plugin": "^8.46.1",
    "@typescript-eslint/parser": "^8.41.0",
    "ava": "^6.4.1",
    "esbuild": "^0.25.11",
@@ -27,7 +27,7 @@ steps:
      output: ${{ runner.temp }}/results
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: ${{ matrix.os }}-zstd-bundle.sarif
      path: ${{ runner.temp }}/results/javascript.sarif
@@ -12,7 +12,7 @@ steps:
      output: "${{ runner.temp }}/results"
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: config-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -25,7 +25,7 @@ steps:
      output: "${{ runner.temp }}/results"
      upload-database: false
  - name: Upload SARIF
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -17,7 +17,7 @@ steps:
    with:
      output: "${{ runner.temp }}/results"
  - name: Upload SARIF
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: with-baseline-information-${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -11,7 +11,7 @@ steps:
    with:
      output: "${{ runner.temp }}/results"
  - name: Upload SARIF
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: ${{ matrix.os }}-${{ matrix.version }}.sarif.json
      path: "${{ runner.temp }}/results/javascript.sarif"
@@ -39,7 +39,7 @@ steps:
      post-processed-sarif-path: "${{ runner.temp }}/post-processed"
  - name: Upload security SARIF
    if: contains(matrix.analysis-kinds, 'code-scanning')
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: |
        quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -47,14 +47,14 @@ steps:
      retention-days: 7
  - name: Upload quality SARIF
    if: contains(matrix.analysis-kinds, 'code-quality')
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: |
        quality-queries-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.quality.sarif.json
      path: "${{ runner.temp }}/results/javascript.quality.sarif"
      retention-days: 7
  - name: Upload post-processed SARIF
-    uses: actions/upload-artifact@v5
+    uses: actions/upload-artifact@v4
    with:
      name: |
        post-processed-${{ matrix.os }}-${{ matrix.version }}-${{ matrix.analysis-kinds }}.sarif.json
@@ -4,7 +4,7 @@ description: "Tests using RuboCop to analyze a multi-language repository and the
 versions: ["default"]
 steps:
  - name: Set up Ruby
-    uses: ruby/setup-ruby@d5126b9b3579e429dd52e51e68624dda2e05be25 # v1.267.0
+    uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
    with:
      ruby-version: 2.6
  - name: Install Code Scanning integration
@@ -21,5 +21,5 @@ outputs:
  environment:
    description: The inferred build environment configuration.
 runs:
-  using: node20
+  using: node24
  main: '../lib/resolve-environment-action.js'
@@ -9,15 +9,9 @@ if [ "$GITHUB_ACTIONS" = "true" ]; then
 fi

 # Check if npm install is likely needed before proceeding
-if [ ! -d node_modules ]; then
-  echo "Running 'npm install' because 'node_modules' directory is missing."
-  npm install
-elif [ package.json -nt package-lock.json ]; then
-  echo "Running 'npm install' because 'package-lock.json' appears to be outdated."
-  npm install
-elif [ package-lock.json -nt node_modules/.package-lock.json ]; then
-  echo "Running 'npm install' because 'node_modules/.package-lock.json' appears to be outdated."
+if [ ! -d node_modules ] || [ package-lock.json -nt node_modules/.package-lock.json ]; then
+  echo "Running 'npm install' because 'node_modules/.package-lock.json' appears to be outdated..."
  npm install
 else
-  echo "Skipping 'npm install' because everything appears to be up-to-date."
+  echo "Skipping 'npm install' because 'node_modules/.package-lock.json' appears to be up-to-date."
 fi
@@ -35,5 +35,5 @@ outputs:
  codeql-version:
    description: The version of the CodeQL binary that was installed.
 runs:
-  using: node20
+  using: node24
  main: '../lib/setup-codeql-action.js'
@@ -78,7 +78,7 @@ test("analyze action with RAM & threads from environment variables", async (t) =
    t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
    t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=4992");
    t.assert(runQueriesStub.calledOnce);
-    t.deepEqual(runQueriesStub.firstCall.args[2], "--threads=-1");
+    t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
    t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=4992");
  });
 });
@@ -76,7 +76,7 @@ test("analyze action with RAM & threads from action inputs", async (t) => {
    t.deepEqual(runFinalizeStub.firstCall.args[1], "--threads=-1");
    t.deepEqual(runFinalizeStub.firstCall.args[2], "--ram=3012");
    t.assert(runQueriesStub.calledOnce);
-    t.deepEqual(runQueriesStub.firstCall.args[2], "--threads=-1");
+    t.deepEqual(runQueriesStub.firstCall.args[3], "--threads=-1");
    t.deepEqual(runQueriesStub.firstCall.args[1], "--ram=3012");
  });
 });
@@ -324,16 +324,10 @@ async function run() {
    );

    if (actionsUtil.getRequiredInput("skip-queries") !== "true") {
-      // Warn if the removed `add-snippets` input is used.
-      if (actionsUtil.getOptionalInput("add-snippets") !== undefined) {
-        logger.warning(
-          "The `add-snippets` input has been removed and no longer has any effect.",
-        );
-      }
-
      runStats = await runQueries(
        outputDir,
        memory,
+        util.getAddSnippetsFlag(actionsUtil.getRequiredInput("add-snippets")),
        threads,
        diffRangePackDir,
        actionsUtil.getOptionalInput("category"),
@@ -37,6 +37,7 @@ test("status report fields", async (t) => {
    setupActionsVars(tmpDir, tmpDir);

    const memoryFlag = "";
+    const addSnippetsFlag = "";
    const threadsFlag = "";
    sinon.stub(uploadLib, "validateSarifFileSchema");

@@ -102,6 +103,7 @@ test("status report fields", async (t) => {
      const statusReport = await runQueries(
        tmpDir,
        memoryFlag,
+        addSnippetsFlag,
        threadsFlag,
        undefined,
        undefined,
@@ -3,6 +3,7 @@ import * as path from "path";
 import { performance } from "perf_hooks";

 import * as io from "@actions/io";
+import * as del from "del";
 import * as yaml from "js-yaml";

 import { getTemporaryDirectory, PullRequestBranches } from "./actions-util";
@@ -436,6 +437,7 @@ export function addSarifExtension(
 export async function runQueries(
  sarifFolder: string,
  memoryFlag: string,
+  addSnippetsFlag: string,
  threadsFlag: string,
  diffRangePackDir: string | undefined,
  automationDetailsId: string | undefined,
@@ -625,6 +627,7 @@ export async function runQueries(
      databasePath,
      queries,
      sarifFile,
+      addSnippetsFlag,
      threadsFlag,
      enableDebugLogging ? "-vv" : "-v",
      sarifRunPropertyFlag,
@@ -668,7 +671,7 @@ export async function runFinalize(
  logger: Logger,
 ): Promise<DatabaseCreationTimings> {
  try {
-    await fs.promises.rm(outputDir, { force: true, recursive: true });
+    await del.deleteAsync(outputDir, { force: true });
  } catch (error: any) {
    if (error?.code !== "ENOENT") {
      throw error;
@@ -169,39 +169,4 @@ test("wrapApiConfigurationError correctly wraps specific configuration errors",
    res,
    new util.ConfigurationError("Resource not accessible by integration"),
  );
-
-  // Enablement errors.
-  const codeSecurityNotEnabledError = new util.HTTPError(
-    "Code Security must be enabled for this repository to use code scanning",
-    403,
-  );
-  res = api.wrapApiConfigurationError(codeSecurityNotEnabledError);
-  t.deepEqual(
-    res,
-    new util.ConfigurationError(
-      api.getFeatureEnablementError(codeSecurityNotEnabledError.message),
-    ),
-  );
-  const advancedSecurityNotEnabledError = new util.HTTPError(
-    "Advanced Security must be enabled for this repository to use code scanning",
-    403,
-  );
-  res = api.wrapApiConfigurationError(advancedSecurityNotEnabledError);
-  t.deepEqual(
-    res,
-    new util.ConfigurationError(
-      api.getFeatureEnablementError(advancedSecurityNotEnabledError.message),
-    ),
-  );
-  const codeScanningNotEnabledError = new util.HTTPError(
-    "Code Scanning is not enabled for this repository. Please enable code scanning in the repository settings.",
-    403,
-  );
-  res = api.wrapApiConfigurationError(codeScanningNotEnabledError);
-  t.deepEqual(
-    res,
-    new util.ConfigurationError(
-      api.getFeatureEnablementError(codeScanningNotEnabledError.message),
-    ),
-  );
 });
@@ -1,6 +1,7 @@
 import * as core from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
 import * as retry from "@octokit/plugin-retry";
+import consoleLogLevel from "console-log-level";

 import { getActionVersion, getRequiredInput } from "./actions-util";
 import { Logger } from "./logging";
@@ -49,12 +50,7 @@ function createApiClientWithDetails(
    githubUtils.getOctokitOptions(auth, {
      baseUrl: apiDetails.apiURL,
      userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: {
-        debug: core.debug,
-        info: core.info,
-        warn: core.warning,
-        error: core.error,
-      },
+      log: consoleLogLevel({ level: "debug" }),
    }),
  );
 }
@@ -283,20 +279,6 @@ export async function getRepositoryProperties(repositoryNwo: RepositoryNwo) {
  });
 }

-function isEnablementError(msg: string) {
-  return [
-    /Code Security must be enabled/,
-    /Advanced Security must be enabled/,
-    /Code Scanning is not enabled/,
-  ].some((pattern) => pattern.test(msg));
-}
-
-// TODO: Move to `error-messages.ts` after refactoring import order to avoid cycle
-// since `error-messages.ts` currently depends on this file.
-export function getFeatureEnablementError(message: string): string {
-  return `Please verify that the necessary features are enabled: ${message}`;
-}
-
 export function wrapApiConfigurationError(e: unknown) {
  const httpError = asHTTPError(e);
  if (httpError !== undefined) {
@@ -318,11 +300,6 @@ export function wrapApiConfigurationError(e: unknown) {
        "Please check that your token is valid and has the required permissions: contents: read, security-events: write",
      );
    }
-    if (httpError.status === 403 && isEnablementError(httpError.message)) {
-      return new ConfigurationError(
-        getFeatureEnablementError(httpError.message),
-      );
-    }
    if (httpError.status === 429) {
      return new ConfigurationError("API rate limit exceeded");
    }
@@ -5,6 +5,7 @@ import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as io from "@actions/io";
 import * as toolcache from "@actions/tool-cache";
 import test, { ExecutionContext } from "ava";
+import * as del from "del";
 import * as yaml from "js-yaml";
 import nock from "nock";
 import * as sinon from "sinon";
@@ -556,7 +557,7 @@ const injectedConfigMacro = test.macro({
      const augmentedConfig = yaml.load(fs.readFileSync(configFile, "utf8"));
      t.deepEqual(augmentedConfig, expectedConfig);

-      await fs.promises.rm(configFile, { force: true });
+      await del.deleteAsync(configFile, { force: true });
    });
  },

@@ -1045,7 +1046,7 @@ test("Avoids duplicating --overwrite flag if specified in CODEQL_ACTION_EXTRA_OP
  );
  t.truthy(configArg, "Should have injected a codescanning config");
  const configFile = configArg!.split("=")[1];
-  await fs.promises.rm(configFile, { force: true });
+  await del.deleteAsync(configFile, { force: true });
 });

 export function stubToolRunnerConstructor(
@@ -167,6 +167,7 @@ export interface CodeQL {
    databasePath: string,
    querySuitePaths: string[] | undefined,
    sarifFile: string,
+    addSnippetsFlag: string,
    threadsFlag: string,
    verbosityFlag: string | undefined,
    sarifRunPropertyFlag: string | undefined,
@@ -816,6 +817,7 @@ export async function getCodeQLForCmd(
      databasePath: string,
      querySuitePaths: string[] | undefined,
      sarifFile: string,
+      addSnippetsFlag: string,
      threadsFlag: string,
      verbosityFlag: string,
      sarifRunPropertyFlag: string | undefined,
@@ -834,6 +836,7 @@ export async function getCodeQLForCmd(
        "--format=sarif-latest",
        verbosityFlag,
        `--output=${sarifFile}`,
+        addSnippetsFlag,
        "--print-diagnostics-summary",
        "--print-metrics-summary",
        "--sarif-add-baseline-file-info",
@@ -5,6 +5,7 @@ import * as artifact from "@actions/artifact";
 import * as artifactLegacy from "@actions/artifact-legacy";
 import * as core from "@actions/core";
 import archiver from "archiver";
+import * as del from "del";

 import { getOptionalInput, getTemporaryDirectory } from "./actions-util";
 import { dbIsFinalized } from "./analyze";
@@ -344,7 +345,7 @@ async function createPartialDatabaseBundle(
  );
  // See `bundleDb` for explanation behind deleting existing db bundle.
  if (fs.existsSync(databaseBundlePath)) {
-    await fs.promises.rm(databaseBundlePath, { force: true });
+    await del.deleteAsync(databaseBundlePath, { force: true });
  }
  const output = fs.createWriteStream(databaseBundlePath);
  const zip = archiver("zip");
@@ -137,10 +137,4 @@ export enum EnvVar {
   * This setting is more specific than `CODEQL_ACTION_TEST_MODE`, which implies this option.
   */
  SKIP_SARIF_UPLOAD = "CODEQL_ACTION_SKIP_SARIF_UPLOAD",
-
-  /**
-   * Whether to skip workflow validation. Intended for internal use, where we know that
-   * the workflow is valid and validation is not necessary.
-   */
-  SKIP_WORKFLOW_VALIDATION = "CODEQL_ACTION_SKIP_WORKFLOW_VALIDATION",
 }
@@ -86,7 +86,7 @@ import {
  getErrorMessage,
  BuildMode,
 } from "./util";
-import { checkWorkflow } from "./workflow";
+import { validateWorkflow } from "./workflow";

 /**
 * Sends a status report indicating that the `init` Action is starting.
@@ -288,9 +288,16 @@ async function run() {
    toolsSource = initCodeQLResult.toolsSource;
    zstdAvailability = initCodeQLResult.zstdAvailability;

-    // Check the workflow for problems. If there are any problems, they are reported
-    // to the workflow log. No exceptions are thrown.
-    await checkWorkflow(logger, codeql);
+    core.startGroup("Validating workflow");
+    const validateWorkflowResult = await validateWorkflow(codeql, logger);
+    if (validateWorkflowResult === undefined) {
+      logger.info("Detected no issues with the code scanning workflow.");
+    } else {
+      logger.warning(
+        `Unable to validate code scanning workflow: ${validateWorkflowResult}`,
+      );
+    }
+    core.endGroup();

    // Set CODEQL_ENABLE_EXPERIMENTAL_FEATURES for Rust if between 2.19.3 (included) and 2.22.1 (excluded)
    // We need to set this environment variable before initializing the config, otherwise Rust
@@ -13,15 +13,7 @@ export interface Logger {
 }

 export function getActionsLogger(): Logger {
-  return {
-    debug: core.debug,
-    info: core.info,
-    warning: core.warning,
-    error: core.error,
-    isDebug: core.isDebug,
-    startGroup: core.startGroup,
-    endGroup: core.endGroup,
-  };
+  return core;
 }

 export function getRunnerLogger(debugMode: boolean): Logger {
@@ -9,7 +9,7 @@ import * as semver from "semver";

 import { CommandInvocationError } from "./actions-util";
 import { Logger } from "./logging";
-import { assertNever, cleanUpPath, isBinaryAccessible } from "./util";
+import { assertNever, cleanUpGlob, isBinaryAccessible } from "./util";

 const MIN_REQUIRED_BSD_TAR_VERSION = "3.4.3";
 const MIN_REQUIRED_GNU_TAR_VERSION = "1.31";
@@ -217,7 +217,7 @@ export async function extractTarZst(
      });
    });
  } catch (e) {
-    await cleanUpPath(dest, "extraction destination directory", logger);
+    await cleanUpGlob(dest, "extraction destination directory", logger);
    throw e;
  }
 }
@@ -12,7 +12,7 @@ import * as semver from "semver";

 import { formatDuration, Logger } from "./logging";
 import * as tar from "./tar";
-import { cleanUpPath, getErrorMessage, getRequiredEnvParam } from "./util";
+import { cleanUpGlob, getErrorMessage, getRequiredEnvParam } from "./util";

 /**
 * High watermark to use when streaming the download and extraction of the CodeQL tools.
@@ -130,7 +130,7 @@ export async function downloadAndExtract(

    // If we failed during processing, we want to clean up the destination directory
    // before we try again.
-    await cleanUpPath(dest, "CodeQL bundle", logger);
+    await cleanUpGlob(dest, "CodeQL bundle", logger);
  }

  const toolsDownloadStart = performance.now();
@@ -167,7 +167,7 @@ export async function downloadAndExtract(
      )}).`,
    );
  } finally {
-    await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger);
+    await cleanUpGlob(archivedBundlePath, "CodeQL bundle archive", logger);
  }

  return {
@@ -101,6 +101,16 @@ test("getMemoryFlag() throws if the ram input is < 0 or NaN", async (t) => {
  }
 });

+test("getAddSnippetsFlag() should return the correct flag", (t) => {
+  t.deepEqual(util.getAddSnippetsFlag(true), "--sarif-add-snippets");
+  t.deepEqual(util.getAddSnippetsFlag("true"), "--sarif-add-snippets");
+
+  t.deepEqual(util.getAddSnippetsFlag(false), "--no-sarif-add-snippets");
+  t.deepEqual(util.getAddSnippetsFlag(undefined), "--no-sarif-add-snippets");
+  t.deepEqual(util.getAddSnippetsFlag("false"), "--no-sarif-add-snippets");
+  t.deepEqual(util.getAddSnippetsFlag("foo bar"), "--no-sarif-add-snippets");
+});
+
 test("getThreadsFlag() should return the correct --threads flag", (t) => {
  const numCpus = os.cpus().length;

@@ -524,12 +534,3 @@ test("getCgroupCpuCountFromCpus returns undefined if the CPU file exists but is
    );
  });
 });
-
-test("checkDiskUsage succeeds and produces positive numbers", async (t) => {
-  process.env["GITHUB_WORKSPACE"] = os.tmpdir();
-  const diskUsage = await util.checkDiskUsage(getRunnerLogger(true));
-  if (t.truthy(diskUsage)) {
-    t.true(diskUsage.numAvailableBytes > 0);
-    t.true(diskUsage.numTotalBytes > 0);
-  }
-});
@@ -6,6 +6,7 @@ import * as path from "path";
 import * as core from "@actions/core";
 import * as exec from "@actions/exec/lib/exec";
 import * as io from "@actions/io";
+import * as del from "del";
 import getFolderSize from "get-folder-size";
 import * as yaml from "js-yaml";
 import * as semver from "semver";
@@ -166,7 +167,7 @@ export async function withTmpDir<T>(
 ): Promise<T> {
  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "codeql-action-"));
  const result = await body(tmpDir);
-  await fs.promises.rm(tmpDir, { force: true, recursive: true });
+  await del.deleteAsync(tmpDir, { force: true });
  return result;
 }

@@ -342,6 +343,21 @@ export function getMemoryFlag(
  return `--ram=${megabytes}`;
 }

+/**
+ * Get the codeql flag to specify whether to add code snippets to the sarif file.
+ *
+ * @returns string
+ */
+export function getAddSnippetsFlag(
+  userInput: string | boolean | undefined,
+): string {
+  if (typeof userInput === "string") {
+    // have to process specifically because any non-empty string is truthy
+    userInput = userInput.toLowerCase() === "true";
+  }
+  return userInput ? "--sarif-add-snippets" : "--no-sarif-add-snippets";
+}
+
 /**
 * Get the value of the codeql `--threads` flag specified for the `threads`
 * input. If no value was specified, all available threads will be used.
@@ -740,7 +756,7 @@ export async function bundleDb(
  // from somewhere else or someone trying to make the action upload a
  // non-database file.
  if (fs.existsSync(databaseBundlePath)) {
-    await fs.promises.rm(databaseBundlePath, { force: true });
+    await del.deleteAsync(databaseBundlePath, { force: true });
  }
  await codeql.databaseBundle(databasePath, databaseBundlePath, dbName);
  return databaseBundlePath;
@@ -1240,13 +1256,19 @@ export async function checkSipEnablement(
  }
 }

-export async function cleanUpPath(file: string, name: string, logger: Logger) {
+export async function cleanUpGlob(glob: string, name: string, logger: Logger) {
  logger.debug(`Cleaning up ${name}.`);
  try {
-    await fs.promises.rm(file, {
-      force: true,
-      recursive: true,
-    });
+    const deletedPaths = await del.deleteAsync(glob, { force: true });
+    if (deletedPaths.length === 0) {
+      logger.warning(
+        `Failed to clean up ${name}: no files found matching ${glob}.`,
+      );
+    } else if (deletedPaths.length === 1) {
+      logger.debug(`Cleaned up ${name}.`);
+    } else {
+      logger.debug(`Cleaned up ${name} (${deletedPaths.length} files).`);
+    }
  } catch (e) {
    logger.warning(`Failed to clean up ${name}: ${e}.`);
  }
@@ -2,17 +2,9 @@ import test, { ExecutionContext } from "ava";
 import * as yaml from "js-yaml";
 import * as sinon from "sinon";

-import * as actionsUtil from "./actions-util";
-import { createStubCodeQL, getCodeQLForTesting } from "./codeql";
-import { EnvVar } from "./environment";
+import { getCodeQLForTesting } from "./codeql";
+import { setupTests } from "./testing-utils";
 import {
-  checkExpectedLogMessages,
-  getRecordingLogger,
-  LoggedMessage,
-  setupTests,
-} from "./testing-utils";
-import {
-  checkWorkflow,
  CodedError,
  formatWorkflowCause,
  formatWorkflowErrors,
@@ -21,7 +13,6 @@ import {
  Workflow,
  WorkflowErrors,
 } from "./workflow";
-import * as workflow from "./workflow";

 function errorCodes(
  actual: CodedError[],
@@ -879,78 +870,3 @@ test("getCategoryInputOrThrow throws error for workflow with multiple calls to a
    },
  );
 });
-
-test("checkWorkflow - validates workflow if `SKIP_WORKFLOW_VALIDATION` is not set", async (t) => {
-  const messages: LoggedMessage[] = [];
-  const codeql = createStubCodeQL({});
-
-  sinon.stub(actionsUtil, "isDynamicWorkflow").returns(false);
-  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
-  validateWorkflow.resolves(undefined);
-
-  await checkWorkflow(getRecordingLogger(messages), codeql);
-
-  t.assert(
-    validateWorkflow.calledOnce,
-    "`checkWorkflow` unexpectedly did not call `validateWorkflow`",
-  );
-  checkExpectedLogMessages(t, messages, [
-    "Detected no issues with the code scanning workflow.",
-  ]);
-});
-
-test("checkWorkflow - logs problems with workflow validation", async (t) => {
-  const messages: LoggedMessage[] = [];
-  const codeql = createStubCodeQL({});
-
-  sinon.stub(actionsUtil, "isDynamicWorkflow").returns(false);
-  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
-  validateWorkflow.resolves("problem");
-
-  await checkWorkflow(getRecordingLogger(messages), codeql);
-
-  t.assert(
-    validateWorkflow.calledOnce,
-    "`checkWorkflow` unexpectedly did not call `validateWorkflow`",
-  );
-  checkExpectedLogMessages(t, messages, [
-    "Unable to validate code scanning workflow: problem",
-  ]);
-});
-
-test("checkWorkflow - skips validation if `SKIP_WORKFLOW_VALIDATION` is `true`", async (t) => {
-  process.env[EnvVar.SKIP_WORKFLOW_VALIDATION] = "true";
-
-  const messages: LoggedMessage[] = [];
-  const codeql = createStubCodeQL({});
-
-  sinon.stub(actionsUtil, "isDynamicWorkflow").returns(false);
-  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
-
-  await checkWorkflow(getRecordingLogger(messages), codeql);
-
-  t.assert(
-    validateWorkflow.notCalled,
-    "`checkWorkflow` called `validateWorkflow` unexpectedly",
-  );
-  t.is(messages.length, 0);
-});
-
-test("checkWorkflow - skips validation for `dynamic` workflows", async (t) => {
-  const messages: LoggedMessage[] = [];
-  const codeql = createStubCodeQL({});
-
-  const isDynamicWorkflow = sinon
-    .stub(actionsUtil, "isDynamicWorkflow")
-    .returns(true);
-  const validateWorkflow = sinon.stub(workflow.internal, "validateWorkflow");
-
-  await checkWorkflow(getRecordingLogger(messages), codeql);
-
-  t.assert(isDynamicWorkflow.calledOnce);
-  t.assert(
-    validateWorkflow.notCalled,
-    "`checkWorkflow` called `validateWorkflow` unexpectedly",
-  );
-  t.is(messages.length, 0);
-});
@@ -5,10 +5,8 @@ import zlib from "zlib";
 import * as core from "@actions/core";
 import * as yaml from "js-yaml";

-import { isDynamicWorkflow } from "./actions-util";
 import * as api from "./api-client";
 import { CodeQL } from "./codeql";
-import { EnvVar } from "./environment";
 import { Logger } from "./logging";
 import {
  getRequiredEnvParam,
@@ -218,7 +216,7 @@ function hasWorkflowTrigger(triggerName: string, doc: Workflow): boolean {
  return Object.prototype.hasOwnProperty.call(doc.on, triggerName);
 }

-async function validateWorkflow(
+export async function validateWorkflow(
  codeql: CodeQL,
  logger: Logger,
 ): Promise<undefined | string> {
@@ -464,36 +462,3 @@ export function getCheckoutPathInputOrThrow(
    ) || getRequiredEnvParam("GITHUB_WORKSPACE") // if unspecified, checkout_path defaults to ${{ github.workspace }}
  );
 }
-
-/**
- * A wrapper around `validateWorkflow` which reports the outcome.
- *
- * @param logger The logger to use.
- * @param codeql The CodeQL instance.
- */
-export async function checkWorkflow(logger: Logger, codeql: CodeQL) {
-  // Check the workflow for problems, unless `SKIP_WORKFLOW_VALIDATION` is `true`
-  // or the workflow trigger is `dynamic`.
-  if (
-    !isDynamicWorkflow() &&
-    process.env[EnvVar.SKIP_WORKFLOW_VALIDATION] !== "true"
-  ) {
-    core.startGroup("Validating workflow");
-    const validateWorkflowResult = await internal.validateWorkflow(
-      codeql,
-      logger,
-    );
-    if (validateWorkflowResult === undefined) {
-      logger.info("Detected no issues with the code scanning workflow.");
-    } else {
-      logger.debug(
-        `Unable to validate code scanning workflow: ${validateWorkflowResult}`,
-      );
-    }
-    core.endGroup();
-  }
-}
-
-export const internal = {
-  validateWorkflow,
-};
@@ -29,6 +29,6 @@ outputs:
  proxy_urls:
    description: A stringified JSON array of objects containing the types and URLs of the configured registries.
 runs:
-  using: node20
+  using: node24
  main: "../lib/start-proxy-action.js"
  post: "../lib/start-proxy-action-post.js"
@@ -41,6 +41,6 @@ outputs:

      { "code-scanning": "some-id", "code-quality": "some-other-id" }
 runs:
-  using: node20
+  using: node24
  main: '../lib/upload-sarif-action.js'
  post: '../lib/upload-sarif-action-post.js'
Author	SHA1	Message	Date
Henry Mercer	4d8b358273	Disable SIP disablement check	2025-10-28 12:27:34 +00:00
Henry Mercer	f336c09493	Add testing trigger	2025-10-28 12:26:18 +00:00