import * as fs from "fs";

import * as os from "os";

import * as path from "path";

import { performance } from "perf_hooks";

import * as github from "@actions/github";

import * as toolcache from "@actions/tool-cache";

import test, { ExecutionContext } from "ava";

import * as sinon from "sinon";

import * as actionsUtil from "./actions-util";

import * as api from "./api-client";

import * as diagnostics from "./diagnostics";

import {

ActionsEnvVars,

Env,

EnvVar,

getEnv,

ReadOnlyEnv,

} from "./environment";

import { Feature } from "./feature-flags";

import { BuiltInLanguage } from "./languages";

import { getCacheRestoreKeyPrefix } from "./overlay/caching";

import { MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION } from "./per-language-bundles";

import * as setupCodeql from "./setup-codeql";

import * as tar from "./tar";

import {

LINKED_CLI_VERSION,

LoggedMessage,

RecordingLogger,

SAMPLE_DEFAULT_CLI_VERSION,

SAMPLE_DOTCOM_API_DETAILS,

checkExpectedLogMessages,

checkUnexpectedLogMessages,

createFeatures,

createTestConfig,

getRecordingLogger,

getTestEnv,

initAllState,

makeMacro,

mockBundleDownloadApi,

setupActionsVars,

setupTests,

} from "./testing-utils";

import * as toolsDownload from "./tools-download";

import { getErrorMessage, GitHubVariant, HTTPError, withTmpDir } from "./util";

setupTests(test);

test.beforeEach(() => {

getEnv().initialise("1.2.3");

});

function stubDownloadAndExtract() {

return sinon

.stub(toolsDownload, "downloadAndExtract")

.callsFake(async (_url, _compressionMethod, dest) => {

fs.mkdirSync(dest, { recursive: true });

return { downloadDurationMs: 200, totalDurationMs: 300 };

});

}

/** Models a hosted Linux runner with zstd and the latest nightly release. */

function stubHostedNightly(tagName: string) {

sinon.stub(process, "platform").value("linux");

sinon.stub(process, "arch").value("x64");

process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] = "github-hosted";

sinon.stub(tar, "isZstdAvailable").resolves({

available: true,

foundZstdBinary: true,

});

const client = github.getOctokit("123", {

request: {

fetch: async () => {

throw new Error("Unexpected API request in nightly bundle test");

},

},

});

const listReleases = sinon

.stub(client.rest.repos, "listReleases")

.rejects(new Error("Unexpected release request in nightly bundle test"));

listReleases

.withArgs({

owner: "dsp-testing",

repo: "codeql-cli-nightlies",

per_page: 1,

page: 1,

prerelease: true,

})

.resolves({

data: [{ tag_name: tagName }],

} as Awaited<ReturnType<typeof client.rest.repos.listReleases>>);

sinon.stub(api, "getApiClient").value(() => client);

return listReleases;

}

test.serial("parse codeql bundle url version", (t) => {

t.deepEqual(

setupCodeql.getCodeQLURLVersion(

"https://github.com/.../codeql-bundle-20200601/...",

),

"20200601",

);

});

test.serial("convert to semver", (t) => {

const tests = {

"20200601": "0.0.0-20200601",

"20200601.0": "0.0.0-20200601.0",

"20200601.0.0": "20200601.0.0",

"1.2.3": "1.2.3",

"1.2.3-alpha": "1.2.3-alpha",

"1.2.3-beta.1": "1.2.3-beta.1",

};

for (const [version, expectedVersion] of Object.entries(tests)) {

try {

const parsedVersion = setupCodeql.convertToSemVer(

version,

new RecordingLogger(),

);

t.deepEqual(parsedVersion, expectedVersion);

} catch (e) {

t.fail(getErrorMessage(e));

}

}

});

test.serial(

"getCodeQLSource sets CLI version for a semver tagged bundle",

async (t) => {

const features = createFeatures([]);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const tagName = "codeql-bundle-v1.2.3";

const url = mockBundleDownloadApi({ tagName });

const source = await setupCodeql.getCodeQLSource(

url,

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

false,

features,

new RecordingLogger(),

);

t.deepEqual(source, {

bundle: { kind: "combined", url },

bundleVersion: "v1.2.3",

cliVersion: "1.2.3",

compressionMethod: "gzip",

sourceType: "download",

toolsVersion: "1.2.3",

} satisfies setupCodeql.CodeQLDownloadSource);

});

},

);

const LINKED_BUNDLE_TEST_CASES = [

{

platform: "linux",

arch: "x64",

tarSupportsZstd: true,

expectedBundleName: "codeql-bundle-linux64.tar.zst",

expectedCompressionMethod: "zstd",

},

{

platform: "linux",

arch: "arm64",

tarSupportsZstd: true,

expectedBundleName: "codeql-bundle-linux-arm64.tar.zst",

expectedCompressionMethod: "zstd",

},

{

platform: "darwin",

arch: "arm64",

tarSupportsZstd: true,

expectedBundleName: "codeql-bundle-osx64.tar.zst",

expectedCompressionMethod: "zstd",

},

{

platform: "darwin",

arch: "x64",

tarSupportsZstd: true,

expectedBundleName: "codeql-bundle-osx64.tar.zst",

expectedCompressionMethod: "zstd",

},

{

platform: "win32",

arch: "x64",

tarSupportsZstd: true,

expectedBundleName: "codeql-bundle-win64.tar.gz",

expectedCompressionMethod: "gzip",

},

{

platform: "linux",

arch: "x64",

tarSupportsZstd: false,

expectedBundleName: "codeql-bundle-linux64.tar.gz",

expectedCompressionMethod: "gzip",

},

] as const;

for (const {

platform,

arch,

tarSupportsZstd,

expectedBundleName,

expectedCompressionMethod,

} of LINKED_BUNDLE_TEST_CASES) {

test.serial(

`getCodeQLSource selects ${expectedBundleName} for linked tools on ${platform}/${arch}`,

async (t) => {

const features = createFeatures([]);

sinon.stub(process, "platform").value(platform);

sinon.stub(process, "arch").value(arch);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const source = await setupCodeql.getCodeQLSource(

"linked",

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

tarSupportsZstd,

features,

new RecordingLogger(),

);

t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion);

t.is(source.sourceType, "download");

if (source.sourceType === "download") {

t.is(source.compressionMethod, expectedCompressionMethod);

t.is(source.bundle.kind, "combined");

t.true(source.bundle.url.endsWith(`/${expectedBundleName}`));

}

});

},

);

}

test.serial(

"getCodeQLSource correctly returns bundled CLI version when tools == latest",

async (t) => {

const loggedMessages: LoggedMessage[] = [];

const logger = getRecordingLogger(loggedMessages);

const features = createFeatures([]);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const source = await setupCodeql.getCodeQLSource(

"latest",

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

false,

features,

logger,

);

// First, ensure that the CLI version is the linked version, so that backwards

// compatibility is maintained.

t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion);

t.is(source.sourceType, "download");

// Afterwards, ensure that we see the deprecation message in the log.

const expected_message: string =

"`tools: latest` has been renamed to `tools: linked`, but the old name is still supported. No action is required.";

t.assert(

loggedMessages.some(

(msg) =>

typeof msg.message === "string" &&

msg.message.includes(expected_message),

),

);

});

},

);

test.serial(

"setupCodeQLBundle logs the CodeQL CLI version being used when asked to use linked tools",

async (t) => {

const loggedMessages: LoggedMessage[] = [];

const logger = getRecordingLogger(loggedMessages);

const features = createFeatures([]);

const extractStub = stubDownloadAndExtract();

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const result = await setupCodeql.setupCodeQLBundle(

"linked",

SAMPLE_DOTCOM_API_DETAILS,

tmpDir,

GitHubVariant.DOTCOM,

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

features,

logger,

);

// Basic sanity check that the version we got back is indeed

// the linked (default) CLI version.

t.is(result.toolsVersion, LINKED_CLI_VERSION.cliVersion);

t.true(extractStub.calledOnce);

t.is(

result.codeqlFolder,

toolcache.find("CodeQL", LINKED_CLI_VERSION.cliVersion),

);

t.deepEqual(result.toolsDownloadStatusReport, {

downloadDurationMs: 200,

totalDurationMs: 300,

});

checkUnexpectedLogMessages(t, loggedMessages, [

"Not caching the CodeQL tools",

"Could not cache CodeQL tools",

]);

// Ensure message logging CodeQL CLI version was present in user logs.

const expected_message: string = `Using CodeQL CLI version ${LINKED_CLI_VERSION.cliVersion}`;

t.assert(

loggedMessages.some(

(msg) =>

typeof msg.message === "string" &&

msg.message.includes(expected_message),

),

);

});

},

);

test.serial(

"setupCodeQLBundle logs the CodeQL CLI version being used when asked to download a non-default bundle",

async (t) => {

const loggedMessages: LoggedMessage[] = [];

const logger = getRecordingLogger(loggedMessages);

const features = createFeatures([]);

const bundleUrl =

"https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.16.0/codeql-bundle-linux64.tar.gz";

const expectedVersion = "2.16.0";

const extractStub = stubDownloadAndExtract();

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const result = await setupCodeql.setupCodeQLBundle(

bundleUrl,

SAMPLE_DOTCOM_API_DETAILS,

tmpDir,

GitHubVariant.DOTCOM,

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

features,

logger,

);

// Basic sanity check that the version we got back is indeed the version that the

// bundle contains..

t.is(result.toolsVersion, expectedVersion);

t.true(extractStub.calledOnce);

t.is(extractStub.firstCall.args[0], bundleUrl);

t.is(result.codeqlFolder, toolcache.find("CodeQL", expectedVersion));

t.deepEqual(result.toolsDownloadStatusReport, {

downloadDurationMs: 200,

totalDurationMs: 300,

});

// Ensure message logging CodeQL CLI version was present in user logs.

const expected_message: string = `Using CodeQL CLI version 2.16.0 sourced from ${bundleUrl} .`;

t.assert(

loggedMessages.some(

(msg) =>

typeof msg.message === "string" &&

msg.message.includes(expected_message),

),

);

});

},

);

test.serial(

"getCodeQLSource and setupCodeQLBundle preserve the nightly version when tools == nightly",

async (t) => {

const loggedMessages: LoggedMessage[] = [];

const logger = getRecordingLogger(loggedMessages);

const features = createFeatures([]);

const extractStub = stubDownloadAndExtract();

const expectedDate = "30260213";

const expectedTag = `codeql-bundle-${expectedDate}`;

stubHostedNightly(expectedTag);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const source = await setupCodeql.getCodeQLSource(

"nightly",

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

false,

features,

logger,

);

// Check that the `CodeQLToolsSource` object matches our expectations.

const expectedVersion = `0.0.0-${expectedDate}`;

const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/codeql-bundle-linux64.tar.zst`;

t.deepEqual(source, {

bundle: { kind: "combined", url: expectedURL },

bundleVersion: expectedDate,

cliVersion: undefined,

compressionMethod: "zstd",

sourceType: "download",

toolsVersion: expectedVersion,

} satisfies setupCodeql.CodeQLToolsSource);

const result = await setupCodeql.setupCodeQLBundle(

"nightly",

SAMPLE_DOTCOM_API_DETAILS,

tmpDir,

GitHubVariant.DOTCOM,

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

features,

logger,

);

t.true(extractStub.calledOnce);

t.is(extractStub.firstCall.args[0], expectedURL);

t.is(result.toolsVersion, source.toolsVersion);

t.is(result.toolsSource, setupCodeql.ToolsSource.Download);

t.is(result.codeqlFolder, toolcache.find("CodeQL", expectedVersion));

t.true(fs.existsSync(`${result.codeqlFolder}.complete`));

t.deepEqual(toolcache.findAllVersions("CodeQL"), [expectedVersion]);

// Afterwards, ensure that we see the expected messages in the log.

checkExpectedLogMessages(t, loggedMessages, [

"Using the latest CodeQL CLI nightly, as requested by 'tools: nightly'.",

`Bundle version ${expectedDate} is not in SemVer format. Will treat it as pre-release ${expectedVersion}.`,

`Attempting to obtain CodeQL tools. CLI version: unknown, bundle tag name: ${expectedTag}`,

`Using CodeQL CLI sourced from ${expectedURL}`,

]);

});

},

);

test.serial(

"getCodeQLSource correctly returns nightly CLI version when forced by FF",

async (t) => {

const loggedMessages: LoggedMessage[] = [];

const logger = getRecordingLogger(loggedMessages);

const features = createFeatures([Feature.ForceNightly]);

const expectedDate = "30260213";

const expectedTag = `codeql-bundle-${expectedDate}`;

stubHostedNightly(expectedTag);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic" });

const source = await setupCodeql.getCodeQLSource(

undefined,

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

false,

features,

logger,

);

// Check that the `CodeQLToolsSource` object matches our expectations.

const expectedVersion = `0.0.0-${expectedDate}`;

const expectedURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/codeql-bundle-linux64.tar.zst`;

t.deepEqual(source, {

bundle: { kind: "combined", url: expectedURL },

bundleVersion: expectedDate,

cliVersion: undefined,

compressionMethod: "zstd",

sourceType: "download",

toolsVersion: expectedVersion,

} satisfies setupCodeql.CodeQLToolsSource);

// Afterwards, ensure that we see the expected messages in the log.

checkExpectedLogMessages(t, loggedMessages, [

`Using the latest CodeQL CLI nightly, as forced by the ${Feature.ForceNightly} feature flag.`,

`Bundle version ${expectedDate} is not in SemVer format. Will treat it as pre-release ${expectedVersion}.`,

`Attempting to obtain CodeQL tools. CLI version: unknown, bundle tag name: ${expectedTag}`,

`Using CodeQL CLI sourced from ${expectedURL}`,

]);

});

},

);

for (const bundlePath of [

"codeql-bundle.tar.gz",

"codeql-bundle.tar.zst",

"codeql-bundle-/codeql-bundle.tar.gz",

"codeql-bundle-linux64.tar.zst",

"codeql-bundle-ruby-linux64.tar.zst",

]) {

test.serial(

`setupCodeQLBundle reports an unknown version for ${bundlePath}`,

async (t) => {

const extractStub = stubDownloadAndExtract();

const downloadSpy = sinon.spy(setupCodeql, "downloadCodeQL");

const url = `https://example.com/${bundlePath}`;

const messages: LoggedMessage[] = [];

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const result = await setupCodeql.setupCodeQLBundle(

url,

SAMPLE_DOTCOM_API_DETAILS,

tmpDir,

GitHubVariant.DOTCOM,

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

createFeatures([]),

getRecordingLogger(messages),

);

t.true(extractStub.calledOnce);

t.is(extractStub.firstCall.args[0], url);

t.is(downloadSpy.firstCall.args[0].bundleVersion, undefined);

t.is(downloadSpy.firstCall.args[0].toolsVersion, "unknown");

t.is(result.toolsVersion, "unknown");

t.is(result.toolsSource, setupCodeql.ToolsSource.Download);

t.is(

result.toolsDownloadStatusReport?.perLanguage?.tools_bundle_language,

bundlePath === "codeql-bundle-ruby-linux64.tar.zst"

? BuiltInLanguage.ruby

: undefined,

);

t.is(path.dirname(result.codeqlFolder), tmpDir);

t.true(fs.existsSync(result.codeqlFolder));

t.false(fs.existsSync(`${result.codeqlFolder}.complete`));

t.deepEqual(toolcache.findAllVersions("CodeQL"), []);

checkExpectedLogMessages(t, messages, [

`Using CodeQL CLI sourced from ${url}`,

bundlePath === "codeql-bundle-ruby-linux64.tar.zst"

? "Not caching the CodeQL tools because they came from a bundle that contains only a single language."

: `Could not cache CodeQL tools because we could not determine the bundle version from the URL ${url}.`,

]);

});

},

);

}

test.serial(

"setupCodeQLBundle preserves local installation without cleaning the toolcache",

async (t) => {

const cleanupSpy = sinon.spy(toolsDownload, "deleteToolcacheBundles");

const downloadSpy = sinon.spy(setupCodeql, "downloadCodeQL");

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

process.env[ActionsEnvVars.RUNNER_ENVIRONMENT] = "github-hosted";

const cachedDirectory = createToolcacheEntry(

tmpDir,

"CodeQL",

CLEANUP_STALE_VERSION,

);

const result = await setupCodeql.setupCodeQLBundle(

path.join(__dirname, "../src/testdata/codeql-bundle.tar.gz"),

SAMPLE_DOTCOM_API_DETAILS,

tmpDir,

GitHubVariant.DOTCOM,

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

createFeatures([]),

new RecordingLogger(),

);

t.is(result.toolsVersion, "local");

t.is(result.toolsSource, setupCodeql.ToolsSource.Local);

t.is(result.toolsDownloadStatusReport, undefined);

t.is(path.dirname(result.codeqlFolder), tmpDir);

t.true(fs.existsSync(result.codeqlFolder));

t.false(fs.existsSync(`${result.codeqlFolder}.complete`));

t.true(fs.existsSync(cachedDirectory));

t.true(cleanupSpy.notCalled);

t.true(downloadSpy.notCalled);

t.is(process.env[EnvVar.HAS_SET_UP_CODEQL], "true");

});

},

);

for (const toolsInput of ["nightly", "nightly-latest"]) {

test.serial(

`getCodeQLSource selects the latest per-language nightly for tools == ${toolsInput}`,

async (t) => {

const expectedTag = "codeql-bundle-30260213";

const baseURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}`;

const latestNightlyRequest = stubHostedNightly(expectedTag);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const source = await setupCodeql.getCodeQLSource(

toolsInput,

SAMPLE_DEFAULT_CLI_VERSION,

["java"],

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

true, // tarSupportsZstd

createFeatures([]),

new RecordingLogger(),

);

t.deepEqual(source, {

sourceType: "download",

bundle: {

kind: "per-language",

language: BuiltInLanguage.java,

url: `${baseURL}/codeql-bundle-java-linux64.tar.zst`,

combinedBundleURL: `${baseURL}/codeql-bundle-linux64.tar.zst`,

},

bundleVersion: "30260213",

cliVersion: undefined,

compressionMethod: "zstd",

toolsVersion: "0.0.0-30260213",

} satisfies setupCodeql.CodeQLDownloadSource);

t.true(latestNightlyRequest.calledOnce);

});

},

);

}

test.serial(

"getCodeQLSource downloads a combined nightly bundle when per-language selection is ineligible",

async (t) => {

const expectedTag = "codeql-bundle-30260213";

stubHostedNightly(expectedTag);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

for (const { languages, otherLanguagePacksReason } of [

// More than one language requires a combined bundle.

{

languages: ["java", "python"],

otherLanguagePacksReason: undefined,

},

// The configured queries may need library packs for other languages.

{

languages: ["java"],

otherLanguagePacksReason: "an example reason",

},

]) {

const source = await setupCodeql.getCodeQLSource(

"nightly",

SAMPLE_DEFAULT_CLI_VERSION,

languages,

otherLanguagePacksReason,

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

true, // tarSupportsZstd

createFeatures([]),

new RecordingLogger(),

);

t.is(source.sourceType, "download");

if (source.sourceType === "download") {

t.deepEqual(source.bundle, {

kind: "combined",

url: `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}/codeql-bundle-linux64.tar.zst`,

});

}

}

});

},

);

test.serial(

"getCodeQLSource uses the latest per-language bundle for a forced nightly",

async (t) => {

const expectedTag = "codeql-bundle-30260213";

const baseURL = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/${expectedTag}`;

const latestNightlyRequest = stubHostedNightly(expectedTag);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic" });

const source = await setupCodeql.getCodeQLSource(

undefined, // toolsInput: the nightly is selected by ForceNightly

SAMPLE_DEFAULT_CLI_VERSION,

["java"],

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

true, // tarSupportsZstd

createFeatures([Feature.ForceNightly]),

new RecordingLogger(),

);

t.is(source.sourceType, "download");

t.true(latestNightlyRequest.calledOnce);

if (source.sourceType === "download") {

t.deepEqual(source.bundle, {

kind: "per-language",

language: BuiltInLanguage.java,

url: `${baseURL}/codeql-bundle-java-linux64.tar.zst`,

combinedBundleURL: `${baseURL}/codeql-bundle-linux64.tar.zst`,

});

}

});

},

);

for (const date of ["20200101", "30260213"]) {

for (const bundle of ["combined", "per-language"] as const) {

test.serial(

`getCodeQLSource preserves an explicit ${bundle} nightly URL for ${date}${

bundle === "per-language" ? " on GHES" : ""

}`,

async (t) => {

const latestNightlyRequest = stubHostedNightly(

"codeql-bundle-30260213",

);

const asset =

bundle === "combined"

? "codeql-bundle-linux64.tar.zst"

: "codeql-bundle-java-linux64.tar.zst";

const url = `https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-${date}/${asset}`;

const features = createFeatures([]);

const variant =

bundle === "per-language" ? GitHubVariant.GHES : GitHubVariant.DOTCOM;

const logger = getRecordingLogger([], { logToConsole: false });

const error = new HTTPError("Not Found", 404);

const extractStub = sinon

.stub(toolsDownload, "downloadAndExtract")

.rejects(error);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

const source = await setupCodeql.getCodeQLSource(

url,

SAMPLE_DEFAULT_CLI_VERSION,

["java"],

undefined, // otherLanguagePacksReason

false,

SAMPLE_DOTCOM_API_DETAILS,

variant,

true,

features,

logger,

);

t.deepEqual(source, {

sourceType: "download",

bundle:

bundle === "combined"

? { kind: "combined", url }

: { kind: "per-language", url, language: BuiltInLanguage.java },

bundleVersion: date,

cliVersion: undefined,

compressionMethod: "zstd",

toolsVersion: `0.0.0-${date}`,

} satisfies setupCodeql.CodeQLDownloadSource);

await t.throwsAsync(

setupCodeql.setupCodeQLBundle(

url,

SAMPLE_DOTCOM_API_DETAILS,

tmpDir,

variant,

SAMPLE_DEFAULT_CLI_VERSION,

["java"],

undefined, // otherLanguagePacksReason

false,

features,

logger,

),

{ is: error },

);

t.true(extractStub.calledOnce);

t.is(extractStub.firstCall.args[0], url);

t.true(latestNightlyRequest.notCalled);

});

},

);

}

}

test.serial(

"getCodeQLSource reports a missing release tag when a toolcache entry disappears",

async (t) => {

sinon

.stub(toolcache, "findAllVersions")

.returns([MIN_PER_LANGUAGE_BUNDLE_CLI_VERSION]);

sinon.stub(toolcache, "find").returns("");

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic" });

await t.throwsAsync(

setupCodeql.getCodeQLSource(

"toolcache",

SAMPLE_DEFAULT_CLI_VERSION,

["java"],

undefined, // otherLanguagePacksReason

false,

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

true,

createFeatures([]),

new RecordingLogger(),

),

{

message:

"Could not determine a release tag for the requested CodeQL bundle.",

},

);

});

},

);

test.serial(

"getCodeQLSource correctly returns latest version from toolcache when tools == toolcache",

async (t) => {

const loggedMessages: LoggedMessage[] = [];

const logger = getRecordingLogger(loggedMessages);

const features = createFeatures([]);

const latestToolcacheVersion = "3.2.1";

const latestVersionPath = "/path/to/latest";

const testVersions = ["2.3.1", latestToolcacheVersion, "1.2.3"];

const findAllVersionsStub = sinon

.stub(toolcache, "findAllVersions")

.returns(testVersions);

const findStub = sinon.stub(toolcache, "find");

findStub

.withArgs("CodeQL", latestToolcacheVersion)

.returns(latestVersionPath);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic" });

const source = await setupCodeql.getCodeQLSource(

"toolcache",

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

false,

features,

logger,

);

// Check that the toolcache functions were called with the expected arguments

t.assert(

findAllVersionsStub.calledOnceWith("CodeQL"),

`toolcache.findAllVersions("CodeQL") wasn't called`,

);

t.assert(

findStub.calledOnceWith("CodeQL", latestToolcacheVersion),

`toolcache.find("CodeQL", ${latestToolcacheVersion}) wasn't called`,

);

// Check that `sourceType` and `toolsVersion` match expectations.

t.is(source.sourceType, "toolcache");

t.is(source.toolsVersion, latestToolcacheVersion);

// Check that key messages we would expect to find in the log are present.

const expectedMessages: string[] = [

`Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: toolcache'.`,

`CLI version ${latestToolcacheVersion} is the latest version in the toolcache.`,

`Using CodeQL CLI version ${latestToolcacheVersion} from toolcache at ${latestVersionPath}`,

];

for (const expectedMessage of expectedMessages) {

t.assert(

loggedMessages.some(

(msg) =>

typeof msg.message === "string" &&

msg.message.includes(expectedMessage),

),

`Expected '${expectedMessage}' in the logger output, but didn't find it in:\n ${loggedMessages.map((m) => ` - '${m.message}'`).join("\n")}`,

);

}

});

},

);

const toolcacheInputFallbackMacro = makeMacro({

exec: async (

t: ExecutionContext<unknown>,

featureList: Feature[],

environment: Record<string, string>,

testVersions: string[],

expectedMessages: string[],

) => {

const loggedMessages: LoggedMessage[] = [];

const logger = getRecordingLogger(loggedMessages);

const features = createFeatures(featureList);

const findAllVersionsStub = sinon

.stub(toolcache, "findAllVersions")

.returns(testVersions);

await withTmpDir(async (tmpDir) => {

setupActionsVars(tmpDir, tmpDir);

for (const [k, v] of Object.entries(environment)) {

process.env[k] = v;

}

const source = await setupCodeql.getCodeQLSource(

"toolcache",

SAMPLE_DEFAULT_CLI_VERSION,

undefined, // rawLanguages

undefined, // otherLanguagePacksReason

false, // useOverlayAwareDefaultCliVersion

SAMPLE_DOTCOM_API_DETAILS,

GitHubVariant.DOTCOM,

false,

features,

logger,

);

// Check that the toolcache functions were called with the expected arguments

t.assert(

findAllVersionsStub.calledWith("CodeQL"),

`toolcache.findAllVersions("CodeQL") wasn't called`,

);

// Check that `sourceType` and `toolsVersion` match expectations.

t.is(source.sourceType, "download");

t.is(

source.toolsVersion,

SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion,

);

// Check that key messages we would expect to find in the log are present.

for (const expectedMessage of expectedMessages) {

t.assert(

loggedMessages.some(

(msg) =>

typeof msg.message === "string" &&

msg.message.includes(expectedMessage),

),

`Expected '${expectedMessage}' in the logger output, but didn't find it in:\n ${loggedMessages.map((m) => ` - '${m.message}'`).join("\n")}`,

);

}

});

},

title: (providedTitle = "") =>

`getCodeQLSource falls back to downloading the CLI if ${providedTitle}`,

});

toolcacheInputFallbackMacro.serial(

"the toolcache doesn't have a CodeQL CLI when tools == toolcache",

[],

{ GITHUB_EVENT_NAME: "dynamic" },

[],

[

`Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: toolcache'.`,

`Found no CodeQL CLI in the toolcache, ignoring 'tools: toolcache'...`,

],

);

toolcacheInputFallbackMacro.serial(

"the workflow trigger is not `dynamic`",

[],

{ GITHUB_EVENT_NAME: "pull_request" },

[],

[

`Ignoring 'tools: toolcache' because the workflow was not triggered dynamically.`,

],

);