diff --git a/lib/entry-points.js b/lib/entry-points.js index 0183005a70..93f26642ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146353,6 +146353,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, @@ -146931,6 +146932,11 @@ var featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: void 0 }, + ["tools_repository_property" /* ToolsRepositoryProperty */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: void 0 + }, ["upload_overlay_db_to_api" /* UploadOverlayDbToApi */]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", @@ -147896,12 +147902,14 @@ function getUnknownLanguagesError(languages) { } // src/feature-flags/properties.ts +var github2 = __toESM(require_github()); var GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => { RepositoryPropertyName2["CONFIG_FILE"] = "github-codeql-config-file"; RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay"; RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries"; RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs"; + RepositoryPropertyName2["TOOLS"] = "github-codeql-tools"; return RepositoryPropertyName2; })(RepositoryPropertyName || {}); function isString2(value) { @@ -147920,7 +147928,8 @@ var repositoryPropertyParsers = { ["github-codeql-config-file" /* CONFIG_FILE */]: stringProperty, ["github-codeql-disable-overlay" /* DISABLE_OVERLAY */]: booleanProperty, ["github-codeql-extra-queries" /* EXTRA_QUERIES */]: stringProperty, - ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty + ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty, + ["github-codeql-tools" /* TOOLS */]: stringProperty }; async function loadPropertiesFromApi(logger, repositoryNwo) { try { @@ -148000,6 +148009,26 @@ var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name) { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } +async function loadRepositoryProperties(repositoryNwo, logger) { + const repositoryOwnerType = github2.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." + ); + return new Success({}); + } + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error3) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error3)}` + ); + return new Failure(error3); + } +} // src/config/db-config.ts var ORG_SCHEMA = { @@ -154014,7 +154043,7 @@ var fs19 = __toESM(require("fs")); var path17 = __toESM(require("path")); var core14 = __toESM(require_core()); var toolrunner4 = __toESM(require_toolrunner()); -var github2 = __toESM(require_github()); +var github3 = __toESM(require_github()); var io6 = __toESM(require_io()); async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) { logger.startGroup("Setup CodeQL tools"); @@ -154218,7 +154247,7 @@ function logFileCoverageOnPrsDeprecationWarning(logger) { if (process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION" /* DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION */]) { return; } - const repositoryOwnerType = github2.context.payload.repository?.owner.type; + const repositoryOwnerType = github3.context.payload.repository?.owner.type; let message = "Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses."; const envVarOptOut = "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`."; const repoPropertyOptOut = 'create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository\'s settings.'; @@ -157341,7 +157370,7 @@ var import_async = __toESM(require_async(), 1); var import_path6 = require("path"); // node_modules/archiver/lib/error.js -var import_util32 = __toESM(require("util"), 1); +var import_util33 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157366,7 +157395,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util32.default.inherits(ArchiverError, Error); +import_util33.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -160297,10 +160326,45 @@ async function runWrapper3() { var fs28 = __toESM(require("fs")); var path24 = __toESM(require("path")); var core21 = __toESM(require_core()); -var github3 = __toESM(require_github()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); +// src/config/inputs.ts +async function getToolsInput(action, repositoryProperties) { + const name = "tools" /* Tools */; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties["github-codeql-tools" /* TOOLS */]; + const allowRepositoryProperty = await action.features.getValue( + "tools_repository_property" /* ToolsRepositoryProperty */ + ); + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}` + ); + return { + name, + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: "repository-property" /* RepositoryProperty */ + }; + } + if (input !== void 0) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { name, value: input, source: "workflow" /* Workflow */ }; + } + if (allowRepositoryProperty && propertyValue !== void 0) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}` + ); + return { + name, + value: propertyValue, + source: "repository-property" /* RepositoryProperty */ + }; + } + return void 0; +} + // src/workflow.ts var fs27 = __toESM(require("fs")); var path23 = __toESM(require("path")); @@ -160591,7 +160655,7 @@ async function sendStartingStatusReport(startedAt, config, logger) { await sendStatusReport(statusReportBase); } } -async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { +async function sendCompletedStatusReport2(startedAt, config, configFile, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { const statusReportBase = await createStatusReportBase( "init" /* Init */, getActionsStatus(error3), @@ -160608,11 +160672,14 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDo const workflowLanguages = getOptionalInput("languages"); const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: workflowLanguages || "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -160648,6 +160715,7 @@ async function run3(actionState) { let codeql; let features; let sourceRoot; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -160704,6 +160772,10 @@ async function run3(actionState) { `The 'init' action should not be run in the same workflow as 'setup-codeql'.` ); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -160711,7 +160783,7 @@ async function run3(actionState) { ); const useOverlayAwareDefaultCliVersion = analysisKinds?.length === 1 && analysisKinds[0] === "code-scanning" /* CodeScanning */; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161043,6 +161115,7 @@ exec ${goBinaryPath} "$@"` config, void 0, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161060,6 +161133,7 @@ exec ${goBinaryPath} "$@"` startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161069,26 +161143,6 @@ exec ${goBinaryPath} "$@"` logger ); } -async function loadRepositoryProperties(repositoryNwo, logger) { - const repositoryOwnerType = github3.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." - ); - return new Success({}); - } - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error3) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error3)}` - ); - return new Failure(error3); - } -} async function recordZstdAvailability(config, zstdAvailability) { addNoLanguageDiagnostic( config, @@ -161649,7 +161703,7 @@ async function runWrapper6() { // src/setup-codeql-action.ts var core24 = __toESM(require_core()); -async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { +async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, getActionsStatus(error3), @@ -161665,11 +161719,14 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -161679,11 +161736,10 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } await sendStatusReport({ ...initStatusReport, ...initToolsDownloadFields }); } -async function run6({ - startedAt, - logger -}) { +async function run6(actionState) { + const { logger, startedAt } = actionState; let codeql; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -161706,6 +161762,12 @@ async function run6({ getTemporaryDirectory(), logger ); + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + const actionStateWithFeatures = { ...actionState, features }; const jobRunUuid = v4_default(); logger.info(`Job run UUID is ${jobRunUuid}.`); core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); @@ -161720,6 +161782,10 @@ async function run6({ if (statusReportBase !== void 0) { await sendStatusReport(statusReportBase); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -161727,7 +161793,7 @@ async function run6({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161764,6 +161830,7 @@ async function run6({ } await sendCompletedStatusReport3( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts new file mode 100644 index 0000000000..a484c76d73 --- /dev/null +++ b/src/config/inputs.test.ts @@ -0,0 +1,99 @@ +import test from "ava"; +import sinon from "sinon"; + +import { getActionsEnv } from "../actions-util"; +import { Feature } from "../feature-flags"; +import { RepositoryPropertyName } from "../feature-flags/properties"; +import { callee } from "../testing-utils"; + +import { ComputedInput, getToolsInput, InputName, InputSource } from "./inputs"; + +test("getToolsInput - undefined if there's no input", async (t) => { + await callee(getToolsInput).withArgs({}).passes(t.is, undefined); +}); + +const expectedWorkflowResult: ComputedInput = { + name: InputName.Tools, + source: InputSource.Workflow, + value: "workflow-input-value", +}; + +const expectedRepositoryPropertyResult: ComputedInput = { + name: InputName.Tools, + source: InputSource.RepositoryProperty, + value: "repo-property-input-value", +}; + +function stubGetToolsInput() { + const actions = getActionsEnv(); + sinon + .stub(actions, "getOptionalInput") + .withArgs(InputName.Tools) + .returns(expectedWorkflowResult.value); + return actions; +} + +const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`; + +test("getToolsInput - returns workflow input if available", async (t) => { + const actions = stubGetToolsInput(); + + await callee(getToolsInput) + .withActions(actions) + .withArgs({}) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property value if enforced", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`, + }); + + // We expect the repository value if provided and the FF is enabled. + const enforcedLogMessage = `Using ${InputName.Tools} input from repository property (enforced):`; + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, enforcedLogMessage) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target + .notLogs(t, enforcedLogMessage) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - prefers workflow input", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the workflow input regardless of the FF state. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); + await target + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property", async (t) => { + const target = callee(getToolsInput).withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the repository property if the FF is enabled or undefined otherwise. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, `Using ${InputName.Tools} input from repository property:`) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target.passes(t.is, undefined); +}); diff --git a/src/config/inputs.ts b/src/config/inputs.ts new file mode 100644 index 0000000000..06cfcfdb6c --- /dev/null +++ b/src/config/inputs.ts @@ -0,0 +1,84 @@ +import { ActionState } from "../action-common"; +import { Feature } from "../feature-flags"; +import { + RepositoryProperties, + RepositoryPropertyName, +} from "../feature-flags/properties"; + +/** Enumerates input names. */ +export enum InputName { + Tools = "tools", +} + +/** Enumerates input sources. */ +export enum InputSource { + Workflow = "workflow", + RepositoryProperty = "repository-property", +} + +/** + * Represents an effective input to the CodeQL Action. That is, + * the input value that was computed or selected from multiple sources. + */ +export type ComputedInput = { + /** The name of the property. */ + name: InputName; + /** The value of the property. */ + value: string; + /** The source of the property. */ + source: InputSource; +}; + +/** + * Gets the computed `tools` input. This comes from either the workflow or + * the repository property. + * + * @param action The Action state. + * @param repositoryProperties The values of known repository properties. + * @returns The computed input or `undefined` if there is no input. + */ +export async function getToolsInput( + action: ActionState<["Logger", "Actions", "FeatureFlags"]>, + repositoryProperties: Partial, +): Promise { + const name = InputName.Tools; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS]; + const allowRepositoryProperty = await action.features.getValue( + Feature.ToolsRepositoryProperty, + ); + + // The repository property takes precedence if it starts with an '!'. + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}`, + ); + return { + name, + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: InputSource.RepositoryProperty, + }; + } + + // Otherwise, the input from the workflow takes precedence. + if (input !== undefined) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { name, value: input, source: InputSource.Workflow }; + } + + // Use the repository property if there's no workflow input. + if (allowRepositoryProperty && propertyValue !== undefined) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}`, + ); + return { + name, + value: propertyValue, + source: InputSource.RepositoryProperty, + }; + } + + // There's no input. + return undefined; +} diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 0c92ac69af..33c02c13eb 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -141,6 +141,8 @@ export enum Feature { /** Note that this currently only disables baseline file coverage information. */ SkipFileCoverageOnPrs = "skip_file_coverage_on_prs", StartProxyUseFeaturesRelease = "start_proxy_use_features_release", + /** Whether to allow the `tools` input to be specified via a repository property. */ + ToolsRepositoryProperty = "tools_repository_property", UploadOverlayDbToApi = "upload_overlay_db_to_api", ValidateDbConfig = "validate_db_config", } @@ -400,6 +402,11 @@ export const featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: undefined, }, + [Feature.ToolsRepositoryProperty]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: undefined, + }, [Feature.UploadOverlayDbToApi]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", diff --git a/src/feature-flags/properties.test.ts b/src/feature-flags/properties.test.ts index 66526b1fb2..d3094a8d1c 100644 --- a/src/feature-flags/properties.test.ts +++ b/src/feature-flags/properties.test.ts @@ -72,13 +72,17 @@ test.serial( ); test.serial("loadPropertiesFromApi loads known properties", async (t) => { + const knownProperties = [ + { property_name: "github-codeql-config-file", value: "owner/repo" }, + { property_name: "github-codeql-extra-queries", value: "+queries" }, + { property_name: "github-codeql-tools", value: "nightly" }, + ]; sinon.stub(api, "getRepositoryProperties").resolves({ headers: {}, status: 200, url: "", data: [ - { property_name: "github-codeql-config-file", value: "owner/repo" }, - { property_name: "github-codeql-extra-queries", value: "+queries" }, + ...knownProperties, { property_name: "unknown-property", value: "something" }, ] satisfies properties.GitHubPropertiesResponse, }); @@ -88,10 +92,12 @@ test.serial("loadPropertiesFromApi loads known properties", async (t) => { logger, mockRepositoryNwo, ); - t.deepEqual(response, { - "github-codeql-config-file": "owner/repo", - "github-codeql-extra-queries": "+queries", - }); + t.deepEqual( + response, + Object.fromEntries( + knownProperties.map((prop) => [prop.property_name, prop.value]), + ), + ); }); test.serial("loadPropertiesFromApi parses true boolean property", async (t) => { diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts index e239c71947..4c888bd5ec 100644 --- a/src/feature-flags/properties.ts +++ b/src/feature-flags/properties.ts @@ -1,7 +1,10 @@ +import * as github from "@actions/github"; + import { isDynamicWorkflow } from "../actions-util"; import { getRepositoryProperties } from "../api-client"; import { Logger } from "../logging"; import { RepositoryNwo } from "../repository"; +import { Failure, getErrorMessage, Result, Success } from "../util"; /** The common prefix that we expect all of our repository properties to have. */ export const GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; @@ -14,6 +17,7 @@ export enum RepositoryPropertyName { DISABLE_OVERLAY = "github-codeql-disable-overlay", EXTRA_QUERIES = "github-codeql-extra-queries", FILE_COVERAGE_ON_PRS = "github-codeql-file-coverage-on-prs", + TOOLS = "github-codeql-tools", } /** Parsed types of the known repository properties. */ @@ -22,6 +26,7 @@ export type AllRepositoryProperties = { [RepositoryPropertyName.DISABLE_OVERLAY]: boolean; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: boolean; + [RepositoryPropertyName.TOOLS]: string; }; /** Parsed repository properties. */ @@ -33,6 +38,7 @@ export type RepositoryPropertyApiType = { [RepositoryPropertyName.DISABLE_OVERLAY]: string; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: string; + [RepositoryPropertyName.TOOLS]: string; }; /** The type of functions which take the `value` from the API and try to convert it to the type we want. */ @@ -81,6 +87,7 @@ const repositoryPropertyParsers: { [RepositoryPropertyName.DISABLE_OVERLAY]: booleanProperty, [RepositoryPropertyName.EXTRA_QUERIES]: stringProperty, [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: booleanProperty, + [RepositoryPropertyName.TOOLS]: stringProperty, }; /** @@ -230,3 +237,35 @@ const KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name: string): name is RepositoryPropertyName { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } + +/** + * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. + */ +export async function loadRepositoryProperties( + repositoryNwo: RepositoryNwo, + logger: Logger, +): Promise> { + // See if we can skip loading repository properties early. In particular, + // repositories owned by users cannot have repository properties, so we can + // skip the API call entirely in that case. + const repositoryOwnerType = github.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and " + + "therefore cannot have repository properties.", + ); + return new Success({}); + } + + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error)}`, + ); + return new Failure(error); + } +} diff --git a/src/init-action.ts b/src/init-action.ts index 8d0434160b..0fdff05721 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -2,7 +2,6 @@ import * as fs from "fs"; import * as path from "path"; import * as core from "@actions/core"; -import * as github from "@actions/github"; import * as io from "@actions/io"; import * as semver from "semver"; import { v4 as uuidV4 } from "uuid"; @@ -26,6 +25,7 @@ import { } from "./caching-utils"; import { CodeQL } from "./codeql"; import { getConfigFileInput } from "./config/file"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import * as configUtils from "./config-utils"; import { DependencyCacheRestoreStatusReport, @@ -41,10 +41,7 @@ import { } from "./diagnostics"; import { EnvVar } from "./environment"; import { Feature, FeatureEnablement, initFeatures } from "./feature-flags"; -import { - loadPropertiesFromApi, - RepositoryProperties, -} from "./feature-flags/properties"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { checkInstallPython311, checkPacksForOverlayCompatibility, @@ -62,7 +59,7 @@ import { OverlayBaseDatabaseDownloadStats, } from "./overlay/caching"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; -import { getRepositoryNwo, RepositoryNwo } from "./repository"; +import { getRepositoryNwo } from "./repository"; import { ToolsSource } from "./setup-codeql"; import { ActionName, @@ -94,10 +91,7 @@ import { checkActionVersion, getErrorMessage, BuildMode, - Result, getOptionalEnvVar, - Success, - Failure, } from "./util"; import { checkWorkflow } from "./workflow"; @@ -137,6 +131,7 @@ async function sendCompletedStatusReport( startedAt: Date, config: configUtils.Config | undefined, configFile: string | undefined, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -165,12 +160,16 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: workflowLanguages || "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { @@ -218,6 +217,7 @@ async function run( let codeql: CodeQL; let features: FeatureEnablement; let sourceRoot: string; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -302,6 +302,12 @@ async function run( ); } + // Get the computed `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -312,7 +318,7 @@ async function run( analysisKinds?.length === 1 && analysisKinds[0] === AnalysisKind.CodeScanning; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -778,6 +784,7 @@ async function run( startedAt, config, undefined, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -795,6 +802,7 @@ async function run( startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -805,38 +813,6 @@ async function run( ); } -/** - * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. - */ -async function loadRepositoryProperties( - repositoryNwo: RepositoryNwo, - logger: Logger, -): Promise> { - // See if we can skip loading repository properties early. In particular, - // repositories owned by users cannot have repository properties, so we can - // skip the API call entirely in that case. - const repositoryOwnerType = github.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and " + - "therefore cannot have repository properties.", - ); - return new Success({}); - } - - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error)}`, - ); - return new Failure(error); - } -} - async function recordZstdAvailability( config: configUtils.Config, zstdAvailability: ZstdAvailability, diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 3336afc1a2..b2a9e90f36 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -11,9 +11,11 @@ import { import { AnalysisKind, getAnalysisKinds } from "./analyses"; import { getGitHubVersion } from "./api-client"; import { CodeQL } from "./codeql"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { initCodeQL } from "./init"; import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; @@ -43,6 +45,7 @@ import { */ async function sendCompletedStatusReport( startedAt: Date, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -67,12 +70,16 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { @@ -87,14 +94,15 @@ async function sendCompletedStatusReport( } /** The main behaviour of this action. */ -async function run({ - startedAt, - logger, -}: ActionState<["Base", "Logger"]>): Promise { +async function run( + actionState: ActionState<["Base", "Logger", "Actions"]>, +): Promise { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. + const { logger, startedAt } = actionState; let codeql: CodeQL; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -123,6 +131,15 @@ async function run({ logger, ); + // Fetch the values of known repository properties that affect us. + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger, + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + + const actionStateWithFeatures = { ...actionState, features }; + const jobRunUuid = uuidV4(); logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); @@ -138,6 +155,13 @@ async function run({ if (statusReportBase !== undefined) { await sendStatusReport(statusReportBase); } + + // Get the computed `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -146,7 +170,7 @@ async function run({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -187,6 +211,7 @@ async function run({ await sendCompletedStatusReport( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 52132b7649..9086dd34ef 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -71,6 +71,7 @@ test.serial("createStatusReportBase", async (t) => { t.is(statusReport.build_mode, BuildMode.None); t.is(statusReport.cause, "failure cause"); t.is(statusReport.commit_oid, process.env["GITHUB_SHA"]!); + t.deepEqual(statusReport.computed_inputs, {}); t.is(statusReport.exception, "exception stack trace"); t.is(statusReport.job_name, process.env["GITHUB_JOB"] || ""); t.is(typeof statusReport.job_run_uuid, "string"); diff --git a/src/status-report.ts b/src/status-report.ts index a0c0b3ab40..d9d2a7ba4c 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -13,6 +13,7 @@ import { } from "./actions-util"; import { getAnalysisKey, getApiClient } from "./api-client"; import type { Config } from "./config/action-config"; +import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; @@ -122,6 +123,8 @@ export interface StatusReportBase { commit_oid: string; /** Time this action completed, or undefined if not yet completed. */ completed_at?: string; + /** A mapping of input names to their computed values. */ + computed_inputs: Partial>; /** Stack trace of the failure (or undefined if status is not failure). */ exception?: string; /** Whether this is a first-party (CodeQL) run of the action. */ @@ -316,6 +319,7 @@ export async function createStatusReportBase( analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID,