diff --git a/.github/actions/release-initialise/action.yml b/.github/actions/release-initialise/action.yml index be16f03950..239dfa9428 100644 --- a/.github/actions/release-initialise/action.yml +++ b/.github/actions/release-initialise/action.yml @@ -25,17 +25,6 @@ runs: shell: bash run: npm ci - - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 - with: - python-version: '3.12' - - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install PyGithub==2.3.0 requests - shell: bash - - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..c3cf8d63f3 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml index 53c8834eea..5d0576e2f6 100644 --- a/.github/workflows/__analysis-kinds.yml +++ b/.github/workflows/__analysis-kinds.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..7341a41740 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index 2d655b2eef..730a387f90 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -59,9 +59,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Prepare test diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index 13918e5395..b527638feb 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml index 71dd9d1df8..fac4ef9f54 100644 --- a/.github/workflows/__autobuild-working-dir.yml +++ b/.github/workflows/__autobuild-working-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 74881301cf..5043433ee3 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..bfe92c55ea 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml index dc97aa3d99..da7aa76383 100644 --- a/.github/workflows/__build-mode-none.yml +++ b/.github/workflows/__build-mode-none.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml index 4383024f3b..fcc77ea36e 100644 --- a/.github/workflows/__build-mode-rollback.yml +++ b/.github/workflows/__build-mode-rollback.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml index 9ccb507866..6c414fb67e 100644 --- a/.github/workflows/__bundle-from-nightly.yml +++ b/.github/workflows/__bundle-from-nightly.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml index 036262395e..a1c1fade09 100644 --- a/.github/workflows/__bundle-from-toolcache.yml +++ b/.github/workflows/__bundle-from-toolcache.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 0bdfd45082..9cc983a843 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml deleted file mode 100644 index 7c1f89cfbd..0000000000 --- a/.github/workflows/__bundle-zstd.yml +++ /dev/null @@ -1,120 +0,0 @@ -# Warning: This file is generated automatically, and should not be modified. -# Instead, please modify the template in the pr-checks directory and run: -# pr-checks/sync.sh -# to regenerate this file. - -name: 'PR Check - Bundle: Zstandard checks' -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: {} - merge_group: - types: - - checks_requested - schedule: - - cron: '0 5 * * *' - workflow_dispatch: - inputs: {} - workflow_call: - inputs: {} -defaults: - run: - shell: bash -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: bundle-zstd-${{github.ref}} -jobs: - bundle-zstd: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-latest - version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - name: 'Bundle: Zstandard checks' - if: github.triggering_actor != 'dependabot[bot]' - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } - env: - CODEQL_ACTION_TEST_MODE: true diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml index 921228910e..3153041401 100644 --- a/.github/workflows/__cleanup-db-cluster-dir.yml +++ b/.github/workflows/__cleanup-db-cluster-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index dedf559719..0c7a2cc151 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index 7dbaed852e..4267e00584 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml index 5eba27ed63..e2434f4256 100644 --- a/.github/workflows/__cpp-deptrace-disabled.yml +++ b/.github/workflows/__cpp-deptrace-disabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml index d26cd7dca7..344ed8d1ea 100644 --- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml +++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml index d3b04db26d..ab1a70584b 100644 --- a/.github/workflows/__cpp-deptrace-enabled.yml +++ b/.github/workflows/__cpp-deptrace-enabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index 7f788ef0a2..c55f3de9b8 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..4ce8b40285 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml index 28487388df..5bd5c8b940 100644 --- a/.github/workflows/__extractor-ram-threads.yml +++ b/.github/workflows/__extractor-ram-threads.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index e3ba6ff101..9244d1fc8f 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -55,17 +55,45 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'false' + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true CODEQL_ACTION_TEST_MODE: true container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..7b4cd1305b 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -67,13 +67,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index ced2df5982..968caf1e69 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -55,9 +55,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -73,7 +73,7 @@ jobs: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.20' - name: Build code diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 32ebaee34a..0f13b1e663 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -55,9 +55,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 8696063265..915835c2ab 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -55,9 +55,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index d8ef15b5a9..ccbb1b5a6e 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -75,9 +75,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index 077382459f..2acc617cb1 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -75,9 +75,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 2c4031b388..a43705b703 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -75,9 +75,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index 623afdee97..9293dcc196 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml index 622156ce4d..1dcbd38a85 100644 --- a/.github/workflows/__javascript-source-root.yml +++ b/.github/workflows/__javascript-source-root.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index 989b28fc53..429a694947 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -71,8 +71,8 @@ jobs: run: | cd "$RUNNER_TEMP/results" actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif) - if [[ "$actual" != "$JOB_RUN_UUID" ]]; then - echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'." + if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then + echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'." exit 1 else echo "Found job run UUID '$actual'." diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml index 3a1656eef7..731d975ce3 100644 --- a/.github/workflows/__language-aliases.yml +++ b/.github/workflows/__language-aliases.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..8e448080f3 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..55023cd916 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -99,13 +99,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -120,7 +120,7 @@ jobs: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml index 9a4ffa71f2..b6c99efcef 100644 --- a/.github/workflows/__overlay-init-fallback.yml +++ b/.github/workflows/__overlay-init-fallback.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..409e0a1a65 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..34d4ae1bca 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..88426cd684 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..2461944dbd 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..e1c3785f6a 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -67,13 +67,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index 29a042ae2b..11a31fdabc 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 7ee8f1fdc7..c405b44fed 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -54,7 +54,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml index 3558be85e4..98f8ec6a2a 100644 --- a/.github/workflows/__ruby.yml +++ b/.github/workflows/__ruby.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index e74daa4e4a..b3638ca6df 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -53,7 +53,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..512058a598 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -75,13 +75,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml index 51751680c3..edc6aa1cc5 100644 --- a/.github/workflows/__start-proxy.yml +++ b/.github/workflows/__start-proxy.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml index 339d6a07cb..099e93001f 100644 --- a/.github/workflows/__submit-sarif-failure.yml +++ b/.github/workflows/__submit-sarif-failure.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -57,7 +57,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'true' - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml index e59a87e3aa..52c189f3a8 100644 --- a/.github/workflows/__swift-autobuild.yml +++ b/.github/workflows/__swift-autobuild.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..99fbf7a897 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -69,13 +69,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..8a8796d9a7 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -67,13 +67,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..76e8f4e3c0 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -65,13 +65,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..77fa0264e5 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -72,13 +72,13 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..59a8edc9d1 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -66,13 +66,13 @@ jobs: steps: # This ensures we don't accidentally use the original checkout for any part of the test. - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -91,7 +91,7 @@ jobs: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/.github/workflows/check-expected-release-files.yml b/.github/workflows/check-expected-release-files.yml index 670f146566..6cabd0454b 100644 --- a/.github/workflows/check-expected-release-files.yml +++ b/.github/workflows/check-expected-release-files.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check Expected Release Files run: | bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c5efa1731a..f27de17fd8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,7 +32,7 @@ jobs: security-events: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up default CodeQL bundle id: setup-default uses: ./setup-codeql @@ -84,7 +84,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init id: init @@ -113,7 +113,6 @@ jobs: matrix: include: - language: actions - - language: python permissions: contents: read @@ -121,7 +120,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init with: diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index ee1ecea3d1..7bc6718e35 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -54,7 +54,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..f67cef5c75 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -48,17 +48,17 @@ jobs: - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..c27f195113 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -44,17 +44,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 0050c5da85..c493c2a382 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -44,16 +44,16 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "${GITHUB_CONTEXT}" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # ensure we have all tags and can push commits - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: 'npm' - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - with: - python-version: '3.12' + + - name: Install JavaScript dependencies + run: npm ci - name: Update git config run: | @@ -127,7 +127,7 @@ jobs: env: PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py CHANGELOG.md > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index ae21707826..ac61475d62 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -39,7 +39,7 @@ jobs: if: runner.os == 'Windows' run: git config --global core.autocrlf false - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -88,7 +88,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -161,7 +161,7 @@ jobs: - name: 'Backport: Check out base ref' id: checkout-base if: ${{ startsWith(github.head_ref, 'backport-') }} - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.base_ref }} diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 8bab54557a..4eb300704d 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -44,7 +44,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs diff --git a/.github/workflows/publish-immutable-action.yml b/.github/workflows/publish-immutable-action.yml index ec9a6518aa..5e5623bb07 100644 --- a/.github/workflows/publish-immutable-action.yml +++ b/.github/workflows/publish-immutable-action.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Publish immutable release id: publish diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 5722289fad..ab169499e2 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -32,11 +32,11 @@ jobs: runs-on: windows-latest steps: - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.12 - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 182b64b9c1..87b934eb6b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -30,7 +30,7 @@ jobs: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index f1d2a1a4f4..faa32c65d9 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -24,7 +24,7 @@ jobs: pull-requests: write # needed to comment on the PR steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ env.HEAD_REF }} diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index b830a827dd..c37f8a79ae 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -52,7 +52,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs @@ -93,7 +93,7 @@ jobs: LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }} VERSION: "${{ needs.prepare.outputs.version }}" run: | - python .github/workflows/script/rollback_changelog.py \ + npx tsx pr-checks/rollback-changelog.ts \ --target-version "${ROLLBACK_TAG:1}" \ --rollback-version "${LATEST_TAG:1}" \ --new-version "$VERSION" > $NEW_CHANGELOG @@ -128,7 +128,9 @@ jobs: NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md" PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts \ + --changelog="$NEW_CHANGELOG" \ + --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG diff --git a/.github/workflows/script/bundle_changelog.py b/.github/workflows/script/bundle_changelog.py deleted file mode 100755 index d8ced87d8d..0000000000 --- a/.github/workflows/script/bundle_changelog.py +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/env python3 -import os -import re - -cli_version = os.environ['CLI_VERSION'] - -# The GitHub Release for the new bundle version. -bundle_release_url = f"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v{cli_version}" -# Get the PR number from the PR URL. -pr_number = os.environ['PR_URL'].split('/')[-1] -changelog_note = f"- Update default CodeQL bundle version to [{cli_version}]({bundle_release_url}). [#{pr_number}]({os.environ['PR_URL']})" - -# If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. -with open('CHANGELOG.md', 'r') as f: - changelog = f.read() - -changelog = changelog.replace('## [UNRELEASED]\n\nNo user facing changes.', '## [UNRELEASED]\n') - -# Add the changelog note to the bottom of the "[UNRELEASED]" section. -changelog = re.sub(r'\n## (\d+\.\d+\.\d+)', f'{changelog_note}\n\n## \\1', changelog, count=1) - -with open('CHANGELOG.md', 'w') as f: - f.write(changelog) diff --git a/.github/workflows/script/prepare_changelog.py b/.github/workflows/script/prepare_changelog.py deleted file mode 100755 index dafb84b39c..0000000000 --- a/.github/workflows/script/prepare_changelog.py +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/env python3 -import os -import sys - -EMPTY_CHANGELOG = 'No changes.\n\n' - -# Prepare the changelog for the new release -# This function will extract the part of the changelog that -# we want to include in the new release. -def extract_changelog_snippet(changelog_file): - output = '' - if (not os.path.exists(changelog_file)): - output = EMPTY_CHANGELOG - - else: - with open(changelog_file, 'r') as f: - lines = f.readlines() - - # Include only the contents of the first section - found_first_section = False - for line in lines: - if line.startswith('## '): - if found_first_section: - break - found_first_section = True - elif found_first_section: - output += line - - return output.strip() - - -if len(sys.argv) < 2: - raise Exception('Expecting argument: changelog_file') -changelog_file = sys.argv[1] -print(extract_changelog_snippet(changelog_file)) diff --git a/.github/workflows/script/rollback_changelog.py b/.github/workflows/script/rollback_changelog.py deleted file mode 100644 index 5e06f83455..0000000000 --- a/.github/workflows/script/rollback_changelog.py +++ /dev/null @@ -1,62 +0,0 @@ -import datetime -import os -import argparse - -EMPTY_CHANGELOG = """# CodeQL Action Changelog - -""" - -def get_today_string(): - today = datetime.datetime.today() - return '{:%d %b %Y}'.format(today) - -# Include everything up to and after the first heading, -# but not the first heading and body. -def drop_unreleased_section(lines: list[str]): - before_first_section = '' - after_first_section = '' - found_first_section = False - skipped_first_section = False - - for i, line in enumerate(lines): - if line.startswith('## ') and not found_first_section: - found_first_section = True - elif line.startswith('## ') and found_first_section: - skipped_first_section = True - - if not found_first_section: - before_first_section += line - if skipped_first_section: - after_first_section += line - - return (before_first_section, after_first_section) - -def update_changelog(target_version, rollback_version, new_version): - before_first_section = EMPTY_CHANGELOG - after_first_section = '' - - if (os.path.exists('CHANGELOG.md')): - with open('CHANGELOG.md', 'r') as f: - (before_first_section, after_first_section) = drop_unreleased_section(f.readlines()) - - newHeader = f'## {new_version} - {get_today_string()}\n' - - print(before_first_section, end="") - print(newHeader) - print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n") - print(after_first_section) - -# We expect three version strings as input: -# -# - target_version: the version that we are re-releasing as `new_version` -# - rollback_version: the version that we are rolling back, typically the one that followed `target_version` -# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version` -# -# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5" -parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.") -parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.") -parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.") -parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.") -args = parser.parse_args() - -update_changelog(args.target_version, args.rollback_version, args.new_version) diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index e7cd9aab15..477fdf0524 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -38,7 +38,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -46,7 +46,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: true - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - id: init diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index f5e79075e6..d3ee924e59 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -33,18 +33,13 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "$GITHUB_CONTEXT" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" git config --global user.name "github-actions[bot]" - - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - with: - python-version: '3.12' - - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: @@ -120,7 +115,7 @@ jobs: - name: Create changelog note run: | - python .github/workflows/script/bundle_changelog.py + npx tsx pr-checks/bundle-changelog.ts - name: Push changelog note run: | diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index f690c3847e..9f38f0f0b4 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,7 +38,7 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs - uses: ./.github/actions/release-initialise @@ -101,7 +101,7 @@ jobs: private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }} - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 30f926d7a6..ee2649ad0e 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -22,13 +22,8 @@ jobs: pull-requests: write # needed to create pull request steps: - - name: Setup Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - with: - python-version: "3.13" - - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -40,10 +35,10 @@ jobs: run: npm ci - name: Checkout Enterprise Releases - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: github/enterprise-releases - token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }} + token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }} path: ${{ github.workspace }}/enterprise-releases/ sparse-checkout: releases.json diff --git a/CHANGELOG.md b/CHANGELOG.md index af737811ff..4234855e52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,27 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## 4.37.8 - 21 Aug 2026 + +No user facing changes. + +## 4.37.7 - 13 Aug 2026 + +- Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085) + +## 4.37.6 - 04 Aug 2026 + +- Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070) + +## 4.37.5 - 03 Aug 2026 + +- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061) + +## 4.37.4 - 29 Jul 2026 + +- This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) +- Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) + ## 4.37.3 - 22 Jul 2026 No user facing changes. diff --git a/lib/defaults.json b/lib/defaults.json index 39ecfc35fa..b5d9f13644 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.3", + "cliVersion": "2.26.3", + "priorBundleVersion": "codeql-bundle-v2.26.2", + "priorCliVersion": "2.26.2" } diff --git a/lib/entry-points.js b/lib/entry-points.js index b7db317324..12bdf418f8 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -213,7 +213,7 @@ var require_file_command = __commonJS({ exports2.issueFileCommand = issueFileCommand; exports2.prepareKeyValueMessage = prepareKeyValueMessage; var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var os7 = __importStar2(require("os")); var utils_1 = require_utils(); function issueFileCommand(command, message) { @@ -221,10 +221,10 @@ var require_file_command = __commonJS({ if (!filePath) { throw new Error(`Unable to find environment variable for file command ${command}`); } - if (!fs31.existsSync(filePath)) { + if (!fs32.existsSync(filePath)) { throw new Error(`Missing file at path: ${filePath}`); } - fs31.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { + fs32.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { encoding: "utf8" }); } @@ -1362,14 +1362,14 @@ var require_util = __commonJS({ } const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80; let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`; - let path29 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`; + let path30 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`; if (origin[origin.length - 1] === "/") { origin = origin.slice(0, origin.length - 1); } - if (path29 && path29[0] !== "/") { - path29 = `/${path29}`; + if (path30 && path30[0] !== "/") { + path30 = `/${path30}`; } - return new URL(`${origin}${path29}`); + return new URL(`${origin}${path30}`); } if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) { throw new InvalidArgumentError("Invalid URL protocol: the URL must start with `http:` or `https:`."); @@ -1820,39 +1820,39 @@ var require_diagnostics = __commonJS({ }); diagnosticsChannel.channel("undici:client:sendHeaders").subscribe((evt) => { const { - request: { method, path: path29, origin } + request: { method, path: path30, origin } } = evt; - debuglog("sending request to %s %s/%s", method, origin, path29); + debuglog("sending request to %s %s/%s", method, origin, path30); }); diagnosticsChannel.channel("undici:request:headers").subscribe((evt) => { const { - request: { method, path: path29, origin }, + request: { method, path: path30, origin }, response: { statusCode } } = evt; debuglog( "received response to %s %s/%s - HTTP %d", method, origin, - path29, + path30, statusCode ); }); diagnosticsChannel.channel("undici:request:trailers").subscribe((evt) => { const { - request: { method, path: path29, origin } + request: { method, path: path30, origin } } = evt; - debuglog("trailers received from %s %s/%s", method, origin, path29); + debuglog("trailers received from %s %s/%s", method, origin, path30); }); diagnosticsChannel.channel("undici:request:error").subscribe((evt) => { const { - request: { method, path: path29, origin }, + request: { method, path: path30, origin }, error: error3 } = evt; debuglog( "request to %s %s/%s errored - %s", method, origin, - path29, + path30, error3.message ); }); @@ -1901,9 +1901,9 @@ var require_diagnostics = __commonJS({ }); diagnosticsChannel.channel("undici:client:sendHeaders").subscribe((evt) => { const { - request: { method, path: path29, origin } + request: { method, path: path30, origin } } = evt; - debuglog("sending request to %s %s/%s", method, origin, path29); + debuglog("sending request to %s %s/%s", method, origin, path30); }); } diagnosticsChannel.channel("undici:websocket:open").subscribe((evt) => { @@ -1966,7 +1966,7 @@ var require_request = __commonJS({ var kHandler = /* @__PURE__ */ Symbol("handler"); var Request = class { constructor(origin, { - path: path29, + path: path30, method, body, headers, @@ -1981,11 +1981,11 @@ var require_request = __commonJS({ expectContinue, servername }, handler2) { - if (typeof path29 !== "string") { + if (typeof path30 !== "string") { throw new InvalidArgumentError("path must be a string"); - } else if (path29[0] !== "/" && !(path29.startsWith("http://") || path29.startsWith("https://")) && method !== "CONNECT") { + } else if (path30[0] !== "/" && !(path30.startsWith("http://") || path30.startsWith("https://")) && method !== "CONNECT") { throw new InvalidArgumentError("path must be an absolute URL or start with a slash"); - } else if (invalidPathRegex.test(path29)) { + } else if (invalidPathRegex.test(path30)) { throw new InvalidArgumentError("invalid request path"); } if (typeof method !== "string") { @@ -2051,7 +2051,7 @@ var require_request = __commonJS({ this.completed = false; this.aborted = false; this.upgrade = upgrade || null; - this.path = query ? buildURL(path29, query) : path29; + this.path = query ? buildURL(path30, query) : path30; this.origin = origin; this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent; this.blocking = blocking == null ? false : blocking; @@ -2218,7 +2218,11 @@ var require_request = __commonJS({ } else if (typeof val[i] === "object") { throw new InvalidArgumentError(`invalid ${key} header`); } else { - arr.push(`${val[i]}`); + const str = `${val[i]}`; + if (!isValidHeaderValue(str)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } + arr.push(str); } } val = arr; @@ -2230,6 +2234,9 @@ var require_request = __commonJS({ val = ""; } else { val = `${val}`; + if (!isValidHeaderValue(val)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } } if (headerName === "host") { if (request3.host !== null) { @@ -5960,6 +5967,7 @@ var require_client_h1 = __commonJS({ RequestContentLengthMismatchError, ResponseContentLengthMismatchError, RequestAbortedError, + InvalidArgumentError, HeadersTimeoutError, HeadersOverflowError, SocketError, @@ -6673,7 +6681,7 @@ var require_client_h1 = __commonJS({ return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT"; } function writeH1(client, request3) { - const { method, path: path29, host, upgrade, blocking, reset } = request3; + const { method, path: path30, host, upgrade, blocking, reset } = request3; let { body, headers, contentLength } = request3; const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH"; if (util3.isFormDataLike(body)) { @@ -6686,8 +6694,16 @@ var require_client_h1 = __commonJS({ } body = bodyStream.stream; contentLength = bodyStream.length; - } else if (util3.isBlobLike(body) && request3.contentType == null && body.type) { - headers.push("content-type", body.type); + } else if (util3.isBlobLike(body) && request3.contentType == null) { + const contentType = body.type; + if (contentType) { + const contentTypeValue = `${contentType}`; + if (!util3.isValidHeaderValue(contentTypeValue)) { + util3.errorRequest(client, request3, new InvalidArgumentError("invalid content-type header")); + return false; + } + headers.push("content-type", contentTypeValue); + } } if (body && typeof body.read === "function") { body.read(0); @@ -6740,7 +6756,7 @@ var require_client_h1 = __commonJS({ if (blocking) { socket[kBlocking] = true; } - let header = `${method} ${path29} HTTP/1.1\r + let header = `${method} ${path30} HTTP/1.1\r `; if (typeof host === "string") { header += `host: ${host}\r @@ -7069,7 +7085,7 @@ var require_client_h2 = __commonJS({ "node_modules/undici/lib/dispatcher/client-h2.js"(exports2, module2) { "use strict"; var assert = require("node:assert"); - var { pipeline } = require("node:stream"); + var { pipeline: pipeline2 } = require("node:stream"); var util3 = require_util(); var { RequestContentLengthMismatchError, @@ -7266,7 +7282,7 @@ var require_client_h2 = __commonJS({ } function writeH2(client, request3) { const session = client[kHTTP2Session]; - const { method, path: path29, host, upgrade, expectContinue, signal, headers: reqHeaders } = request3; + const { method, path: path30, host, upgrade, expectContinue, signal, headers: reqHeaders } = request3; let { body } = request3; if (upgrade) { util3.errorRequest(client, request3, new Error("Upgrade not supported for H2")); @@ -7333,7 +7349,7 @@ var require_client_h2 = __commonJS({ }); return true; } - headers[HTTP2_HEADER_PATH] = path29; + headers[HTTP2_HEADER_PATH] = path30; headers[HTTP2_HEADER_SCHEME] = "https"; const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH"; if (body && typeof body.read === "function") { @@ -7516,7 +7532,7 @@ var require_client_h2 = __commonJS({ } function writeStream(abort, socket, expectsPayload, h2stream, body, client, request3, contentLength) { assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined"); - const pipe = pipeline( + const pipe = pipeline2( body, h2stream, (err) => { @@ -7686,9 +7702,9 @@ var require_redirect_handler = __commonJS({ return this.handler.onHeaders(statusCode, headers, resume, statusText); } const { origin, pathname, search } = util3.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin))); - const path29 = search ? `${pathname}${search}` : pathname; + const path30 = search ? `${pathname}${search}` : pathname; this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin); - this.opts.path = path29; + this.opts.path = path30; this.opts.origin = origin; this.opts.maxRedirections = 0; this.opts.query = null; @@ -8923,10 +8939,10 @@ var require_proxy_agent = __commonJS({ }; const { origin, - path: path29 = "/", + path: path30 = "/", headers = {} } = opts; - opts.path = origin + path29; + opts.path = origin + path30; if (!("host" in headers) && !("Host" in headers)) { const { host } = new URL2(origin); headers.host = host; @@ -9239,6 +9255,24 @@ var require_retry_handler = __commonJS({ const current = Date.now(); return new Date(retryAfter).getTime() - current; } + function validatePartialResponseContentLength(headers, range2, statusCode, retryCount) { + const contentLength = headers["content-length"]; + if (contentLength == null) { + return null; + } + if (!Number.isFinite(range2.start) || !Number.isFinite(range2.end)) { + return null; + } + const length = Number(contentLength); + const expectedLength = range2.end - range2.start + 1; + if (!Number.isFinite(length) || length !== expectedLength) { + return new RequestRetryError("Content-Length mismatch", statusCode, { + headers, + data: { count: retryCount } + }); + } + return null; + } var RetryHandler = class _RetryHandler { constructor(opts, handlers) { const { retryOptions, ...dispatchOpts } = opts; @@ -9411,6 +9445,11 @@ var require_retry_handler = __commonJS({ ); return false; } + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = contentRange; assert(this.start === start, "content-range mismatch"); assert(this.end == null || this.end === end, "content-range mismatch"); @@ -9428,6 +9467,11 @@ var require_retry_handler = __commonJS({ statusMessage ); } + const contentLengthError = validatePartialResponseContentLength(headers, range2, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = range2; assert( start != null && Number.isFinite(start), @@ -10506,7 +10550,7 @@ var require_api_pipeline = __commonJS({ util3.destroy(ret, err); } }; - function pipeline(opts, handler2) { + function pipeline2(opts, handler2) { try { const pipelineHandler = new PipelineHandler(opts, handler2); this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler); @@ -10515,7 +10559,7 @@ var require_api_pipeline = __commonJS({ return new PassThrough3().destroy(err); } } - module2.exports = pipeline; + module2.exports = pipeline2; } }); @@ -10847,20 +10891,20 @@ var require_mock_utils = __commonJS({ } return true; } - function safeUrl(path29) { - if (typeof path29 !== "string") { - return path29; + function safeUrl(path30) { + if (typeof path30 !== "string") { + return path30; } - const pathSegments = path29.split("?"); + const pathSegments = path30.split("?"); if (pathSegments.length !== 2) { - return path29; + return path30; } const qp = new URLSearchParams(pathSegments.pop()); qp.sort(); return [...pathSegments, qp.toString()].join("?"); } - function matchKey(mockDispatch2, { path: path29, method, body, headers }) { - const pathMatch = matchValue(mockDispatch2.path, path29); + function matchKey(mockDispatch2, { path: path30, method, body, headers }) { + const pathMatch = matchValue(mockDispatch2.path, path30); const methodMatch = matchValue(mockDispatch2.method, method); const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true; const headersMatch = matchHeaders(mockDispatch2, headers); @@ -10882,7 +10926,7 @@ var require_mock_utils = __commonJS({ function getMockDispatch(mockDispatches, key) { const basePath = key.query ? buildURL(key.path, key.query) : key.path; const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath; - let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path29 }) => matchValue(safeUrl(path29), resolvedPath)); + let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path30 }) => matchValue(safeUrl(path30), resolvedPath)); if (matchedMockDispatches.length === 0) { throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`); } @@ -10920,9 +10964,9 @@ var require_mock_utils = __commonJS({ } } function buildKey(opts) { - const { path: path29, method, body, headers, query } = opts; + const { path: path30, method, body, headers, query } = opts; return { - path: path29, + path: path30, method, body, headers, @@ -11385,10 +11429,10 @@ var require_pending_interceptors_formatter = __commonJS({ } format(pendingInterceptors) { const withPrettyHeaders = pendingInterceptors.map( - ({ method, path: path29, data: { statusCode }, persist, times, timesInvoked, origin }) => ({ + ({ method, path: path30, data: { statusCode }, persist, times, timesInvoked, origin }) => ({ Method: method, Origin: origin, - Path: path29, + Path: path30, "Status code": statusCode, Persistent: persist ? PERSISTENT : NOT_PERSISTENT, Invocations: timesInvoked, @@ -13680,7 +13724,7 @@ var require_fetch = __commonJS({ subresourceSet } = require_constants3(); var EE = require("node:events"); - var { Readable: Readable3, pipeline, finished } = require("node:stream"); + var { Readable: Readable3, pipeline: pipeline2, finished } = require("node:stream"); var { addAbortListener, isErrored, isReadable, bufferToLowerCasedHeaderName } = require_util(); var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url(); var { getGlobalDispatcher } = require_global2(); @@ -14624,7 +14668,7 @@ var require_fetch = __commonJS({ status, statusText, headersList, - body: decoders.length ? pipeline(this.body, ...decoders, (err) => { + body: decoders.length ? pipeline2(this.body, ...decoders, (err) => { if (err) { this.onError(err); } @@ -16269,18 +16313,52 @@ var require_util6 = __commonJS({ } } } - function validateCookiePath(path29) { - for (let i = 0; i < path29.length; ++i) { - const code = path29.charCodeAt(i); + function validateCookiePath(path30) { + for (let i = 0; i < path30.length; ++i) { + const code = path30.charCodeAt(i); if (code < 32 || // exclude CTLs (0-31) - code === 127 || // DEL + code > 126 || // exclude DEL and non-ascii code === 59) { throw new Error("Invalid cookie path"); } } } + function isLetterOrDigit(code) { + return code >= 48 && code <= 57 || // 0-9 + code >= 65 && code <= 90 || // A-Z + code >= 97 && code <= 122; + } function validateCookieDomain(domain) { - if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) { + if (domain === " ") { + return; + } + if (domain.length > 255) { + throw new Error("Invalid cookie domain"); + } + let labelLength = 0; + for (let i = 0; i < domain.length; ++i) { + const code = domain.charCodeAt(i); + if (code === 46) { + if (labelLength === 0) { + throw new Error("Invalid cookie domain"); + } + if (domain.charCodeAt(i - 1) === 45) { + throw new Error("Invalid cookie domain"); + } + labelLength = 0; + continue; + } + if (labelLength === 0 && !isLetterOrDigit(code)) { + throw new Error("Invalid cookie domain"); + } + if (!isLetterOrDigit(code) && code !== 45) { + throw new Error("Invalid cookie domain"); + } + if (++labelLength > 63) { + throw new Error("Invalid cookie domain"); + } + } + if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) { throw new Error("Invalid cookie domain"); } } @@ -16363,7 +16441,11 @@ var require_util6 = __commonJS({ throw new Error("Invalid unparsed"); } const [key, ...value] = part.split("="); - out.push(`${key.trim()}=${value.join("=")}`); + const trimmedKey = key.trim(); + const joinedValue = value.join("="); + validateCookieName(trimmedKey); + validateCookieValue(joinedValue); + out.push(`${trimmedKey}=${joinedValue}`); } return out.join("; "); } @@ -18604,7 +18686,7 @@ ${value}`; var require_eventsource = __commonJS({ "node_modules/undici/lib/web/eventsource/eventsource.js"(exports2, module2) { "use strict"; - var { pipeline } = require("node:stream"); + var { pipeline: pipeline2 } = require("node:stream"); var { fetching } = require_fetch(); var { makeRequest } = require_request2(); var { webidl } = require_webidl(); @@ -18762,7 +18844,7 @@ var require_eventsource = __commonJS({ )); } }); - pipeline( + pipeline2( response.body.stream, eventSourceStream, (error3) => { @@ -18964,11 +19046,11 @@ var require_undici = __commonJS({ if (typeof opts.path !== "string") { throw new InvalidArgumentError("invalid opts.path"); } - let path29 = opts.path; + let path30 = opts.path; if (!opts.path.startsWith("/")) { - path29 = `/${path29}`; + path30 = `/${path30}`; } - url2 = new URL(util3.parseOrigin(url2).origin + path29); + url2 = new URL(util3.parseOrigin(url2).origin + path30); } else { if (!opts) { opts = typeof url2 === "object" ? url2 : {}; @@ -20271,7 +20353,7 @@ var require_path_utils = __commonJS({ exports2.toPosixPath = toPosixPath; exports2.toWin32Path = toWin32Path; exports2.toPlatformPath = toPlatformPath; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function toPosixPath(pth) { return pth.replace(/[\\]/g, "/"); } @@ -20279,7 +20361,7 @@ var require_path_utils = __commonJS({ return pth.replace(/[/]/g, "\\"); } function toPlatformPath(pth) { - return pth.replace(/[/\\]/g, path29.sep); + return pth.replace(/[/\\]/g, path30.sep); } } }); @@ -20361,13 +20443,13 @@ var require_io_util = __commonJS({ exports2.isRooted = isRooted; exports2.tryGetExecutablePath = tryGetExecutablePath; exports2.getCmdPath = getCmdPath; - var fs31 = __importStar2(require("fs")); - var path29 = __importStar2(require("path")); - _a2 = fs31.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; + var fs32 = __importStar2(require("fs")); + var path30 = __importStar2(require("path")); + _a2 = fs32.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; exports2.IS_WINDOWS = process.platform === "win32"; function readlink(fsPath) { return __awaiter2(this, void 0, void 0, function* () { - const result = yield fs31.promises.readlink(fsPath); + const result = yield fs32.promises.readlink(fsPath); if (exports2.IS_WINDOWS && !result.endsWith("\\")) { return `${result}\\`; } @@ -20375,7 +20457,7 @@ var require_io_util = __commonJS({ }); } exports2.UV_FS_O_EXLOCK = 268435456; - exports2.READONLY = fs31.constants.O_RDONLY; + exports2.READONLY = fs32.constants.O_RDONLY; function exists(fsPath) { return __awaiter2(this, void 0, void 0, function* () { try { @@ -20417,7 +20499,7 @@ var require_io_util = __commonJS({ } if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { - const upperExt = path29.extname(filePath).toUpperCase(); + const upperExt = path30.extname(filePath).toUpperCase(); if (extensions.some((validExt) => validExt.toUpperCase() === upperExt)) { return filePath; } @@ -20441,11 +20523,11 @@ var require_io_util = __commonJS({ if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { try { - const directory = path29.dirname(filePath); - const upperName = path29.basename(filePath).toUpperCase(); + const directory = path30.dirname(filePath); + const upperName = path30.basename(filePath).toUpperCase(); for (const actualName of yield (0, exports2.readdir)(directory)) { if (upperName === actualName.toUpperCase()) { - filePath = path29.join(directory, actualName); + filePath = path30.join(directory, actualName); break; } } @@ -20557,7 +20639,7 @@ var require_io = __commonJS({ exports2.which = which9; exports2.findInPath = findInPath; var assert_1 = require("assert"); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var ioUtil = __importStar2(require_io_util()); function cp(source_1, dest_1) { return __awaiter2(this, arguments, void 0, function* (source, dest, options = {}) { @@ -20566,7 +20648,7 @@ var require_io = __commonJS({ if (destStat && destStat.isFile() && !force) { return; } - const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path29.join(dest, path29.basename(source)) : dest; + const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path30.join(dest, path30.basename(source)) : dest; if (!(yield ioUtil.exists(source))) { throw new Error(`no such file or directory: ${source}`); } @@ -20578,7 +20660,7 @@ var require_io = __commonJS({ yield cpDirRecursive(source, newDest, 0, force); } } else { - if (path29.relative(source, newDest) === "") { + if (path30.relative(source, newDest) === "") { throw new Error(`'${newDest}' and '${source}' are the same file`); } yield copyFile2(source, newDest, force); @@ -20590,7 +20672,7 @@ var require_io = __commonJS({ if (yield ioUtil.exists(dest)) { let destExists = true; if (yield ioUtil.isDirectory(dest)) { - dest = path29.join(dest, path29.basename(source)); + dest = path30.join(dest, path30.basename(source)); destExists = yield ioUtil.exists(dest); } if (destExists) { @@ -20601,7 +20683,7 @@ var require_io = __commonJS({ } } } - yield mkdirP(path29.dirname(dest)); + yield mkdirP(path30.dirname(dest)); yield ioUtil.rename(source, dest); }); } @@ -20660,7 +20742,7 @@ var require_io = __commonJS({ } const extensions = []; if (ioUtil.IS_WINDOWS && process.env["PATHEXT"]) { - for (const extension of process.env["PATHEXT"].split(path29.delimiter)) { + for (const extension of process.env["PATHEXT"].split(path30.delimiter)) { if (extension) { extensions.push(extension); } @@ -20673,12 +20755,12 @@ var require_io = __commonJS({ } return []; } - if (tool.includes(path29.sep)) { + if (tool.includes(path30.sep)) { return []; } const directories = []; if (process.env.PATH) { - for (const p of process.env.PATH.split(path29.delimiter)) { + for (const p of process.env.PATH.split(path30.delimiter)) { if (p) { directories.push(p); } @@ -20686,7 +20768,7 @@ var require_io = __commonJS({ } const matches = []; for (const directory of directories) { - const filePath = yield ioUtil.tryGetExecutablePath(path29.join(directory, tool), extensions); + const filePath = yield ioUtil.tryGetExecutablePath(path30.join(directory, tool), extensions); if (filePath) { matches.push(filePath); } @@ -20816,7 +20898,7 @@ var require_toolrunner = __commonJS({ var os7 = __importStar2(require("os")); var events = __importStar2(require("events")); var child = __importStar2(require("child_process")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var io9 = __importStar2(require_io()); var ioUtil = __importStar2(require_io_util()); var timers_1 = require("timers"); @@ -21031,7 +21113,7 @@ var require_toolrunner = __commonJS({ exec() { return __awaiter2(this, void 0, void 0, function* () { if (!ioUtil.isRooted(this.toolPath) && (this.toolPath.includes("/") || IS_WINDOWS && this.toolPath.includes("\\"))) { - this.toolPath = path29.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); + this.toolPath = path30.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); } this.toolPath = yield io9.which(this.toolPath, true); return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { @@ -21559,7 +21641,7 @@ var require_core = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.platform = exports2.toPlatformPath = exports2.toWin32Path = exports2.toPosixPath = exports2.markdownSummary = exports2.summary = exports2.ExitCode = void 0; - exports2.exportVariable = exportVariable15; + exports2.exportVariable = exportVariable16; exports2.setSecret = setSecret2; exports2.addPath = addPath2; exports2.getInput = getInput2; @@ -21567,7 +21649,7 @@ var require_core = __commonJS({ exports2.getBooleanInput = getBooleanInput; exports2.setOutput = setOutput7; exports2.setCommandEcho = setCommandEcho; - exports2.setFailed = setFailed13; + exports2.setFailed = setFailed12; exports2.isDebug = isDebug5; exports2.debug = debug6; exports2.error = error3; @@ -21584,14 +21666,14 @@ var require_core = __commonJS({ var file_command_1 = require_file_command(); var utils_1 = require_utils(); var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var oidc_utils_1 = require_oidc_utils(); var ExitCode; (function(ExitCode2) { ExitCode2[ExitCode2["Success"] = 0] = "Success"; ExitCode2[ExitCode2["Failure"] = 1] = "Failure"; })(ExitCode || (exports2.ExitCode = ExitCode = {})); - function exportVariable15(name, val) { + function exportVariable16(name, val) { const convertedVal = (0, utils_1.toCommandValue)(val); process.env[name] = convertedVal; const filePath = process.env["GITHUB_ENV"] || ""; @@ -21610,7 +21692,7 @@ var require_core = __commonJS({ } else { (0, command_1.issueCommand)("add-path", {}, inputPath); } - process.env["PATH"] = `${inputPath}${path29.delimiter}${process.env["PATH"]}`; + process.env["PATH"] = `${inputPath}${path30.delimiter}${process.env["PATH"]}`; } function getInput2(name, options) { const val = process.env[`INPUT_${name.replace(/ /g, "_").toUpperCase()}`] || ""; @@ -21651,7 +21733,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``); function setCommandEcho(enabled) { (0, command_1.issue)("echo", enabled ? "on" : "off"); } - function setFailed13(message) { + function setFailed12(message) { process.exitCode = ExitCode.Failure; error3(message); } @@ -21747,8 +21829,8 @@ var require_context = __commonJS({ if ((0, fs_1.existsSync)(process.env.GITHUB_EVENT_PATH)) { this.payload = JSON.parse((0, fs_1.readFileSync)(process.env.GITHUB_EVENT_PATH, { encoding: "utf8" })); } else { - const path29 = process.env.GITHUB_EVENT_PATH; - process.stdout.write(`GITHUB_EVENT_PATH ${path29} does not exist${os_1.EOL}`); + const path30 = process.env.GITHUB_EVENT_PATH; + process.stdout.write(`GITHUB_EVENT_PATH ${path30} does not exist${os_1.EOL}`); } } this.eventName = process.env.GITHUB_EVENT_NAME; @@ -22169,7 +22251,7 @@ function isKeyOperator(operator) { function getValues(context5, operator, key, modifier) { var value = context5[key], result = []; if (isDefined(value) && value !== "") { - if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") { + if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean") { value = value.toString(); if (modifier && modifier !== "*") { value = value.substring(0, parseInt(modifier, 10)); @@ -22382,99 +22464,474 @@ var init_universal_user_agent3 = __esm({ } }); -// node_modules/fast-content-type-parse/index.js -var require_fast_content_type_parse = __commonJS({ - "node_modules/fast-content-type-parse/index.js"(exports2, module2) { +// node_modules/content-type/dist/index.js +var require_dist = __commonJS({ + "node_modules/content-type/dist/index.js"(exports2) { "use strict"; - var NullObject = function NullObject2() { - }; - NullObject.prototype = /* @__PURE__ */ Object.create(null); - var paramRE = /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\v\u0020-\u00ff])*"|[!#$%&'*+.^\w`|~-]+) */gu; - var quotedPairRE = /\\([\v\u0020-\u00ff])/gu; - var mediaTypeRE = /^[!#$%&'*+.^\w|~-]+\/[!#$%&'*+.^\w|~-]+$/u; - var defaultContentType = { type: "", parameters: new NullObject() }; - Object.freeze(defaultContentType.parameters); - Object.freeze(defaultContentType); - function parse2(header) { - if (typeof header !== "string") { - throw new TypeError("argument header is required and must be a string"); - } - let index2 = header.indexOf(";"); - const type = index2 !== -1 ? header.slice(0, index2).trim() : header.trim(); - if (mediaTypeRE.test(type) === false) { - throw new TypeError("invalid media type"); - } - const result = { - type: type.toLowerCase(), - parameters: new NullObject() - }; - if (index2 === -1) { - return result; + Object.defineProperty(exports2, "__esModule", { value: true }); + exports2.format = format; + exports2.parse = parse3; + var TEXT_REGEXP = /^[\u0009\u0020-\u007e\u0080-\u00ff]*$/; + var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/; + var QUOTE_REGEXP = /[\\"]/g; + var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/; + var NullObject = /* @__PURE__ */ (() => { + const C = function() { + }; + C.prototype = /* @__PURE__ */ Object.create(null); + return C; + })(); + function format(obj) { + const { type, parameters } = obj; + if (!type || !TYPE_REGEXP.test(type)) { + throw new TypeError(`Invalid type: ${type}`); } - let key; - let match2; - let value; - paramRE.lastIndex = index2; - while (match2 = paramRE.exec(header)) { - if (match2.index !== index2) { - throw new TypeError("invalid parameter format"); + let result = type; + if (parameters) { + for (const param of Object.keys(parameters)) { + if (!TOKEN_REGEXP.test(param)) { + throw new TypeError(`Invalid parameter name: ${param}`); + } + result += `; ${param}=${qstring(parameters[param])}`; } - index2 += match2[0].length; - key = match2[1].toLowerCase(); - value = match2[2]; - if (value[0] === '"') { - value = value.slice(1, value.length - 1); - quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1")); + } + return result; + } + function parse3(header, options) { + const len = header.length; + let index2 = skipOWS(header, 0, len); + const valueStart = index2; + index2 = skipValue(header, index2, len); + const valueEnd = trailingOWS(header, valueStart, index2); + const type = header.slice(valueStart, valueEnd).toLowerCase(); + const parameters = options?.parameters === false ? new NullObject() : parseParameters(header, index2, len); + return { type, parameters }; + } + var SP = 32; + var HTAB = 9; + var SEMI = 59; + var EQ = 61; + var DQUOTE = 34; + var BSLASH = 92; + function parseParameters(header, index2, len) { + const parameters = new NullObject(); + parameter: while (index2 < len) { + index2 = skipOWS(header, index2 + 1, len); + const keyStart = index2; + while (index2 < len) { + const code = header.charCodeAt(index2); + if (code === SEMI) + continue parameter; + if (code === EQ) { + const keyEnd = trailingOWS(header, keyStart, index2); + const key = header.slice(keyStart, keyEnd).toLowerCase(); + index2 = skipOWS(header, index2 + 1, len); + if (index2 < len && header.charCodeAt(index2) === DQUOTE) { + index2++; + let value = ""; + while (index2 < len) { + const code2 = header.charCodeAt(index2++); + if (code2 === DQUOTE) { + index2 = skipValue(header, index2, len); + if (parameters[key] === void 0) + parameters[key] = value; + break; + } + if (code2 === BSLASH && index2 < len) { + value += header[index2++]; + continue; + } + value += String.fromCharCode(code2); + } + continue parameter; + } + const valueStart = index2; + index2 = skipValue(header, index2, len); + if (parameters[key] === void 0) { + const valueEnd = trailingOWS(header, valueStart, index2); + parameters[key] = header.slice(valueStart, valueEnd); + } + continue parameter; + } + index2++; } - result.parameters[key] = value; } - if (index2 !== header.length) { - throw new TypeError("invalid parameter format"); + return parameters; + } + function skipValue(str, index2, len) { + while (index2 < len) { + const char = str.charCodeAt(index2); + if (char === SEMI) + break; + index2++; } - return result; + return index2; } - function safeParse2(header) { - if (typeof header !== "string") { - return defaultContentType; + function skipOWS(header, index2, len) { + while (index2 < len) { + const char = header.charCodeAt(index2); + if (char !== SP && char !== HTAB) + break; + index2++; } - let index2 = header.indexOf(";"); - const type = index2 !== -1 ? header.slice(0, index2).trim() : header.trim(); - if (mediaTypeRE.test(type) === false) { - return defaultContentType; + return index2; + } + function trailingOWS(header, start, end) { + while (end > start) { + const char = header.charCodeAt(end - 1); + if (char !== SP && char !== HTAB) + break; + end--; } - const result = { - type: type.toLowerCase(), - parameters: new NullObject() + return end; + } + function qstring(str) { + if (TOKEN_REGEXP.test(str)) + return str; + if (TEXT_REGEXP.test(str)) + return `"${str.replace(QUOTE_REGEXP, "\\$&")}"`; + throw new TypeError(`Invalid parameter value: ${str}`); + } + } +}); + +// node_modules/json-with-bigint/json-with-bigint.js +var intRegex, noiseValue, originalStringify, originalParse, customFormat, bigIntsStringify, noiseStringify, isUnstringifiable, isRawJSON, stringifyIteratively, JSONStringify, featureCache, isContextSourceSupported, convertMarkedBigIntsReviver, JSONParseV2, MAX_INT, MAX_DIGITS, stringsOrLargeNumbers, noiseValueWithQuotes, applyReviverIteratively, serializeBigInts, JSONParse; +var init_json_with_bigint = __esm({ + "node_modules/json-with-bigint/json-with-bigint.js"() { + intRegex = /^-?\d+$/; + noiseValue = /^-?\d+n+$/; + originalStringify = JSON.stringify; + originalParse = JSON.parse; + customFormat = /^-?\d+n$/; + bigIntsStringify = /([\[:])?"(-?\d+)n"($|\s*[,\}\]])/g; + noiseStringify = /([\[:])?("-?\d+n+)n("$|"\s*[,\}\]])/g; + isUnstringifiable = (val) => val === void 0 || typeof val === "function" || typeof val === "symbol"; + isRawJSON = (val) => val !== null && typeof val === "object" && val.constructor && val.constructor.name === "RawJSON"; + stringifyIteratively = (rootValue, replacer, spaceParam) => { + let space2 = ""; + if (typeof spaceParam === "number") { + space2 = " ".repeat(Math.min(10, Math.max(0, Math.floor(spaceParam)))); + } else if (typeof spaceParam === "string") { + space2 = spaceParam.slice(0, 10); + } + const isFunctionReplacer = typeof replacer === "function"; + const propertyList = Array.isArray(replacer) ? new Set(replacer.map(String)) : null; + const prepareVal = (parent, key, val) => { + const isObject2 = val !== null && typeof val === "object"; + const hasToJSON = isObject2 && typeof val.toJSON === "function"; + if (hasToJSON) { + val = val.toJSON(key); + } + const isNoise = typeof val === "string" && noiseValue.test(val); + if (isNoise) return val + "n"; + const isBigInt = typeof val === "bigint"; + if (isBigInt) { + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) return JSON.rawJSON(val.toString()); + return val.toString() + "n"; + } + if (isFunctionReplacer) { + val = replacer.call(parent, key, val); + } + const isPostReplacerObject = val !== null && typeof val === "object"; + if (isPostReplacerObject) { + const isPrimitiveWrapper = val instanceof Number || val instanceof String || val instanceof Boolean; + if (isPrimitiveWrapper) { + val = val.valueOf(); + } + } + return val; }; - if (index2 === -1) { - return result; + const rootProcessed = prepareVal({ "": rootValue }, "", rootValue); + if (isUnstringifiable(rootProcessed)) { + return void 0; } - let key; - let match2; - let value; - paramRE.lastIndex = index2; - while (match2 = paramRE.exec(header)) { - if (match2.index !== index2) { - return defaultContentType; + const isRootPrimitive = rootProcessed === null || typeof rootProcessed !== "object"; + const isRootNativeRawJSON = isRawJSON(rootProcessed); + if (isRootPrimitive || isRootNativeRawJSON) { + return originalStringify(rootProcessed); + } + const chunks = []; + let level = 0; + const stack = [ + { + parent: { "": rootProcessed }, + key: "", + val: rootProcessed, + isArray: Array.isArray(rootProcessed), + keys: Array.isArray(rootProcessed) ? null : Object.keys(rootProcessed), + index: 0, + first: true + } + ]; + const visited = new WeakSet([rootProcessed]); + while (stack.length > 0) { + const node = stack[stack.length - 1]; + if (node.index === 0) { + chunks.push(node.isArray ? "[" : "{"); + level++; + } + let isDone = false; + if (node.isArray) { + if (node.index < node.val.length) { + if (!node.first) chunks.push(","); + if (space2) chunks.push("\n" + space2.repeat(level)); + const childRaw = node.val[node.index]; + const childVal = prepareVal(node.val, String(node.index), childRaw); + if (isUnstringifiable(childVal)) { + chunks.push("null"); + node.first = false; + node.index++; + } else { + const isComplexObject = childVal !== null && typeof childVal === "object"; + const isNativeRaw = isRawJSON(childVal); + if (isComplexObject && !isNativeRaw) { + if (visited.has(childVal)) { + throw new TypeError("Converting circular structure to JSON"); + } + visited.add(childVal); + stack.push({ + parent: node.val, + key: String(node.index), + val: childVal, + isArray: Array.isArray(childVal), + keys: Array.isArray(childVal) ? null : Object.keys(childVal), + index: 0, + first: true + }); + node.first = false; + node.index++; + } else { + chunks.push(originalStringify(childVal)); + node.first = false; + node.index++; + } + } + } else { + isDone = true; + } + } else { + while (node.index < node.keys.length) { + const k = node.keys[node.index++]; + const isFilteredOutByArray = propertyList && !propertyList.has(k); + if (isFilteredOutByArray) continue; + const childRaw = node.val[k]; + const childVal = prepareVal(node.val, k, childRaw); + if (isUnstringifiable(childVal)) continue; + if (!node.first) chunks.push(","); + if (space2) { + chunks.push("\n" + space2.repeat(level) + originalStringify(k) + ": "); + } else { + chunks.push(originalStringify(k) + ":"); + } + const isComplexObject = childVal !== null && typeof childVal === "object"; + const isNativeRaw = isRawJSON(childVal); + if (isComplexObject && !isNativeRaw) { + if (visited.has(childVal)) { + throw new TypeError("Converting circular structure to JSON"); + } + visited.add(childVal); + stack.push({ + parent: node.val, + key: k, + val: childVal, + isArray: Array.isArray(childVal), + keys: Array.isArray(childVal) ? null : Object.keys(childVal), + index: 0, + first: true + }); + node.first = false; + break; + } else { + chunks.push(originalStringify(childVal)); + node.first = false; + } + } + const isNodeFullyProcessed = node.index >= node.keys.length && stack[stack.length - 1] === node; + if (isNodeFullyProcessed) { + isDone = true; + } } - index2 += match2[0].length; - key = match2[1].toLowerCase(); - value = match2[2]; - if (value[0] === '"') { - value = value.slice(1, value.length - 1); - quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1")); + if (isDone) { + level--; + if (!node.first && space2) chunks.push("\n" + space2.repeat(level)); + chunks.push(node.isArray ? "]" : "}"); + visited.delete(node.val); + stack.pop(); } - result.parameters[key] = value; } - if (index2 !== header.length) { - return defaultContentType; + return chunks.join(""); + }; + JSONStringify = (value, replacer, space2) => { + try { + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) { + return originalStringify( + value, + (key, val) => { + if (typeof val === "bigint") return JSON.rawJSON(val.toString()); + const hasFunctionReplacer = typeof replacer === "function"; + if (hasFunctionReplacer) return replacer(key, val); + const isKeyInArrayReplacer = Array.isArray(replacer) && replacer.includes(key); + if (isKeyInArrayReplacer) return val; + return val; + }, + space2 + ); + } + if (!value) return originalStringify(value, replacer, space2); + const convertedToCustomJSON = originalStringify( + value, + (key, val) => { + const isNoise = typeof val === "string" && noiseValue.test(val); + if (isNoise) return val.toString() + "n"; + if (typeof val === "bigint") return val.toString() + "n"; + const hasFunctionReplacer = typeof replacer === "function"; + if (hasFunctionReplacer) return replacer(key, val); + const isKeyInArrayReplacer = Array.isArray(replacer) && replacer.includes(key); + if (isKeyInArrayReplacer) return val; + return val; + }, + space2 + ); + const processedJSON = convertedToCustomJSON.replace( + bigIntsStringify, + "$1$2$3" + ); + const denoisedJSON = processedJSON.replace(noiseStringify, "$1$2$3"); + return denoisedJSON; + } catch (error3) { + if (error3 instanceof RangeError) { + const convertedJSON = stringifyIteratively(value, replacer, space2); + if (convertedJSON === void 0) return void 0; + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) return convertedJSON; + const processedJSON = convertedJSON.replace(bigIntsStringify, "$1$2$3"); + return processedJSON.replace(noiseStringify, "$1$2$3"); + } + throw error3; } - return result; - } - module2.exports.default = { parse: parse2, safeParse: safeParse2 }; - module2.exports.parse = parse2; - module2.exports.safeParse = safeParse2; - module2.exports.defaultContentType = defaultContentType; + }; + featureCache = /* @__PURE__ */ new Map(); + isContextSourceSupported = () => { + const parseFingerprint = JSON.parse.toString(); + if (featureCache.has(parseFingerprint)) { + return featureCache.get(parseFingerprint); + } + try { + const result = JSON.parse( + "1", + (_2, __, context5) => !!context5?.source && context5.source === "1" + ); + featureCache.set(parseFingerprint, result); + return result; + } catch { + featureCache.set(parseFingerprint, false); + return false; + } + }; + convertMarkedBigIntsReviver = (key, value, context5, userReviver) => { + const isCustomFormatBigInt = typeof value === "string" && customFormat.test(value); + if (isCustomFormatBigInt) return BigInt(value.slice(0, -1)); + const isNoiseValue = typeof value === "string" && noiseValue.test(value); + if (isNoiseValue) return value.slice(0, -1); + const hasUserReviver = typeof userReviver === "function"; + if (!hasUserReviver) return value; + return userReviver(key, value, context5); + }; + JSONParseV2 = (text, reviver) => { + return JSON.parse(text, (key, value, context5) => { + const isNumber2 = typeof value === "number"; + const isOutOfBounds = value > Number.MAX_SAFE_INTEGER || value < Number.MIN_SAFE_INTEGER; + const isBigNumber = isNumber2 && isOutOfBounds; + const isInt = context5 && intRegex.test(context5.source); + const isBigInt = isBigNumber && isInt; + if (isBigInt) return BigInt(context5.source); + const hasCustomReviver = typeof reviver === "function"; + if (!hasCustomReviver) return value; + return reviver(key, value, context5); + }); + }; + MAX_INT = Number.MAX_SAFE_INTEGER.toString(); + MAX_DIGITS = MAX_INT.length; + stringsOrLargeNumbers = /"(?:\\.|[^"])*"|-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/g; + noiseValueWithQuotes = /^"-?\d+n+"$/; + applyReviverIteratively = (parsed, userReviver) => { + const rootHolder = { "": parsed }; + const stack = [{ parent: rootHolder, key: "", visited: false }]; + while (stack.length > 0) { + const node = stack[stack.length - 1]; + if (!node.visited) { + node.visited = true; + const value = node.parent[node.key]; + const isComplexObject = value !== null && typeof value === "object"; + if (isComplexObject) { + const keys = Object.keys(value); + for (let i = keys.length - 1; i >= 0; i--) { + stack.push({ parent: value, key: keys[i], visited: false }); + } + } + } else { + const { parent, key } = node; + let value = parent[key]; + if (typeof value === "string") { + const isCustomFormatBigInt = customFormat.test(value); + if (isCustomFormatBigInt) { + value = BigInt(value.slice(0, -1)); + } else { + const isNoise = noiseValue.test(value); + if (isNoise) value = value.slice(0, -1); + } + } + const hasUserReviver = typeof userReviver === "function"; + if (hasUserReviver) { + value = userReviver.call(parent, key, value); + } + const isDeleted = value === void 0; + if (isDeleted) { + delete parent[key]; + } else { + parent[key] = value; + } + stack.pop(); + } + } + return rootHolder[""]; + }; + serializeBigInts = (text) => { + return text.replace( + stringsOrLargeNumbers, + (match2, digits, fractional, exponential) => { + const isString3 = match2[0] === '"'; + const isNoise = isString3 && noiseValueWithQuotes.test(match2); + if (isNoise) return match2.substring(0, match2.length - 1) + 'n"'; + const hasFractionalOrExponential = fractional || exponential; + const isLessThanMaxSafeInt = digits && (digits.length < MAX_DIGITS || digits.length === MAX_DIGITS && digits <= MAX_INT); + const isStandardValue = isString3 || hasFractionalOrExponential || isLessThanMaxSafeInt; + if (isStandardValue) return match2; + return '"' + match2 + 'n"'; + } + ); + }; + JSONParse = (text, reviver) => { + if (!text) return originalParse(text, reviver); + try { + if (isContextSourceSupported()) return JSONParseV2(text, reviver); + const serializedData = serializeBigInts(text); + return originalParse( + serializedData, + (key, value, context5) => convertMarkedBigIntsReviver(key, value, context5, reviver) + ); + } catch (error3) { + if (error3 instanceof RangeError) { + const serializedData = serializeBigInts(text); + const parsed = originalParse(serializedData); + return applyReviverIteratively(parsed, reviver); + } + throw error3; + } + }; } }); @@ -22540,7 +22997,7 @@ async function fetchWrapper(requestOptions) { } const log = requestOptions.request?.log || console; const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false; - const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSON.stringify(requestOptions.body) : requestOptions.body; + const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body; const requestHeaders = Object.fromEntries( Object.entries(requestOptions.headers).map(([name, value]) => [ name, @@ -22634,16 +23091,19 @@ async function getResponseData(response) { if (!contentType) { return response.text().catch(noop); } - const mimetype = (0, import_fast_content_type_parse.safeParse)(contentType); + const mimetype = (0, import_content_type.parse)(contentType); if (isJSONResponse(mimetype)) { let text = ""; try { text = await response.text(); - return JSON.parse(text); + return JSONParse(text); } catch (err) { return text; } - } else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8") { + } else if (mimetype.type.startsWith("text/") || // `application/octet-stream` is the canonical "arbitrary binary" type + // (RFC 2046) and must never be decoded as text, even when the response + // carries a (misleading) `charset=utf-8` parameter — see #751. + mimetype.parameters.charset?.toLowerCase() === "utf-8" && mimetype.type !== "application/octet-stream") { return response.text().catch(noop); } else { return response.arrayBuffer().catch( @@ -22662,9 +23122,10 @@ function toErrorMessage(data) { if (data instanceof ArrayBuffer) { return "Unknown error"; } - if ("message" in data) { - const suffix = "documentation_url" in data ? ` - ${data.documentation_url}` : ""; - return Array.isArray(data.errors) ? `${data.message}: ${data.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${data.message}${suffix}`; + if (typeof data === "object" && data !== null && "message" in data) { + const objectData = data; + const suffix = "documentation_url" in objectData ? ` - ${objectData.documentation_url}` : ""; + return Array.isArray(objectData.errors) ? `${objectData.message}: ${objectData.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${objectData.message}${suffix}`; } return `Unknown error: ${JSON.stringify(data)}`; } @@ -22691,14 +23152,15 @@ function withDefaults2(oldEndpoint, newDefaults) { defaults: withDefaults2.bind(null, endpoint2) }); } -var import_fast_content_type_parse, VERSION2, defaults_default, noop, request; +var import_content_type, VERSION2, defaults_default, noop, request; var init_dist_bundle2 = __esm({ "node_modules/@octokit/request/dist-bundle/index.js"() { init_dist_bundle(); init_universal_user_agent3(); - import_fast_content_type_parse = __toESM(require_fast_content_type_parse(), 1); + import_content_type = __toESM(require_dist(), 1); + init_json_with_bigint(); init_dist_src(); - VERSION2 = "10.0.7"; + VERSION2 = "10.0.13"; defaults_default = { headers: { "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent3()}` @@ -22812,6 +23274,9 @@ var init_dist_bundle3 = __esm({ Error.captureStackTrace(this, this.constructor); } } + request; + headers; + response; name = "GraphqlResponseError"; errors; data; @@ -22892,7 +23357,7 @@ var init_dist_bundle4 = __esm({ var VERSION4; var init_version = __esm({ "node_modules/@octokit/core/dist-src/version.js"() { - VERSION4 = "7.0.6"; + VERSION4 = "7.0.7"; } }); @@ -26510,7 +26975,7 @@ var require_parse2 = __commonJS({ "node_modules/semver/functions/parse.js"(exports2, module2) { "use strict"; var SemVer = require_semver(); - var parse2 = (version, options, throwErrors = false) => { + var parse3 = (version, options, throwErrors = false) => { if (version instanceof SemVer) { return version; } @@ -26523,7 +26988,7 @@ var require_parse2 = __commonJS({ throw er; } }; - module2.exports = parse2; + module2.exports = parse3; } }); @@ -26531,9 +26996,9 @@ var require_parse2 = __commonJS({ var require_valid = __commonJS({ "node_modules/semver/functions/valid.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var valid4 = (version, options) => { - const v = parse2(version, options); + const v = parse3(version, options); return v ? v.version : null; }; module2.exports = valid4; @@ -26544,9 +27009,9 @@ var require_valid = __commonJS({ var require_clean = __commonJS({ "node_modules/semver/functions/clean.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var clean3 = (version, options) => { - const s = parse2(version.trim().replace(/^[=v]+/, ""), options); + const s = parse3(version.trim().replace(/^[=v]+/, ""), options); return s ? s.version : null; }; module2.exports = clean3; @@ -26581,10 +27046,10 @@ var require_inc = __commonJS({ var require_diff = __commonJS({ "node_modules/semver/functions/diff.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var diff = (version1, version2) => { - const v1 = parse2(version1, null, true); - const v2 = parse2(version2, null, true); + const v1 = parse3(version1, null, true); + const v2 = parse3(version2, null, true); const comparison = v1.compare(v2); if (comparison === 0) { return null; @@ -26655,9 +27120,9 @@ var require_patch = __commonJS({ var require_prerelease = __commonJS({ "node_modules/semver/functions/prerelease.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var prerelease = (version, options) => { - const parsed = parse2(version, options); + const parsed = parse3(version, options); return parsed && parsed.prerelease.length ? parsed.prerelease : null; }; module2.exports = prerelease; @@ -26843,7 +27308,7 @@ var require_coerce = __commonJS({ "node_modules/semver/functions/coerce.js"(exports2, module2) { "use strict"; var SemVer = require_semver(); - var parse2 = require_parse2(); + var parse3 = require_parse2(); var { safeRe: re, t } = require_re(); var coerce3 = (version, options) => { if (version instanceof SemVer) { @@ -26878,7 +27343,7 @@ var require_coerce = __commonJS({ const patch = match2[4] || "0"; const prerelease = options.includePrerelease && match2[5] ? `-${match2[5]}` : ""; const build2 = options.includePrerelease && match2[6] ? `+${match2[6]}` : ""; - return parse2(`${major}.${minor}.${patch}${prerelease}${build2}`, options); + return parse3(`${major}.${minor}.${patch}${prerelease}${build2}`, options); }; module2.exports = coerce3; } @@ -26888,7 +27353,7 @@ var require_coerce = __commonJS({ var require_truncate = __commonJS({ "node_modules/semver/functions/truncate.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var constants = require_constants6(); var SemVer = require_semver(); var truncate = (version, truncation, options) => { @@ -26900,7 +27365,7 @@ var require_truncate = __commonJS({ }; var cloneInputVersion = (version, options) => { const versionStringToParse = version instanceof SemVer ? version.version : version; - return parse2(versionStringToParse, options); + return parse3(versionStringToParse, options); }; var doTruncation = (version, truncation) => { if (isPrerelease(truncation)) { @@ -27944,7 +28409,7 @@ var require_semver2 = __commonJS({ var constants = require_constants6(); var SemVer = require_semver(); var identifiers = require_identifiers(); - var parse2 = require_parse2(); + var parse3 = require_parse2(); var valid4 = require_valid(); var clean3 = require_clean(); var inc = require_inc(); @@ -27983,7 +28448,7 @@ var require_semver2 = __commonJS({ var simplifyRange = require_simplify(); var subset = require_subset(); module2.exports = { - parse: parse2, + parse: parse3, valid: valid4, clean: clean3, inc, @@ -29356,14 +29821,14 @@ var require_light = __commonJS({ var require_helpers = __commonJS({ "node_modules/jsonschema/lib/helpers.js"(exports2, module2) { "use strict"; - var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema, path29, name, argument) { - if (Array.isArray(path29)) { - this.path = path29; - this.property = path29.reduce(function(sum, item) { + var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema, path30, name, argument) { + if (Array.isArray(path30)) { + this.path = path30; + this.property = path30.reduce(function(sum, item) { return sum + makeSuffix(item); }, "instance"); - } else if (path29 !== void 0) { - this.property = path29; + } else if (path30 !== void 0) { + this.property = path30; } if (message) { this.message = message; @@ -29456,16 +29921,16 @@ var require_helpers = __commonJS({ name: { value: "SchemaError", enumerable: false } } ); - var SchemaContext = exports2.SchemaContext = function SchemaContext2(schema, options, path29, base, schemas) { + var SchemaContext = exports2.SchemaContext = function SchemaContext2(schema, options, path30, base, schemas) { this.schema = schema; this.options = options; - if (Array.isArray(path29)) { - this.path = path29; - this.propertyPath = path29.reduce(function(sum, item) { + if (Array.isArray(path30)) { + this.path = path30; + this.propertyPath = path30.reduce(function(sum, item) { return sum + makeSuffix(item); }, "instance"); } else { - this.propertyPath = path29; + this.propertyPath = path30; } this.base = base; this.schemas = schemas; @@ -29474,10 +29939,10 @@ var require_helpers = __commonJS({ return (() => resolveUrl(this.base, target))(); }; SchemaContext.prototype.makeChild = function makeChild(schema, propertyName) { - var path29 = propertyName === void 0 ? this.path : this.path.concat([propertyName]); + var path30 = propertyName === void 0 ? this.path : this.path.concat([propertyName]); var id = schema.$id || schema.id; let base = (() => resolveUrl(this.base, id || ""))(); - var ctx = new SchemaContext(schema, this.options, path29, base, Object.create(this.schemas)); + var ctx = new SchemaContext(schema, this.options, path30, base, Object.create(this.schemas)); if (id && !ctx.schemas[base]) { ctx.schemas[base] = schema; } @@ -30477,7 +30942,7 @@ var require_validator = __commonJS({ Validator3.prototype.getSchema = function getSchema(urn) { return this.schemas[urn]; }; - Validator3.prototype.validate = function validate(instance, schema, options, ctx) { + Validator3.prototype.validate = function validate2(instance, schema, options, ctx) { if (typeof schema !== "boolean" && typeof schema !== "object" || schema === null) { throw new SchemaError("Expected `schema` to be an object or boolean"); } @@ -30938,7 +31403,7 @@ var require_internal_path_helper = __commonJS({ exports2.hasRoot = hasRoot; exports2.normalizeSeparators = normalizeSeparators; exports2.safeTrimTrailingSeparator = safeTrimTrailingSeparator; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var assert_1 = __importDefault2(require("assert")); var IS_WINDOWS = process.platform === "win32"; function dirname6(p) { @@ -30946,7 +31411,7 @@ var require_internal_path_helper = __commonJS({ if (IS_WINDOWS && /^\\\\[^\\]+(\\[^\\]+)?$/.test(p)) { return p; } - let result = path29.dirname(p); + let result = path30.dirname(p); if (IS_WINDOWS && /^\\\\[^\\]+\\[^\\]+\\$/.test(result)) { result = safeTrimTrailingSeparator(result); } @@ -30983,7 +31448,7 @@ var require_internal_path_helper = __commonJS({ (0, assert_1.default)(hasAbsoluteRoot(root), `ensureAbsoluteRoot parameter 'root' must have an absolute root`); if (root.endsWith("/") || IS_WINDOWS && root.endsWith("\\")) { } else { - root += path29.sep; + root += path30.sep; } return root + itemPath; } @@ -31017,10 +31482,10 @@ var require_internal_path_helper = __commonJS({ return ""; } p = normalizeSeparators(p); - if (!p.endsWith(path29.sep)) { + if (!p.endsWith(path30.sep)) { return p; } - if (p === path29.sep) { + if (p === path30.sep) { return p; } if (IS_WINDOWS && /^[A-Z]:\\$/i.test(p)) { @@ -31227,6 +31692,8 @@ var require_brace_expansion = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -31260,11 +31727,12 @@ var require_brace_expansion = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand3(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand3(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -31278,86 +31746,175 @@ var require_brace_expansion = __commonJS({ function gte7(i, y) { return i >= y; } - function expand3(str, max, isTop) { - var expansions = []; - var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; - var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - var isSequence = isNumericSequence || isAlphaSequence; - var isOptions = m.body.indexOf(",") >= 0; - if (!isSequence && !isOptions) { - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); - } - return [str]; - } - var n; - if (isSequence) { - n = m.body.split(/\.\./); - } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); - if (n.length === 1) { - var post = m.post.length ? expand3(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); - } + function combine2(acc, base, pre, values, max, maxLength, dropEmpties, outBase) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && expansion.length === base[a]) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + outBase.push(base[a]); + length += expansion.length; } } - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y); i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; + return out; + } + function expandSequence2(body, isAlphaSequence, max, maxLength) { + var n = body.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; } } } - N.push(c); } - } else { - N = concatMap(n, function(el) { - return expand3(el, max, false); - }); + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + return N; + } + function expand3(str, max, maxLength, isTop) { + var acc = [""]; + var accBase = [0]; + var dropEmpties = false; + var firstGroup = true; + var nextBase; + for (; ; ) { + var m = balanced2("{", "}", str); + if (!m) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } + var pre = m.pre; + if (/\$$/.test(pre)) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(",") >= 0; + if (!isSequence && !isOptions) { + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + "{" + m.body + escClose2 + m.post; + isTop = true; + firstGroup = true; + dropEmpties = false; + accBase = []; + for (var b = 0; b < acc.length; b++) { + accBase.push(acc[b].length); + } + continue; + } + return combine2( + acc, + accBase, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties, + [] + ); } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + var values; + if (isSequence) { + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); + } else { + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand3(n[0], max, maxLength, false).map(embrace2); + if (n.length === 1) { + nextBase = []; + acc = combine2( + acc, + accBase, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; + continue; + } + } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d].length !== accBase[d]) { + dropsEmpties = false; + } + } + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand3(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } + } + } + nextBase = []; + acc = combine2( + acc, + accBase, + pre, + values, + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; } - return expansions; + return acc; } } }); @@ -31367,7 +31924,7 @@ var require_minimatch = __commonJS({ "node_modules/minimatch/minimatch.js"(exports2, module2) { module2.exports = minimatch2; minimatch2.Minimatch = Minimatch2; - var path29 = (function() { + var path30 = (function() { try { return require("path"); } catch (e) { @@ -31375,7 +31932,7 @@ var require_minimatch = __commonJS({ })() || { sep: "/" }; - minimatch2.sep = path29.sep; + minimatch2.sep = path30.sep; var GLOBSTAR2 = minimatch2.GLOBSTAR = Minimatch2.GLOBSTAR = {}; var expand3 = require_brace_expansion(); var plTypes = { @@ -31464,8 +32021,8 @@ var require_minimatch = __commonJS({ assertValidPattern2(pattern); if (!options) options = {}; pattern = pattern.trim(); - if (!options.allowWindowsEscape && path29.sep !== "/") { - pattern = pattern.split(path29.sep).join("/"); + if (!options.allowWindowsEscape && path30.sep !== "/") { + pattern = pattern.split(path30.sep).join("/"); } this.options = options; this.maxGlobstarRecursion = options.maxGlobstarRecursion !== void 0 ? options.maxGlobstarRecursion : 200; @@ -31554,9 +32111,9 @@ var require_minimatch = __commonJS({ throw new TypeError("pattern is too long"); } }; - Minimatch2.prototype.parse = parse2; + Minimatch2.prototype.parse = parse3; var SUBPARSE = {}; - function parse2(pattern, isSub) { + function parse3(pattern, isSub) { assertValidPattern2(pattern); var options = this.options; if (pattern === "**") { @@ -31836,8 +32393,8 @@ var require_minimatch = __commonJS({ if (this.empty) return f === ""; if (f === "/" && partial) return true; var options = this.options; - if (path29.sep !== "/") { - f = f.split(path29.sep).join("/"); + if (path30.sep !== "/") { + f = f.split(path30.sep).join("/"); } f = f.split(slashSplit); this.debug(this.pattern, "split", f); @@ -32080,7 +32637,7 @@ var require_internal_path = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.Path = void 0; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var pathHelper = __importStar2(require_internal_path_helper()); var assert_1 = __importDefault2(require("assert")); var IS_WINDOWS = process.platform === "win32"; @@ -32095,12 +32652,12 @@ var require_internal_path = __commonJS({ (0, assert_1.default)(itemPath, `Parameter 'itemPath' must not be empty`); itemPath = pathHelper.safeTrimTrailingSeparator(itemPath); if (!pathHelper.hasRoot(itemPath)) { - this.segments = itemPath.split(path29.sep); + this.segments = itemPath.split(path30.sep); } else { let remaining = itemPath; let dir = pathHelper.dirname(remaining); while (dir !== remaining) { - const basename2 = path29.basename(remaining); + const basename2 = path30.basename(remaining); this.segments.unshift(basename2); remaining = dir; dir = pathHelper.dirname(remaining); @@ -32118,7 +32675,7 @@ var require_internal_path = __commonJS({ (0, assert_1.default)(segment === pathHelper.dirname(segment), `Parameter 'itemPath' root segment contains information for multiple segments`); this.segments.push(segment); } else { - (0, assert_1.default)(!segment.includes(path29.sep), `Parameter 'itemPath' contains unexpected path separators`); + (0, assert_1.default)(!segment.includes(path30.sep), `Parameter 'itemPath' contains unexpected path separators`); this.segments.push(segment); } } @@ -32129,12 +32686,12 @@ var require_internal_path = __commonJS({ */ toString() { let result = this.segments[0]; - let skipSlash = result.endsWith(path29.sep) || IS_WINDOWS && /^[A-Z]:$/i.test(result); + let skipSlash = result.endsWith(path30.sep) || IS_WINDOWS && /^[A-Z]:$/i.test(result); for (let i = 1; i < this.segments.length; i++) { if (skipSlash) { skipSlash = false; } else { - result += path29.sep; + result += path30.sep; } result += this.segments[i]; } @@ -32192,7 +32749,7 @@ var require_internal_pattern = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.Pattern = void 0; var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var pathHelper = __importStar2(require_internal_path_helper()); var assert_1 = __importDefault2(require("assert")); var minimatch_1 = require_minimatch(); @@ -32221,7 +32778,7 @@ var require_internal_pattern = __commonJS({ } pattern = _Pattern.fixupPattern(pattern, homedir2); this.segments = new internal_path_1.Path(pattern).segments; - this.trailingSeparator = pathHelper.normalizeSeparators(pattern).endsWith(path29.sep); + this.trailingSeparator = pathHelper.normalizeSeparators(pattern).endsWith(path30.sep); pattern = pathHelper.safeTrimTrailingSeparator(pattern); let foundGlob = false; const searchSegments = this.segments.map((x) => _Pattern.getLiteral(x)).filter((x) => !foundGlob && !(foundGlob = x === "")); @@ -32245,8 +32802,8 @@ var require_internal_pattern = __commonJS({ match(itemPath) { if (this.segments[this.segments.length - 1] === "**") { itemPath = pathHelper.normalizeSeparators(itemPath); - if (!itemPath.endsWith(path29.sep) && this.isImplicitPattern === false) { - itemPath = `${itemPath}${path29.sep}`; + if (!itemPath.endsWith(path30.sep) && this.isImplicitPattern === false) { + itemPath = `${itemPath}${path30.sep}`; } } else { itemPath = pathHelper.safeTrimTrailingSeparator(itemPath); @@ -32281,9 +32838,9 @@ var require_internal_pattern = __commonJS({ (0, assert_1.default)(literalSegments.every((x, i) => (x !== "." || i === 0) && x !== ".."), `Invalid pattern '${pattern}'. Relative pathing '.' and '..' is not allowed.`); (0, assert_1.default)(!pathHelper.hasRoot(pattern) || literalSegments[0], `Invalid pattern '${pattern}'. Root segment must not contain globs.`); pattern = pathHelper.normalizeSeparators(pattern); - if (pattern === "." || pattern.startsWith(`.${path29.sep}`)) { + if (pattern === "." || pattern.startsWith(`.${path30.sep}`)) { pattern = _Pattern.globEscape(process.cwd()) + pattern.substr(1); - } else if (pattern === "~" || pattern.startsWith(`~${path29.sep}`)) { + } else if (pattern === "~" || pattern.startsWith(`~${path30.sep}`)) { homedir2 = homedir2 || os7.homedir(); (0, assert_1.default)(homedir2, "Unable to determine HOME directory"); (0, assert_1.default)(pathHelper.hasAbsoluteRoot(homedir2), `Expected HOME directory to be a rooted path. Actual '${homedir2}'`); @@ -32367,8 +32924,8 @@ var require_internal_search_state = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.SearchState = void 0; var SearchState = class { - constructor(path29, level) { - this.path = path29; + constructor(path30, level) { + this.path = path30; this.level = level; } }; @@ -32510,9 +33067,9 @@ var require_internal_globber = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.DefaultGlobber = void 0; var core31 = __importStar2(require_core()); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var globOptionsHelper = __importStar2(require_internal_glob_options_helper()); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var patternHelper = __importStar2(require_internal_pattern_helper()); var internal_match_kind_1 = require_internal_match_kind(); var internal_pattern_1 = require_internal_pattern(); @@ -32564,7 +33121,7 @@ var require_internal_globber = __commonJS({ for (const searchPath of patternHelper.getSearchPaths(patterns)) { core31.debug(`Search path '${searchPath}'`); try { - yield __await2(fs31.promises.lstat(searchPath)); + yield __await2(fs32.promises.lstat(searchPath)); } catch (err) { if (err.code === "ENOENT") { continue; @@ -32588,7 +33145,7 @@ var require_internal_globber = __commonJS({ if (!stats) { continue; } - if (options.excludeHiddenFiles && path29.basename(item.path).match(/^\./)) { + if (options.excludeHiddenFiles && path30.basename(item.path).match(/^\./)) { continue; } if (stats.isDirectory()) { @@ -32598,7 +33155,7 @@ var require_internal_globber = __commonJS({ continue; } const childLevel = item.level + 1; - const childItems = (yield __await2(fs31.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path29.join(item.path, x), childLevel)); + const childItems = (yield __await2(fs32.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path30.join(item.path, x), childLevel)); stack.push(...childItems.reverse()); } else if (match2 & internal_match_kind_1.MatchKind.File) { yield yield __await2(item.path); @@ -32633,7 +33190,7 @@ var require_internal_globber = __commonJS({ let stats; if (options.followSymbolicLinks) { try { - stats = yield fs31.promises.stat(item.path); + stats = yield fs32.promises.stat(item.path); } catch (err) { if (err.code === "ENOENT") { if (options.omitBrokenSymbolicLinks) { @@ -32645,10 +33202,10 @@ var require_internal_globber = __commonJS({ throw err; } } else { - stats = yield fs31.promises.lstat(item.path); + stats = yield fs32.promises.lstat(item.path); } if (stats.isDirectory() && options.followSymbolicLinks) { - const realPath = yield fs31.promises.realpath(item.path); + const realPath = yield fs32.promises.realpath(item.path); while (traversalChain.length >= item.level) { traversalChain.pop(); } @@ -32757,10 +33314,10 @@ var require_internal_hash_files = __commonJS({ exports2.hashFiles = hashFiles2; var crypto3 = __importStar2(require("crypto")); var core31 = __importStar2(require_core()); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var stream2 = __importStar2(require("stream")); var util3 = __importStar2(require("util")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function hashFiles2(globber_1, currentWorkspace_1) { return __awaiter2(this, arguments, void 0, function* (globber, currentWorkspace, verbose = false) { var _a2, e_1, _b, _c; @@ -32776,17 +33333,17 @@ var require_internal_hash_files = __commonJS({ _e = false; const file = _c; writeDelegate(file); - if (!file.startsWith(`${githubWorkspace}${path29.sep}`)) { + if (!file.startsWith(`${githubWorkspace}${path30.sep}`)) { writeDelegate(`Ignore '${file}' since it is not under GITHUB_WORKSPACE.`); continue; } - if (fs31.statSync(file).isDirectory()) { + if (fs32.statSync(file).isDirectory()) { writeDelegate(`Skip directory '${file}'.`); continue; } const hash2 = crypto3.createHash("sha256"); - const pipeline = util3.promisify(stream2.pipeline); - yield pipeline(fs31.createReadStream(file), hash2); + const pipeline2 = util3.promisify(stream2.pipeline); + yield pipeline2(fs32.createReadStream(file), hash2); result.write(hash2.digest()); count++; if (!hasMatch) { @@ -33006,8 +33563,8 @@ var require_semver3 = __commonJS({ } } var i; - exports2.parse = parse2; - function parse2(version, options) { + exports2.parse = parse3; + function parse3(version, options) { if (!options || typeof options !== "object") { options = { loose: !!options, @@ -33035,12 +33592,12 @@ var require_semver3 = __commonJS({ } exports2.valid = valid4; function valid4(version, options) { - var v = parse2(version, options); + var v = parse3(version, options); return v ? v.version : null; } exports2.clean = clean3; function clean3(version, options) { - var s = parse2(version.trim().replace(/^[=v]+/, ""), options); + var s = parse3(version.trim().replace(/^[=v]+/, ""), options); return s ? s.version : null; } exports2.SemVer = SemVer; @@ -33276,8 +33833,8 @@ var require_semver3 = __commonJS({ if (eq(version1, version2)) { return null; } else { - var v1 = parse2(version1); - var v2 = parse2(version2); + var v1 = parse3(version1); + var v2 = parse3(version2); var prefix = ""; if (v1.prerelease.length || v2.prerelease.length) { prefix = "pre"; @@ -33983,7 +34540,7 @@ var require_semver3 = __commonJS({ } exports2.prerelease = prerelease; function prerelease(version, options) { - var parsed = parse2(version, options); + var parsed = parse3(version, options); return parsed && parsed.prerelease.length ? parsed.prerelease : null; } exports2.intersects = intersects; @@ -34020,7 +34577,7 @@ var require_semver3 = __commonJS({ if (match2 === null) { return null; } - return parse2(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options); + return parse3(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options); } } }); @@ -34030,7 +34587,7 @@ var require_constants7 = __commonJS({ "node_modules/@actions/cache/lib/internal/constants.js"(exports2) { "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; + exports2.CacheReadDeniedMessagePrefix = exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; var CacheFilename; (function(CacheFilename2) { CacheFilename2["Gzip"] = "cache.tgz"; @@ -34055,6 +34612,7 @@ var require_constants7 = __commonJS({ exports2.TarFilename = "cache.tar"; exports2.ManifestFilename = "manifest.txt"; exports2.CacheFileSizeLimit = 10 * Math.pow(1024, 3); + exports2.CacheReadDeniedMessagePrefix = "cache read denied:"; } }); @@ -34161,8 +34719,8 @@ var require_cacheUtils = __commonJS({ var glob2 = __importStar2(require_glob()); var io9 = __importStar2(require_io()); var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); - var path29 = __importStar2(require("path")); + var fs32 = __importStar2(require("fs")); + var path30 = __importStar2(require("path")); var semver11 = __importStar2(require_semver3()); var util3 = __importStar2(require("util")); var constants_1 = require_constants7(); @@ -34182,15 +34740,15 @@ var require_cacheUtils = __commonJS({ baseLocation = "/home"; } } - tempDirectory = path29.join(baseLocation, "actions", "temp"); + tempDirectory = path30.join(baseLocation, "actions", "temp"); } - const dest = path29.join(tempDirectory, crypto3.randomUUID()); + const dest = path30.join(tempDirectory, crypto3.randomUUID()); yield io9.mkdirP(dest); return dest; }); } function getArchiveFileSizeInBytes(filePath) { - return fs31.statSync(filePath).size; + return fs32.statSync(filePath).size; } function resolvePaths(patterns) { return __awaiter2(this, void 0, void 0, function* () { @@ -34206,7 +34764,7 @@ var require_cacheUtils = __commonJS({ _c = _g.value; _e = false; const file = _c; - const relativeFile = path29.relative(workspace, file).replace(new RegExp(`\\${path29.sep}`, "g"), "/"); + const relativeFile = path30.relative(workspace, file).replace(new RegExp(`\\${path30.sep}`, "g"), "/"); core31.debug(`Matched: ${relativeFile}`); if (relativeFile === "") { paths.push("."); @@ -34228,7 +34786,7 @@ var require_cacheUtils = __commonJS({ } function unlinkFile(filePath) { return __awaiter2(this, void 0, void 0, function* () { - return util3.promisify(fs31.unlink)(filePath); + return util3.promisify(fs32.unlink)(filePath); }); } function getVersion(app_1) { @@ -34270,7 +34828,7 @@ var require_cacheUtils = __commonJS({ } function getGnuTarPathOnWindows() { return __awaiter2(this, void 0, void 0, function* () { - if (fs31.existsSync(constants_1.GnuTarPathOnWindows)) { + if (fs32.existsSync(constants_1.GnuTarPathOnWindows)) { return constants_1.GnuTarPathOnWindows; } const versionOutput = yield getVersion("tar"); @@ -34733,13 +35291,13 @@ function __disposeResources(env) { } return next(); } -function __rewriteRelativeImportExtension(path29, preserveJsx) { - if (typeof path29 === "string" && /^\.\.?\//.test(path29)) { - return path29.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext2, cm) { +function __rewriteRelativeImportExtension(path30, preserveJsx) { + if (typeof path30 === "string" && /^\.\.?\//.test(path30)) { + return path30.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext2, cm) { return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext2 || !cm) ? m : d + ext2 + "." + cm.toLowerCase() + "js"; }); } - return path29; + return path30; } var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default; var init_tslib_es6 = __esm({ @@ -35352,12 +35910,12 @@ var require_pipeline = __commonJS({ } sendRequest(httpClient, request3) { const policies = this.getOrderedPolicies(); - const pipeline = policies.reduceRight((next, policy) => { + const pipeline2 = policies.reduceRight((next, policy) => { return (req) => { return policy.sendRequest(req, next); }; }, (req) => httpClient.sendRequest(req)); - return pipeline(request3); + return pipeline2(request3); } getOrderedPolicies() { if (!this._orderedPolicies) { @@ -36719,7 +37277,7 @@ var require_ms = __commonJS({ options = options || {}; var type = typeof val; if (type === "string" && val.length > 0) { - return parse2(val); + return parse3(val); } else if (type === "number" && isFinite(val)) { return options.long ? fmtLong(val) : fmtShort(val); } @@ -36727,7 +37285,7 @@ var require_ms = __commonJS({ "val is not a non-empty string or a valid number. val=" + JSON.stringify(val) ); }; - function parse2(str) { + function parse3(str) { str = String(str); if (str.length > 100) { return; @@ -37540,7 +38098,7 @@ var require_helpers3 = __commonJS({ }); // node_modules/agent-base/dist/index.js -var require_dist = __commonJS({ +var require_dist2 = __commonJS({ "node_modules/agent-base/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -37792,7 +38350,7 @@ var require_parse_proxy_response = __commonJS({ }); // node_modules/https-proxy-agent/dist/index.js -var require_dist2 = __commonJS({ +var require_dist3 = __commonJS({ "node_modules/https-proxy-agent/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -37831,7 +38389,7 @@ var require_dist2 = __commonJS({ var tls = __importStar2(require("tls")); var assert_1 = __importDefault2(require("assert")); var debug_1 = __importDefault2(require_src()); - var agent_base_1 = require_dist(); + var agent_base_1 = require_dist2(); var url_1 = require("url"); var parse_proxy_response_1 = require_parse_proxy_response(); var debug6 = (0, debug_1.default)("https-proxy-agent"); @@ -37942,7 +38500,7 @@ var require_dist2 = __commonJS({ }); // node_modules/http-proxy-agent/dist/index.js -var require_dist3 = __commonJS({ +var require_dist4 = __commonJS({ "node_modules/http-proxy-agent/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -37981,7 +38539,7 @@ var require_dist3 = __commonJS({ var tls = __importStar2(require("tls")); var debug_1 = __importDefault2(require_src()); var events_1 = require("events"); - var agent_base_1 = require_dist(); + var agent_base_1 = require_dist2(); var url_1 = require("url"); var debug6 = (0, debug_1.default)("http-proxy-agent"); var HttpProxyAgent = class extends agent_base_1.Agent { @@ -38080,8 +38638,8 @@ var require_proxyPolicy = __commonJS({ exports2.loadNoProxy = loadNoProxy; exports2.getDefaultProxySettings = getDefaultProxySettings; exports2.proxyPolicy = proxyPolicy; - var https_proxy_agent_1 = require_dist2(); - var http_proxy_agent_1 = require_dist3(); + var https_proxy_agent_1 = require_dist3(); + var http_proxy_agent_1 = require_dist4(); var log_js_1 = require_log2(); var HTTPS_PROXY = "HTTPS_PROXY"; var HTTP_PROXY = "HTTP_PROXY"; @@ -38484,26 +39042,26 @@ var require_createPipelineFromOptions = __commonJS({ var tlsPolicy_js_1 = require_tlsPolicy(); var multipartPolicy_js_1 = require_multipartPolicy(); function createPipelineFromOptions(options) { - const pipeline = (0, pipeline_js_1.createEmptyPipeline)(); + const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)(); if (checkEnvironment_js_1.isNodeLike) { if (options.agent) { - pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); + pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); } if (options.tlsOptions) { - pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); + pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); } - pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); - pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); + pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); + pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); } - pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); - pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); - pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); - pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); + pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); + pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); + pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); + pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); if (checkEnvironment_js_1.isNodeLike) { - pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); + pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); } - pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); - return pipeline; + pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); + return pipeline2; } } }); @@ -38725,21 +39283,21 @@ var require_clientHelpers = __commonJS({ var oauth2AuthenticationPolicy_js_1 = require_oauth2AuthenticationPolicy(); var cachedHttpClient; function createDefaultPipeline(options = {}) { - const pipeline = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options); - pipeline.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options)); + const pipeline2 = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options); + pipeline2.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options)); const { credential, authSchemes, allowInsecureConnection } = options; if (credential) { if ((0, credentials_js_1.isApiKeyCredential)(credential)) { - pipeline.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isBasicCredential)(credential)) { - pipeline.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isBearerTokenCredential)(credential)) { - pipeline.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isOAuth2TokenCredential)(credential)) { - pipeline.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } } - return pipeline; + return pipeline2; } function getCachedDefaultHttpsClient() { if (!cachedHttpClient) { @@ -38875,11 +39433,11 @@ var require_sendRequest = __commonJS({ var clientHelpers_js_1 = require_clientHelpers(); var typeGuards_js_1 = require_typeGuards(); var multipart_js_1 = require_multipart(); - async function sendRequest(method, url2, pipeline, options = {}, customHttpClient) { + async function sendRequest(method, url2, pipeline2, options = {}, customHttpClient) { const httpClient = customHttpClient ?? (0, clientHelpers_js_1.getCachedDefaultHttpsClient)(); const request3 = buildPipelineRequest(method, url2, options); try { - const response = await pipeline.sendRequest(httpClient, request3); + const response = await pipeline2.sendRequest(httpClient, request3); const headers = response.headers.toJSON(); const stream2 = response.readableStreamBody ?? response.browserStreamBody; const parsedBody = options.responseAsStream || stream2 !== void 0 ? void 0 : getResponseBody(response); @@ -39142,68 +39700,68 @@ var require_getClient = __commonJS({ var urlHelpers_js_1 = require_urlHelpers(); var checkEnvironment_js_1 = require_checkEnvironment(); function getClient(endpoint2, clientOptions = {}) { - const pipeline = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions); + const pipeline2 = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions); if (clientOptions.additionalPolicies?.length) { for (const { policy, position } of clientOptions.additionalPolicies) { const afterPhase = position === "perRetry" ? "Sign" : void 0; - pipeline.addPolicy(policy, { + pipeline2.addPolicy(policy, { afterPhase }); } } const { allowInsecureConnection, httpClient } = clientOptions; const endpointUrl = clientOptions.endpoint ?? endpoint2; - const client = (path29, ...args) => { - const getUrl = (requestOptions) => (0, urlHelpers_js_1.buildRequestUrl)(endpointUrl, path29, args, { allowInsecureConnection, ...requestOptions }); + const client = (path30, ...args) => { + const getUrl = (requestOptions) => (0, urlHelpers_js_1.buildRequestUrl)(endpointUrl, path30, args, { allowInsecureConnection, ...requestOptions }); return { get: (requestOptions = {}) => { - return buildOperation("GET", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("GET", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, post: (requestOptions = {}) => { - return buildOperation("POST", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("POST", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, put: (requestOptions = {}) => { - return buildOperation("PUT", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("PUT", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, patch: (requestOptions = {}) => { - return buildOperation("PATCH", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("PATCH", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, delete: (requestOptions = {}) => { - return buildOperation("DELETE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("DELETE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, head: (requestOptions = {}) => { - return buildOperation("HEAD", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("HEAD", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, options: (requestOptions = {}) => { - return buildOperation("OPTIONS", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("OPTIONS", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, trace: (requestOptions = {}) => { - return buildOperation("TRACE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("TRACE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); } }; }; return { path: client, pathUnchecked: client, - pipeline + pipeline: pipeline2 }; } - function buildOperation(method, url2, pipeline, options, allowInsecureConnection, httpClient) { + function buildOperation(method, url2, pipeline2, options, allowInsecureConnection, httpClient) { allowInsecureConnection = options.allowInsecureConnection ?? allowInsecureConnection; return { then: function(onFulfilled, onrejected) { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected); }, async asBrowserStream() { if (checkEnvironment_js_1.isNodeLike) { throw new Error("`asBrowserStream` is supported only in the browser environment. Use `asNodeStream` instead to obtain the response body stream. If you require a Web stream of the response in Node, consider using `Readable.toWeb` on the result of `asNodeStream`."); } else { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); } }, async asNodeStream() { if (checkEnvironment_js_1.isNodeLike) { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); } else { throw new Error("`isNodeStream` is not supported in the browser environment. Use `asBrowserStream` to obtain the response body stream."); } @@ -40693,31 +41251,31 @@ var require_createPipelineFromOptions2 = __commonJS({ var tracingPolicy_js_1 = require_tracingPolicy(); var wrapAbortSignalLikePolicy_js_1 = require_wrapAbortSignalLikePolicy(); function createPipelineFromOptions(options) { - const pipeline = (0, pipeline_js_1.createEmptyPipeline)(); + const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)(); if (core_util_1.isNodeLike) { if (options.agent) { - pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); + pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); } if (options.tlsOptions) { - pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); - } - pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); - pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); - } - pipeline.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)()); - pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); - pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); - pipeline.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName)); - pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); - pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); - pipeline.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), { + pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); + } + pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); + pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); + } + pipeline2.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)()); + pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); + pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); + pipeline2.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName)); + pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); + pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); + pipeline2.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), { afterPhase: "Retry" }); if (core_util_1.isNodeLike) { - pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); + pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); } - pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); - return pipeline; + pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); + return pipeline2; } } }); @@ -41631,8 +42189,8 @@ var require_disableKeepAlivePolicy = __commonJS({ } }; } - function pipelineContainsDisableKeepAlivePolicy(pipeline) { - return pipeline.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName); + function pipelineContainsDisableKeepAlivePolicy(pipeline2) { + return pipeline2.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName); } } }); @@ -42663,7 +43221,7 @@ var require_deserializationPolicy = __commonJS({ return result; } async function deserializeResponseBody(jsonContentTypes, xmlContentTypes, response, options, parseXML) { - const parsedResponse = await parse2(jsonContentTypes, xmlContentTypes, response, options, parseXML); + const parsedResponse = await parse3(jsonContentTypes, xmlContentTypes, response, options, parseXML); if (!shouldDeserializeResponse(parsedResponse)) { return parsedResponse; } @@ -42764,7 +43322,7 @@ var require_deserializationPolicy = __commonJS({ } return { error: error3, shouldReturnResponse: false }; } - async function parse2(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) { + async function parse3(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) { if (!operationResponse.request.streamResponseStatusCodes?.has(operationResponse.status) && operationResponse.bodyAsText) { const text = operationResponse.bodyAsText; const contentType = operationResponse.headers.get("Content-Type") || ""; @@ -42971,18 +43529,18 @@ var require_pipeline3 = __commonJS({ var core_rest_pipeline_1 = require_commonjs6(); var serializationPolicy_js_1 = require_serializationPolicy(); function createClientPipeline(options = {}) { - const pipeline = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {}); + const pipeline2 = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {}); if (options.credentialOptions) { - pipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ + pipeline2.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ credential: options.credentialOptions.credential, scopes: options.credentialOptions.credentialScopes })); } - pipeline.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" }); - pipeline.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), { + pipeline2.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" }); + pipeline2.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), { phase: "Deserialize" }); - return pipeline; + return pipeline2; } } }); @@ -43025,15 +43583,15 @@ var require_urlHelpers2 = __commonJS({ let isAbsolutePath = false; let requestUrl = replaceAll(baseUri, urlReplacements); if (operationSpec.path) { - let path29 = replaceAll(operationSpec.path, urlReplacements); - if (operationSpec.path === "/{nextLink}" && path29.startsWith("/")) { - path29 = path29.substring(1); + let path30 = replaceAll(operationSpec.path, urlReplacements); + if (operationSpec.path === "/{nextLink}" && path30.startsWith("/")) { + path30 = path30.substring(1); } - if (isAbsoluteUrl(path29)) { - requestUrl = path29; + if (isAbsoluteUrl(path30)) { + requestUrl = path30; isAbsolutePath = true; } else { - requestUrl = appendPath(requestUrl, path29); + requestUrl = appendPath(requestUrl, path30); } } const { queryParams, sequenceParams } = calculateQueryParameters(operationSpec, operationArguments, fallbackObject); @@ -43079,9 +43637,9 @@ var require_urlHelpers2 = __commonJS({ } const searchStart = pathToAppend.indexOf("?"); if (searchStart !== -1) { - const path29 = pathToAppend.substring(0, searchStart); + const path30 = pathToAppend.substring(0, searchStart); const search = pathToAppend.substring(searchStart + 1); - newPath = newPath + path29; + newPath = newPath + path30; if (search) { parsedUrl.search = parsedUrl.search ? `${parsedUrl.search}&${search}` : search; } @@ -45997,10 +46555,10 @@ var require_utils_common = __commonJS({ var constants_js_1 = require_constants10(); function escapeURLPath(url2) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 || "/"; - path29 = escape3(path29); - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 || "/"; + path30 = escape3(path30); + urlParsed.pathname = path30; return urlParsed.toString(); } function getProxyUriFromDevConnString(connectionString) { @@ -46085,9 +46643,9 @@ var require_utils_common = __commonJS({ } function appendToURLPath(url2, name) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 ? path29.endsWith("/") ? `${path29}${name}` : `${path29}/${name}` : name; - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 ? path30.endsWith("/") ? `${path30}${name}` : `${path30}/${name}` : name; + urlParsed.pathname = path30; return urlParsed.toString(); } function setURLParameter(url2, name, value) { @@ -47314,9 +47872,9 @@ var require_StorageSharedKeyCredentialPolicy = __commonJS({ * @param request - */ getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${this.factory.accountName}${path29}`; + canonicalizedResourceString += `/${this.factory.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -48055,10 +48613,10 @@ var require_utils_common2 = __commonJS({ var constants_js_1 = require_constants11(); function escapeURLPath(url2) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 || "/"; - path29 = escape3(path29); - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 || "/"; + path30 = escape3(path30); + urlParsed.pathname = path30; return urlParsed.toString(); } function getProxyUriFromDevConnString(connectionString) { @@ -48143,9 +48701,9 @@ var require_utils_common2 = __commonJS({ } function appendToURLPath(url2, name) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 ? path29.endsWith("/") ? `${path29}${name}` : `${path29}/${name}` : name; - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 ? path30.endsWith("/") ? `${path30}${name}` : `${path30}/${name}` : name; + urlParsed.pathname = path30; return urlParsed.toString(); } function setURLParameter(url2, name, value) { @@ -49066,9 +49624,9 @@ var require_StorageSharedKeyCredentialPolicy2 = __commonJS({ * @param request - */ getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${this.factory.accountName}${path29}`; + canonicalizedResourceString += `/${this.factory.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -49698,9 +50256,9 @@ var require_StorageSharedKeyCredentialPolicyV2 = __commonJS({ return canonicalizedHeadersStringToSign; } function getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${options.accountName}${path29}`; + canonicalizedResourceString += `/${options.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -50045,9 +50603,9 @@ var require_StorageSharedKeyCredentialPolicyV22 = __commonJS({ return canonicalizedHeadersStringToSign; } function getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${options.accountName}${path29}`; + canonicalizedResourceString += `/${options.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -50200,11 +50758,11 @@ var require_Pipeline = __commonJS({ var StorageSharedKeyCredentialPolicyV2_js_1 = require_StorageSharedKeyCredentialPolicyV22(); var StorageBrowserPolicyFactory_js_1 = require_StorageBrowserPolicyFactory2(); var StorageCorrectContentLengthPolicy_js_1 = require_StorageCorrectContentLengthPolicy2(); - function isPipelineLike(pipeline) { - if (!pipeline || typeof pipeline !== "object") { + function isPipelineLike(pipeline2) { + if (!pipeline2 || typeof pipeline2 !== "object") { return false; } - const castPipeline = pipeline; + const castPipeline = pipeline2; return Array.isArray(castPipeline.factories) && typeof castPipeline.options === "object" && typeof castPipeline.toServiceClientOptions === "function"; } var Pipeline = class { @@ -50244,11 +50802,11 @@ var require_Pipeline = __commonJS({ if (!credential) { credential = new AnonymousCredential_js_1.AnonymousCredential(); } - const pipeline = new Pipeline([], pipelineOptions); - pipeline._credential = credential; - return pipeline; + const pipeline2 = new Pipeline([], pipelineOptions); + pipeline2._credential = credential; + return pipeline2; } - function processDownlevelPipeline(pipeline) { + function processDownlevelPipeline(pipeline2) { const knownFactoryFunctions = [ isAnonymousCredential, isStorageSharedKeyCredential, @@ -50258,8 +50816,8 @@ var require_Pipeline = __commonJS({ isStorageTelemetryPolicyFactory, isCoreHttpPolicyFactory ]; - if (pipeline.factories.length) { - const novelFactories = pipeline.factories.filter((factory) => { + if (pipeline2.factories.length) { + const novelFactories = pipeline2.factories.filter((factory) => { return !knownFactoryFunctions.some((knownFactory) => knownFactory(factory)); }); if (novelFactories.length) { @@ -50272,14 +50830,14 @@ var require_Pipeline = __commonJS({ } return void 0; } - function getCoreClientOptions(pipeline) { - const { httpClient: v1Client, ...restOptions } = pipeline.options; - let httpClient = pipeline._coreHttpClient; + function getCoreClientOptions(pipeline2) { + const { httpClient: v1Client, ...restOptions } = pipeline2.options; + let httpClient = pipeline2._coreHttpClient; if (!httpClient) { httpClient = v1Client ? (0, core_http_compat_1.convertHttpClient)(v1Client) : (0, storage_common_1.getCachedDefaultHttpClient)(); - pipeline._coreHttpClient = httpClient; + pipeline2._coreHttpClient = httpClient; } - let corePipeline = pipeline._corePipeline; + let corePipeline = pipeline2._corePipeline; if (!corePipeline) { const packageDetails = `azsdk-js-azure-storage-blob/${constants_js_1.SDK_VERSION}`; const userAgentPrefix = restOptions.userAgentOptions && restOptions.userAgentOptions.userAgentPrefix ? `${restOptions.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`; @@ -50320,11 +50878,11 @@ var require_Pipeline = __commonJS({ corePipeline.addPolicy((0, StorageRetryPolicyV2_js_1.storageRetryPolicy)(restOptions.retryOptions), { phase: "Retry" }); corePipeline.addPolicy((0, storage_common_1.storageRequestFailureDetailsParserPolicy)()); corePipeline.addPolicy((0, StorageBrowserPolicyV2_js_1.storageBrowserPolicy)()); - const downlevelResults = processDownlevelPipeline(pipeline); + const downlevelResults = processDownlevelPipeline(pipeline2); if (downlevelResults) { corePipeline.addPolicy(downlevelResults.wrappedPolicies, downlevelResults.afterRetry ? { afterPhase: "Retry" } : void 0); } - const credential = getCredentialFromPipeline(pipeline); + const credential = getCredentialFromPipeline(pipeline2); if ((0, core_auth_1.isTokenCredential)(credential)) { corePipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ credential, @@ -50337,7 +50895,7 @@ var require_Pipeline = __commonJS({ accountKey: credential.accountKey }), { phase: "Sign" }); } - pipeline._corePipeline = corePipeline; + pipeline2._corePipeline = corePipeline; } return { ...restOptions, @@ -50346,12 +50904,12 @@ var require_Pipeline = __commonJS({ pipeline: corePipeline }; } - function getCredentialFromPipeline(pipeline) { - if (pipeline._credential) { - return pipeline._credential; + function getCredentialFromPipeline(pipeline2) { + if (pipeline2._credential) { + return pipeline2._credential; } let credential = new AnonymousCredential_js_1.AnonymousCredential(); - for (const factory of pipeline.factories) { + for (const factory of pipeline2.factories) { if ((0, core_auth_1.isTokenCredential)(factory.credential)) { credential = factory.credential; } else if (isStorageSharedKeyCredential(factory)) { @@ -63876,13 +64434,13 @@ var require_StorageClient = __commonJS({ * @param url - url to resource * @param pipeline - request policy pipeline. */ - constructor(url2, pipeline) { + constructor(url2, pipeline2) { this.url = (0, utils_common_js_1.escapeURLPath)(url2); this.accountName = (0, utils_common_js_1.getAccountNameFromUrl)(url2); - this.pipeline = pipeline; - this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline)); + this.pipeline = pipeline2; + this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2)); this.isHttps = (0, utils_common_js_1.iEqual)((0, utils_common_js_1.getURLScheme)(this.url) || "", "https"); - this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline); + this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline2); const storageClientContext = this.storageClientContext; storageClientContext.requestContentType = void 0; } @@ -68665,21 +69223,21 @@ var require_Clients = __commonJS({ } constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { options = options || {}; - let pipeline; + let pipeline2; let url2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; if (blobNameOrOptions && typeof blobNameOrOptions !== "string") { options = blobNameOrOptions; } - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -68691,20 +69249,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); ({ blobName: this._name, containerName: this._containerName } = this.getBlobAndContainerNamesFromUrl()); this.blobContext = this.storageClientContext.blob; this._snapshot = (0, utils_common_js_1.getURLParameter)(this.url, constants_js_1.URLConstants.Parameters.SNAPSHOT); @@ -69690,19 +70248,19 @@ var require_Clients = __commonJS({ */ appendBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -69714,20 +70272,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.appendBlobContext = this.storageClientContext.appendBlob; } /** @@ -69963,22 +70521,22 @@ var require_Clients = __commonJS({ */ blockBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; if (blobNameOrOptions && typeof blobNameOrOptions !== "string") { options = blobNameOrOptions; } - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -69990,20 +70548,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.blockBlobContext = this.storageClientContext.blockBlob; this._blobContext = this.storageClientContext.blob; } @@ -70575,19 +71133,19 @@ var require_Clients = __commonJS({ */ pageBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -70599,20 +71157,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.pageBlobContext = this.storageClientContext.pageBlob; } /** @@ -71677,10 +72235,10 @@ var require_BlobBatch = __commonJS({ accountKey: credential.accountKey }), { phase: "Sign" }); } - const pipeline = new Pipeline_js_1.Pipeline([]); - pipeline._credential = credential; - pipeline._corePipeline = corePipeline; - return pipeline; + const pipeline2 = new Pipeline_js_1.Pipeline([]); + pipeline2._credential = credential; + pipeline2._corePipeline = corePipeline; + return pipeline2; } appendSubRequestToBody(request3) { this.body += [ @@ -71702,8 +72260,8 @@ var require_BlobBatch = __commonJS({ if (this.operationCount >= constants_js_1.BATCH_MAX_REQUEST) { throw new RangeError(`Cannot exceed ${constants_js_1.BATCH_MAX_REQUEST} sub requests in a single batch`); } - const path29 = (0, utils_common_js_1.getURLPath)(subRequest.url); - if (!path29 || path29 === "") { + const path30 = (0, utils_common_js_1.getURLPath)(subRequest.url); + if (!path30 || path30 === "") { throw new RangeError(`Invalid url for sub request: '${subRequest.url}'`); } } @@ -71772,17 +72330,17 @@ var require_BlobBatchClient = __commonJS({ var BlobBatchClient = class { serviceOrContainerContext; constructor(url2, credentialOrPipeline, options) { - let pipeline; + let pipeline2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) { - pipeline = credentialOrPipeline; + pipeline2 = credentialOrPipeline; } else if (!credentialOrPipeline) { - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); } - const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline)); - const path29 = (0, utils_common_js_1.getURLPath)(url2); - if (path29 && path29 !== "/") { + const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2)); + const path30 = (0, utils_common_js_1.getURLPath)(url2); + if (path30 && path30 !== "/") { this.serviceOrContainerContext = storageClientContext.container; } else { this.serviceOrContainerContext = storageClientContext.service; @@ -71943,18 +72501,18 @@ var require_ContainerClient = __commonJS({ return this._containerName; } constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string") { const containerName = credentialOrPipelineOrContainerName; const extractedCreds = (0, utils_common_js_1.extractConnectionStringParts)(urlOrConnectionString); @@ -71965,20 +72523,20 @@ var require_ContainerClient = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName parameter"); } - super(url2, pipeline); + super(url2, pipeline2); this._containerName = this.getContainerNameFromUrl(); this.containerContext = this.storageClientContext.container; } @@ -73656,28 +74214,28 @@ var require_BlobServiceClient = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - const pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); - return new _BlobServiceClient(extractedCreds.url, pipeline); + const pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + return new _BlobServiceClient(extractedCreds.url, pipeline2); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { - const pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); - return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline); + const pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline2); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } constructor(url2, credentialOrPipeline, options) { - let pipeline; + let pipeline2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) { - pipeline = credentialOrPipeline; + pipeline2 = credentialOrPipeline; } else if (core_util_1.isNodeLike && credentialOrPipeline instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipeline instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipeline)) { - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); } else { - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } - super(url2, pipeline); + super(url2, pipeline2); this.serviceContext = this.storageClientContext.service; } /** @@ -74849,7 +75407,7 @@ var require_requestUtils = __commonJS({ }); // node_modules/@azure/abort-controller/dist/index.js -var require_dist4 = __commonJS({ +var require_dist5 = __commonJS({ "node_modules/@azure/abort-controller/dist/index.js"(exports2) { "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); @@ -75069,17 +75627,17 @@ var require_downloadUtils = __commonJS({ var http_client_1 = require_lib(); var storage_blob_1 = require_commonjs15(); var buffer = __importStar2(require("buffer")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var stream2 = __importStar2(require("stream")); var util3 = __importStar2(require("util")); var utils = __importStar2(require_cacheUtils()); var constants_1 = require_constants7(); var requestUtils_1 = require_requestUtils(); - var abort_controller_1 = require_dist4(); + var abort_controller_1 = require_dist5(); function pipeResponseToStream(response, output) { return __awaiter2(this, void 0, void 0, function* () { - const pipeline = util3.promisify(stream2.pipeline); - yield pipeline(response.message, output); + const pipeline2 = util3.promisify(stream2.pipeline); + yield pipeline2(response.message, output); }); } var DownloadProgress = class { @@ -75180,7 +75738,7 @@ var require_downloadUtils = __commonJS({ exports2.DownloadProgress = DownloadProgress; function downloadCacheHttpClient(archiveLocation, archivePath) { return __awaiter2(this, void 0, void 0, function* () { - const writeStream = fs31.createWriteStream(archivePath); + const writeStream = fs32.createWriteStream(archivePath); const httpClient = new http_client_1.HttpClient("actions/cache"); const downloadResponse = yield (0, requestUtils_1.retryHttpClientResponse)("downloadCache", () => __awaiter2(this, void 0, void 0, function* () { return httpClient.get(archiveLocation); @@ -75205,7 +75763,7 @@ var require_downloadUtils = __commonJS({ function downloadCacheHttpClientConcurrent(archiveLocation, archivePath, options) { return __awaiter2(this, void 0, void 0, function* () { var _a2; - const archiveDescriptor = yield fs31.promises.open(archivePath, "w"); + const archiveDescriptor = yield fs32.promises.open(archivePath, "w"); const httpClient = new http_client_1.HttpClient("actions/cache", void 0, { socketTimeout: options.timeoutInMs, keepAlive: true @@ -75321,7 +75879,7 @@ var require_downloadUtils = __commonJS({ } else { const maxSegmentSize = Math.min(134217728, buffer.constants.MAX_LENGTH); const downloadProgress = new DownloadProgress(contentLength); - const fd = fs31.openSync(archivePath, "w"); + const fd = fs32.openSync(archivePath, "w"); try { downloadProgress.startDisplayTimer(); const controller = new abort_controller_1.AbortController(); @@ -75339,12 +75897,12 @@ var require_downloadUtils = __commonJS({ controller.abort(); throw new Error("Aborting cache download as the download time exceeded the timeout."); } else if (Buffer.isBuffer(result)) { - fs31.writeFileSync(fd, result); + fs32.writeFileSync(fd, result); } } } finally { downloadProgress.stopDisplayTimer(); - fs31.closeSync(fd); + fs32.closeSync(fd); } } }); @@ -75482,6 +76040,9 @@ var require_config = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.isGhes = isGhes; exports2.getCacheServiceVersion = getCacheServiceVersion; + exports2.getCacheMode = getCacheMode; + exports2.isCacheReadable = isCacheReadable; + exports2.isCacheWritable = isCacheWritable; exports2.getCacheServiceURL = getCacheServiceURL; function isGhes() { const ghUrl = new URL(process.env["GITHUB_SERVER_URL"] || "https://github.com"); @@ -75496,6 +76057,20 @@ var require_config = __commonJS({ return "v1"; return process.env["ACTIONS_CACHE_SERVICE_V2"] ? "v2" : "v1"; } + var KNOWN_CACHE_MODES = ["none", "read", "write", "write-only"]; + function getCacheMode() { + return (process.env["ACTIONS_CACHE_MODE"] || "").trim().toLowerCase(); + } + function isCacheReadable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "read" || mode === "write"; + } + function isCacheWritable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "write" || mode === "write-only"; + } function getCacheServiceURL() { const version = getCacheServiceVersion(); switch (version) { @@ -75515,7 +76090,7 @@ var require_package = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "5.1.0", + version: "5.2.0", preview: true, description: "Actions cache lib", keywords: [ @@ -75666,7 +76241,7 @@ var require_cacheHttpClient = __commonJS({ var core31 = __importStar2(require_core()); var http_client_1 = require_lib(); var auth_1 = require_auth(); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var url_1 = require("url"); var utils = __importStar2(require_cacheUtils()); var uploadUtils_1 = require_uploadUtils(); @@ -75674,6 +76249,7 @@ var require_cacheHttpClient = __commonJS({ var options_1 = require_options(); var requestUtils_1 = require_requestUtils(); var config_1 = require_config(); + var constants_1 = require_constants7(); var user_agent_1 = require_user_agent(); function getCacheApiUrl(resource) { const baseUrl = (0, config_1.getCacheServiceURL)(); @@ -75702,6 +76278,7 @@ var require_cacheHttpClient = __commonJS({ } function getCacheEntry(keys, paths, options) { return __awaiter2(this, void 0, void 0, function* () { + var _a2; const httpClient = createHttpClient(); const version = utils.getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive); const resource = `cache?keys=${encodeURIComponent(keys.join(","))}&version=${version}`; @@ -75715,6 +76292,10 @@ var require_cacheHttpClient = __commonJS({ return null; } if (!(0, requestUtils_1.isSuccessStatusCode)(response.statusCode)) { + const errorMessage = (_a2 = response.error) === null || _a2 === void 0 ? void 0 : _a2.message; + if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(constants_1.CacheReadDeniedMessagePrefix)) { + throw new Error(errorMessage); + } throw new Error(`Cache service responded with ${response.statusCode}`); } const cacheResult = response.result; @@ -75801,7 +76382,7 @@ Other caches with similar key:`); return __awaiter2(this, void 0, void 0, function* () { const fileSize = utils.getArchiveFileSizeInBytes(archivePath); const resourceUrl = getCacheApiUrl(`caches/${cacheId.toString()}`); - const fd = fs31.openSync(archivePath, "r"); + const fd = fs32.openSync(archivePath, "r"); const uploadOptions = (0, options_1.getUploadOptions)(options); const concurrency = utils.assertDefined("uploadConcurrency", uploadOptions.uploadConcurrency); const maxChunkSize = utils.assertDefined("uploadChunkSize", uploadOptions.uploadChunkSize); @@ -75815,7 +76396,7 @@ Other caches with similar key:`); const start = offset; const end = offset + chunkSize - 1; offset += maxChunkSize; - yield uploadChunk(httpClient, resourceUrl, () => fs31.createReadStream(archivePath, { + yield uploadChunk(httpClient, resourceUrl, () => fs32.createReadStream(archivePath, { fd, start, end, @@ -75826,7 +76407,7 @@ Other caches with similar key:`); } }))); } finally { - fs31.closeSync(fd); + fs32.closeSync(fd); } return; }); @@ -81091,7 +81672,7 @@ var require_tar = __commonJS({ var exec_1 = require_exec(); var io9 = __importStar2(require_io()); var fs_1 = require("fs"); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var utils = __importStar2(require_cacheUtils()); var constants_1 = require_constants7(); var IS_WINDOWS = process.platform === "win32"; @@ -81137,13 +81718,13 @@ var require_tar = __commonJS({ const BSD_TAR_ZSTD = tarPath.type === constants_1.ArchiveToolType.BSD && compressionMethod !== constants_1.CompressionMethod.Gzip && IS_WINDOWS; switch (type) { case "create": - args.push("--posix", "-cf", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "--exclude", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "--files-from", constants_1.ManifestFilename); + args.push("--posix", "-cf", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "--exclude", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "--files-from", constants_1.ManifestFilename); break; case "extract": - args.push("-xf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path29.sep}`, "g"), "/")); + args.push("-xf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path30.sep}`, "g"), "/")); break; case "list": - args.push("-tf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "-P"); + args.push("-tf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P"); break; } if (tarPath.type === constants_1.ArchiveToolType.GNU) { @@ -81189,7 +81770,7 @@ var require_tar = __commonJS({ return BSD_TAR_ZSTD ? [ "zstd -d --long=30 --force -o", constants_1.TarFilename, - archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/") + archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/") ] : [ "--use-compress-program", IS_WINDOWS ? '"zstd -d --long=30"' : "unzstd --long=30" @@ -81198,7 +81779,7 @@ var require_tar = __commonJS({ return BSD_TAR_ZSTD ? [ "zstd -d --force -o", constants_1.TarFilename, - archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/") + archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/") ] : ["--use-compress-program", IS_WINDOWS ? '"zstd -d"' : "unzstd"]; default: return ["-z"]; @@ -81213,7 +81794,7 @@ var require_tar = __commonJS({ case constants_1.CompressionMethod.Zstd: return BSD_TAR_ZSTD ? [ "zstd -T0 --long=30 --force -o", - cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), + cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), constants_1.TarFilename ] : [ "--use-compress-program", @@ -81222,7 +81803,7 @@ var require_tar = __commonJS({ case constants_1.CompressionMethod.ZstdWithoutLong: return BSD_TAR_ZSTD ? [ "zstd -T0 --force -o", - cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), + cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), constants_1.TarFilename ] : ["--use-compress-program", IS_WINDOWS ? '"zstd -T0"' : "zstdmt"]; default: @@ -81260,7 +81841,7 @@ var require_tar = __commonJS({ } function createTar(archiveFolder, sourceDirectories, compressionMethod) { return __awaiter2(this, void 0, void 0, function* () { - (0, fs_1.writeFileSync)(path29.join(archiveFolder, constants_1.ManifestFilename), sourceDirectories.join("\n")); + (0, fs_1.writeFileSync)(path30.join(archiveFolder, constants_1.ManifestFilename), sourceDirectories.join("\n")); const commands = yield getCommands(compressionMethod, "create"); yield execCommands(commands, archiveFolder); }); @@ -81337,18 +81918,19 @@ var require_cache4 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.FinalizeCacheError = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.FinalizeCacheError = exports2.CacheReadDeniedError = exports2.CACHE_READ_DENIED_PREFIX = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; exports2.isFeatureAvailable = isFeatureAvailable; exports2.restoreCache = restoreCache5; exports2.saveCache = saveCache5; var core31 = __importStar2(require_core()); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var utils = __importStar2(require_cacheUtils()); var cacheHttpClient = __importStar2(require_cacheHttpClient()); var cacheTwirpClient = __importStar2(require_cacheTwirpClient()); var config_1 = require_config(); var tar_1 = require_tar(); var http_client_1 = require_lib(); + var constants_1 = require_constants7(); var ValidationError = class _ValidationError extends Error { constructor(message) { super(message); @@ -81374,6 +81956,15 @@ var require_cache4 = __commonJS({ } }; exports2.CacheWriteDeniedError = CacheWriteDeniedError; + exports2.CACHE_READ_DENIED_PREFIX = constants_1.CacheReadDeniedMessagePrefix; + var CacheReadDeniedError = class _CacheReadDeniedError extends Error { + constructor(message) { + super(message); + this.name = "CacheReadDeniedError"; + Object.setPrototypeOf(this, _CacheReadDeniedError.prototype); + } + }; + exports2.CacheReadDeniedError = CacheReadDeniedError; var FinalizeCacheError = class _FinalizeCacheError extends Error { constructor(message) { super(message); @@ -81411,6 +82002,12 @@ var require_cache4 = __commonJS({ const cacheServiceVersion = (0, config_1.getCacheServiceVersion)(); core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheReadable)(cacheMode)) { + core31.info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`); + core31.debug(`Skipped restore for paths [${paths.join(", ")}] with primary key '${primaryKey}'.`); + return void 0; + } switch (cacheServiceVersion) { case "v2": return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive); @@ -81422,6 +82019,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; core31.debug("Resolved Keys:"); @@ -81435,10 +82033,19 @@ var require_cache4 = __commonJS({ const compressionMethod = yield utils.getCompressionMethod(); let archivePath = ""; try { - const cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { - compressionMethod, - enableCrossOsArchive - }); + let cacheEntry; + try { + cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { + compressionMethod, + enableCrossOsArchive + }); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) { return void 0; } @@ -81446,7 +82053,7 @@ var require_cache4 = __commonJS({ core31.info("Lookup only - skipping download"); return cacheEntry.cacheKey; } - archivePath = path29.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); + archivePath = path30.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); core31.debug(`Archive Path: ${archivePath}`); yield cacheHttpClient.downloadCache(cacheEntry.archiveLocation, archivePath, options); if (core31.isDebug()) { @@ -81480,6 +82087,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; options = Object.assign(Object.assign({}, options), { useAzureSdk: true }); restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; @@ -81500,7 +82108,16 @@ var require_cache4 = __commonJS({ restoreKeys, version: utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive) }; - const response = yield twirpClient.GetCacheEntryDownloadURL(request3); + let response; + try { + response = yield twirpClient.GetCacheEntryDownloadURL(request3); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!response.ok) { core31.debug(`Cache not found for version ${request3.version} of keys: ${keys.join(", ")}`); return void 0; @@ -81515,7 +82132,7 @@ var require_cache4 = __commonJS({ core31.info("Lookup only - skipping download"); return response.matchedKey; } - archivePath = path29.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); + archivePath = path30.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); core31.debug(`Archive path: ${archivePath}`); core31.debug(`Starting download of archive to: ${archivePath}`); yield cacheHttpClient.downloadCache(response.signedDownloadUrl, archivePath, options); @@ -81556,6 +82173,12 @@ var require_cache4 = __commonJS({ core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); checkKey(key); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheWritable)(cacheMode)) { + core31.info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`); + core31.debug(`Skipped save for paths [${paths.join(", ")}] with key '${key}'.`); + return -1; + } switch (cacheServiceVersion) { case "v2": return yield saveCacheV2(paths, key, options, enableCrossOsArchive); @@ -81577,7 +82200,7 @@ var require_cache4 = __commonJS({ throw new Error(`Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`); } const archiveFolder = yield utils.createTempDirectory(); - const archivePath = path29.join(archiveFolder, utils.getCacheFileName(compressionMethod)); + const archivePath = path30.join(archiveFolder, utils.getCacheFileName(compressionMethod)); core31.debug(`Archive Path: ${archivePath}`); try { yield (0, tar_1.createTar)(archiveFolder, cachePaths, compressionMethod); @@ -81648,7 +82271,7 @@ var require_cache4 = __commonJS({ throw new Error(`Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`); } const archiveFolder = yield utils.createTempDirectory(); - const archivePath = path29.join(archiveFolder, utils.getCacheFileName(compressionMethod)); + const archivePath = path30.join(archiveFolder, utils.getCacheFileName(compressionMethod)); core31.debug(`Archive Path: ${archivePath}`); try { yield (0, tar_1.createTar)(archiveFolder, cachePaths, compressionMethod); @@ -81804,7 +82427,7 @@ var require_manifest = __commonJS({ var core_1 = require_core(); var os7 = require("os"); var cp = require("child_process"); - var fs31 = require("fs"); + var fs32 = require("fs"); function _findMatch(versionSpec, stable, candidates, archFilter) { return __awaiter2(this, void 0, void 0, function* () { const platFilter = os7.platform(); @@ -81866,10 +82489,10 @@ var require_manifest = __commonJS({ const lsbReleaseFile = "/etc/lsb-release"; const osReleaseFile = "/etc/os-release"; let contents = ""; - if (fs31.existsSync(lsbReleaseFile)) { - contents = fs31.readFileSync(lsbReleaseFile).toString(); - } else if (fs31.existsSync(osReleaseFile)) { - contents = fs31.readFileSync(osReleaseFile).toString(); + if (fs32.existsSync(lsbReleaseFile)) { + contents = fs32.readFileSync(lsbReleaseFile).toString(); + } else if (fs32.existsSync(osReleaseFile)) { + contents = fs32.readFileSync(osReleaseFile).toString(); } return contents; } @@ -82078,10 +82701,10 @@ var require_tool_cache = __commonJS({ var core31 = __importStar2(require_core()); var io9 = __importStar2(require_io()); var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var mm = __importStar2(require_manifest()); var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var httpm = __importStar2(require_lib()); var semver11 = __importStar2(require_semver2()); var stream2 = __importStar2(require("stream")); @@ -82102,8 +82725,8 @@ var require_tool_cache = __commonJS({ var userAgent2 = "actions/tool-cache"; function downloadTool3(url2, dest, auth2, headers) { return __awaiter2(this, void 0, void 0, function* () { - dest = dest || path29.join(_getTempDirectory(), crypto3.randomUUID()); - yield io9.mkdirP(path29.dirname(dest)); + dest = dest || path30.join(_getTempDirectory(), crypto3.randomUUID()); + yield io9.mkdirP(path30.dirname(dest)); core31.debug(`Downloading ${url2}`); core31.debug(`Destination ${dest}`); const maxAttempts = 3; @@ -82124,7 +82747,7 @@ var require_tool_cache = __commonJS({ } function downloadToolAttempt(url2, dest, auth2, headers) { return __awaiter2(this, void 0, void 0, function* () { - if (fs31.existsSync(dest)) { + if (fs32.existsSync(dest)) { throw new Error(`Destination file path ${dest} already exists`); } const http = new httpm.HttpClient(userAgent2, [], { @@ -82143,12 +82766,12 @@ var require_tool_cache = __commonJS({ core31.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`); throw err; } - const pipeline = util3.promisify(stream2.pipeline); + const pipeline2 = util3.promisify(stream2.pipeline); const responseMessageFactory = _getGlobal("TEST_DOWNLOAD_TOOL_RESPONSE_MESSAGE_FACTORY", () => response.message); const readStream = responseMessageFactory(); let succeeded = false; try { - yield pipeline(readStream, fs31.createWriteStream(dest)); + yield pipeline2(readStream, fs32.createWriteStream(dest)); core31.debug("download complete"); succeeded = true; return dest; @@ -82193,7 +82816,7 @@ var require_tool_cache = __commonJS({ process.chdir(originalCwd); } } else { - const escapedScript = path29.join(__dirname, "..", "scripts", "Invoke-7zdec.ps1").replace(/'/g, "''").replace(/"|\n|\r/g, ""); + const escapedScript = path30.join(__dirname, "..", "scripts", "Invoke-7zdec.ps1").replace(/'/g, "''").replace(/"|\n|\r/g, ""); const escapedFile = file.replace(/'/g, "''").replace(/"|\n|\r/g, ""); const escapedTarget = dest.replace(/'/g, "''").replace(/"|\n|\r/g, ""); const command = `& '${escapedScript}' -Source '${escapedFile}' -Target '${escapedTarget}'`; @@ -82360,12 +82983,12 @@ var require_tool_cache = __commonJS({ arch2 = arch2 || os7.arch(); core31.debug(`Caching tool ${tool} ${version} ${arch2}`); core31.debug(`source dir: ${sourceDir}`); - if (!fs31.statSync(sourceDir).isDirectory()) { + if (!fs32.statSync(sourceDir).isDirectory()) { throw new Error("sourceDir is not a directory"); } const destPath = yield _createToolPath(tool, version, arch2); - for (const itemName of fs31.readdirSync(sourceDir)) { - const s = path29.join(sourceDir, itemName); + for (const itemName of fs32.readdirSync(sourceDir)) { + const s = path30.join(sourceDir, itemName); yield io9.cp(s, destPath, { recursive: true }); } _completeToolPath(tool, version, arch2); @@ -82378,11 +83001,11 @@ var require_tool_cache = __commonJS({ arch2 = arch2 || os7.arch(); core31.debug(`Caching tool ${tool} ${version} ${arch2}`); core31.debug(`source file: ${sourceFile}`); - if (!fs31.statSync(sourceFile).isFile()) { + if (!fs32.statSync(sourceFile).isFile()) { throw new Error("sourceFile is not a file"); } const destFolder = yield _createToolPath(tool, version, arch2); - const destPath = path29.join(destFolder, targetFile); + const destPath = path30.join(destFolder, targetFile); core31.debug(`destination file ${destPath}`); yield io9.cp(sourceFile, destPath); _completeToolPath(tool, version, arch2); @@ -82405,9 +83028,9 @@ var require_tool_cache = __commonJS({ let toolPath = ""; if (versionSpec) { versionSpec = semver11.clean(versionSpec) || ""; - const cachePath = path29.join(_getCacheDirectory(), toolName, versionSpec, arch2); + const cachePath = path30.join(_getCacheDirectory(), toolName, versionSpec, arch2); core31.debug(`checking cache: ${cachePath}`); - if (fs31.existsSync(cachePath) && fs31.existsSync(`${cachePath}.complete`)) { + if (fs32.existsSync(cachePath) && fs32.existsSync(`${cachePath}.complete`)) { core31.debug(`Found tool in cache ${toolName} ${versionSpec} ${arch2}`); toolPath = cachePath; } else { @@ -82419,13 +83042,13 @@ var require_tool_cache = __commonJS({ function findAllVersions2(toolName, arch2) { const versions = []; arch2 = arch2 || os7.arch(); - const toolPath = path29.join(_getCacheDirectory(), toolName); - if (fs31.existsSync(toolPath)) { - const children = fs31.readdirSync(toolPath); + const toolPath = path30.join(_getCacheDirectory(), toolName); + if (fs32.existsSync(toolPath)) { + const children = fs32.readdirSync(toolPath); for (const child of children) { if (isExplicitVersion(child)) { - const fullPath = path29.join(toolPath, child, arch2 || ""); - if (fs31.existsSync(fullPath) && fs31.existsSync(`${fullPath}.complete`)) { + const fullPath = path30.join(toolPath, child, arch2 || ""); + if (fs32.existsSync(fullPath) && fs32.existsSync(`${fullPath}.complete`)) { versions.push(child); } } @@ -82476,7 +83099,7 @@ var require_tool_cache = __commonJS({ function _createExtractFolder(dest) { return __awaiter2(this, void 0, void 0, function* () { if (!dest) { - dest = path29.join(_getTempDirectory(), crypto3.randomUUID()); + dest = path30.join(_getTempDirectory(), crypto3.randomUUID()); } yield io9.mkdirP(dest); return dest; @@ -82484,7 +83107,7 @@ var require_tool_cache = __commonJS({ } function _createToolPath(tool, version, arch2) { return __awaiter2(this, void 0, void 0, function* () { - const folderPath = path29.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); + const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); core31.debug(`destination ${folderPath}`); const markerPath = `${folderPath}.complete`; yield io9.rmRF(folderPath); @@ -82494,9 +83117,9 @@ var require_tool_cache = __commonJS({ }); } function _completeToolPath(tool, version, arch2) { - const folderPath = path29.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); + const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); const markerPath = `${folderPath}.complete`; - fs31.writeFileSync(markerPath, ""); + fs32.writeFileSync(markerPath, ""); core31.debug("finished caching tool"); } function isExplicitVersion(versionSpec) { @@ -88187,13 +88810,13 @@ These characters are not allowed in the artifact name due to limitations with ce (0, core_1.info)(`Artifact name is valid!`); } exports2.validateArtifactName = validateArtifactName; - function validateFilePath(path29) { - if (!path29) { + function validateFilePath(path30) { + if (!path30) { throw new Error(`Provided file path input during validation is empty`); } for (const [invalidCharacterKey, errorMessageForCharacter] of invalidArtifactFilePathCharacters) { - if (path29.includes(invalidCharacterKey)) { - throw new Error(`The path for one of the files in artifact is not valid: ${path29}. Contains the following character: ${errorMessageForCharacter} + if (path30.includes(invalidCharacterKey)) { + throw new Error(`The path for one of the files in artifact is not valid: ${path30}. Contains the following character: ${errorMessageForCharacter} Invalid characters include: ${Array.from(invalidArtifactFilePathCharacters.values()).toString()} @@ -88738,15 +89361,15 @@ var require_upload_zip_specification = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getUploadZipSpecification = exports2.validateRootDirectory = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core_1 = require_core(); var path_1 = require("path"); var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation(); function validateRootDirectory(rootDirectory) { - if (!fs31.existsSync(rootDirectory)) { + if (!fs32.existsSync(rootDirectory)) { throw new Error(`The provided rootDirectory ${rootDirectory} does not exist`); } - if (!fs31.statSync(rootDirectory).isDirectory()) { + if (!fs32.statSync(rootDirectory).isDirectory()) { throw new Error(`The provided rootDirectory ${rootDirectory} is not a valid directory`); } (0, core_1.info)(`Root directory input is valid!`); @@ -88757,7 +89380,7 @@ var require_upload_zip_specification = __commonJS({ rootDirectory = (0, path_1.normalize)(rootDirectory); rootDirectory = (0, path_1.resolve)(rootDirectory); for (let file of filesToZip) { - const stats = fs31.lstatSync(file, { throwIfNoEntry: false }); + const stats = fs32.lstatSync(file, { throwIfNoEntry: false }); if (!stats) { throw new Error(`File ${file} does not exist`); } @@ -88943,6 +89566,8 @@ var require_brace_expansion2 = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -88976,11 +89601,12 @@ var require_brace_expansion2 = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand3(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand3(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -88994,18 +89620,90 @@ var require_brace_expansion2 = __commonJS({ function gte7(i, y) { return i >= y; } - function expand3(str, max, isTop) { - var expansions = []; - var m = balanced2("{", "}", str); - if (!m) return [str]; - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (var k = 0; k < post.length && k < max; k++) { - var expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); + function combine2(acc, pre, values, max, maxLength, dropEmpties) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && !expansion) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + length += expansion.length; + } + } + return out; + } + function expandSequence2(body, isAlphaSequence, max, maxLength) { + var n = body.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; + } + return N; + } + function expand3(str, max, maxLength, isTop) { + var acc = [""]; + var dropEmpties = false; + var firstGroup = true; + for (; ; ) { + const m = balanced2("{", "}", str); + if (!m) { + return combine2(acc, str, [""], max, maxLength, dropEmpties); + } + const pre = m.pre; + if (/\$$/.test(pre)) { + acc = combine2( + acc, + pre + "{" + m.body + "}", + [""], + max, + maxLength, + dropEmpties && !m.post.length + ); + firstGroup = false; + if (!m.post.length) break; + str = m.post; + continue; } - } else { var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -89013,74 +89711,69 @@ var require_brace_expansion2 = __commonJS({ if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); + isTop = true; + continue; } - return [str]; + return combine2( + acc, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties + ); } - var n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + var values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand3(n[0], max, maxLength, false).map(embrace2); if (n.length === 1) { - return post.map(function(p) { - return m.pre + n[0] + p; - }); + acc = combine2( + acc, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length + ); + if (!m.post.length) break; + str = m.post; + continue; } } - } - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d]) { + dropsEmpties = false; } - N.push(c); - } - } else { - N = []; - for (var j = 0; j < n.length; j++) { - N.push.apply(N, expand3(n[j], max, false)); } - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand3(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } } } + acc = combine2(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) break; + str = m.post; } - return expansions; + return acc; } } }); @@ -89096,8 +89789,8 @@ var require_minimatch2 = __commonJS({ return new Minimatch2(pattern, options).match(p); }; module2.exports = minimatch2; - var path29 = require_path(); - minimatch2.sep = path29.sep; + var path30 = require_path(); + minimatch2.sep = path30.sep; var GLOBSTAR2 = /* @__PURE__ */ Symbol("globstar **"); minimatch2.GLOBSTAR = GLOBSTAR2; var expand3 = require_brace_expansion2(); @@ -89703,8 +90396,8 @@ var require_minimatch2 = __commonJS({ if (this.empty) return f === ""; if (f === "/" && partial) return true; const options = this.options; - if (path29.sep !== "/") { - f = f.split(path29.sep).join("/"); + if (path30.sep !== "/") { + f = f.split(path30.sep).join("/"); } f = f.split(slashSplit); this.debug(this.pattern, "split", f); @@ -89742,13 +90435,13 @@ var require_minimatch2 = __commonJS({ var require_readdir_glob = __commonJS({ "node_modules/@actions/artifact/node_modules/readdir-glob/index.js"(exports2, module2) { module2.exports = readdirGlob2; - var fs31 = require("fs"); + var fs32 = require("fs"); var { EventEmitter: EventEmitter2 } = require("events"); var { Minimatch: Minimatch2 } = require_minimatch2(); var { resolve: resolve14 } = require("path"); function readdir3(dir, strict) { return new Promise((resolve15, reject) => { - fs31.readdir(dir, { withFileTypes: true }, (err, files) => { + fs32.readdir(dir, { withFileTypes: true }, (err, files) => { if (err) { switch (err.code) { case "ENOTDIR": @@ -89781,7 +90474,7 @@ var require_readdir_glob = __commonJS({ } function stat2(file, followSymlinks) { return new Promise((resolve15, reject) => { - const statFunc = followSymlinks ? fs31.stat : fs31.lstat; + const statFunc = followSymlinks ? fs32.stat : fs32.lstat; statFunc(file, (err, stats) => { if (err) { switch (err.code) { @@ -89802,8 +90495,8 @@ var require_readdir_glob = __commonJS({ }); }); } - async function* exploreWalkAsync2(dir, path29, followSymlinks, useStat, shouldSkip, strict) { - let files = await readdir3(path29 + dir, strict); + async function* exploreWalkAsync2(dir, path30, followSymlinks, useStat, shouldSkip, strict) { + let files = await readdir3(path30 + dir, strict); for (const file of files) { let name = file.name; if (name === void 0) { @@ -89812,7 +90505,7 @@ var require_readdir_glob = __commonJS({ } const filename = dir + "/" + name; const relative3 = filename.slice(1); - const absolute = path29 + "/" + relative3; + const absolute = path30 + "/" + relative3; let stats = null; if (useStat || followSymlinks) { stats = await stat2(absolute, followSymlinks); @@ -89826,15 +90519,15 @@ var require_readdir_glob = __commonJS({ if (stats.isDirectory()) { if (!shouldSkip(relative3)) { yield { relative: relative3, absolute, stats }; - yield* exploreWalkAsync2(filename, path29, followSymlinks, useStat, shouldSkip, false); + yield* exploreWalkAsync2(filename, path30, followSymlinks, useStat, shouldSkip, false); } } else { yield { relative: relative3, absolute, stats }; } } } - async function* explore2(path29, followSymlinks, useStat, shouldSkip) { - yield* exploreWalkAsync2("", path29, followSymlinks, useStat, shouldSkip, true); + async function* explore2(path30, followSymlinks, useStat, shouldSkip) { + yield* exploreWalkAsync2("", path30, followSymlinks, useStat, shouldSkip, true); } function readOptions2(options) { return { @@ -91846,54 +92539,54 @@ var require_polyfills = __commonJS({ } var chdir; module2.exports = patch; - function patch(fs31) { + function patch(fs32) { if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) { - patchLchmod(fs31); - } - if (!fs31.lutimes) { - patchLutimes(fs31); - } - fs31.chown = chownFix(fs31.chown); - fs31.fchown = chownFix(fs31.fchown); - fs31.lchown = chownFix(fs31.lchown); - fs31.chmod = chmodFix(fs31.chmod); - fs31.fchmod = chmodFix(fs31.fchmod); - fs31.lchmod = chmodFix(fs31.lchmod); - fs31.chownSync = chownFixSync(fs31.chownSync); - fs31.fchownSync = chownFixSync(fs31.fchownSync); - fs31.lchownSync = chownFixSync(fs31.lchownSync); - fs31.chmodSync = chmodFixSync(fs31.chmodSync); - fs31.fchmodSync = chmodFixSync(fs31.fchmodSync); - fs31.lchmodSync = chmodFixSync(fs31.lchmodSync); - fs31.stat = statFix(fs31.stat); - fs31.fstat = statFix(fs31.fstat); - fs31.lstat = statFix(fs31.lstat); - fs31.statSync = statFixSync(fs31.statSync); - fs31.fstatSync = statFixSync(fs31.fstatSync); - fs31.lstatSync = statFixSync(fs31.lstatSync); - if (fs31.chmod && !fs31.lchmod) { - fs31.lchmod = function(path29, mode, cb) { + patchLchmod(fs32); + } + if (!fs32.lutimes) { + patchLutimes(fs32); + } + fs32.chown = chownFix(fs32.chown); + fs32.fchown = chownFix(fs32.fchown); + fs32.lchown = chownFix(fs32.lchown); + fs32.chmod = chmodFix(fs32.chmod); + fs32.fchmod = chmodFix(fs32.fchmod); + fs32.lchmod = chmodFix(fs32.lchmod); + fs32.chownSync = chownFixSync(fs32.chownSync); + fs32.fchownSync = chownFixSync(fs32.fchownSync); + fs32.lchownSync = chownFixSync(fs32.lchownSync); + fs32.chmodSync = chmodFixSync(fs32.chmodSync); + fs32.fchmodSync = chmodFixSync(fs32.fchmodSync); + fs32.lchmodSync = chmodFixSync(fs32.lchmodSync); + fs32.stat = statFix(fs32.stat); + fs32.fstat = statFix(fs32.fstat); + fs32.lstat = statFix(fs32.lstat); + fs32.statSync = statFixSync(fs32.statSync); + fs32.fstatSync = statFixSync(fs32.fstatSync); + fs32.lstatSync = statFixSync(fs32.lstatSync); + if (fs32.chmod && !fs32.lchmod) { + fs32.lchmod = function(path30, mode, cb) { if (cb) process.nextTick(cb); }; - fs31.lchmodSync = function() { + fs32.lchmodSync = function() { }; } - if (fs31.chown && !fs31.lchown) { - fs31.lchown = function(path29, uid, gid, cb) { + if (fs32.chown && !fs32.lchown) { + fs32.lchown = function(path30, uid, gid, cb) { if (cb) process.nextTick(cb); }; - fs31.lchownSync = function() { + fs32.lchownSync = function() { }; } if (platform2 === "win32") { - fs31.rename = typeof fs31.rename !== "function" ? fs31.rename : (function(fs$rename) { + fs32.rename = typeof fs32.rename !== "function" ? fs32.rename : (function(fs$rename) { function rename(from, to, cb) { var start = Date.now(); var backoff = 0; fs$rename(from, to, function CB(er) { if (er && (er.code === "EACCES" || er.code === "EPERM") && Date.now() - start < 6e4) { setTimeout(function() { - fs31.stat(to, function(stater, st) { + fs32.stat(to, function(stater, st) { if (stater && stater.code === "ENOENT") fs$rename(from, to, CB); else @@ -91909,9 +92602,9 @@ var require_polyfills = __commonJS({ } if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename); return rename; - })(fs31.rename); + })(fs32.rename); } - fs31.read = typeof fs31.read !== "function" ? fs31.read : (function(fs$read) { + fs32.read = typeof fs32.read !== "function" ? fs32.read : (function(fs$read) { function read(fd, buffer, offset, length, position, callback_) { var callback; if (callback_ && typeof callback_ === "function") { @@ -91919,22 +92612,22 @@ var require_polyfills = __commonJS({ callback = function(er, _2, __) { if (er && er.code === "EAGAIN" && eagCounter < 10) { eagCounter++; - return fs$read.call(fs31, fd, buffer, offset, length, position, callback); + return fs$read.call(fs32, fd, buffer, offset, length, position, callback); } callback_.apply(this, arguments); }; } - return fs$read.call(fs31, fd, buffer, offset, length, position, callback); + return fs$read.call(fs32, fd, buffer, offset, length, position, callback); } if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read); return read; - })(fs31.read); - fs31.readSync = typeof fs31.readSync !== "function" ? fs31.readSync : /* @__PURE__ */ (function(fs$readSync) { + })(fs32.read); + fs32.readSync = typeof fs32.readSync !== "function" ? fs32.readSync : /* @__PURE__ */ (function(fs$readSync) { return function(fd, buffer, offset, length, position) { var eagCounter = 0; while (true) { try { - return fs$readSync.call(fs31, fd, buffer, offset, length, position); + return fs$readSync.call(fs32, fd, buffer, offset, length, position); } catch (er) { if (er.code === "EAGAIN" && eagCounter < 10) { eagCounter++; @@ -91944,11 +92637,11 @@ var require_polyfills = __commonJS({ } } }; - })(fs31.readSync); - function patchLchmod(fs32) { - fs32.lchmod = function(path29, mode, callback) { - fs32.open( - path29, + })(fs32.readSync); + function patchLchmod(fs33) { + fs33.lchmod = function(path30, mode, callback) { + fs33.open( + path30, constants.O_WRONLY | constants.O_SYMLINK, mode, function(err, fd) { @@ -91956,80 +92649,80 @@ var require_polyfills = __commonJS({ if (callback) callback(err); return; } - fs32.fchmod(fd, mode, function(err2) { - fs32.close(fd, function(err22) { + fs33.fchmod(fd, mode, function(err2) { + fs33.close(fd, function(err22) { if (callback) callback(err2 || err22); }); }); } ); }; - fs32.lchmodSync = function(path29, mode) { - var fd = fs32.openSync(path29, constants.O_WRONLY | constants.O_SYMLINK, mode); + fs33.lchmodSync = function(path30, mode) { + var fd = fs33.openSync(path30, constants.O_WRONLY | constants.O_SYMLINK, mode); var threw = true; var ret; try { - ret = fs32.fchmodSync(fd, mode); + ret = fs33.fchmodSync(fd, mode); threw = false; } finally { if (threw) { try { - fs32.closeSync(fd); + fs33.closeSync(fd); } catch (er) { } } else { - fs32.closeSync(fd); + fs33.closeSync(fd); } } return ret; }; } - function patchLutimes(fs32) { - if (constants.hasOwnProperty("O_SYMLINK") && fs32.futimes) { - fs32.lutimes = function(path29, at, mt, cb) { - fs32.open(path29, constants.O_SYMLINK, function(er, fd) { + function patchLutimes(fs33) { + if (constants.hasOwnProperty("O_SYMLINK") && fs33.futimes) { + fs33.lutimes = function(path30, at, mt, cb) { + fs33.open(path30, constants.O_SYMLINK, function(er, fd) { if (er) { if (cb) cb(er); return; } - fs32.futimes(fd, at, mt, function(er2) { - fs32.close(fd, function(er22) { + fs33.futimes(fd, at, mt, function(er2) { + fs33.close(fd, function(er22) { if (cb) cb(er2 || er22); }); }); }); }; - fs32.lutimesSync = function(path29, at, mt) { - var fd = fs32.openSync(path29, constants.O_SYMLINK); + fs33.lutimesSync = function(path30, at, mt) { + var fd = fs33.openSync(path30, constants.O_SYMLINK); var ret; var threw = true; try { - ret = fs32.futimesSync(fd, at, mt); + ret = fs33.futimesSync(fd, at, mt); threw = false; } finally { if (threw) { try { - fs32.closeSync(fd); + fs33.closeSync(fd); } catch (er) { } } else { - fs32.closeSync(fd); + fs33.closeSync(fd); } } return ret; }; - } else if (fs32.futimes) { - fs32.lutimes = function(_a2, _b, _c, cb) { + } else if (fs33.futimes) { + fs33.lutimes = function(_a2, _b, _c, cb) { if (cb) process.nextTick(cb); }; - fs32.lutimesSync = function() { + fs33.lutimesSync = function() { }; } } function chmodFix(orig) { if (!orig) return orig; return function(target, mode, cb) { - return orig.call(fs31, target, mode, function(er) { + return orig.call(fs32, target, mode, function(er) { if (chownErOk(er)) er = null; if (cb) cb.apply(this, arguments); }); @@ -92039,7 +92732,7 @@ var require_polyfills = __commonJS({ if (!orig) return orig; return function(target, mode) { try { - return orig.call(fs31, target, mode); + return orig.call(fs32, target, mode); } catch (er) { if (!chownErOk(er)) throw er; } @@ -92048,7 +92741,7 @@ var require_polyfills = __commonJS({ function chownFix(orig) { if (!orig) return orig; return function(target, uid, gid, cb) { - return orig.call(fs31, target, uid, gid, function(er) { + return orig.call(fs32, target, uid, gid, function(er) { if (chownErOk(er)) er = null; if (cb) cb.apply(this, arguments); }); @@ -92058,7 +92751,7 @@ var require_polyfills = __commonJS({ if (!orig) return orig; return function(target, uid, gid) { try { - return orig.call(fs31, target, uid, gid); + return orig.call(fs32, target, uid, gid); } catch (er) { if (!chownErOk(er)) throw er; } @@ -92078,13 +92771,13 @@ var require_polyfills = __commonJS({ } if (cb) cb.apply(this, arguments); } - return options ? orig.call(fs31, target, options, callback) : orig.call(fs31, target, callback); + return options ? orig.call(fs32, target, options, callback) : orig.call(fs32, target, callback); }; } function statFixSync(orig) { if (!orig) return orig; return function(target, options) { - var stats = options ? orig.call(fs31, target, options) : orig.call(fs31, target); + var stats = options ? orig.call(fs32, target, options) : orig.call(fs32, target); if (stats) { if (stats.uid < 0) stats.uid += 4294967296; if (stats.gid < 0) stats.gid += 4294967296; @@ -92113,16 +92806,16 @@ var require_legacy_streams = __commonJS({ "node_modules/graceful-fs/legacy-streams.js"(exports2, module2) { var Stream = require("stream").Stream; module2.exports = legacy; - function legacy(fs31) { + function legacy(fs32) { return { ReadStream, WriteStream }; - function ReadStream(path29, options) { - if (!(this instanceof ReadStream)) return new ReadStream(path29, options); + function ReadStream(path30, options) { + if (!(this instanceof ReadStream)) return new ReadStream(path30, options); Stream.call(this); var self2 = this; - this.path = path29; + this.path = path30; this.fd = null; this.readable = true; this.paused = false; @@ -92156,7 +92849,7 @@ var require_legacy_streams = __commonJS({ }); return; } - fs31.open(this.path, this.flags, this.mode, function(err, fd) { + fs32.open(this.path, this.flags, this.mode, function(err, fd) { if (err) { self2.emit("error", err); self2.readable = false; @@ -92167,10 +92860,10 @@ var require_legacy_streams = __commonJS({ self2._read(); }); } - function WriteStream(path29, options) { - if (!(this instanceof WriteStream)) return new WriteStream(path29, options); + function WriteStream(path30, options) { + if (!(this instanceof WriteStream)) return new WriteStream(path30, options); Stream.call(this); - this.path = path29; + this.path = path30; this.fd = null; this.writable = true; this.flags = "w"; @@ -92195,7 +92888,7 @@ var require_legacy_streams = __commonJS({ this.busy = false; this._queue = []; if (this.fd === null) { - this._open = fs31.open; + this._open = fs32.open; this._queue.push([this._open, this.path, this.flags, this.mode, void 0]); this.flush(); } @@ -92230,7 +92923,7 @@ var require_clone = __commonJS({ // node_modules/graceful-fs/graceful-fs.js var require_graceful_fs = __commonJS({ "node_modules/graceful-fs/graceful-fs.js"(exports2, module2) { - var fs31 = require("fs"); + var fs32 = require("fs"); var polyfills = require_polyfills(); var legacy = require_legacy_streams(); var clone = require_clone(); @@ -92262,12 +92955,12 @@ var require_graceful_fs = __commonJS({ m = "GFS4: " + m.split(/\n/).join("\nGFS4: "); console.error(m); }; - if (!fs31[gracefulQueue]) { + if (!fs32[gracefulQueue]) { queue2 = global[gracefulQueue] || []; - publishQueue(fs31, queue2); - fs31.close = (function(fs$close) { + publishQueue(fs32, queue2); + fs32.close = (function(fs$close) { function close(fd, cb) { - return fs$close.call(fs31, fd, function(err) { + return fs$close.call(fs32, fd, function(err) { if (!err) { resetQueue(); } @@ -92279,48 +92972,48 @@ var require_graceful_fs = __commonJS({ value: fs$close }); return close; - })(fs31.close); - fs31.closeSync = (function(fs$closeSync) { + })(fs32.close); + fs32.closeSync = (function(fs$closeSync) { function closeSync(fd) { - fs$closeSync.apply(fs31, arguments); + fs$closeSync.apply(fs32, arguments); resetQueue(); } Object.defineProperty(closeSync, previousSymbol, { value: fs$closeSync }); return closeSync; - })(fs31.closeSync); + })(fs32.closeSync); if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) { process.on("exit", function() { - debug6(fs31[gracefulQueue]); - require("assert").equal(fs31[gracefulQueue].length, 0); + debug6(fs32[gracefulQueue]); + require("assert").equal(fs32[gracefulQueue].length, 0); }); } } var queue2; if (!global[gracefulQueue]) { - publishQueue(global, fs31[gracefulQueue]); - } - module2.exports = patch(clone(fs31)); - if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs31.__patched) { - module2.exports = patch(fs31); - fs31.__patched = true; - } - function patch(fs32) { - polyfills(fs32); - fs32.gracefulify = patch; - fs32.createReadStream = createReadStream4; - fs32.createWriteStream = createWriteStream3; - var fs$readFile = fs32.readFile; - fs32.readFile = readFile; - function readFile(path29, options, cb) { + publishQueue(global, fs32[gracefulQueue]); + } + module2.exports = patch(clone(fs32)); + if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs32.__patched) { + module2.exports = patch(fs32); + fs32.__patched = true; + } + function patch(fs33) { + polyfills(fs33); + fs33.gracefulify = patch; + fs33.createReadStream = createReadStream4; + fs33.createWriteStream = createWriteStream3; + var fs$readFile = fs33.readFile; + fs33.readFile = readFile; + function readFile(path30, options, cb) { if (typeof options === "function") cb = options, options = null; - return go$readFile(path29, options, cb); - function go$readFile(path30, options2, cb2, startTime) { - return fs$readFile(path30, options2, function(err) { + return go$readFile(path30, options, cb); + function go$readFile(path31, options2, cb2, startTime) { + return fs$readFile(path31, options2, function(err) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$readFile, [path30, options2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$readFile, [path31, options2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92328,16 +93021,16 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$writeFile = fs32.writeFile; - fs32.writeFile = writeFile; - function writeFile(path29, data, options, cb) { + var fs$writeFile = fs33.writeFile; + fs33.writeFile = writeFile; + function writeFile(path30, data, options, cb) { if (typeof options === "function") cb = options, options = null; - return go$writeFile(path29, data, options, cb); - function go$writeFile(path30, data2, options2, cb2, startTime) { - return fs$writeFile(path30, data2, options2, function(err) { + return go$writeFile(path30, data, options, cb); + function go$writeFile(path31, data2, options2, cb2, startTime) { + return fs$writeFile(path31, data2, options2, function(err) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$writeFile, [path30, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$writeFile, [path31, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92345,17 +93038,17 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$appendFile = fs32.appendFile; + var fs$appendFile = fs33.appendFile; if (fs$appendFile) - fs32.appendFile = appendFile; - function appendFile(path29, data, options, cb) { + fs33.appendFile = appendFile; + function appendFile(path30, data, options, cb) { if (typeof options === "function") cb = options, options = null; - return go$appendFile(path29, data, options, cb); - function go$appendFile(path30, data2, options2, cb2, startTime) { - return fs$appendFile(path30, data2, options2, function(err) { + return go$appendFile(path30, data, options, cb); + function go$appendFile(path31, data2, options2, cb2, startTime) { + return fs$appendFile(path31, data2, options2, function(err) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$appendFile, [path30, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$appendFile, [path31, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92363,9 +93056,9 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$copyFile = fs32.copyFile; + var fs$copyFile = fs33.copyFile; if (fs$copyFile) - fs32.copyFile = copyFile2; + fs33.copyFile = copyFile2; function copyFile2(src, dest, flags, cb) { if (typeof flags === "function") { cb = flags; @@ -92383,34 +93076,34 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$readdir = fs32.readdir; - fs32.readdir = readdir3; + var fs$readdir = fs33.readdir; + fs33.readdir = readdir3; var noReaddirOptionVersions = /^v[0-5]\./; - function readdir3(path29, options, cb) { + function readdir3(path30, options, cb) { if (typeof options === "function") cb = options, options = null; - var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path30, options2, cb2, startTime) { - return fs$readdir(path30, fs$readdirCallback( - path30, + var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path31, options2, cb2, startTime) { + return fs$readdir(path31, fs$readdirCallback( + path31, options2, cb2, startTime )); - } : function go$readdir2(path30, options2, cb2, startTime) { - return fs$readdir(path30, options2, fs$readdirCallback( - path30, + } : function go$readdir2(path31, options2, cb2, startTime) { + return fs$readdir(path31, options2, fs$readdirCallback( + path31, options2, cb2, startTime )); }; - return go$readdir(path29, options, cb); - function fs$readdirCallback(path30, options2, cb2, startTime) { + return go$readdir(path30, options, cb); + function fs$readdirCallback(path31, options2, cb2, startTime) { return function(err, files) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) enqueue([ go$readdir, - [path30, options2, cb2], + [path31, options2, cb2], err, startTime || Date.now(), Date.now() @@ -92425,21 +93118,21 @@ var require_graceful_fs = __commonJS({ } } if (process.version.substr(0, 4) === "v0.8") { - var legStreams = legacy(fs32); + var legStreams = legacy(fs33); ReadStream = legStreams.ReadStream; WriteStream = legStreams.WriteStream; } - var fs$ReadStream = fs32.ReadStream; + var fs$ReadStream = fs33.ReadStream; if (fs$ReadStream) { ReadStream.prototype = Object.create(fs$ReadStream.prototype); ReadStream.prototype.open = ReadStream$open; } - var fs$WriteStream = fs32.WriteStream; + var fs$WriteStream = fs33.WriteStream; if (fs$WriteStream) { WriteStream.prototype = Object.create(fs$WriteStream.prototype); WriteStream.prototype.open = WriteStream$open; } - Object.defineProperty(fs32, "ReadStream", { + Object.defineProperty(fs33, "ReadStream", { get: function() { return ReadStream; }, @@ -92449,7 +93142,7 @@ var require_graceful_fs = __commonJS({ enumerable: true, configurable: true }); - Object.defineProperty(fs32, "WriteStream", { + Object.defineProperty(fs33, "WriteStream", { get: function() { return WriteStream; }, @@ -92460,7 +93153,7 @@ var require_graceful_fs = __commonJS({ configurable: true }); var FileReadStream = ReadStream; - Object.defineProperty(fs32, "FileReadStream", { + Object.defineProperty(fs33, "FileReadStream", { get: function() { return FileReadStream; }, @@ -92471,7 +93164,7 @@ var require_graceful_fs = __commonJS({ configurable: true }); var FileWriteStream = WriteStream; - Object.defineProperty(fs32, "FileWriteStream", { + Object.defineProperty(fs33, "FileWriteStream", { get: function() { return FileWriteStream; }, @@ -92481,7 +93174,7 @@ var require_graceful_fs = __commonJS({ enumerable: true, configurable: true }); - function ReadStream(path29, options) { + function ReadStream(path30, options) { if (this instanceof ReadStream) return fs$ReadStream.apply(this, arguments), this; else @@ -92501,7 +93194,7 @@ var require_graceful_fs = __commonJS({ } }); } - function WriteStream(path29, options) { + function WriteStream(path30, options) { if (this instanceof WriteStream) return fs$WriteStream.apply(this, arguments), this; else @@ -92519,22 +93212,22 @@ var require_graceful_fs = __commonJS({ } }); } - function createReadStream4(path29, options) { - return new fs32.ReadStream(path29, options); + function createReadStream4(path30, options) { + return new fs33.ReadStream(path30, options); } - function createWriteStream3(path29, options) { - return new fs32.WriteStream(path29, options); + function createWriteStream3(path30, options) { + return new fs33.WriteStream(path30, options); } - var fs$open = fs32.open; - fs32.open = open; - function open(path29, flags, mode, cb) { + var fs$open = fs33.open; + fs33.open = open; + function open(path30, flags, mode, cb) { if (typeof mode === "function") cb = mode, mode = null; - return go$open(path29, flags, mode, cb); - function go$open(path30, flags2, mode2, cb2, startTime) { - return fs$open(path30, flags2, mode2, function(err, fd) { + return go$open(path30, flags, mode, cb); + function go$open(path31, flags2, mode2, cb2, startTime) { + return fs$open(path31, flags2, mode2, function(err, fd) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$open, [path30, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$open, [path31, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92542,20 +93235,20 @@ var require_graceful_fs = __commonJS({ }); } } - return fs32; + return fs33; } function enqueue(elem) { debug6("ENQUEUE", elem[0].name, elem[1]); - fs31[gracefulQueue].push(elem); + fs32[gracefulQueue].push(elem); retry2(); } var retryTimer; function resetQueue() { var now = Date.now(); - for (var i = 0; i < fs31[gracefulQueue].length; ++i) { - if (fs31[gracefulQueue][i].length > 2) { - fs31[gracefulQueue][i][3] = now; - fs31[gracefulQueue][i][4] = now; + for (var i = 0; i < fs32[gracefulQueue].length; ++i) { + if (fs32[gracefulQueue][i].length > 2) { + fs32[gracefulQueue][i][3] = now; + fs32[gracefulQueue][i][4] = now; } } retry2(); @@ -92563,9 +93256,9 @@ var require_graceful_fs = __commonJS({ function retry2() { clearTimeout(retryTimer); retryTimer = void 0; - if (fs31[gracefulQueue].length === 0) + if (fs32[gracefulQueue].length === 0) return; - var elem = fs31[gracefulQueue].shift(); + var elem = fs32[gracefulQueue].shift(); var fn = elem[0]; var args = elem[1]; var err = elem[2]; @@ -92587,7 +93280,7 @@ var require_graceful_fs = __commonJS({ debug6("RETRY", fn.name, args); fn.apply(null, args.concat([startTime])); } else { - fs31[gracefulQueue].push(elem); + fs32[gracefulQueue].push(elem); } } if (retryTimer === void 0) { @@ -92739,10 +93432,10 @@ var require_util12 = __commonJS({ return objectToString(arg) === "[object Array]"; } exports2.isArray = isArray2; - function isBoolean(arg) { + function isBoolean2(arg) { return typeof arg === "boolean"; } - exports2.isBoolean = isBoolean; + exports2.isBoolean = isBoolean2; function isNull(arg) { return arg === null; } @@ -94639,22 +95332,22 @@ var require_lazystream = __commonJS({ // node_modules/normalize-path/index.js var require_normalize_path = __commonJS({ "node_modules/normalize-path/index.js"(exports2, module2) { - module2.exports = function(path29, stripTrailing) { - if (typeof path29 !== "string") { + module2.exports = function(path30, stripTrailing) { + if (typeof path30 !== "string") { throw new TypeError("expected path to be a string"); } - if (path29 === "\\" || path29 === "/") return "/"; - var len = path29.length; - if (len <= 1) return path29; + if (path30 === "\\" || path30 === "/") return "/"; + var len = path30.length; + if (len <= 1) return path30; var prefix = ""; - if (len > 4 && path29[3] === "\\") { - var ch = path29[2]; - if ((ch === "?" || ch === ".") && path29.slice(0, 2) === "\\\\") { - path29 = path29.slice(2); + if (len > 4 && path30[3] === "\\") { + var ch = path30[2]; + if ((ch === "?" || ch === ".") && path30.slice(0, 2) === "\\\\") { + path30 = path30.slice(2); prefix = "//"; } } - var segs = path29.split(/[/\\]+/); + var segs = path30.split(/[/\\]+/); if (stripTrailing !== false && segs[segs.length - 1] === "") { segs.pop(); } @@ -96812,7 +97505,7 @@ var require_validators = __commonJS({ throw new ERR_INVALID_ARG_TYPE(name, "a dictionary", value); } }); - var validateArray = hideStackFrames((value, name, minLength = 0) => { + var validateArray2 = hideStackFrames((value, name, minLength = 0) => { if (!ArrayIsArray(value)) { throw new ERR_INVALID_ARG_TYPE(name, "Array", value); } @@ -96822,19 +97515,19 @@ var require_validators = __commonJS({ } }); function validateStringArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { validateString(value[i], `${name}[${i}]`); } } function validateBooleanArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { validateBoolean(value[i], `${name}[${i}]`); } } function validateAbortSignalArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { const signal = value[i]; const indexedName = `${name}[${i}]`; @@ -96930,7 +97623,7 @@ var require_validators = __commonJS({ isInt32, isUint32, parseFileMode, - validateArray, + validateArray: validateArray2, validateStringArray, validateBooleanArray, validateAbortSignalArray, @@ -100736,7 +101429,7 @@ var require_pipeline4 = __commonJS({ } } } - function pipeline(...streams) { + function pipeline2(...streams) { return pipelineImpl(streams, once(popCallback(streams))); } function pipelineImpl(streams, callback, opts) { @@ -101002,7 +101695,7 @@ var require_pipeline4 = __commonJS({ } module2.exports = { pipelineImpl, - pipeline + pipeline: pipeline2 }; } }); @@ -101011,7 +101704,7 @@ var require_pipeline4 = __commonJS({ var require_compose = __commonJS({ "node_modules/readable-stream/lib/internal/streams/compose.js"(exports2, module2) { "use strict"; - var { pipeline } = require_pipeline4(); + var { pipeline: pipeline2 } = require_pipeline4(); var Duplex = require_duplex(); var { destroyer } = require_destroy2(); var { @@ -101071,7 +101764,7 @@ var require_compose = __commonJS({ } } const head = streams[0]; - const tail = pipeline(streams, onfinished); + const tail = pipeline2(streams, onfinished); const writable = !!(isWritable(head) || isWritableStream(head) || isTransformStream(head)); const readable = !!(isReadable(tail) || isReadableStream(tail) || isTransformStream(tail)); d = new Duplex({ @@ -101614,7 +102307,7 @@ var require_promises = __commonJS({ var { pipelineImpl: pl } = require_pipeline4(); var { finished } = require_end_of_stream(); require_stream2(); - function pipeline(...streams) { + function pipeline2(...streams) { return new Promise2((resolve14, reject) => { let signal; let end; @@ -101642,7 +102335,7 @@ var require_promises = __commonJS({ } module2.exports = { finished, - pipeline + pipeline: pipeline2 }; } }); @@ -101662,7 +102355,7 @@ var require_stream2 = __commonJS({ } = require_errors4(); var compose = require_compose(); var { setDefaultHighWaterMark, getDefaultHighWaterMark } = require_state3(); - var { pipeline } = require_pipeline4(); + var { pipeline: pipeline2 } = require_pipeline4(); var { destroyer } = require_destroy2(); var eos = require_end_of_stream(); var promises6 = require_promises(); @@ -101726,7 +102419,7 @@ var require_stream2 = __commonJS({ Stream.Duplex = require_duplex(); Stream.Transform = require_transform(); Stream.PassThrough = require_passthrough2(); - Stream.pipeline = pipeline; + Stream.pipeline = pipeline2; var { addAbortSignal } = require_add_abort_signal(); Stream.addAbortSignal = addAbortSignal; Stream.finished = eos; @@ -101742,7 +102435,7 @@ var require_stream2 = __commonJS({ return promises6; } }); - ObjectDefineProperty(pipeline, customPromisify, { + ObjectDefineProperty(pipeline2, customPromisify, { __proto__: null, enumerable: true, get() { @@ -103410,7 +104103,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur g.minimatch.escape = vi.escape; g.minimatch.unescape = Ei.unescape; }); - var fs31 = R((Wt) => { + var fs32 = R((Wt) => { "use strict"; Object.defineProperty(Wt, "__esModule", { value: true }); Wt.LRUCache = void 0; @@ -104279,7 +104972,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur }; Object.defineProperty(_2, "__esModule", { value: true }); _2.PathScurry = _2.Path = _2.PathScurryDarwin = _2.PathScurryPosix = _2.PathScurryWin32 = _2.PathScurryBase = _2.PathPosix = _2.PathWin32 = _2.PathBase = _2.ChildrenCache = _2.ResolveCache = void 0; - var Qt = fs31(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => { + var Qt = fs32(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => { let t = vs.get(n); if (t) return t; let e = n.normalize("NFKD"); @@ -105657,8 +106350,8 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur // node_modules/archiver-utils/file.js var require_file3 = __commonJS({ "node_modules/archiver-utils/file.js"(exports2, module2) { - var fs31 = require_graceful_fs(); - var path29 = require("path"); + var fs32 = require_graceful_fs(); + var path30 = require("path"); var flatten = require_flatten(); var difference = require_difference(); var union = require_union(); @@ -105683,8 +106376,8 @@ var require_file3 = __commonJS({ return result; }; file.exists = function() { - var filepath = path29.join.apply(path29, arguments); - return fs31.existsSync(filepath); + var filepath = path30.join.apply(path30, arguments); + return fs32.existsSync(filepath); }; file.expand = function(...args) { var options = isPlainObject4(args[0]) ? args.shift() : {}; @@ -105697,12 +106390,12 @@ var require_file3 = __commonJS({ }); if (options.filter) { matches = matches.filter(function(filepath) { - filepath = path29.join(options.cwd || "", filepath); + filepath = path30.join(options.cwd || "", filepath); try { if (typeof options.filter === "function") { return options.filter(filepath); } else { - return fs31.statSync(filepath)[options.filter](); + return fs32.statSync(filepath)[options.filter](); } } catch (e) { return false; @@ -105714,7 +106407,7 @@ var require_file3 = __commonJS({ file.expandMapping = function(patterns, destBase, options) { options = Object.assign({ rename: function(destBase2, destPath) { - return path29.join(destBase2 || "", destPath); + return path30.join(destBase2 || "", destPath); } }, options); var files = []; @@ -105722,14 +106415,14 @@ var require_file3 = __commonJS({ file.expand(options, patterns).forEach(function(src) { var destPath = src; if (options.flatten) { - destPath = path29.basename(destPath); + destPath = path30.basename(destPath); } if (options.ext) { destPath = destPath.replace(/(\.[^\/]*)?$/, options.ext); } var dest = options.rename(destBase, destPath, options); if (options.cwd) { - src = path29.join(options.cwd, src); + src = path30.join(options.cwd, src); } dest = dest.replace(pathSeparatorRe, "/"); src = src.replace(pathSeparatorRe, "/"); @@ -105810,8 +106503,8 @@ var require_file3 = __commonJS({ // node_modules/archiver-utils/index.js var require_archiver_utils = __commonJS({ "node_modules/archiver-utils/index.js"(exports2, module2) { - var fs31 = require_graceful_fs(); - var path29 = require("path"); + var fs32 = require_graceful_fs(); + var path30 = require("path"); var isStream2 = require_is_stream(); var lazystream = require_lazystream(); var normalizePath4 = require_normalize_path(); @@ -105859,7 +106552,7 @@ var require_archiver_utils = __commonJS({ }; utils.lazyReadStream = function(filepath) { return new lazystream.Readable(function() { - return fs31.createReadStream(filepath); + return fs32.createReadStream(filepath); }); }; utils.normalizeInputSource = function(source) { @@ -105887,7 +106580,7 @@ var require_archiver_utils = __commonJS({ callback = base; base = dirpath; } - fs31.readdir(dirpath, function(err, list) { + fs32.readdir(dirpath, function(err, list) { var i = 0; var file; var filepath; @@ -105899,11 +106592,11 @@ var require_archiver_utils = __commonJS({ if (!file) { return callback(null, results); } - filepath = path29.join(dirpath, file); - fs31.stat(filepath, function(err2, stats) { + filepath = path30.join(dirpath, file); + fs32.stat(filepath, function(err2, stats) { results.push({ path: filepath, - relative: path29.relative(base, filepath).replace(/\\/g, "/"), + relative: path30.relative(base, filepath).replace(/\\/g, "/"), stats }); if (stats && stats.isDirectory()) { @@ -105962,10 +106655,10 @@ var require_error3 = __commonJS({ // node_modules/@actions/artifact/node_modules/archiver/lib/core.js var require_core2 = __commonJS({ "node_modules/@actions/artifact/node_modules/archiver/lib/core.js"(exports2, module2) { - var fs31 = require("fs"); + var fs32 = require("fs"); var glob2 = require_readdir_glob(); var async = require_async(); - var path29 = require("path"); + var path30 = require("path"); var util3 = require_archiver_utils(); var inherits = require("util").inherits; var ArchiverError2 = require_error3(); @@ -106026,7 +106719,7 @@ var require_core2 = __commonJS({ data.sourcePath = filepath; task.data = data; this._entriesCount++; - if (data.stats && data.stats instanceof fs31.Stats) { + if (data.stats && data.stats instanceof fs32.Stats) { task = this._updateQueueTaskWithStats(task, data.stats); if (task) { if (data.stats.size) { @@ -106197,7 +106890,7 @@ var require_core2 = __commonJS({ callback(); return; } - fs31.lstat(task.filepath, function(err, stats) { + fs32.lstat(task.filepath, function(err, stats) { if (this._state.aborted) { setImmediate(callback); return; @@ -106240,10 +106933,10 @@ var require_core2 = __commonJS({ task.data.sourceType = "buffer"; task.source = Buffer.concat([]); } else if (stats.isSymbolicLink() && this._moduleSupports("symlink")) { - var linkPath = fs31.readlinkSync(task.filepath); - var dirName = path29.dirname(task.filepath); + var linkPath = fs32.readlinkSync(task.filepath); + var dirName = path30.dirname(task.filepath); task.data.type = "symlink"; - task.data.linkname = path29.relative(dirName, path29.resolve(dirName, linkPath)); + task.data.linkname = path30.relative(dirName, path30.resolve(dirName, linkPath)); task.data.sourceType = "buffer"; task.source = Buffer.concat([]); } else { @@ -108965,13 +109658,13 @@ var require_streamx = __commonJS({ } function pipelinePromise(...streams) { return new Promise((resolve14, reject) => { - return pipeline(...streams, (err) => { + return pipeline2(...streams, (err) => { if (err) return reject(err); resolve14(); }); }); } - function pipeline(stream2, ...streams) { + function pipeline2(stream2, ...streams) { const all = Array.isArray(stream2) ? [...stream2, ...streams] : [stream2, ...streams]; const done = all.length && typeof all[all.length - 1] === "function" ? all.pop() : null; if (all.length < 2) throw new Error("Pipeline requires at least 2 streams"); @@ -109056,7 +109749,7 @@ var require_streamx = __commonJS({ return s._writev !== Writable.prototype._writev && s._writev !== Duplex.prototype._writev; } module2.exports = { - pipeline, + pipeline: pipeline2, pipelinePromise, isStream: isStream2, isStreamx, @@ -110010,7 +110703,7 @@ var require_tar2 = __commonJS({ }); // node_modules/buffer-crc32/dist/index.cjs -var require_dist5 = __commonJS({ +var require_dist6 = __commonJS({ "node_modules/buffer-crc32/dist/index.cjs"(exports2, module2) { "use strict"; function getDefaultExportFromCjs(x) { @@ -110322,7 +111015,7 @@ var require_json = __commonJS({ "node_modules/@actions/artifact/node_modules/archiver/lib/plugins/json.js"(exports2, module2) { var inherits = require("util").inherits; var Transform5 = require_ours().Transform; - var crc325 = require_dist5(); + var crc325 = require_dist6(); var util3 = require_archiver_utils(); var Json2 = function(options) { if (!(this instanceof Json2)) { @@ -110693,8 +111386,8 @@ var require_context2 = __commonJS({ if ((0, fs_1.existsSync)(process.env.GITHUB_EVENT_PATH)) { this.payload = JSON.parse((0, fs_1.readFileSync)(process.env.GITHUB_EVENT_PATH, { encoding: "utf8" })); } else { - const path29 = process.env.GITHUB_EVENT_PATH; - process.stdout.write(`GITHUB_EVENT_PATH ${path29} does not exist${os_1.EOL}`); + const path30 = process.env.GITHUB_EVENT_PATH; + process.stdout.write(`GITHUB_EVENT_PATH ${path30} does not exist${os_1.EOL}`); } } this.eventName = process.env.GITHUB_EVENT_NAME; @@ -111957,7 +112650,7 @@ var require_dist_node2 = __commonJS({ return template.replace(/\/$/, ""); } } - function parse2(options) { + function parse3(options) { let method = options.method.toUpperCase(); let url2 = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}"); let headers = Object.assign({}, options.headers); @@ -112021,7 +112714,7 @@ var require_dist_node2 = __commonJS({ ); } function endpointWithDefaults2(defaults3, route, options) { - return parse2(merge2(defaults3, route, options)); + return parse3(merge2(defaults3, route, options)); } function withDefaults4(oldDefaults, newDefaults) { const DEFAULTS22 = merge2(oldDefaults, newDefaults); @@ -112030,7 +112723,7 @@ var require_dist_node2 = __commonJS({ DEFAULTS: DEFAULTS22, defaults: withDefaults4.bind(null, DEFAULTS22), merge: merge2.bind(null, DEFAULTS22), - parse: parse2 + parse: parse3 }); } var endpoint2 = withDefaults4(null, DEFAULTS2); @@ -115590,7 +116283,7 @@ var require_traverse = __commonJS({ })(this.value); }; function walk(root, cb, immutable) { - var path29 = []; + var path30 = []; var parents = []; var alive = true; return (function walker(node_) { @@ -115599,11 +116292,11 @@ var require_traverse = __commonJS({ var state = { node, node_, - path: [].concat(path29), + path: [].concat(path30), parent: parents.slice(-1)[0], - key: path29.slice(-1)[0], - isRoot: path29.length === 0, - level: path29.length, + key: path30.slice(-1)[0], + isRoot: path30.length === 0, + level: path30.length, circular: null, update: function(x) { if (!state.isRoot) { @@ -115658,7 +116351,7 @@ var require_traverse = __commonJS({ parents.push(state); var keys = Object.keys(state.node); keys.forEach(function(key, i2) { - path29.push(key); + path30.push(key); if (modifiers.pre) modifiers.pre.call(state, state.node[key], key); var child = walker(state.node[key]); if (immutable && Object.hasOwnProperty.call(state.node, key)) { @@ -115667,7 +116360,7 @@ var require_traverse = __commonJS({ child.isLast = i2 == keys.length - 1; child.isFirst = i2 == 0; if (modifiers.post) modifiers.post.call(state, child); - path29.pop(); + path30.pop(); }); parents.pop(); } @@ -116262,7 +116955,7 @@ var require_binary = __commonJS({ }); return stream2; }; - exports2.parse = function parse2(buffer) { + exports2.parse = function parse3(buffer) { var self2 = words(function(bytes, cb) { return function(name) { if (offset + bytes <= buffer.length) { @@ -116688,11 +117381,11 @@ var require_unzip_stream = __commonJS({ return requiredLength; case states.CENTRAL_DIRECTORY_FILE_HEADER_SUFFIX: var isUtf8 = (this.parsedEntity.flags & 2048) !== 0; - var path29 = this._decodeString(chunk.slice(0, this.parsedEntity.fileNameLength), isUtf8); + var path30 = this._decodeString(chunk.slice(0, this.parsedEntity.fileNameLength), isUtf8); var extraDataBuffer = chunk.slice(this.parsedEntity.fileNameLength, this.parsedEntity.fileNameLength + this.parsedEntity.extraFieldLength); var extra = this._readExtraFields(extraDataBuffer); if (extra && extra.parsed && extra.parsed.path && !isUtf8) { - path29 = extra.parsed.path; + path30 = extra.parsed.path; } this.parsedEntity.extra = extra.parsed; var isUnix = (this.parsedEntity.versionMadeBy & 65280) >> 8 === 3; @@ -116704,7 +117397,7 @@ var require_unzip_stream = __commonJS({ } if (this.options.debug) { const debugObj = Object.assign({}, this.parsedEntity, { - path: path29, + path: path30, flags: "0x" + this.parsedEntity.flags.toString(16), unixAttrs: unixAttrs && "0" + unixAttrs.toString(8), isSymlink, @@ -117141,8 +117834,8 @@ var require_parser_stream = __commonJS({ // node_modules/mkdirp/index.js var require_mkdirp = __commonJS({ "node_modules/mkdirp/index.js"(exports2, module2) { - var path29 = require("path"); - var fs31 = require("fs"); + var path30 = require("path"); + var fs32 = require("fs"); var _0777 = parseInt("0777", 8); module2.exports = mkdirP.mkdirp = mkdirP.mkdirP = mkdirP; function mkdirP(p, opts, f, made) { @@ -117153,7 +117846,7 @@ var require_mkdirp = __commonJS({ opts = { mode: opts }; } var mode = opts.mode; - var xfs = opts.fs || fs31; + var xfs = opts.fs || fs32; if (mode === void 0) { mode = _0777; } @@ -117161,7 +117854,7 @@ var require_mkdirp = __commonJS({ var cb = f || /* istanbul ignore next */ function() { }; - p = path29.resolve(p); + p = path30.resolve(p); xfs.mkdir(p, mode, function(er) { if (!er) { made = made || p; @@ -117169,8 +117862,8 @@ var require_mkdirp = __commonJS({ } switch (er.code) { case "ENOENT": - if (path29.dirname(p) === p) return cb(er); - mkdirP(path29.dirname(p), opts, function(er2, made2) { + if (path30.dirname(p) === p) return cb(er); + mkdirP(path30.dirname(p), opts, function(er2, made2) { if (er2) cb(er2, made2); else mkdirP(p, opts, cb, made2); }); @@ -117192,19 +117885,19 @@ var require_mkdirp = __commonJS({ opts = { mode: opts }; } var mode = opts.mode; - var xfs = opts.fs || fs31; + var xfs = opts.fs || fs32; if (mode === void 0) { mode = _0777; } if (!made) made = null; - p = path29.resolve(p); + p = path30.resolve(p); try { xfs.mkdirSync(p, mode); made = made || p; } catch (err0) { switch (err0.code) { case "ENOENT": - made = sync(path29.dirname(p), opts, made); + made = sync(path30.dirname(p), opts, made); sync(p, opts, made); break; // In the case of any other error, just see if there's a dir @@ -117229,8 +117922,8 @@ var require_mkdirp = __commonJS({ // node_modules/unzip-stream/lib/extract.js var require_extract2 = __commonJS({ "node_modules/unzip-stream/lib/extract.js"(exports2, module2) { - var fs31 = require("fs"); - var path29 = require("path"); + var fs32 = require("fs"); + var path30 = require("path"); var util3 = require("util"); var mkdirp = require_mkdirp(); var Transform5 = require("stream").Transform; @@ -117272,11 +117965,11 @@ var require_extract2 = __commonJS({ }; Extract.prototype._processEntry = function(entry) { var self2 = this; - var destPath = path29.join(this.opts.path, entry.path); - var directory = entry.isDirectory ? destPath : path29.dirname(destPath); + var destPath = path30.join(this.opts.path, entry.path); + var directory = entry.isDirectory ? destPath : path30.dirname(destPath); this.unfinishedEntries++; var writeFileFn = function() { - var pipedStream = fs31.createWriteStream(destPath); + var pipedStream = fs32.createWriteStream(destPath); pipedStream.on("close", function() { self2.unfinishedEntries--; self2._notifyAwaiter(); @@ -117400,10 +118093,10 @@ var require_download_artifact = __commonJS({ parsed.search = ""; return parsed.toString(); }; - function exists(path29) { + function exists(path30) { return __awaiter2(this, void 0, void 0, function* () { try { - yield promises_1.default.access(path29); + yield promises_1.default.access(path30); return true; } catch (error3) { if (error3.code === "ENOENT") { @@ -117635,12 +118328,12 @@ var require_dist_node11 = __commonJS({ octokit.log.debug("request", options); const start = Date.now(); const requestOptions = octokit.request.endpoint.parse(options); - const path29 = requestOptions.url.replace(options.baseUrl, ""); + const path30 = requestOptions.url.replace(options.baseUrl, ""); return request3(options).then((response) => { - octokit.log.info(`${requestOptions.method} ${path29} - ${response.status} in ${Date.now() - start}ms`); + octokit.log.info(`${requestOptions.method} ${path30} - ${response.status} in ${Date.now() - start}ms`); return response; }).catch((error3) => { - octokit.log.info(`${requestOptions.method} ${path29} - ${error3.status} in ${Date.now() - start}ms`); + octokit.log.info(`${requestOptions.method} ${path30} - ${error3.status} in ${Date.now() - start}ms`); throw error3; }); }); @@ -118474,7 +119167,7 @@ var require_file_command2 = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.prepareKeyValueMessage = exports2.issueFileCommand = void 0; var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var os7 = __importStar2(require("os")); var utils_1 = require_utils10(); function issueFileCommand(command, message) { @@ -118482,10 +119175,10 @@ var require_file_command2 = __commonJS({ if (!filePath) { throw new Error(`Unable to find environment variable for file command ${command}`); } - if (!fs31.existsSync(filePath)) { + if (!fs32.existsSync(filePath)) { throw new Error(`Missing file at path: ${filePath}`); } - fs31.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { + fs32.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { encoding: "utf8" }); } @@ -119735,7 +120428,7 @@ var require_path_utils2 = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.toPlatformPath = exports2.toWin32Path = exports2.toPosixPath = void 0; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function toPosixPath(pth) { return pth.replace(/[\\]/g, "/"); } @@ -119745,7 +120438,7 @@ var require_path_utils2 = __commonJS({ } exports2.toWin32Path = toWin32Path; function toPlatformPath(pth) { - return pth.replace(/[/\\]/g, path29.sep); + return pth.replace(/[/\\]/g, path30.sep); } exports2.toPlatformPath = toPlatformPath; } @@ -119808,12 +120501,12 @@ var require_io_util2 = __commonJS({ var _a2; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getCmdPath = exports2.tryGetExecutablePath = exports2.isRooted = exports2.isDirectory = exports2.exists = exports2.READONLY = exports2.UV_FS_O_EXLOCK = exports2.IS_WINDOWS = exports2.unlink = exports2.symlink = exports2.stat = exports2.rmdir = exports2.rm = exports2.rename = exports2.readlink = exports2.readdir = exports2.open = exports2.mkdir = exports2.lstat = exports2.copyFile = exports2.chmod = void 0; - var fs31 = __importStar2(require("fs")); - var path29 = __importStar2(require("path")); - _a2 = fs31.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.readlink = _a2.readlink, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; + var fs32 = __importStar2(require("fs")); + var path30 = __importStar2(require("path")); + _a2 = fs32.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.readlink = _a2.readlink, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; exports2.IS_WINDOWS = process.platform === "win32"; exports2.UV_FS_O_EXLOCK = 268435456; - exports2.READONLY = fs31.constants.O_RDONLY; + exports2.READONLY = fs32.constants.O_RDONLY; function exists(fsPath) { return __awaiter2(this, void 0, void 0, function* () { try { @@ -119858,7 +120551,7 @@ var require_io_util2 = __commonJS({ } if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { - const upperExt = path29.extname(filePath).toUpperCase(); + const upperExt = path30.extname(filePath).toUpperCase(); if (extensions.some((validExt) => validExt.toUpperCase() === upperExt)) { return filePath; } @@ -119882,11 +120575,11 @@ var require_io_util2 = __commonJS({ if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { try { - const directory = path29.dirname(filePath); - const upperName = path29.basename(filePath).toUpperCase(); + const directory = path30.dirname(filePath); + const upperName = path30.basename(filePath).toUpperCase(); for (const actualName of yield exports2.readdir(directory)) { if (upperName === actualName.toUpperCase()) { - filePath = path29.join(directory, actualName); + filePath = path30.join(directory, actualName); break; } } @@ -119981,7 +120674,7 @@ var require_io2 = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.findInPath = exports2.which = exports2.mkdirP = exports2.rmRF = exports2.mv = exports2.cp = void 0; var assert_1 = require("assert"); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var ioUtil = __importStar2(require_io_util2()); function cp(source, dest, options = {}) { return __awaiter2(this, void 0, void 0, function* () { @@ -119990,7 +120683,7 @@ var require_io2 = __commonJS({ if (destStat && destStat.isFile() && !force) { return; } - const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path29.join(dest, path29.basename(source)) : dest; + const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path30.join(dest, path30.basename(source)) : dest; if (!(yield ioUtil.exists(source))) { throw new Error(`no such file or directory: ${source}`); } @@ -120002,7 +120695,7 @@ var require_io2 = __commonJS({ yield cpDirRecursive(source, newDest, 0, force); } } else { - if (path29.relative(source, newDest) === "") { + if (path30.relative(source, newDest) === "") { throw new Error(`'${newDest}' and '${source}' are the same file`); } yield copyFile2(source, newDest, force); @@ -120015,7 +120708,7 @@ var require_io2 = __commonJS({ if (yield ioUtil.exists(dest)) { let destExists = true; if (yield ioUtil.isDirectory(dest)) { - dest = path29.join(dest, path29.basename(source)); + dest = path30.join(dest, path30.basename(source)); destExists = yield ioUtil.exists(dest); } if (destExists) { @@ -120026,7 +120719,7 @@ var require_io2 = __commonJS({ } } } - yield mkdirP(path29.dirname(dest)); + yield mkdirP(path30.dirname(dest)); yield ioUtil.rename(source, dest); }); } @@ -120089,7 +120782,7 @@ var require_io2 = __commonJS({ } const extensions = []; if (ioUtil.IS_WINDOWS && process.env["PATHEXT"]) { - for (const extension of process.env["PATHEXT"].split(path29.delimiter)) { + for (const extension of process.env["PATHEXT"].split(path30.delimiter)) { if (extension) { extensions.push(extension); } @@ -120102,12 +120795,12 @@ var require_io2 = __commonJS({ } return []; } - if (tool.includes(path29.sep)) { + if (tool.includes(path30.sep)) { return []; } const directories = []; if (process.env.PATH) { - for (const p of process.env.PATH.split(path29.delimiter)) { + for (const p of process.env.PATH.split(path30.delimiter)) { if (p) { directories.push(p); } @@ -120115,7 +120808,7 @@ var require_io2 = __commonJS({ } const matches = []; for (const directory of directories) { - const filePath = yield ioUtil.tryGetExecutablePath(path29.join(directory, tool), extensions); + const filePath = yield ioUtil.tryGetExecutablePath(path30.join(directory, tool), extensions); if (filePath) { matches.push(filePath); } @@ -120231,7 +120924,7 @@ var require_toolrunner2 = __commonJS({ var os7 = __importStar2(require("os")); var events = __importStar2(require("events")); var child = __importStar2(require("child_process")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var io9 = __importStar2(require_io2()); var ioUtil = __importStar2(require_io_util2()); var timers_1 = require("timers"); @@ -120446,7 +121139,7 @@ var require_toolrunner2 = __commonJS({ exec() { return __awaiter2(this, void 0, void 0, function* () { if (!ioUtil.isRooted(this.toolPath) && (this.toolPath.includes("/") || IS_WINDOWS && this.toolPath.includes("\\"))) { - this.toolPath = path29.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); + this.toolPath = path30.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); } this.toolPath = yield io9.which(this.toolPath, true); return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { @@ -120946,14 +121639,14 @@ var require_core3 = __commonJS({ var file_command_1 = require_file_command2(); var utils_1 = require_utils10(); var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var oidc_utils_1 = require_oidc_utils2(); var ExitCode; (function(ExitCode2) { ExitCode2[ExitCode2["Success"] = 0] = "Success"; ExitCode2[ExitCode2["Failure"] = 1] = "Failure"; })(ExitCode || (exports2.ExitCode = ExitCode = {})); - function exportVariable15(name, val) { + function exportVariable16(name, val) { const convertedVal = (0, utils_1.toCommandValue)(val); process.env[name] = convertedVal; const filePath = process.env["GITHUB_ENV"] || ""; @@ -120962,7 +121655,7 @@ var require_core3 = __commonJS({ } (0, command_1.issueCommand)("set-env", { name }, convertedVal); } - exports2.exportVariable = exportVariable15; + exports2.exportVariable = exportVariable16; function setSecret2(secret) { (0, command_1.issueCommand)("add-mask", {}, secret); } @@ -120974,7 +121667,7 @@ var require_core3 = __commonJS({ } else { (0, command_1.issueCommand)("add-path", {}, inputPath); } - process.env["PATH"] = `${inputPath}${path29.delimiter}${process.env["PATH"]}`; + process.env["PATH"] = `${inputPath}${path30.delimiter}${process.env["PATH"]}`; } exports2.addPath = addPath2; function getInput2(name, options) { @@ -121021,11 +121714,11 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``); (0, command_1.issue)("echo", enabled ? "on" : "off"); } exports2.setCommandEcho = setCommandEcho; - function setFailed13(message) { + function setFailed12(message) { process.exitCode = ExitCode.Failure; error3(message); } - exports2.setFailed = setFailed13; + exports2.setFailed = setFailed12; function isDebug5() { return process.env["RUNNER_DEBUG"] === "1"; } @@ -121150,13 +121843,13 @@ These characters are not allowed in the artifact name due to limitations with ce (0, core_1.info)(`Artifact name is valid!`); } exports2.checkArtifactName = checkArtifactName; - function checkArtifactFilePath(path29) { - if (!path29) { - throw new Error(`Artifact path: ${path29}, is incorrectly provided`); + function checkArtifactFilePath(path30) { + if (!path30) { + throw new Error(`Artifact path: ${path30}, is incorrectly provided`); } for (const [invalidCharacterKey, errorMessageForCharacter] of invalidArtifactFilePathCharacters) { - if (path29.includes(invalidCharacterKey)) { - throw new Error(`Artifact path is not valid: ${path29}. Contains the following character: ${errorMessageForCharacter} + if (path30.includes(invalidCharacterKey)) { + throw new Error(`Artifact path is not valid: ${path30}. Contains the following character: ${errorMessageForCharacter} Invalid characters include: ${Array.from(invalidArtifactFilePathCharacters.values()).toString()} @@ -121202,25 +121895,25 @@ var require_upload_specification = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getUploadSpecification = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core_1 = require_core3(); var path_1 = require("path"); var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation2(); function getUploadSpecification(artifactName, rootDirectory, artifactFiles) { const specifications = []; - if (!fs31.existsSync(rootDirectory)) { + if (!fs32.existsSync(rootDirectory)) { throw new Error(`Provided rootDirectory ${rootDirectory} does not exist`); } - if (!fs31.statSync(rootDirectory).isDirectory()) { + if (!fs32.statSync(rootDirectory).isDirectory()) { throw new Error(`Provided rootDirectory ${rootDirectory} is not a valid directory`); } rootDirectory = (0, path_1.normalize)(rootDirectory); rootDirectory = (0, path_1.resolve)(rootDirectory); for (let file of artifactFiles) { - if (!fs31.existsSync(file)) { + if (!fs32.existsSync(file)) { throw new Error(`File ${file} does not exist`); } - if (!fs31.statSync(file).isDirectory()) { + if (!fs32.statSync(file).isDirectory()) { file = (0, path_1.normalize)(file); file = (0, path_1.resolve)(file); if (!file.startsWith(rootDirectory)) { @@ -121245,11 +121938,11 @@ var require_upload_specification = __commonJS({ // node_modules/tmp/lib/tmp.js var require_tmp = __commonJS({ "node_modules/tmp/lib/tmp.js"(exports2, module2) { - var fs31 = require("fs"); + var fs32 = require("fs"); var os7 = require("os"); - var path29 = require("path"); + var path30 = require("path"); var crypto3 = require("crypto"); - var _c = { fs: fs31.constants, os: os7.constants }; + var _c = { fs: fs32.constants, os: os7.constants }; var RANDOM_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; var TEMPLATE_PATTERN = /XXXXXX/; var DEFAULT_TRIES = 3; @@ -121261,13 +121954,13 @@ var require_tmp = __commonJS({ var FILE_MODE = 384; var EXIT = "exit"; var _removeObjects = []; - var FN_RMDIR_SYNC = fs31.rmdirSync.bind(fs31); + var FN_RMDIR_SYNC = fs32.rmdirSync.bind(fs32); var _gracefulCleanup = false; function rimraf(dirPath, callback) { - return fs31.rm(dirPath, { recursive: true }, callback); + return fs32.rm(dirPath, { recursive: true }, callback); } function FN_RIMRAF_SYNC(dirPath) { - return fs31.rmSync(dirPath, { recursive: true }); + return fs32.rmSync(dirPath, { recursive: true }); } function tmpName(options, callback) { const args = _parseArguments(options, callback), opts = args[0], cb = args[1]; @@ -121277,7 +121970,7 @@ var require_tmp = __commonJS({ (function _getUniqueName() { try { const name = _generateTmpName(sanitizedOptions); - fs31.stat(name, function(err2) { + fs32.stat(name, function(err2) { if (!err2) { if (tries-- > 0) return _getUniqueName(); return cb(new Error("Could not get a unique tmp filename, max tries reached " + name)); @@ -121297,7 +121990,7 @@ var require_tmp = __commonJS({ do { const name = _generateTmpName(sanitizedOptions); try { - fs31.statSync(name); + fs32.statSync(name); } catch (e) { return name; } @@ -121308,10 +122001,10 @@ var require_tmp = __commonJS({ const args = _parseArguments(options, callback), opts = args[0], cb = args[1]; tmpName(opts, function _tmpNameCreated(err, name) { if (err) return cb(err); - fs31.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) { + fs32.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) { if (err2) return cb(err2); if (opts.discardDescriptor) { - return fs31.close(fd, function _discardCallback(possibleErr) { + return fs32.close(fd, function _discardCallback(possibleErr) { return cb(possibleErr, name, void 0, _prepareTmpFileRemoveCallback(name, -1, opts, false)); }); } else { @@ -121325,9 +122018,9 @@ var require_tmp = __commonJS({ const args = _parseArguments(options), opts = args[0]; const discardOrDetachDescriptor = opts.discardDescriptor || opts.detachDescriptor; const name = tmpNameSync(opts); - let fd = fs31.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE); + let fd = fs32.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE); if (opts.discardDescriptor) { - fs31.closeSync(fd); + fs32.closeSync(fd); fd = void 0; } return { @@ -121340,7 +122033,7 @@ var require_tmp = __commonJS({ const args = _parseArguments(options, callback), opts = args[0], cb = args[1]; tmpName(opts, function _tmpNameCreated(err, name) { if (err) return cb(err); - fs31.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) { + fs32.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) { if (err2) return cb(err2); cb(null, name, _prepareTmpDirRemoveCallback(name, opts, false)); }); @@ -121349,7 +122042,7 @@ var require_tmp = __commonJS({ function dirSync(options) { const args = _parseArguments(options), opts = args[0]; const name = tmpNameSync(opts); - fs31.mkdirSync(name, opts.mode || DIR_MODE); + fs32.mkdirSync(name, opts.mode || DIR_MODE); return { name, removeCallback: _prepareTmpDirRemoveCallback(name, opts, true) @@ -121363,20 +122056,20 @@ var require_tmp = __commonJS({ next(); }; if (0 <= fdPath[0]) - fs31.close(fdPath[0], function() { - fs31.unlink(fdPath[1], _handler); + fs32.close(fdPath[0], function() { + fs32.unlink(fdPath[1], _handler); }); - else fs31.unlink(fdPath[1], _handler); + else fs32.unlink(fdPath[1], _handler); } function _removeFileSync(fdPath) { let rethrownException = null; try { - if (0 <= fdPath[0]) fs31.closeSync(fdPath[0]); + if (0 <= fdPath[0]) fs32.closeSync(fdPath[0]); } catch (e) { if (!_isEBADF(e) && !_isENOENT(e)) throw e; } finally { try { - fs31.unlinkSync(fdPath[1]); + fs32.unlinkSync(fdPath[1]); } catch (e) { if (!_isENOENT(e)) rethrownException = e; } @@ -121392,7 +122085,7 @@ var require_tmp = __commonJS({ return sync ? removeCallbackSync : removeCallback; } function _prepareTmpDirRemoveCallback(name, opts, sync) { - const removeFunction = opts.unsafeCleanup ? rimraf : fs31.rmdir.bind(fs31); + const removeFunction = opts.unsafeCleanup ? rimraf : fs32.rmdir.bind(fs32); const removeFunctionSync = opts.unsafeCleanup ? FN_RIMRAF_SYNC : FN_RMDIR_SYNC; const removeCallbackSync = _prepareRemoveCallback(removeFunctionSync, name, sync); const removeCallback = _prepareRemoveCallback(removeFunction, name, sync, removeCallbackSync); @@ -121454,35 +122147,35 @@ var require_tmp = __commonJS({ return [actualOptions, callback]; } function _resolvePath(name, tmpDir, cb) { - const pathToResolve = path29.isAbsolute(name) ? name : path29.join(tmpDir, name); - fs31.stat(pathToResolve, function(err) { + const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name); + fs32.stat(pathToResolve, function(err) { if (err) { - fs31.realpath(path29.dirname(pathToResolve), function(err2, parentDir) { + fs32.realpath(path30.dirname(pathToResolve), function(err2, parentDir) { if (err2) return cb(err2); - cb(null, path29.join(parentDir, path29.basename(pathToResolve))); + cb(null, path30.join(parentDir, path30.basename(pathToResolve))); }); } else { - fs31.realpath(pathToResolve, cb); + fs32.realpath(pathToResolve, cb); } }); } function _resolvePathSync(name, tmpDir) { - const pathToResolve = path29.isAbsolute(name) ? name : path29.join(tmpDir, name); + const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name); try { - fs31.statSync(pathToResolve); - return fs31.realpathSync(pathToResolve); + fs32.statSync(pathToResolve); + return fs32.realpathSync(pathToResolve); } catch (_err) { - const parentDir = fs31.realpathSync(path29.dirname(pathToResolve)); - return path29.join(parentDir, path29.basename(pathToResolve)); + const parentDir = fs32.realpathSync(path30.dirname(pathToResolve)); + return path30.join(parentDir, path30.basename(pathToResolve)); } } function _generateTmpName(opts) { const tmpDir = opts.tmpdir; if (!_isUndefined(opts.name)) { - return path29.join(tmpDir, opts.dir, opts.name); + return path30.join(tmpDir, opts.dir, opts.name); } if (!_isUndefined(opts.template)) { - return path29.join(tmpDir, opts.dir, opts.template).replace(TEMPLATE_PATTERN, _randomChars(6)); + return path30.join(tmpDir, opts.dir, opts.template).replace(TEMPLATE_PATTERN, _randomChars(6)); } const name = [ opts.prefix ? opts.prefix : "tmp", @@ -121492,7 +122185,7 @@ var require_tmp = __commonJS({ _randomChars(12), opts.postfix ? "-" + opts.postfix : "" ].join(""); - return path29.join(tmpDir, opts.dir, name); + return path30.join(tmpDir, opts.dir, name); } function _assertPath(option, value) { if (typeof value !== "string") { @@ -121506,8 +122199,8 @@ var require_tmp = __commonJS({ function _assertOptionsBase(options) { if (!_isUndefined(options.name)) { const name = options.name; - if (path29.isAbsolute(name)) throw new Error(`name option must not contain an absolute path, found "${name}".`); - const basename2 = path29.basename(name); + if (path30.isAbsolute(name)) throw new Error(`name option must not contain an absolute path, found "${name}".`); + const basename2 = path30.basename(name); if (basename2 === ".." || basename2 === "." || basename2 !== name) { throw new Error(`name option must not contain a path, found "${name}".`); } @@ -121536,8 +122229,8 @@ var require_tmp = __commonJS({ if (_isUndefined(name)) return cb(null); _resolvePath(name, tmpDir, function(err, resolvedPath) { if (err) return cb(err); - const relativePath2 = path29.relative(tmpDir, resolvedPath); - if (relativePath2.startsWith("..") || path29.isAbsolute(relativePath2)) { + const relativePath2 = path30.relative(tmpDir, resolvedPath); + if (relativePath2.startsWith("..") || path30.isAbsolute(relativePath2)) { return cb(new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath2}".`)); } cb(null, relativePath2); @@ -121546,8 +122239,8 @@ var require_tmp = __commonJS({ function _getRelativePathSync(option, name, tmpDir) { if (_isUndefined(name)) return; const resolvedPath = _resolvePathSync(name, tmpDir); - const relativePath2 = path29.relative(tmpDir, resolvedPath); - if (relativePath2.startsWith("..") || path29.isAbsolute(relativePath2)) { + const relativePath2 = path30.relative(tmpDir, resolvedPath); + if (relativePath2.startsWith("..") || path30.isAbsolute(relativePath2)) { throw new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath2}".`); } return relativePath2; @@ -121593,10 +122286,10 @@ var require_tmp = __commonJS({ _gracefulCleanup = true; } function _getTmpDir(options, cb) { - return fs31.realpath(options && options.tmpdir || os7.tmpdir(), cb); + return fs32.realpath(options && options.tmpdir || os7.tmpdir(), cb); } function _getTmpDirSync(options) { - return fs31.realpathSync(options && options.tmpdir || os7.tmpdir()); + return fs32.realpathSync(options && options.tmpdir || os7.tmpdir()); } process.addListener(EXIT, _garbageCollector); Object.defineProperty(module2.exports, "tmpdir", { @@ -121626,14 +122319,14 @@ var require_tmp_promise = __commonJS({ var fileWithOptions = promisify( (options, cb) => tmp.file( options, - (err, path29, fd, cleanup) => err ? cb(err) : cb(void 0, { path: path29, fd, cleanup: promisify(cleanup) }) + (err, path30, fd, cleanup) => err ? cb(err) : cb(void 0, { path: path30, fd, cleanup: promisify(cleanup) }) ) ); module2.exports.file = async (options) => fileWithOptions(options); module2.exports.withFile = async function withFile(fn, options) { - const { path: path29, fd, cleanup } = await module2.exports.file(options); + const { path: path30, fd, cleanup } = await module2.exports.file(options); try { - return await fn({ path: path29, fd }); + return await fn({ path: path30, fd }); } finally { await cleanup(); } @@ -121642,14 +122335,14 @@ var require_tmp_promise = __commonJS({ var dirWithOptions = promisify( (options, cb) => tmp.dir( options, - (err, path29, cleanup) => err ? cb(err) : cb(void 0, { path: path29, cleanup: promisify(cleanup) }) + (err, path30, cleanup) => err ? cb(err) : cb(void 0, { path: path30, cleanup: promisify(cleanup) }) ) ); module2.exports.dir = async (options) => dirWithOptions(options); module2.exports.withDir = async function withDir(fn, options) { - const { path: path29, cleanup } = await module2.exports.dir(options); + const { path: path30, cleanup } = await module2.exports.dir(options); try { - return await fn({ path: path29 }); + return await fn({ path: path30 }); } finally { await cleanup(); } @@ -122450,10 +123143,10 @@ var require_upload_gzip = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.createGZipFileInBuffer = exports2.createGZipFileOnDisk = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var zlib3 = __importStar2(require("zlib")); var util_1 = require("util"); - var stat2 = (0, util_1.promisify)(fs31.stat); + var stat2 = (0, util_1.promisify)(fs32.stat); var gzipExemptFileExtensions = [ ".gz", ".gzip", @@ -122486,9 +123179,9 @@ var require_upload_gzip = __commonJS({ } } return new Promise((resolve14, reject) => { - const inputStream = fs31.createReadStream(originalFilePath); + const inputStream = fs32.createReadStream(originalFilePath); const gzip = zlib3.createGzip(); - const outputStream = fs31.createWriteStream(tempFilePath); + const outputStream = fs32.createWriteStream(tempFilePath); inputStream.pipe(gzip).pipe(outputStream); outputStream.on("finish", () => __awaiter2(this, void 0, void 0, function* () { const size = (yield stat2(tempFilePath)).size; @@ -122506,7 +123199,7 @@ var require_upload_gzip = __commonJS({ return __awaiter2(this, void 0, void 0, function* () { return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { var _a2, e_1, _b, _c; - const inputStream = fs31.createReadStream(originalFilePath); + const inputStream = fs32.createReadStream(originalFilePath); const gzip = zlib3.createGzip(); inputStream.pipe(gzip); const chunks = []; @@ -122715,7 +123408,7 @@ var require_upload_http_client = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.UploadHttpClient = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core31 = __importStar2(require_core3()); var tmp = __importStar2(require_tmp_promise()); var stream2 = __importStar2(require("stream")); @@ -122729,7 +123422,7 @@ var require_upload_http_client = __commonJS({ var http_manager_1 = require_http_manager(); var upload_gzip_1 = require_upload_gzip(); var requestUtils_1 = require_requestUtils2(); - var stat2 = (0, util_1.promisify)(fs31.stat); + var stat2 = (0, util_1.promisify)(fs32.stat); var UploadHttpClient = class { constructor() { this.uploadHttpManager = new http_manager_1.HttpManager((0, config_variables_1.getUploadFileConcurrency)(), "@actions/artifact-upload"); @@ -122866,7 +123559,7 @@ var require_upload_http_client = __commonJS({ let openUploadStream; if (totalFileSize < buffer.byteLength) { core31.debug(`The gzip file created for ${parameters.file} did not help with reducing the size of the file. The original file will be uploaded as-is`); - openUploadStream = () => fs31.createReadStream(parameters.file); + openUploadStream = () => fs32.createReadStream(parameters.file); isGzip = false; uploadFileSize = totalFileSize; } else { @@ -122912,7 +123605,7 @@ var require_upload_http_client = __commonJS({ failedChunkSizes += chunkSize; continue; } - const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs31.createReadStream(uploadFilePath, { + const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs32.createReadStream(uploadFilePath, { start: startChunkIndex, end: endChunkIndex, autoClose: false @@ -123107,7 +123800,7 @@ var require_download_http_client = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.DownloadHttpClient = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core31 = __importStar2(require_core3()); var zlib3 = __importStar2(require("zlib")); var utils_1 = require_utils11(); @@ -123198,7 +123891,7 @@ var require_download_http_client = __commonJS({ return __awaiter2(this, void 0, void 0, function* () { let retryCount = 0; const retryLimit = (0, config_variables_1.getRetryLimit)(); - let destinationStream = fs31.createWriteStream(downloadPath); + let destinationStream = fs32.createWriteStream(downloadPath); const headers = (0, utils_1.getDownloadHeaders)("application/json", true, true); const makeDownloadRequest = () => __awaiter2(this, void 0, void 0, function* () { const client = this.downloadHttpManager.getClient(httpClientIndex); @@ -123240,7 +123933,7 @@ var require_download_http_client = __commonJS({ } }); yield (0, utils_1.rmFile)(fileDownloadPath); - destinationStream = fs31.createWriteStream(fileDownloadPath); + destinationStream = fs32.createWriteStream(fileDownloadPath); }); while (retryCount <= retryLimit) { let response; @@ -123357,21 +124050,21 @@ var require_download_specification = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getDownloadSpecification = void 0; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function getDownloadSpecification(artifactName, artifactEntries, downloadPath, includeRootDirectory) { const directories = /* @__PURE__ */ new Set(); const specifications = { - rootDownloadLocation: includeRootDirectory ? path29.join(downloadPath, artifactName) : downloadPath, + rootDownloadLocation: includeRootDirectory ? path30.join(downloadPath, artifactName) : downloadPath, directoryStructure: [], emptyFilesToCreate: [], filesToDownload: [] }; for (const entry of artifactEntries) { if (entry.path.startsWith(`${artifactName}/`) || entry.path.startsWith(`${artifactName}\\`)) { - const normalizedPathEntry = path29.normalize(entry.path); - const filePath = path29.join(downloadPath, includeRootDirectory ? normalizedPathEntry : normalizedPathEntry.replace(artifactName, "")); + const normalizedPathEntry = path30.normalize(entry.path); + const filePath = path30.join(downloadPath, includeRootDirectory ? normalizedPathEntry : normalizedPathEntry.replace(artifactName, "")); if (entry.itemType === "file") { - directories.add(path29.dirname(filePath)); + directories.add(path30.dirname(filePath)); if (entry.fileLength === 0) { specifications.emptyFilesToCreate.push(filePath); } else { @@ -123513,7 +124206,7 @@ Note: The size of downloaded zips can differ significantly from the reported siz return uploadResponse; }); } - downloadArtifact(name, path29, options) { + downloadArtifact(name, path30, options) { return __awaiter2(this, void 0, void 0, function* () { const downloadHttpClient = new download_http_client_1.DownloadHttpClient(); const artifacts = yield downloadHttpClient.listArtifacts(); @@ -123527,12 +124220,12 @@ Note: The size of downloaded zips can differ significantly from the reported siz throw new Error(`Unable to find an artifact with the name: ${name}`); } const items = yield downloadHttpClient.getContainerItems(artifactToDownload.name, artifactToDownload.fileContainerResourceUrl); - if (!path29) { - path29 = (0, config_variables_1.getWorkSpaceDirectory)(); + if (!path30) { + path30 = (0, config_variables_1.getWorkSpaceDirectory)(); } - path29 = (0, path_1.normalize)(path29); - path29 = (0, path_1.resolve)(path29); - const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(name, items.value, path29, (options === null || options === void 0 ? void 0 : options.createArtifactFolder) || false); + path30 = (0, path_1.normalize)(path30); + path30 = (0, path_1.resolve)(path30); + const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(name, items.value, path30, (options === null || options === void 0 ? void 0 : options.createArtifactFolder) || false); if (downloadSpecification.filesToDownload.length === 0) { core31.info(`No downloadable files were found for the artifact: ${artifactToDownload.name}`); } else { @@ -123547,7 +124240,7 @@ Note: The size of downloaded zips can differ significantly from the reported siz }; }); } - downloadAllArtifacts(path29) { + downloadAllArtifacts(path30) { return __awaiter2(this, void 0, void 0, function* () { const downloadHttpClient = new download_http_client_1.DownloadHttpClient(); const response = []; @@ -123556,18 +124249,18 @@ Note: The size of downloaded zips can differ significantly from the reported siz core31.info("Unable to find any artifacts for the associated workflow"); return response; } - if (!path29) { - path29 = (0, config_variables_1.getWorkSpaceDirectory)(); + if (!path30) { + path30 = (0, config_variables_1.getWorkSpaceDirectory)(); } - path29 = (0, path_1.normalize)(path29); - path29 = (0, path_1.resolve)(path29); + path30 = (0, path_1.normalize)(path30); + path30 = (0, path_1.resolve)(path30); let downloadedArtifacts = 0; while (downloadedArtifacts < artifacts.count) { const currentArtifactToDownload = artifacts.value[downloadedArtifacts]; downloadedArtifacts += 1; core31.info(`starting download of artifact ${currentArtifactToDownload.name} : ${downloadedArtifacts}/${artifacts.count}`); const items = yield downloadHttpClient.getContainerItems(currentArtifactToDownload.name, currentArtifactToDownload.fileContainerResourceUrl); - const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(currentArtifactToDownload.name, items.value, path29, true); + const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(currentArtifactToDownload.name, items.value, path30, true); if (downloadSpecification.filesToDownload.length === 0) { core31.info(`No downloadable files were found for any artifact ${currentArtifactToDownload.name}`); } else { @@ -141446,8 +142139,8 @@ __export(entry_points_exports, { module.exports = __toCommonJS(entry_points_exports); // src/analyze-action.ts -var fs22 = __toESM(require("fs")); -var import_path4 = __toESM(require("path")); +var fs23 = __toESM(require("fs")); +var import_path5 = __toESM(require("path")); var import_perf_hooks4 = require("perf_hooks"); var core16 = __toESM(require_core()); @@ -141492,6 +142185,10 @@ var ReadOnlyEnv = class { clone() { return Object.create(this, { vars: { value: { ...this.vars } } }); } + /** Gets a copy of the underlying environment. */ + get() { + return { ...this.vars }; + } /** Tries to get the value for `name` and throws if there isn't one. */ getRequired(name) { return getRequiredEnvVar(this.vars, name); @@ -141537,21 +142234,21 @@ async function getFolderSize(itemPath, options) { getFolderSize.loose = async (itemPath, options) => await core(itemPath, options); getFolderSize.strict = async (itemPath, options) => await core(itemPath, options, { strict: true }); async function core(rootItemPath, options = {}, returnType = {}) { - const fs31 = options.fs || await import("node:fs/promises"); + const fs32 = options.fs || await import("node:fs/promises"); let folderSize = 0n; const foundInos = /* @__PURE__ */ new Set(); const errors = []; await processItem(rootItemPath); async function processItem(itemPath) { if (options.ignore?.test(itemPath)) return; - const stats = returnType.strict ? await fs31.lstat(itemPath, { bigint: true }) : await fs31.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3)); + const stats = returnType.strict ? await fs32.lstat(itemPath, { bigint: true }) : await fs32.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3)); if (typeof stats !== "object") return; if (!foundInos.has(stats.ino)) { foundInos.add(stats.ino); folderSize += stats.size; } if (stats.isDirectory()) { - const directoryItems = returnType.strict ? await fs31.readdir(itemPath) : await fs31.readdir(itemPath).catch((error3) => errors.push(error3)); + const directoryItems = returnType.strict ? await fs32.readdir(itemPath) : await fs32.readdir(itemPath).catch((error3) => errors.push(error3)); if (typeof directoryItems !== "object") return; await Promise.all( directoryItems.map( @@ -142006,6 +142703,11 @@ var binaryTag = defineScalarTag("tag:yaml.org,2002:binary", { }); var YAML_DATE_REGEXP = /* @__PURE__ */ new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$"); var YAML_TIMESTAMP_REGEXP = /* @__PURE__ */ new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9]?)-([0-9][0-9]?)(?:[Tt]|[ \\t]+)([0-9][0-9]?):([0-9][0-9]):([0-9][0-9])(?:\\.([0-9]*))?(?:[ \\t]*(Z|([-+])([0-9][0-9]?)(?::([0-9][0-9]))?))?$"); +function makeUtcDate(year, month, day, hour = 0, minute = 0, second = 0, fraction = 0) { + const date = new Date(Date.UTC(year, month, day, hour, minute, second, fraction)); + date.setUTCFullYear(year, month, day); + return date; +} function resolveYamlTimestamp(source) { let match2 = YAML_DATE_REGEXP.exec(source); if (match2 === null) match2 = YAML_TIMESTAMP_REGEXP.exec(source); @@ -142014,7 +142716,7 @@ function resolveYamlTimestamp(source) { const month = +match2[2] - 1; const day = +match2[3]; if (!match2[4]) { - const date2 = new Date(Date.UTC(year, month, day)); + const date2 = makeUtcDate(year, month, day); if (date2.getUTCFullYear() !== year || date2.getUTCMonth() !== month || date2.getUTCDate() !== day) return NOT_RESOLVED; return date2; } @@ -142028,7 +142730,7 @@ function resolveYamlTimestamp(source) { while (value.length < 3) value += "0"; fraction = +value; } - const date = new Date(Date.UTC(year, month, day, hour, minute, second, fraction)); + const date = makeUtcDate(year, month, day, hour, minute, second, fraction); if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month || date.getUTCDate() !== day) return NOT_RESOLVED; if (match2[9]) { const offsetHour = +match2[10]; @@ -142126,7 +142828,11 @@ var mapTag = defineMappingTag("tag:yaml.org,2002:map", { return Object.prototype.hasOwnProperty.call(container, String(key)); }, keys: (container) => Object.keys(container), - get: (container, key) => container[String(key)] + get: (container, key) => { + const normalizedKey = String(key); + if (!Object.prototype.hasOwnProperty.call(container, normalizedKey)) return null; + return container[normalizedKey]; + } }); var setTag = defineMappingTag("tag:yaml.org,2002:set", { create: () => /* @__PURE__ */ new Set(), @@ -142147,9 +142853,9 @@ var setTag = defineMappingTag("tag:yaml.org,2002:set", { }); function createTagDefinitionMap() { return { - scalar: {}, - sequence: {}, - mapping: {} + scalar: /* @__PURE__ */ Object.create(null), + sequence: /* @__PURE__ */ Object.create(null), + mapping: /* @__PURE__ */ Object.create(null) }; } function createTagDefinitionListMap() { @@ -142319,7 +143025,11 @@ var legacyMapTag = defineMappingTag("tag:yaml.org,2002:map", { return normalizedKey !== null && Object.prototype.hasOwnProperty.call(container, normalizedKey); }, keys: (container) => Object.keys(container), - get: (container, key) => container[String(key)] + get: (container, key) => { + const normalizedKey = String(key); + if (!Object.prototype.hasOwnProperty.call(container, normalizedKey)) return null; + return container[normalizedKey]; + } }); var DEFAULT_SNIPPET_OPTIONS = { maxLength: 79, @@ -142655,10 +143365,10 @@ function getScalarValue(input, scalar) { return getPlainValue(input, valueStart, valueEnd); } } -var DEFAULT_TAG_HANDLERS = { +var DEFAULT_TAG_HANDLERS = Object.assign(/* @__PURE__ */ Object.create(null), { "!": "!", "!!": "tag:yaml.org,2002:" -}; +}); function tagPercentEncode(source) { return encodeURI(source).replace(/!/g, "%21"); } @@ -142911,6 +143621,10 @@ function constructFromEvents(events, options) { } case 6: { const frame = state.frames.pop(); + if (frame.kind === "mapping" && frame.hasKey) { + state.position = frame.keyPosition; + throwError$1(state, "incomplete mapping pair in event stream"); + } if (frame.kind === "document") state.documents.push(frame.value); else { const value = frame.tag.carrierIsResult ? frame.value : finalizeCollection(state, frame.position, frame.tag, frame.value); @@ -142974,6 +143688,17 @@ function addMappingEvent(state, start, anchorStart, anchorEnd, tagStart, tagEnd, style }); } +function insertFlowPairMappingEvent(state, snapshot) { + state.events.splice(snapshot.eventsLength, 0, { + type: 3, + start: snapshot.position, + anchorStart: NO_RANGE$1, + anchorEnd: NO_RANGE$1, + tagStart: NO_RANGE$1, + tagEnd: NO_RANGE$1, + style: 2 + }); +} function addScalarEvent(state, valueStart, valueEnd, anchorStart, anchorEnd, tagStart, tagEnd, style, chomping = 1, indent = -1, fast = false) { state.events.push({ type: 4, @@ -143417,12 +144142,8 @@ function readFlowCollection(state, nodeIndent, props) { state.position++; skipFlowSeparationSpace(state, nodeIndent); if (!isMapping) { - restoreState(state, entryStart); - addMappingEvent(state, entryStart.position, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, 2); - if (!parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)) addEmptyScalarEvent(state); - skipFlowSeparationSpace(state, nodeIndent); - state.position++; - skipFlowSeparationSpace(state, nodeIndent); + insertFlowPairMappingEvent(state, entryStart); + if (!keyWasRead) addEmptyScalarEvent(state); } else if (!keyWasRead) addEmptyScalarEvent(state); if (!parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)) addEmptyScalarEvent(state); skipFlowSeparationSpace(state, nodeIndent); @@ -143432,9 +144153,8 @@ function readFlowCollection(state, nodeIndent, props) { addEmptyScalarEvent(state); } else if (isMapping) addEmptyScalarEvent(state); else if (isPair) { - restoreState(state, entryStart); - addMappingEvent(state, entryStart.position, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, 2); - parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true); + insertFlowPairMappingEvent(state, entryStart); + if (!keyWasRead) addEmptyScalarEvent(state); addEmptyScalarEvent(state); addPopEvent(state); } @@ -143575,10 +144295,6 @@ function parseNode(state, parentIndent, nodeContext, allowToSeek, allowCompact, else if (state.lineIndent === parentIndent) indentStatus = 0; else indentStatus = -1; } - if (state.position === state.lineStart && testDocumentSeparator(state)) { - state.depth--; - return false; - } if (indentStatus === 1) while (true) { const ch = state.input.charCodeAt(state.position); const propertyState = snapshotState(state); @@ -144071,7 +144787,7 @@ function isNsCharOrWhitespace(c) { function isPlainSafe(c, prev, inblock) { const cIsNsCharOrWhitespace = isNsCharOrWhitespace(c); const cIsNsChar = cIsNsCharOrWhitespace && !isWhitespace(c); - return (inblock ? cIsNsCharOrWhitespace : cIsNsCharOrWhitespace && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET) && c !== CHAR_SHARP && !(prev === CHAR_COLON && !cIsNsChar) || isNsCharOrWhitespace(prev) && !isWhitespace(prev) && c === CHAR_SHARP || prev === CHAR_COLON && cIsNsChar; + return (inblock ? cIsNsCharOrWhitespace : cIsNsCharOrWhitespace && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET) && c !== CHAR_SHARP && !(prev === CHAR_COLON && !cIsNsChar) || isNsCharOrWhitespace(prev) && !isWhitespace(prev) && c === CHAR_SHARP || prev === CHAR_COLON && cIsNsChar && (inblock || c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET); } function isPlainSafeFirst(c) { return isPrintable(c) && c !== CHAR_BOM && !isWhitespace(c) && c !== CHAR_MINUS && c !== CHAR_QUESTION && c !== CHAR_COLON && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET && c !== CHAR_SHARP && c !== CHAR_AMPERSAND && c !== CHAR_ASTERISK && c !== CHAR_EXCLAMATION && c !== CHAR_VERTICAL_LINE && c !== CHAR_EQUALS && c !== CHAR_GREATER_THAN && c !== CHAR_SINGLE_QUOTE && c !== CHAR_DOUBLE_QUOTE && c !== CHAR_PERCENT && c !== CHAR_COMMERCIAL_AT && c !== CHAR_GRAVE_ACCENT; @@ -144127,14 +144843,14 @@ function chooseScalarStyle(state, string2, layout, singleLineOnly, forceQuote, i if (char === CHAR_LINE_FEED) { hasLineBreak = true; if (shouldTrackWidth) { - hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && string2[previousLineBreak + 1] !== " "; + hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && !isMoreIndented(string2[previousLineBreak + 1]); previousLineBreak = i; } } else if (!isPrintable(char)) return STYLE_DOUBLE; plain = plain && isPlainSafe(char, prevChar, inblock); prevChar = char; } - hasFoldableLine = hasFoldableLine || shouldTrackWidth && i - previousLineBreak - 1 > lineWidth && string2[previousLineBreak + 1] !== " "; + hasFoldableLine = hasFoldableLine || shouldTrackWidth && i - previousLineBreak - 1 > lineWidth && !isMoreIndented(string2[previousLineBreak + 1]); } if (!hasLineBreak && !hasFoldableLine) { if (plain && !forceQuote) return STYLE_PLAIN; @@ -144199,27 +144915,30 @@ function encodeFlowBreaks(string2, indent) { function dropEndingNewline(string2) { return string2[string2.length - 1] === "\n" ? string2.slice(0, -1) : string2; } +function isMoreIndented(char) { + return char === " " || char === " "; +} function foldBlockScalar(string2, width) { const lineRe = /(\n+)([^\n]*)/g; let nextLF = string2.indexOf("\n"); if (nextLF === -1) nextLF = string2.length; lineRe.lastIndex = nextLF; let result = foldLine(string2.slice(0, nextLF), width); - let prevMoreIndented = string2[0] === "\n" || string2[0] === " "; + let prevMoreIndented = string2[0] === "\n" || isMoreIndented(string2[0]); let moreIndented; let match2; while (match2 = lineRe.exec(string2)) { const prefix = match2[1]; const line = match2[2]; - moreIndented = line[0] === " "; + moreIndented = line !== "" && isMoreIndented(line[0]); result += prefix + (!prevMoreIndented && !moreIndented && line !== "" ? "\n" : "") + foldLine(line, width); prevMoreIndented = moreIndented; } return result; } function foldLine(line, width) { - if (line === "" || line[0] === " ") return line; - const breakRe = / [^ ]/g; + if (line === "" || isMoreIndented(line[0])) return line; + const breakRe = / [^ \t]/g; let match2; let start = 0; let end; @@ -144519,28 +145238,32 @@ function isString(value) { function isNumber(value) { return typeof value === "number"; } +function isBoolean(value) { + return typeof value === "boolean"; +} function isStringOrUndefined(value) { return value === void 0 || isString(value); } -function defaultCheck(validate) { - return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); +function defaultCheck(validate2) { + return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate2(arg) }); } -function makeValidator(validate, required = true) { +function makeValidator(validate2) { return { - validate, - check: defaultCheck(validate), - required + validate: validate2, + check: defaultCheck(validate2), + required: true }; } var string = makeValidator(isString); var number = makeValidator(isNumber); +var boolean = makeValidator(isBoolean); function array(validator) { - const validate = (val) => { + const validate2 = (val) => { return isArray(val) && val.every((e) => validator.validate(e)); }; return { - validate, - check: (val, opts, path29) => { + validate: validate2, + check: (val, opts, path30) => { const result = successfulCheckSchema(); if (!isArray(val)) { result.valid = false; @@ -144548,7 +145271,7 @@ function array(validator) { } let index2 = 0; for (const e of val) { - const elementPath = `${path29}[${index2}]`; + const elementPath = `${path30}[${index2}]`; const eResult = validator.check(e, opts, `${elementPath}`); result.invalidKeys.push(...eResult.invalidKeys); result.unknownKeys.push(...eResult.unknownKeys); @@ -144574,11 +145297,11 @@ function object(schema) { validate: (val) => { return isObject(val) && validateSchema(schema, val); }, - check: (val, opts, path29) => { + check: (val, opts, path30) => { if (!isObject(val)) { return invalidCheckSchema(); } - return checkSchema(schema, val, opts, path29); + return checkSchema(schema, val, opts, path30); }, required: true }; @@ -144588,11 +145311,11 @@ function optionalOrNull(validator) { validate: (val) => { return val === void 0 || val === null || validator.validate(val); }, - check: (val, opts, path29) => { + check: (val, opts, path30) => { if (val === void 0 || val === null) { return successfulCheckSchema(); } - return validator.check(val, opts, path29); + return validator.check(val, opts, path30); }, required: false }; @@ -144602,11 +145325,11 @@ function optional(validator) { validate: (val) => { return val === void 0 || validator.validate(val); }, - check: (val, opts, path29) => { + check: (val, opts, path30) => { if (val === void 0) { return successfulCheckSchema(); } - return validator.check(val, opts, path29); + return validator.check(val, opts, path30); }, required: false }; @@ -144615,6 +145338,10 @@ function validateSchema(schema, obj) { const result = checkSchema(schema, obj, { failFast: true }); return result.valid; } +function validateArray(elementSchema, arr) { + const elementValidator = object(elementSchema); + return array(elementValidator).validate(arr); +} function successfulCheckSchema() { return { valid: true, @@ -144629,7 +145356,7 @@ function invalidCheckSchema() { invalidKeys: [] }; } -function checkSchema(schema, obj, options = {}, path29 = "") { +function checkSchema(schema, obj, options = {}, path30 = "") { const result = successfulCheckSchema(); const inputKeys = new Set(Object.keys(obj)); const invalidKeys = /* @__PURE__ */ new Set(); @@ -144652,7 +145379,7 @@ function checkSchema(schema, obj, options = {}, path29 = "") { continue; } if (hasKey) { - const checkResult = validator.check(obj[key], options, `${path29}.${key}`); + const checkResult = validator.check(obj[key], options, `${path30}.${key}`); result.unknownKeys.push(...checkResult.unknownKeys); result.invalidKeys.push(...checkResult.invalidKeys); if (checkResult.invalidKeys.length > 0) { @@ -144669,10 +145396,10 @@ function checkSchema(schema, obj, options = {}, path29 = "") { invalidKeys.delete(key); } for (const remainingKey of inputKeys) { - result.unknownKeys.push(`${path29}.${remainingKey}`); + result.unknownKeys.push(`${path30}.${remainingKey}`); } for (const invalidKey of invalidKeys) { - result.invalidKeys.push(`${path29}.${invalidKey}`); + result.invalidKeys.push(`${path30}.${invalidKey}`); } return result; } @@ -144995,45 +145722,6 @@ function asHTTPError(arg) { } return void 0; } -var cachedCodeQlVersion = void 0; -function isVersionInfo(x) { - const candidate = x; - return typeof candidate === "object" && candidate !== null && typeof candidate.version === "string" && (candidate.features === void 0 || typeof candidate.features === "object" && candidate.features !== null) && (candidate.overlayVersion === void 0 || typeof candidate.overlayVersion === "number"); -} -function isPersistedVersionInfo(x) { - const candidate = x; - return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && isVersionInfo(candidate.version); -} -function cacheCodeQlVersion(cmd, version) { - if (cachedCodeQlVersion !== void 0) { - throw new Error("cacheCodeQlVersion() should be called only once"); - } - cachedCodeQlVersion = version; - core2.exportVariable( - "CODEQL_ACTION_CLI_VERSION_INFO" /* CODEQL_VERSION_INFO */, - JSON.stringify({ cmd, version }) - ); -} -function getCachedCodeQlVersion(cmd) { - if (cachedCodeQlVersion !== void 0) { - return cachedCodeQlVersion; - } - const serialized = process.env["CODEQL_ACTION_CLI_VERSION_INFO" /* CODEQL_VERSION_INFO */]; - if (!serialized) { - return void 0; - } - let persisted; - try { - persisted = JSON.parse(serialized); - } catch { - return void 0; - } - if (!isPersistedVersionInfo(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { - return void 0; - } - cachedCodeQlVersion = persisted.version; - return cachedCodeQlVersion; -} async function codeQlVersionAtLeast(codeql, requiredVersion) { return semver.gte((await codeql.getVersion()).version, requiredVersion); } @@ -145310,7 +145998,11 @@ var Failure = class { // src/actions-util.ts function getActionsEnv() { - return { getOptionalInput }; + return { + getRequiredInput, + getOptionalInput, + exportVariable: core3.exportVariable + }; } var getRequiredInput = function(name) { const value = core3.getInput(name); @@ -145331,7 +146023,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.3"; + return "4.37.8"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); @@ -145655,6 +146347,59 @@ function formatDuration(durationMs) { var os3 = __toESM(require("os")); var core7 = __toESM(require_core()); +// node_modules/uuid/dist-node/regex.js +var regex_default = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i; + +// node_modules/uuid/dist-node/validate.js +function validate(uuid) { + return typeof uuid === "string" && regex_default.test(uuid); +} +var validate_default = validate; + +// node_modules/uuid/dist-node/stringify.js +var byteToHex = []; +for (let i = 0; i < 256; ++i) { + byteToHex.push((i + 256).toString(16).slice(1)); +} +function unsafeStringify(arr, offset = 0) { + return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); +} + +// node_modules/uuid/dist-node/rng.js +var rnds8 = new Uint8Array(16); +function rng() { + return crypto.getRandomValues(rnds8); +} + +// node_modules/uuid/dist-node/v4.js +function v4(options, buf, offset) { + if (!buf && !options && crypto.randomUUID) { + return crypto.randomUUID(); + } + return _v4(options, buf, offset); +} +function _v4(options, buf, offset) { + options = options || {}; + const rnds = options.random ?? options.rng?.() ?? rng(); + if (rnds.length < 16) { + throw new Error("Random bytes length must be >= 16"); + } + rnds[6] = rnds[6] & 15 | 64; + rnds[8] = rnds[8] & 63 | 128; + if (buf) { + offset = offset || 0; + if (offset < 0 || offset + 16 > buf.length) { + throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); + } + for (let i = 0; i < 16; ++i) { + buf[offset + i] = rnds[i]; + } + return buf; + } + return unsafeStringify(rnds); +} +var v4_default = v4; + // src/api-client.ts var core5 = __toESM(require_core()); var githubUtils = __toESM(require_utils4()); @@ -145788,7 +146533,11 @@ function getRegistryProxy(action) { return void 0; } function makeProxyRequestOptions(dispatcher) { + if (dispatcher === void 0) { + return githubUtils.defaults.request; + } return { + ...githubUtils.defaults.request, fetch: (req, init2) => { return (0, import_undici.fetch)(req, { ...init2, dispatcher }); } @@ -145797,7 +146546,7 @@ function makeProxyRequestOptions(dispatcher) { function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) { const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry); - const requestOptions = proxy === void 0 ? githubUtils.defaults.request : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth2, { baseUrl: apiDetails.apiURL, @@ -145975,6 +146724,64 @@ function wrapApiConfigurationError(e) { return e; } +// src/cli/output-cache.ts +var fs3 = __toESM(require("fs")); +var import_path = __toESM(require("path")); +var COMMAND_CACHE_FILENAME = "codeql-action-command-cache.json"; +var cachedCodeQlVersion = void 0; +function getCommandCacheFilePath(env) { + return import_path.default.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME); +} +function cacheCodeQlVersion(env, cmd, version) { + if (cachedCodeQlVersion !== void 0) { + throw new Error("cacheCodeQlVersion() should be called only once"); + } + cachedCodeQlVersion = version; + const outputCache = { + cmd, + entries: { version } + }; + fs3.writeFileSync( + getCommandCacheFilePath(env), + JSON.stringify(outputCache), + "utf8" + ); +} +function getCachedCodeQlVersion(logger, env, cmd) { + if (cachedCodeQlVersion !== void 0) { + return cachedCodeQlVersion; + } + let serialized; + try { + serialized = fs3.readFileSync(getCommandCacheFilePath(env), "utf8"); + } catch (e) { + logger.debug( + `Cannot read CLI-cache file ${getCommandCacheFilePath(env)}: ${e}` + ); + return void 0; + } + let persisted; + try { + persisted = JSON.parse(serialized); + } catch (e) { + logger.debug(`Cannot parse CLI-cache data as JSON: ${e}`); + return void 0; + } + if (!isOutputCache(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { + return void 0; + } + cachedCodeQlVersion = persisted.entries.version; + return cachedCodeQlVersion; +} +function isVersionInfo(x) { + const candidate = x; + return typeof candidate === "object" && candidate !== null && typeof candidate.version === "string" && (candidate.features === void 0 || typeof candidate.features === "object" && candidate.features !== null) && (candidate.overlayVersion === void 0 || typeof candidate.overlayVersion === "number"); +} +function isOutputCache(x) { + const candidate = x; + return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && candidate.entries !== void 0 && isVersionInfo(candidate.entries.version); +} + // src/config/pack-registries.ts function parseRegistries(registriesInput) { try { @@ -145993,9 +146800,9 @@ function parseRegistriesWithoutCredentials(registriesInput) { } // src/git-utils.ts -var fs3 = __toESM(require("fs")); +var fs4 = __toESM(require("fs")); var os2 = __toESM(require("os")); -var path3 = __toESM(require("path")); +var path4 = __toESM(require("path")); var core6 = __toESM(require_core()); var toolrunner2 = __toESM(require_toolrunner()); var io3 = __toESM(require_io()); @@ -146144,7 +146951,7 @@ var getGitRoot = async function(sourceRoot) { } }; function hasSubmodules(gitRoot) { - return fs3.existsSync(path3.join(gitRoot, ".gitmodules")); + return fs4.existsSync(path4.join(gitRoot, ".gitmodules")); } var getFileOidsUnderPath = async function(basePath) { const gitRoot = await getGitRoot(basePath); @@ -146262,6 +147069,148 @@ async function getGeneratedFiles(workingDirectory) { return generatedFiles; } +// src/start-proxy/types.ts +var usernameSchema = { + /** The username needed to authenticate to the package registry, if any. */ + username: optionalOrNull(string) +}; +function hasUsername(config) { + return "username" in config; +} +var usernamePasswordSchema = { + /** The password needed to authenticate to the package registry, if any. */ + password: optionalOrNull(string), + ...usernameSchema +}; +function hasUsernameAndPassword(config) { + return hasUsername(config) && "password" in config; +} +var tokenSchema = { + /** The token needed to authenticate to the package registry, if any. */ + token: optionalOrNull(string), + ...usernameSchema +}; +function hasToken(config) { + return "token" in config; +} +function isToken(config) { + return "token" in config && validateSchema(tokenSchema, config); +} +var azureConfigSchema = { + "tenant-id": string, + "client-id": string +}; +function isAzureConfig(config) { + return validateSchema(azureConfigSchema, config); +} +var awsConfigSchema = { + "aws-region": string, + "account-id": string, + "role-name": string, + domain: string, + "domain-owner": string, + audience: optionalOrNull(string) +}; +function isAWSConfig(config) { + return validateSchema(awsConfigSchema, config); +} +var jfrogConfigSchema = { + "jfrog-oidc-provider-name": string, + audience: optionalOrNull(string), + "identity-mapping-name": optionalOrNull(string) +}; +function isJFrogConfig(config) { + return validateSchema(jfrogConfigSchema, config); +} +var cloudsmithConfigSchema = { + namespace: string, + "service-slug": string, + "api-host": string +}; +function isCloudsmithConfig(config) { + return validateSchema(cloudsmithConfigSchema, config); +} +var gcpConfigSchema = { + "workload-identity-provider": string, + "service-account": optionalOrNull(string), + audience: optionalOrNull(string) +}; +function isGCPConfig(config) { + return validateSchema(gcpConfigSchema, config); +} +var oidcSchemas = [ + { schema: azureConfigSchema, name: "Azure" }, + { schema: awsConfigSchema, name: "AWS" }, + { schema: jfrogConfigSchema, name: "JFrog" }, + { schema: cloudsmithConfigSchema, name: "Cloudsmith" }, + { schema: gcpConfigSchema, name: "GCP" } +]; +function credentialToStr(credential) { + let result = `Type: ${credential.type};`; + const appendIfDefined = (name, val) => { + if (isDefined2(val)) { + result += ` ${name}: ${val};`; + } + }; + appendIfDefined("Url", credential.url); + appendIfDefined("Host", credential.host); + if (hasUsername(credential)) { + appendIfDefined("Username", credential.username); + } + if ("password" in credential) { + appendIfDefined( + "Password", + isDefined2(credential.password) ? "***" : void 0 + ); + } + if (hasToken(credential)) { + appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0); + } + if (isAzureConfig(credential)) { + appendIfDefined("Tenant", credential["tenant-id"]); + appendIfDefined("Client", credential["client-id"]); + } else if (isAWSConfig(credential)) { + appendIfDefined("AWS Region", credential["aws-region"]); + appendIfDefined("AWS Account", credential["account-id"]); + appendIfDefined("AWS Role", credential["role-name"]); + appendIfDefined("AWS Domain", credential.domain); + appendIfDefined("AWS Domain Owner", credential["domain-owner"]); + appendIfDefined("AWS Audience", credential.audience); + } else if (isJFrogConfig(credential)) { + appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]); + appendIfDefined( + "JFrog Identity Mapping", + credential["identity-mapping-name"] + ); + appendIfDefined("JFrog Audience", credential.audience); + } else if (isCloudsmithConfig(credential)) { + appendIfDefined("Cloudsmith Namespace", credential.namespace); + appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]); + appendIfDefined("Cloudsmith API Host", credential["api-host"]); + } else if (isGCPConfig(credential)) { + appendIfDefined( + "GCP Workload Identity Provider", + credential["workload-identity-provider"] + ); + appendIfDefined("GCP Service Account", credential["service-account"]); + appendIfDefined("GCP Audience", credential.audience); + } + return result; +} +var registryBaseSchema = { + /** The type of the package registry. */ + type: string, + /** Whether the registry replaces the base registry for the ecosystem. */ + "replaces-base": optional(boolean) +}; +function getAddressString(address) { + if (address.url === void 0) { + return address.host; + } else { + return address.url; + } +} + // src/status-report.ts function getDisplayActionName(actionName) { if (actionName === "finish" /* Analyze */) { @@ -146269,6 +147218,17 @@ function getDisplayActionName(actionName) { } return actionName; } +function getJobUUID(action) { + const existingJobRunUuid = action.env.getOptional("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */); + if (existingJobRunUuid !== void 0 && validate_default(existingJobRunUuid)) { + action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); + return existingJobRunUuid; + } + const jobRunUuid = v4_default(); + action.logger.info(`Job run UUID is ${jobRunUuid}.`); + action.actions.exportVariable("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + return jobRunUuid; +} function isFirstPartyAnalysis(actionName) { if (actionName !== "upload-sarif" /* UploadSarif */) { return true; @@ -146319,11 +147279,39 @@ function setJobStatusIfUnsuccessful(actionStatus) { ); } } +function getRegistryTypesFromEnv(logger, env = getEnv()) { + const value = env.getOptional("CODEQL_PROXY_URLS" /* PROXY_URLS */); + if (value === void 0) { + return void 0; + } + try { + const data = JSON.parse(value); + if (!isArray(data)) { + logger.debug( + `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array, but got '${typeof data}'.` + ); + return void 0; + } + if (!validateArray(registryBaseSchema, data)) { + logger.debug( + `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array of registry objects, but got something else.` + ); + return void 0; + } + const types2 = new Set(data.map((r) => r.type)); + return Array.from(types2).sort().join(","); + } catch (err) { + logger.debug( + `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}': ${getErrorMessage(err)}.` + ); + return void 0; + } +} async function createStatusReportBase(actionName, status, actionStartedAt, config, diskInfo, logger, cause, exception) { try { const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || ""; const ref = await getRef(); - const jobRunUUID = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */] || ""; + const jobRunUUID = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */] || ""; const workflowRunID = getWorkflowRunID(); const workflowRunAttempt = getWorkflowRunAttempt(); const workflowName = process.env["GITHUB_WORKFLOW"] || ""; @@ -146335,7 +147323,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi core7.exportVariable("CODEQL_WORKFLOW_STARTED_AT" /* WORKFLOW_STARTED_AT */, workflowStartedAt); } const runnerOs = getRequiredEnvParam("RUNNER_OS"); - const codeQlCliVersion = getCachedCodeQlVersion(); + const codeQlCliVersion = getCachedCodeQlVersion(logger, getEnv()); const actionRef = process.env["GITHUB_ACTION_REF"] || ""; const testingEnvironment = getTestingEnvironment(); if (testingEnvironment) { @@ -146353,10 +147341,12 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, ref, + registry_types: getRegistryTypesFromEnv(logger), runner_os: runnerOs, started_at: workflowStartedAt, status, @@ -146550,33 +147540,41 @@ async function runInActions(action) { const env = getEnv(); const actionsEnv = getActionsEnv(); try { - await action.run({ + const actionState = { name: action.name, startedAt, logger, env, actions: actionsEnv - }); + }; + getJobUUID(actionState); + await action.run(actionState); } catch (error3) { core8.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error3)}` ); - await sendUnhandledErrorStatusReport(action.name, startedAt, error3, logger); + const statusReportError = action.transformTelemetryError !== void 0 ? action.transformTelemetryError(wrapError(error3)) : error3; + await sendUnhandledErrorStatusReport( + action.name, + startedAt, + statusReportError, + logger + ); } } // src/feature-flags.ts -var fs5 = __toESM(require("fs")); -var path5 = __toESM(require("path")); +var fs6 = __toESM(require("fs")); +var path6 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.26.1"; -var cliVersion = "2.26.1"; +var bundleVersion = "codeql-bundle-v2.26.3"; +var cliVersion = "2.26.3"; // src/overlay/index.ts -var fs4 = __toESM(require("fs")); -var path4 = __toESM(require("path")); +var fs5 = __toESM(require("fs")); +var path5 = __toESM(require("path")); var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8"; var CODEQL_OVERLAY_MINIMUM_VERSION_CPP = "2.25.0"; var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1"; @@ -146589,12 +147587,12 @@ async function writeBaseDatabaseOidsFile(config, sourceRoot) { const gitFileOids = await getFileOidsUnderPath(sourceRoot); const gitFileOidsJson = JSON.stringify(gitFileOids); const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config); - await fs4.promises.writeFile(baseDatabaseOidsFilePath, gitFileOidsJson); + await fs5.promises.writeFile(baseDatabaseOidsFilePath, gitFileOidsJson); } async function readBaseDatabaseOidsFile(config, logger) { const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config); try { - const contents = await fs4.promises.readFile( + const contents = await fs5.promises.readFile( baseDatabaseOidsFilePath, "utf-8" ); @@ -146616,14 +147614,14 @@ async function writeOverlayChangesFile(config, sourceRoot, logger) { const diffRangeFiles = await getDiffRangeFilePaths(sourceRoot, logger); const changedFiles = [.../* @__PURE__ */ new Set([...oidChangedFiles, ...diffRangeFiles])]; const changedFilesJson = JSON.stringify({ changes: changedFiles }); - const overlayChangesFile = path4.join( + const overlayChangesFile = path5.join( getTemporaryDirectory(), "overlay-changes.json" ); logger.debug( `Writing overlay changed files to ${overlayChangesFile}: ${changedFilesJson}` ); - await fs4.promises.writeFile(overlayChangesFile, changedFilesJson); + await fs5.promises.writeFile(overlayChangesFile, changedFilesJson); return overlayChangesFile; } function computeChangedFiles(baseFileOids, overlayFileOids) { @@ -146642,7 +147640,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) { } async function getDiffRangeFilePaths(sourceRoot, logger) { const jsonFilePath = getDiffRangesJsonFilePath(); - if (!fs4.existsSync(jsonFilePath)) { + if (!fs5.existsSync(jsonFilePath)) { logger.debug( `No diff ranges JSON file found at ${jsonFilePath}; skipping.` ); @@ -146650,7 +147648,7 @@ async function getDiffRangeFilePaths(sourceRoot, logger) { } let contents; try { - contents = await fs4.promises.readFile(jsonFilePath, "utf8"); + contents = await fs5.promises.readFile(jsonFilePath, "utf8"); } catch (e) { logger.warning( `Failed to read diff ranges JSON file at ${jsonFilePath}: ${e}` @@ -146682,7 +147680,7 @@ async function getDiffRangeFilePaths(sourceRoot, logger) { return [...new Set(diffRanges.map((r) => r.path))]; } const relativePaths = diffRanges.map( - (r) => path4.relative(sourceRoot, path4.join(repoRoot, r.path)).replaceAll(path4.sep, "/") + (r) => path5.relative(sourceRoot, path5.join(repoRoot, r.path)).replaceAll(path5.sep, "/") ).filter((rel) => !rel.startsWith("..")); return [...new Set(relativePaths)]; } @@ -146716,11 +147714,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: void 0 }, - ["allow_toolcache_input" /* AllowToolcacheInput */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: void 0 - }, ["cleanup_trap_caches" /* CleanupTrapCaches */]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", @@ -146889,9 +147882,34 @@ var featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: void 0 }, - ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: { + ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_9_gb" /* OverlayAnalysisMinDisk9Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_9_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_10_gb" /* OverlayAnalysisMinDisk10Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_10_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_11_gb" /* OverlayAnalysisMinDisk11Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_11_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_12_gb" /* OverlayAnalysisMinDisk12Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_12_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_13_gb" /* OverlayAnalysisMinDisk13Gb */]: { defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_13_GB", minimumVersion: void 0 }, ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: { @@ -146931,6 +147949,11 @@ var featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: void 0 }, + ["tools_repository_property" /* ToolsRepositoryProperty */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: void 0 + }, ["upload_overlay_db_to_api" /* UploadOverlayDbToApi */]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", @@ -147052,7 +148075,7 @@ var Features = class extends OfflineFeatures { super(logger); this.gitHubFeatureFlags = new GitHubFeatureFlags( repositoryNwo, - path5.join(tempDir, FEATURE_FLAGS_FILE_NAME), + path6.join(tempDir, FEATURE_FLAGS_FILE_NAME), logger ); } @@ -147184,12 +148207,12 @@ var GitHubFeatureFlags = class { } async readLocalFlags() { try { - if (fs5.existsSync(this.featureFlagsFile)) { + if (fs6.existsSync(this.featureFlagsFile)) { this.logger.debug( `Loading feature flags from ${this.featureFlagsFile}` ); return JSON.parse( - fs5.readFileSync(this.featureFlagsFile, "utf8") + fs6.readFileSync(this.featureFlagsFile, "utf8") ); } } catch (e) { @@ -147202,7 +148225,7 @@ var GitHubFeatureFlags = class { async writeLocalFlags(flags) { try { this.logger.debug(`Writing feature flags to ${this.featureFlagsFile}`); - fs5.writeFileSync(this.featureFlagsFile, JSON.stringify(flags)); + fs6.writeFileSync(this.featureFlagsFile, JSON.stringify(flags)); } catch (e) { this.logger.warning( `Error writing cached feature flags file ${this.featureFlagsFile}: ${e}.` @@ -147417,8 +148440,8 @@ var SarifScanOrder = [ ]; // src/analyze.ts -var fs16 = __toESM(require("fs")); -var path15 = __toESM(require("path")); +var fs17 = __toESM(require("fs")); +var path16 = __toESM(require("path")); var import_perf_hooks3 = require("perf_hooks"); var io5 = __toESM(require_io()); @@ -147426,8 +148449,8 @@ var io5 = __toESM(require_io()); var core13 = __toESM(require_core()); // src/codeql.ts -var fs15 = __toESM(require("fs")); -var path14 = __toESM(require("path")); +var fs16 = __toESM(require("fs")); +var path15 = __toESM(require("path")); var core12 = __toESM(require_core()); var toolrunner3 = __toESM(require_toolrunner()); @@ -147680,8 +148703,8 @@ function wrapCliConfigurationError(cliError) { } // src/config-utils.ts -var fs9 = __toESM(require("fs")); -var path10 = __toESM(require("path")); +var fs10 = __toESM(require("fs")); +var path11 = __toESM(require("path")); var import_perf_hooks = require("perf_hooks"); var core10 = __toESM(require_core()); @@ -147736,13 +148759,13 @@ function getDependencyCachingEnabled() { } // src/config/db-config.ts -var path7 = __toESM(require("path")); +var path8 = __toESM(require("path")); var jsonschema = __toESM(require_lib2()); var semver5 = __toESM(require_semver2()); // src/diagnostics.ts var import_fs = require("fs"); -var import_path = __toESM(require("path")); +var import_path2 = __toESM(require("path")); var unwrittenDiagnostics = []; var unwrittenDefaultLanguageDiagnostics = []; var diagnosticCounter = 0; @@ -147781,7 +148804,7 @@ function addNoLanguageDiagnostic(config, diagnostic) { function writeDiagnostic(config, language, diagnostic) { const logger = getActionsLogger(); const databasePath = language ? getCodeQLDatabasePath(config, language) : config.dbLocation; - const diagnosticsPath = import_path.default.resolve( + const diagnosticsPath = import_path2.default.resolve( databasePath, "diagnostic", "codeql-action" @@ -147793,7 +148816,7 @@ function writeDiagnostic(config, language, diagnostic) { /[^a-zA-Z0-9.-]/g, "" ); - const jsonPath = import_path.default.resolve( + const jsonPath = import_path2.default.resolve( diagnosticsPath, `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); @@ -147896,12 +148919,14 @@ function getUnknownLanguagesError(languages) { } // src/feature-flags/properties.ts +var github2 = __toESM(require_github()); var GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => { RepositoryPropertyName2["CONFIG_FILE"] = "github-codeql-config-file"; RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay"; RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries"; RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs"; + RepositoryPropertyName2["TOOLS"] = "github-codeql-tools"; return RepositoryPropertyName2; })(RepositoryPropertyName || {}); function isString2(value) { @@ -147920,7 +148945,8 @@ var repositoryPropertyParsers = { ["github-codeql-config-file" /* CONFIG_FILE */]: stringProperty, ["github-codeql-disable-overlay" /* DISABLE_OVERLAY */]: booleanProperty, ["github-codeql-extra-queries" /* EXTRA_QUERIES */]: stringProperty, - ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty + ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty, + ["github-codeql-tools" /* TOOLS */]: stringProperty }; async function loadPropertiesFromApi(logger, repositoryNwo) { try { @@ -148000,6 +149026,26 @@ var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name) { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } +async function loadRepositoryProperties(repositoryNwo, logger) { + const repositoryOwnerType = github2.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." + ); + return new Success({}); + } + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error3) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error3)}` + ); + return new Failure(error3); + } +} // src/config/db-config.ts var ORG_SCHEMA = { @@ -148118,11 +149164,11 @@ function parsePacksSpecification(packStr) { throw new ConfigurationError(getPacksStrInvalid(packStr)); } } - if (packPath && (path7.isAbsolute(packPath) || // Permit using "/" instead of "\" on Windows + if (packPath && (path8.isAbsolute(packPath) || // Permit using "/" instead of "\" on Windows // Use `x.split(y).join(z)` as a polyfill for `x.replaceAll(y, z)` since // if we used a regex we'd need to escape the path separator on Windows // which seems more awkward. - path7.normalize(packPath).split(path7.sep).join("/") !== packPath.split(path7.sep).join("/"))) { + path8.normalize(packPath).split(path8.sep).join("/") !== packPath.split(path8.sep).join("/"))) { throw new ConfigurationError(getPacksStrInvalid(packStr)); } if (!packPath && pathStart) { @@ -148318,7 +149364,7 @@ function parseUserConfig(logger, pathInput, contents, validateConfig) { } // src/config/remote-file.ts -var DEFAULT_CONFIG_FILE_NAME = ".github/codeql-action.yaml"; +var DEFAULT_CONFIG_FILE_NAME = ".github/codeql-config.yml"; var DEFAULT_CONFIG_FILE_REF = "main"; function getDefaultOwner(env) { const currentRepoNwo = env.getRequired("GITHUB_REPOSITORY" /* GITHUB_REPOSITORY */); @@ -148355,12 +149401,12 @@ function parseNewRemoteFileAddress(env, configFile) { return new Failure(void 0); } const owner = pieces.groups.owner?.trim(); - const path29 = pieces.groups.path?.trim(); + const path30 = pieces.groups.path?.trim(); const ref = pieces.groups.ref?.trim(); return new Success({ owner: owner || getDefaultOwner(env), repo, - path: path29 || DEFAULT_CONFIG_FILE_NAME, + path: path30 || DEFAULT_CONFIG_FILE_NAME, ref: ref || DEFAULT_CONFIG_FILE_REF }); } @@ -148394,22 +149440,27 @@ async function getConfigFileInput({ logger, actions, features -}, repositoryProperties) { +}, repositoryProperties, analysisKinds) { const input = actions.getOptionalInput("config-file"); if (input !== void 0) { logger.info(`Using configuration file input from workflow: ${input}`); return input; } const propertyValue = repositoryProperties["github-codeql-config-file" /* CONFIG_FILE */]; + const analysisKindSupported = analysisKinds === void 0 || analysisKinds.includes("code-scanning" /* CodeScanning */) && analysisKinds.length === 1; if (propertyValue !== void 0 && propertyValue.trim().length > 0) { const useRepositoryProperty = await features.getValue( "config_file_repository_property" /* ConfigFileRepositoryProperty */ ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}` ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind." + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled." @@ -148454,7 +149505,7 @@ async function getRemoteConfig(actionState, configFile, apiDetails) { } // src/diff-informed-analysis-utils.ts -var fs6 = __toESM(require("fs")); +var fs7 = __toESM(require("fs")); async function getDiffInformedAnalysisBranches(codeql, features, logger) { if (!await features.getValue("diff_informed_queries" /* DiffInformedQueries */, codeql)) { return void 0; @@ -148496,7 +149547,7 @@ async function prepareDiffInformedAnalysis(codeql, features, logger) { function writeDiffRangesJsonFile(logger, ranges) { const jsonContents = JSON.stringify(ranges, null, 2); const jsonFilePath = getDiffRangesJsonFilePath(); - fs6.writeFileSync(jsonFilePath, jsonContents); + fs7.writeFileSync(jsonFilePath, jsonContents); logger.debug( `Wrote pr-diff-range JSON file to ${jsonFilePath}: ${jsonContents}` @@ -148504,11 +149555,11 @@ ${jsonContents}` } function readDiffRangesJsonFile(logger) { const jsonFilePath = getDiffRangesJsonFilePath(); - if (!fs6.existsSync(jsonFilePath)) { + if (!fs7.existsSync(jsonFilePath)) { logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`); return void 0; } - const jsonContents = fs6.readFileSync(jsonFilePath, "utf8"); + const jsonContents = fs7.readFileSync(jsonFilePath, "utf8"); logger.debug( `Read pr-diff-range JSON file from ${jsonFilePath}: ${jsonContents}` @@ -148759,13 +149810,13 @@ Improved incremental analysis will be automatically retried when the next versio } // src/overlay/status.ts -var fs7 = __toESM(require("fs")); -var path8 = __toESM(require("path")); +var fs8 = __toESM(require("fs")); +var path9 = __toESM(require("path")); var actionsCache = __toESM(require_cache4()); var MAX_CACHE_OPERATION_MS = 3e4; var STATUS_FILE_NAME = "overlay-status.json"; function getStatusFilePath(languages) { - return path8.join( + return path9.join( getTemporaryDirectory(), "overlay-status", [...languages].sort().join("+"), @@ -148804,7 +149855,7 @@ async function getOverlayStatus(codeql, languages, diskUsage, logger) { const cacheKey3 = await getCacheKey(codeql, languages, diskUsage); const statusFile = getStatusFilePath(languages); try { - await fs7.promises.mkdir(path8.dirname(statusFile), { recursive: true }); + await fs8.promises.mkdir(path9.dirname(statusFile), { recursive: true }); const foundKey = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS, actionsCache.restoreCache([statusFile], cacheKey3), @@ -148816,13 +149867,13 @@ async function getOverlayStatus(codeql, languages, diskUsage, logger) { logger.debug("No overlay status found in Actions cache."); return void 0; } - if (!fs7.existsSync(statusFile)) { + if (!fs8.existsSync(statusFile)) { logger.debug( "Overlay status cache entry found but status file is missing." ); return void 0; } - const contents = await fs7.promises.readFile(statusFile, "utf-8"); + const contents = await fs8.promises.readFile(statusFile, "utf-8"); const parsed = JSON.parse(contents); if (!isObject(parsed) || typeof parsed["attemptedToBuildOverlayBaseDatabase"] !== "boolean" || typeof parsed["builtOverlayBaseDatabase"] !== "boolean") { logger.debug( @@ -148842,8 +149893,8 @@ async function saveOverlayStatus(codeql, languages, diskUsage, status, logger) { const cacheKey3 = await getCacheKey(codeql, languages, diskUsage); const statusFile = getStatusFilePath(languages); try { - await fs7.promises.mkdir(path8.dirname(statusFile), { recursive: true }); - await fs7.promises.writeFile(statusFile, JSON.stringify(status)); + await fs8.promises.mkdir(path9.dirname(statusFile), { recursive: true }); + await fs8.promises.writeFile(statusFile, JSON.stringify(status)); const cacheId = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS, actionsCache.saveCache([statusFile], cacheKey3), @@ -148869,8 +149920,8 @@ async function getCacheKey(codeql, languages, diskUsage) { } // src/trap-caching.ts -var fs8 = __toESM(require("fs")); -var path9 = __toESM(require("path")); +var fs9 = __toESM(require("fs")); +var path10 = __toESM(require("path")); var actionsCache2 = __toESM(require_cache4()); var CACHE_VERSION = 1; var CODEQL_TRAP_CACHE_PREFIX = "codeql-trap"; @@ -148887,13 +149938,13 @@ async function downloadTrapCaches(codeql, languages, logger) { `Found ${languagesSupportingCaching.length} languages that support TRAP caching` ); if (languagesSupportingCaching.length === 0) return result; - const cachesDir = path9.join( + const cachesDir = path10.join( getTemporaryDirectory(), "trapCaches" ); for (const language of languagesSupportingCaching) { - const cacheDir2 = path9.join(cachesDir, language); - fs8.mkdirSync(cacheDir2, { recursive: true }); + const cacheDir2 = path10.join(cachesDir, language); + fs9.mkdirSync(cacheDir2, { recursive: true }); result[language] = cacheDir2; } if (await isAnalyzingDefaultBranch()) { @@ -148905,7 +149956,7 @@ async function downloadTrapCaches(codeql, languages, logger) { let baseSha = "unknown"; const eventPath = process.env.GITHUB_EVENT_PATH; if (getWorkflowEventName() === "pull_request" && eventPath !== void 0) { - const event = JSON.parse(fs8.readFileSync(path9.resolve(eventPath), "utf-8")); + const event = JSON.parse(fs9.readFileSync(path10.resolve(eventPath), "utf-8")); baseSha = event.pull_request?.base?.sha || baseSha; } for (const language of languages) { @@ -149091,10 +150142,15 @@ async function cachePrefix(codeql, language) { } // src/config-utils.ts -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 2e4; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1e6; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6; +var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14e3; +var OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE = { + ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */]: 8e3, + ["overlay_analysis_min_disk_9_gb" /* OverlayAnalysisMinDisk9Gb */]: 9e3, + ["overlay_analysis_min_disk_10_gb" /* OverlayAnalysisMinDisk10Gb */]: 1e4, + ["overlay_analysis_min_disk_11_gb" /* OverlayAnalysisMinDisk11Gb */]: 11e3, + ["overlay_analysis_min_disk_12_gb" /* OverlayAnalysisMinDisk12Gb */]: 12e3, + ["overlay_analysis_min_disk_13_gb" /* OverlayAnalysisMinDisk13Gb */]: 13e3 +}; var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024; var CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE = "2.24.3"; async function getSupportedLanguageMap(codeql, logger) { @@ -149124,9 +150180,9 @@ async function getSupportedLanguageMap(codeql, logger) { } var baseWorkflowsPath = ".github/workflows"; function hasActionsWorkflows(sourceRoot) { - const workflowsPath = path10.resolve(sourceRoot, baseWorkflowsPath); - const stats = fs9.lstatSync(workflowsPath, { throwIfNoEntry: false }); - return stats !== void 0 && stats.isDirectory() && fs9.readdirSync(workflowsPath).length > 0; + const workflowsPath = path11.resolve(sourceRoot, baseWorkflowsPath); + const stats = fs10.lstatSync(workflowsPath, { throwIfNoEntry: false }); + return stats !== void 0 && stats.isDirectory() && fs10.readdirSync(workflowsPath).length > 0; } async function getRawLanguagesInRepo(repository, sourceRoot, logger) { logger.debug( @@ -149283,8 +150339,8 @@ async function downloadCacheWithTime(codeQL, languages, logger) { async function loadUserConfig(actionState, configFile, workspacePath, apiDetails, tempDir) { if (isLocal(configFile)) { if (configFile !== userConfigFromActionPath(tempDir)) { - configFile = path10.resolve(workspacePath, configFile); - if (!(configFile + path10.sep).startsWith(workspacePath + path10.sep)) { + configFile = path11.resolve(workspacePath, configFile); + if (!(configFile + path11.sep).startsWith(workspacePath + path11.sep)) { throw new ConfigurationError( getConfigFileOutsideWorkspaceErrorMessage(configFile) ); @@ -149344,16 +150400,28 @@ async function checkOverlayAnalysisFeatureEnabled(features, codeql, languages, c } return new Success(void 0); } -function runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks) { - const minimumDiskSpaceBytes = useV2ResourceChecks ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; - if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { - const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1e6); - const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1e6); +async function getMinimumDiskSpaceMb(features) { + let minimumMb = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB; + for (const [feature, thresholdMb] of Object.entries( + OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE + )) { + if (await features.getValue(feature)) { + minimumMb = Math.min(minimumMb, thresholdMb); + } + } + return minimumMb; +} +function runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb) { + const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1e6); + if (diskUsage.numAvailableBytes < minimumDiskSpaceMb * 1e6) { logger.info( `Setting overlay database mode to ${"none" /* None */} due to insufficient disk space (${diskSpaceMb} MB, needed ${minimumDiskSpaceMb} MB).` ); return false; } + logger.debug( + `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is at or above the minimum of ${minimumDiskSpaceMb} MB.` + ); return true; } async function runnerHasSufficientMemory(codeql, ramInput, logger) { @@ -149374,12 +150442,13 @@ async function runnerHasSufficientMemory(codeql, ramInput, logger) { return false; } logger.debug( - `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.` + `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is at or above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.` ); return true; } -async function checkRunnerResources(codeql, diskUsage, ramInput, logger, useV2ResourceChecks) { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { +async function checkRunnerResources(codeql, features, diskUsage, ramInput, logger) { + const minimumDiskSpaceMb = await getMinimumDiskSpaceMb(features); + if (!runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb)) { return new Failure("insufficient-disk-space" /* InsufficientDiskSpace */); } if (!await runnerHasSufficientMemory(codeql, ramInput, logger)) { @@ -149427,9 +150496,6 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b "overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */, codeql ); - const useV2ResourceChecks = await features.getValue( - "overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */ - ); const checkOverlayStatus = await features.getValue( "overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */ ); @@ -149443,10 +150509,10 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b } const resourceResult = performResourceChecks && diskUsage !== void 0 ? await checkRunnerResources( codeql, + features, diskUsage, ramInput, - logger, - useV2ResourceChecks + logger ) : new Success(void 0); if (resourceResult.isFailure()) { return resourceResult; @@ -149557,10 +150623,10 @@ async function setCppTrapCachingEnvironmentVariables(config, logger) { } } function dbLocationOrDefault(dbLocation, tempDir) { - return dbLocation || path10.resolve(tempDir, "codeql_databases"); + return dbLocation || path11.resolve(tempDir, "codeql_databases"); } function userConfigFromActionPath(tempDir) { - return path10.resolve(tempDir, "user-config-from-action.yml"); + return path11.resolve(tempDir, "user-config-from-action.yml"); } function hasQueryCustomisation(userConfig) { return isDefined2(userConfig["disable-default-queries"]) || isDefined2(userConfig.queries) || isDefined2(userConfig["query-filters"]); @@ -149610,7 +150676,7 @@ async function determineUserConfig(action, tempDir, inputs) { fromConfigInput, fromConfigFile ); - fs9.writeFileSync(computedConfigPath, dump(mergedConfig)); + fs10.writeFileSync(computedConfigPath, dump(mergedConfig)); action.logger.debug( `Using merged configurations from 'config' input with configuration from '${inputs.configFile}': ${computedConfigPath}` ); @@ -149622,7 +150688,7 @@ async function determineUserConfig(action, tempDir, inputs) { `Both a config file and config input were provided. Ignoring config file.` ); } - fs9.writeFileSync(computedConfigPath, inputs.configInput); + fs10.writeFileSync(computedConfigPath, inputs.configInput); inputs.configFile = computedConfigPath; action.logger.debug( `Using config from action input: ${inputs.configFile}` @@ -149663,7 +150729,6 @@ async function initConfig(actionState, inputs) { try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); if (isInTestMode() && process.env["CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION" /* TOLERATE_MISSING_GIT_VERSION */] !== "true") { @@ -149776,7 +150841,7 @@ function isLocal(configPath) { return !containsAtRef(configPath); } function getLocalConfig(logger, configFile, validateConfig) { - if (!fs9.existsSync(configFile)) { + if (!fs10.existsSync(configFile)) { throw new ConfigurationError( getConfigFileDoesNotExistErrorMessage(configFile) ); @@ -149784,27 +150849,27 @@ function getLocalConfig(logger, configFile, validateConfig) { return parseUserConfig( logger, configFile, - fs9.readFileSync(configFile, "utf-8"), + fs10.readFileSync(configFile, "utf-8"), validateConfig ); } function getPathToParsedConfigFile(tempDir) { - return path10.join(tempDir, "config"); + return path11.join(tempDir, "config"); } async function saveConfig(config, logger) { const configString = JSON.stringify(config); const configFile = getPathToParsedConfigFile(config.tempDir); - fs9.mkdirSync(path10.dirname(configFile), { recursive: true }); - fs9.writeFileSync(configFile, configString, "utf8"); + fs10.mkdirSync(path11.dirname(configFile), { recursive: true }); + fs10.writeFileSync(configFile, configString, "utf8"); logger.debug("Saved config:"); logger.debug(configString); } async function getConfig(tempDir, logger) { const configFile = getPathToParsedConfigFile(tempDir); - if (!fs9.existsSync(configFile)) { + if (!fs10.existsSync(configFile)) { return void 0; } - const configString = fs9.readFileSync(configFile, "utf8"); + const configString = fs10.readFileSync(configFile, "utf8"); logger.debug("Loaded config:"); logger.debug(configString); const config = JSON.parse(configString); @@ -149826,9 +150891,9 @@ async function generateRegistries(registriesInput, tempDir, logger) { let qlconfigFile; if (registries) { const qlconfig = createRegistriesBlock(registries); - qlconfigFile = path10.join(tempDir, "qlconfig.yml"); + qlconfigFile = path11.join(tempDir, "qlconfig.yml"); const qlconfigContents = dump(qlconfig); - fs9.writeFileSync(qlconfigFile, qlconfigContents, "utf8"); + fs10.writeFileSync(qlconfigFile, qlconfigContents, "utf8"); logger.debug("Generated qlconfig.yml:"); logger.debug(qlconfigContents); registriesAuthTokens = registries.map((registry) => `${registry.url}=${registry.token}`).join(","); @@ -149939,21 +151004,6 @@ function getPrimaryAnalysisKind(config) { function getPrimaryAnalysisConfig(config) { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -async function logGitVersionTelemetry(config, gitVersion) { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion - } - ) - ); - } -} async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount) { if (config.languages.length < 1) { return; @@ -149972,58 +151022,14 @@ async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount) } // src/setup-codeql.ts -var fs13 = __toESM(require("fs")); -var path12 = __toESM(require("path")); +var fs14 = __toESM(require("fs")); +var path13 = __toESM(require("path")); var toolcache3 = __toESM(require_tool_cache()); var import_fast_deep_equal = __toESM(require_fast_deep_equal()); var semver9 = __toESM(require_semver2()); -// node_modules/uuid/dist-node/stringify.js -var byteToHex = []; -for (let i = 0; i < 256; ++i) { - byteToHex.push((i + 256).toString(16).slice(1)); -} -function unsafeStringify(arr, offset = 0) { - return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); -} - -// node_modules/uuid/dist-node/rng.js -var rnds8 = new Uint8Array(16); -function rng() { - return crypto.getRandomValues(rnds8); -} - -// node_modules/uuid/dist-node/v4.js -function v4(options, buf, offset) { - if (!buf && !options && crypto.randomUUID) { - return crypto.randomUUID(); - } - return _v4(options, buf, offset); -} -function _v4(options, buf, offset) { - options = options || {}; - const rnds = options.random ?? options.rng?.() ?? rng(); - if (rnds.length < 16) { - throw new Error("Random bytes length must be >= 16"); - } - rnds[6] = rnds[6] & 15 | 64; - rnds[8] = rnds[8] & 63 | 128; - if (buf) { - offset = offset || 0; - if (offset < 0 || offset + 16 > buf.length) { - throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); - } - for (let i = 0; i < 16; ++i) { - buf[offset + i] = rnds[i]; - } - return buf; - } - return unsafeStringify(rnds); -} -var v4_default = v4; - // src/overlay/caching.ts -var fs10 = __toESM(require("fs")); +var fs11 = __toESM(require("fs")); var actionsCache3 = __toESM(require_cache4()); var semver6 = __toESM(require_semver2()); var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500; @@ -150033,7 +151039,7 @@ var CACHE_PREFIX = "codeql-overlay-base-database"; var MAX_CACHE_OPERATION_MS3 = 6e5; async function checkOverlayBaseDatabase(codeql, config, logger, warningPrefix) { const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config); - if (!fs10.existsSync(baseDatabaseOidsFilePath)) { + if (!fs11.existsSync(baseDatabaseOidsFilePath)) { logger.warning( `${warningPrefix}: ${baseDatabaseOidsFilePath} does not exist` ); @@ -150322,7 +151328,7 @@ async function getCodeQlVersionsForOverlayBaseDatabases(rawLanguages, logger) { // src/tar.ts var import_child_process = require("child_process"); -var fs11 = __toESM(require("fs")); +var fs12 = __toESM(require("fs")); var stream = __toESM(require("stream")); var import_toolrunner = __toESM(require_toolrunner()); var io4 = __toESM(require_io()); @@ -150395,7 +151401,7 @@ async function isZstdAvailable(logger) { } } async function extract(tarPath, dest, compressionMethod, tarVersion, logger) { - fs11.mkdirSync(dest, { recursive: true }); + fs12.mkdirSync(dest, { recursive: true }); switch (compressionMethod) { case "gzip": return await toolcache.extractTar(tarPath, dest); @@ -150439,10 +151445,12 @@ async function extractTarZst(tar, dest, tarVersion, logger) { reject(new Error(`Error while extracting tar: ${err}`)); }); if (tar instanceof stream.Readable) { - tar.pipe(tarProcess.stdin).on("error", (err) => { - reject( - new Error(`Error while downloading and extracting tar: ${err}`) - ); + stream.pipeline(tar, tarProcess.stdin, (err) => { + if (err) { + reject( + new Error(`Error while downloading and extracting tar: ${err}`) + ); + } }); } tarProcess.on("exit", (code) => { @@ -150479,9 +151487,9 @@ function inferCompressionMethod(tarPath) { } // src/tools-download.ts -var fs12 = __toESM(require("fs")); +var fs13 = __toESM(require("fs")); var os4 = __toESM(require("os")); -var path11 = __toESM(require("path")); +var path12 = __toESM(require("path")); var import_perf_hooks2 = require("perf_hooks"); var core11 = __toESM(require_core()); var import_http_client = __toESM(require_lib()); @@ -150489,23 +151497,8 @@ var toolcache2 = __toESM(require_tool_cache()); var import_follow_redirects = __toESM(require_follow_redirects()); var semver8 = __toESM(require_semver2()); var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; +var STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1e3; var TOOLCACHE_TOOL_NAME = "CodeQL"; -function makeDownloadFirstToolsDownloadDurations(downloadDurationMs, extractionDurationMs) { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false - }; -} -function makeStreamedToolsDownloadDurations(combinedDurationMs) { - return { - combinedDurationMs, - downloadDurationMs: void 0, - extractionDurationMs: void 0, - streamExtraction: true - }; -} async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorization, headers, tarVersion, logger) { logger.info( `Downloading CodeQL tools from ${codeqlURL} . This may take a while.` @@ -150530,11 +151523,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat combinedDurationMs )}).` ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs) - }; + return {}; } } catch (e) { core11.warning( @@ -150576,25 +151565,18 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat } finally { await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs - ) - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger) { - fs12.mkdirSync(dest, { recursive: true }); + fs13.mkdirSync(dest, { recursive: true }); const agent = new import_http_client.HttpClient().getAgent(codeqlURL); headers = Object.assign( { "User-Agent": "CodeQL Action" }, authorization ? { authorization } : {}, headers ); - const response = await new Promise( - (resolve14) => import_follow_redirects.https.get( + const response = await new Promise((resolve14, reject) => { + const request3 = import_follow_redirects.https.get( codeqlURL, { headers, @@ -150604,9 +151586,18 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio agent }, (r) => resolve14(r) - ) - ); + ); + request3.on("error", reject); + request3.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => { + request3.destroy( + new Error( + `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.` + ) + ); + }); + }); if (response.statusCode !== 200) { + response.resume(); throw new Error( `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.` ); @@ -150614,7 +151605,7 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio await extractTarZst(response, dest, tarVersion, logger); } function getToolcacheDirectory(version) { - return path11.join( + return path12.join( getRequiredEnvParam("RUNNER_TOOL_CACHE"), TOOLCACHE_TOOL_NAME, semver8.clean(version) || version, @@ -150623,14 +151614,9 @@ function getToolcacheDirectory(version) { } function writeToolcacheMarkerFile(extractedPath, logger) { const markerFilePath = `${extractedPath}.complete`; - fs12.writeFileSync(markerFilePath, ""); + fs13.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } -function sanitizeUrlForStatusReport(url2) { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url2.startsWith(`https://github.com/${repo}/releases/download/`) - ) ? url2 : "sanitized-value"; -} // src/setup-codeql.ts var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; @@ -150758,7 +151744,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) { const candidates = toolcache3.findAllVersions("CodeQL").filter(isGoodVersion).map((version) => ({ folder: toolcache3.find("CodeQL", version), version - })).filter(({ folder }) => fs13.existsSync(path12.join(folder, "pinned-version"))); + })).filter(({ folder }) => fs14.existsSync(path13.join(folder, "pinned-version"))); if (candidates.length === 1) { const candidate = candidates[0]; logger.debug( @@ -150922,10 +151908,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO } } else if (toolsInput !== void 0 && toolsInput === CODEQL_TOOLCACHE_INPUT) { let latestToolcacheVersion; - const allowToolcacheValueFF = await features.getValue( - "allow_toolcache_input" /* AllowToolcacheInput */ - ); - const allowToolcacheValue = allowToolcacheValueFF && (isDynamicWorkflow() || isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || isInTestMode(); if (allowToolcacheValue) { logger.info( `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.` @@ -150941,15 +151924,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...` ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.` - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` + ); } const version = await resolveDefaultCliVersion( defaultCliVersion, @@ -151239,8 +152216,7 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function useZstdBundle(cliVersion2, tarSupportsZstd) { @@ -151250,7 +152226,7 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) { ); } function getTempExtractionDir(tempDir) { - return path12.join(tempDir, v4_default()); + return path13.join(tempDir, v4_default()); } async function getNightlyToolsUrl(logger) { const zstdAvailability = await isZstdAvailable(logger); @@ -151298,8 +152274,8 @@ function isReservedToolsValue(tools) { } // src/tracer-config.ts -var fs14 = __toESM(require("fs")); -var path13 = __toESM(require("path")); +var fs15 = __toESM(require("fs")); +var path14 = __toESM(require("path")); async function shouldEnableIndirectTracing(codeql, config) { if (config.buildMode === "none" /* None */) { return false; @@ -151314,18 +152290,18 @@ async function endTracingForCluster(codeql, config, logger) { logger.info( "Unsetting build tracing environment variables. Subsequent steps of this job will not be traced." ); - const envVariablesFile = path13.resolve( + const envVariablesFile = path14.resolve( config.dbLocation, "temp/tracingEnvironment/end-tracing.json" ); - if (!fs14.existsSync(envVariablesFile)) { + if (!fs15.existsSync(envVariablesFile)) { throw new Error( `Environment file for ending tracing not found: ${envVariablesFile}` ); } try { const endTracingEnvVariables = JSON.parse( - fs14.readFileSync(envVariablesFile, "utf8") + fs15.readFileSync(envVariablesFile, "utf8") ); for (const [key, value] of Object.entries(endTracingEnvVariables)) { if (value !== null) { @@ -151342,8 +152318,8 @@ async function endTracingForCluster(codeql, config, logger) { } async function getTracerConfigForCluster(config) { const tracingEnvVariables = JSON.parse( - fs14.readFileSync( - path13.resolve( + fs15.readFileSync( + path14.resolve( config.dbLocation, "temp/tracingEnvironment/start-tracing.json" ), @@ -151368,14 +152344,23 @@ var CODEQL_NEXT_MINIMUM_VERSION = "2.20.7"; var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16"; var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01"; var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++"; +function isDiskConfigurationError(e) { + if (!(e instanceof Error)) { + return false; + } + return ( + // out of disk space + e.message.includes("ENOSPC") || // access denied + e.message.includes("EACCES") + ); +} async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) { try { const { codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion } = await setupCodeQLBundle( toolsInput, apiDetails, @@ -151387,12 +152372,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV features, logger ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport - )}` - ); - let codeqlCmd = path14.join(codeqlFolder, "codeql", "codeql"); + let codeqlCmd = path15.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; } else if (process.platform !== "linux" && process.platform !== "darwin") { @@ -151400,17 +152380,16 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV `Unsupported platform: ${process.platform}` ); } - cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion); + cachedCodeQL = await getCodeQLForCmd(logger, codeqlCmd, checkVersion); return { codeql: cachedCodeQL, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } catch (rawError) { const e = wrapApiConfigurationError(rawError); - const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") ? ConfigurationError : Error; + const ErrorClass = e instanceof ConfigurationError || isDiskConfigurationError(e) ? ConfigurationError : Error; throw new ErrorClass( `Unable to download and extract CodeQL CLI: ${getErrorMessage(e)}${e instanceof Error && e.stack ? ` @@ -151418,19 +152397,19 @@ Details: ${e.stack}` : ""}` ); } } -async function getCodeQL(cmd) { +async function getCodeQL(logger, cmd) { if (cachedCodeQL === void 0) { - cachedCodeQL = await getCodeQLForCmd(cmd, true); + cachedCodeQL = await getCodeQLForCmd(logger, cmd, true); } return cachedCodeQL; } -async function getCodeQLForCmd(cmd, checkVersion) { +async function getCodeQLForCmd(logger, cmd, checkVersion) { const codeql = { getPath() { return cmd; }, async getVersion() { - let result = getCachedCodeQlVersion(cmd); + let result = getCachedCodeQlVersion(logger, getEnv(), cmd); if (result === void 0) { result = await runCliJson( cmd, @@ -151439,7 +152418,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { noStreamStdout: true } ); - cacheCodeQlVersion(cmd, result); + cacheCodeQlVersion(getEnv(), cmd, result); } return result; }, @@ -151451,17 +152430,17 @@ async function getCodeQLForCmd(cmd, checkVersion) { }, async isTracedLanguage(language) { const extractorPath = await this.resolveExtractor(language); - const tracingConfigPath = path14.join( + const tracingConfigPath = path15.join( extractorPath, "tools", "tracing-config.lua" ); - return fs15.existsSync(tracingConfigPath); + return fs16.existsSync(tracingConfigPath); }, async isScannedLanguage(language) { return !await this.isTracedLanguage(language); }, - async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) { + async databaseInitCluster(config, sourceRoot, processName, qlconfigFile) { const extraArgs = config.languages.map( (language) => `--language=${language}` ); @@ -151536,7 +152515,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { }, async runAutobuild(config, language) { applyAutobuildAzurePipelinesTimeoutFix(); - const autobuildCmd = path14.join( + const autobuildCmd = path15.join( await this.resolveExtractor(language), "tools", process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh" @@ -151906,7 +152885,7 @@ async function writeCodeScanningConfigFile(config, logger) { logger.startGroup("Augmented user configuration file contents"); logger.info(dump(augmentedConfig)); logger.endGroup(); - fs15.writeFileSync(codeScanningConfigFile, dump(augmentedConfig)); + fs16.writeFileSync(codeScanningConfigFile, dump(augmentedConfig)); return codeScanningConfigFile; } var TRAP_CACHE_SIZE_MB = 1024; @@ -151929,7 +152908,7 @@ async function getTrapCachingExtractorConfigArgsForLang(config, language) { ]; } function getGeneratedCodeScanningConfigPath(config) { - return path14.resolve(config.tempDir, "user-config.yaml"); + return path15.resolve(config.tempDir, "user-config.yaml"); } function getExtractionVerbosityArguments(enableDebugLogging) { return enableDebugLogging ? [`--verbosity=${EXTRACTION_DEBUG_MODE_VERBOSITY}`] : []; @@ -151943,7 +152922,7 @@ function applyAutobuildAzurePipelinesTimeoutFix() { ].join(" "); } async function getJobRunUuidSarifOptions() { - const jobRunUuid = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */]; + const jobRunUuid = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */]; return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : []; } @@ -152017,7 +152996,7 @@ async function setupCppAutobuild(codeql, logger) { } async function runAutobuild(config, language, logger) { logger.startGroup(`Attempting to automatically build ${language} code`); - const codeQL = await getCodeQL(config.codeQLCmd); + const codeQL = await getCodeQL(logger, config.codeQLCmd); if (language === "cpp" /* cpp */) { await setupCppAutobuild(codeQL, logger); } @@ -152034,31 +153013,31 @@ async function runAutobuild(config, language, logger) { // src/dependency-caching.ts var os5 = __toESM(require("os")); -var import_path2 = require("path"); +var import_path3 = require("path"); var actionsCache4 = __toESM(require_cache4()); var glob = __toESM(require_glob()); var CODEQL_DEPENDENCY_CACHE_PREFIX = "codeql-dependencies"; var CODEQL_DEPENDENCY_CACHE_VERSION = 1; function getJavaTempDependencyDir() { - return (0, import_path2.join)(getTemporaryDirectory(), "codeql_java", "repository"); + return (0, import_path3.join)(getTemporaryDirectory(), "codeql_java", "repository"); } async function getJavaDependencyDirs() { return [ // Maven - (0, import_path2.join)(os5.homedir(), ".m2", "repository"), + (0, import_path3.join)(os5.homedir(), ".m2", "repository"), // Gradle - (0, import_path2.join)(os5.homedir(), ".gradle", "caches"), + (0, import_path3.join)(os5.homedir(), ".gradle", "caches"), // CodeQL Java build-mode: none getJavaTempDependencyDir() ]; } function getCsharpTempDependencyDir() { - return (0, import_path2.join)(getTemporaryDirectory(), "codeql_csharp", "repository"); + return (0, import_path3.join)(getTemporaryDirectory(), "codeql_csharp", "repository"); } async function getCsharpDependencyDirs(codeql, features) { const dirs = [ // Nuget - (0, import_path2.join)(os5.homedir(), ".nuget", "packages") + (0, import_path3.join)(os5.homedir(), ".nuget", "packages") ]; if (await features.getValue("csharp_cache_bmn" /* CsharpCacheBuildModeNone */, codeql)) { dirs.push(getCsharpTempDependencyDir()); @@ -152113,7 +153092,7 @@ var defaultCacheConfigs = { getHashPatterns: getCsharpHashPatterns }, go: { - getDependencyPaths: async () => [(0, import_path2.join)(os5.homedir(), "go", "pkg", "mod")], + getDependencyPaths: async () => [(0, import_path3.join)(os5.homedir(), "go", "pkg", "mod")], getHashPatterns: async () => internal.makePatternCheck(["**/go.sum"]) } }; @@ -152366,7 +153345,7 @@ function dbIsFinalized(config, language, logger) { const dbPath = getCodeQLDatabasePath(config, language); try { const dbInfo = load( - fs16.readFileSync(path15.resolve(dbPath, "codeql-database.yml"), "utf8") + fs17.readFileSync(path16.resolve(dbPath, "codeql-database.yml"), "utf8") ); return !("inProgress" in dbInfo); } catch { @@ -152437,7 +153416,7 @@ extensions: data: `; let data = ranges.map((range2) => { - const filename = path15.join(checkoutPath, range2.path).replaceAll(path15.sep, "/"); + const filename = path16.join(checkoutPath, range2.path).replaceAll(path16.sep, "/"); return ` - [${dump(filename, { forceQuotes: true, quoteStyle: "single" }).trim()}, ${range2.startLine}, ${range2.endLine}] `; }).join(""); @@ -152450,10 +153429,10 @@ function writeDiffRangeDataExtensionPack(logger, ranges, checkoutPath) { if (ranges.length === 0) { ranges = [{ path: "", startLine: 0, endLine: 0 }]; } - const diffRangeDir = path15.join(getTemporaryDirectory(), "pr-diff-range"); - fs16.mkdirSync(diffRangeDir, { recursive: true }); - fs16.writeFileSync( - path15.join(diffRangeDir, "qlpack.yml"), + const diffRangeDir = path16.join(getTemporaryDirectory(), "pr-diff-range"); + fs17.mkdirSync(diffRangeDir, { recursive: true }); + fs17.writeFileSync( + path16.join(diffRangeDir, "qlpack.yml"), ` name: codeql-action/pr-diff-range version: 0.0.0 @@ -152468,8 +153447,8 @@ dataExtensions: ranges, checkoutPath ); - const extensionFilePath = path15.join(diffRangeDir, "pr-diff-range.yml"); - fs16.writeFileSync(extensionFilePath, extensionContents); + const extensionFilePath = path16.join(diffRangeDir, "pr-diff-range.yml"); + fs17.writeFileSync(extensionFilePath, extensionContents); logger.debug( `Wrote pr-diff-range extension pack to ${extensionFilePath}: ${extensionContents}` @@ -152592,7 +153571,7 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir async function runInterpretResultsFor(analysis, language, queries, enableDebugLogging) { logger.info(`Interpreting ${analysis.name} results for ${language}`); const category = analysis.fixCategory(logger, automationDetailsId); - const sarifFile = path15.join( + const sarifFile = path16.join( sarifFolder, addSarifExtension(analysis, language) ); @@ -152621,7 +153600,7 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir } function getPerQueryAlertCounts(sarifPath) { const sarifObject = JSON.parse( - fs16.readFileSync(sarifPath, "utf8") + fs17.readFileSync(sarifPath, "utf8") ); const perQueryAlertCounts = {}; for (const sarifRun of sarifObject.runs) { @@ -152639,13 +153618,13 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir } async function runFinalize(features, outputDir, threadsFlag, memoryFlag, codeql, config, logger) { try { - await fs16.promises.rm(outputDir, { force: true, recursive: true }); + await fs17.promises.rm(outputDir, { force: true, recursive: true }); } catch (error3) { if (error3?.code !== "ENOENT") { throw error3; } } - await fs16.promises.mkdir(outputDir, { recursive: true }); + await fs17.promises.mkdir(outputDir, { recursive: true }); const timings = await finalizeDatabaseCreation( codeql, features, @@ -152689,7 +153668,7 @@ async function warnIfGoInstalledAfterInit(config, logger) { } // src/database-upload.ts -var fs17 = __toESM(require("fs")); +var fs18 = __toESM(require("fs")); async function cleanupAndUploadDatabases(repositoryNwo, codeql, config, apiDetails, features, logger) { if (getRequiredInput("upload-database") !== "true") { logger.debug("Database upload disabled in workflow. Skipping upload."); @@ -152725,7 +153704,7 @@ async function cleanupAndUploadDatabases(repositoryNwo, codeql, config, apiDetai const bundledDb = await bundleDb(config, language, codeql, language, { includeDiagnostics: false }); - bundledDbSize = fs17.statSync(bundledDb).size; + bundledDbSize = fs18.statSync(bundledDb).size; const commitOid = await getCommitOid( getRequiredInput("checkout_path") ); @@ -152805,7 +153784,7 @@ async function recordClearCleanupSizes(codeql, config, reports, logger) { const bundledDb = await bundleDb(config, language, codeql, language, { includeDiagnostics: false }); - report.clear_cleanup_zipped_size_bytes = fs17.statSync(bundledDb).size; + report.clear_cleanup_zipped_size_bytes = fs18.statSync(bundledDb).size; logger.debug( `Database for ${language} is ${report.clear_cleanup_zipped_size_bytes} bytes zipped at the '${"clear" /* Clear */}' cleanup level (vs. ${report.zipped_upload_size_bytes ?? "unknown"} bytes at the '${"overlay" /* Overlay */}' level).` ); @@ -152828,7 +153807,7 @@ async function uploadBundledDatabase(repositoryNwo, language, commitOid, bundled if (uploadsBaseUrl.endsWith("/")) { uploadsBaseUrl = uploadsBaseUrl.slice(0, -1); } - const bundledDbReadStream = fs17.createReadStream(bundledDb); + const bundledDbReadStream = fs18.createReadStream(bundledDb); try { const startTime = performance.now(); await client.request( @@ -152880,16 +153859,16 @@ __export(upload_lib_exports, { waitForProcessing: () => waitForProcessing, writePostProcessedFiles: () => writePostProcessedFiles }); -var fs21 = __toESM(require("fs")); -var path18 = __toESM(require("path")); +var fs22 = __toESM(require("fs")); +var path19 = __toESM(require("path")); var url = __toESM(require("url")); var import_zlib = __toESM(require("zlib")); var core15 = __toESM(require_core()); var jsonschema2 = __toESM(require_lib2()); // src/fingerprints.ts -var fs18 = __toESM(require("fs")); -var import_path3 = __toESM(require("path")); +var fs19 = __toESM(require("fs")); +var import_path4 = __toESM(require("path")); // node_modules/long/index.js var wasm = null; @@ -153876,7 +154855,7 @@ async function hash(callback, filepath) { } updateHash(current); }; - const readStream = fs18.createReadStream(filepath, "utf8"); + const readStream = fs19.createReadStream(filepath, "utf8"); for await (const data of readStream) { for (let i = 0; i < data.length; ++i) { processCharacter(data.charCodeAt(i)); @@ -153948,14 +154927,14 @@ function resolveUriToFile(location, artifacts, sourceRoot, logger) { ); return void 0; } - if (!import_path3.default.isAbsolute(uri)) { + if (!import_path4.default.isAbsolute(uri)) { uri = srcRootPrefix + uri; } - if (!fs18.existsSync(uri)) { + if (!fs19.existsSync(uri)) { logger.debug(`Unable to compute fingerprint for non-existent file: ${uri}`); return void 0; } - if (fs18.statSync(uri).isDirectory()) { + if (fs19.statSync(uri).isDirectory()) { logger.debug(`Unable to compute fingerprint for directory: ${uri}`); return void 0; } @@ -154010,21 +154989,15 @@ async function addFingerprints(sarifLog, sourceRoot, logger) { } // src/init.ts -var fs19 = __toESM(require("fs")); -var path17 = __toESM(require("path")); +var fs20 = __toESM(require("fs")); +var path18 = __toESM(require("path")); var core14 = __toESM(require_core()); var toolrunner4 = __toESM(require_toolrunner()); -var github2 = __toESM(require_github()); +var github3 = __toESM(require_github()); var io6 = __toESM(require_io()); async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion, - zstdAvailability - } = await setupCodeQL( + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = await setupCodeQL( toolsInput, apiDetails, tempDir, @@ -154042,8 +155015,7 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe codeql, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function initConfig2(actionState, inputs) { @@ -154051,16 +155023,15 @@ async function initConfig2(actionState, inputs) { return await initConfig(actionState, inputs); }); } -async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile, logger) { - fs19.mkdirSync(config.dbLocation, { recursive: true }); +async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile) { + fs20.mkdirSync(config.dbLocation, { recursive: true }); await wrapEnvironment( databaseInitEnvironment, async () => await codeql.databaseInitCluster( config, sourceRoot, processName, - qlconfigFile, - logger + qlconfigFile ) ); } @@ -154087,25 +155058,25 @@ async function checkPacksForOverlayCompatibility(codeql, config, logger) { } function checkPackForOverlayCompatibility(packDir, codeQlOverlayVersion, logger) { try { - let qlpackPath = path17.join(packDir, "qlpack.yml"); - if (!fs19.existsSync(qlpackPath)) { - qlpackPath = path17.join(packDir, "codeql-pack.yml"); + let qlpackPath = path18.join(packDir, "qlpack.yml"); + if (!fs20.existsSync(qlpackPath)) { + qlpackPath = path18.join(packDir, "codeql-pack.yml"); } const qlpackContents = load( - fs19.readFileSync(qlpackPath, "utf8") + fs20.readFileSync(qlpackPath, "utf8") ); if (!qlpackContents.buildMetadata) { return true; } - const packInfoPath = path17.join(packDir, ".packinfo"); - if (!fs19.existsSync(packInfoPath)) { + const packInfoPath = path18.join(packDir, ".packinfo"); + if (!fs20.existsSync(packInfoPath)) { logger.warning( `The query pack at ${packDir} does not have a .packinfo file, so it cannot support overlay analysis. Recompiling the query pack with the latest CodeQL CLI should solve this problem.` ); return false; } const packInfoFileContents = JSON.parse( - fs19.readFileSync(packInfoPath, "utf8") + fs20.readFileSync(packInfoPath, "utf8") ); const packOverlayVersion = packInfoFileContents.overlayVersion; if (typeof packOverlayVersion !== "number") { @@ -154130,7 +155101,7 @@ function checkPackForOverlayCompatibility(packDir, codeQlOverlayVersion, logger) } async function checkInstallPython311(languages, codeql) { if (languages.includes("python" /* python */) && process.platform === "win32" && !(await codeql.getVersion()).features?.supportsPython312) { - const script = path17.resolve( + const script = path18.resolve( __dirname, "../python-setup", "check_python12.ps1" @@ -154140,8 +155111,8 @@ async function checkInstallPython311(languages, codeql) { ]).exec(); } } -function cleanupDatabaseClusterDirectory(config, logger, options = {}, rmSync5 = fs19.rmSync) { - if (fs19.existsSync(config.dbLocation) && (fs19.statSync(config.dbLocation).isFile() || fs19.readdirSync(config.dbLocation).length > 0)) { +function cleanupDatabaseClusterDirectory(config, logger, options = {}, rmSync5 = fs20.rmSync) { + if (fs20.existsSync(config.dbLocation) && (fs20.statSync(config.dbLocation).isFile() || fs20.readdirSync(config.dbLocation).length > 0)) { if (!options.disableExistingDirectoryWarning) { logger.warning( `The database cluster directory ${config.dbLocation} must be empty. Attempting to clean it up.` @@ -154218,7 +155189,7 @@ function logFileCoverageOnPrsDeprecationWarning(logger) { if (process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION" /* DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION */]) { return; } - const repositoryOwnerType = github2.context.payload.repository?.owner.type; + const repositoryOwnerType = github3.context.payload.repository?.owner.type; let message = "Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses."; const envVarOptOut = "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`."; const repoPropertyOptOut = 'create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository\'s settings.'; @@ -154246,7 +155217,7 @@ To opt out of this change, ${envVarOptOut}`; } // src/sarif/index.ts -var fs20 = __toESM(require("fs")); +var fs21 = __toESM(require("fs")); var InvalidSarifUploadError = class extends Error { }; function getToolNames(sarifFile) { @@ -154261,7 +155232,7 @@ function getToolNames(sarifFile) { return Object.keys(toolNames); } function readSarifFile(sarifFilePath) { - return JSON.parse(fs20.readFileSync(sarifFilePath, "utf8")); + return JSON.parse(fs21.readFileSync(sarifFilePath, "utf8")); } function combineSarifFiles(sarifFiles, logger) { logger.info(`Loading SARIF file(s)`); @@ -154364,7 +155335,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo let tempDir = getTemporaryDirectory(); const config = await getConfig(tempDir, logger); if (config !== void 0) { - codeQL = await getCodeQL(config.codeQLCmd); + codeQL = await getCodeQL(logger, config.codeQLCmd); tempDir = config.tempDir; } else { logger.info( @@ -154395,10 +155366,10 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo ); codeQL = initCodeQLResult.codeql; } - const baseTempDir = path18.resolve(tempDir, "combined-sarif"); - fs21.mkdirSync(baseTempDir, { recursive: true }); - const outputDirectory = fs21.mkdtempSync(path18.resolve(baseTempDir, "output-")); - const outputFile = path18.resolve(outputDirectory, "combined-sarif.sarif"); + const baseTempDir = path19.resolve(tempDir, "combined-sarif"); + fs22.mkdirSync(baseTempDir, { recursive: true }); + const outputDirectory = fs22.mkdtempSync(path19.resolve(baseTempDir, "output-")); + const outputFile = path19.resolve(outputDirectory, "combined-sarif.sarif"); await codeQL.mergeResults(sarifFiles, outputFile, { mergeRunsFromEqualCategory: true }); @@ -154431,7 +155402,7 @@ function getAutomationID2(category, analysis_key, environment) { async function uploadPayload(payload, repositoryNwo, logger, analysis) { logger.info("Uploading results"); if (shouldSkipSarifUpload()) { - const payloadSaveFile = path18.join( + const payloadSaveFile = path19.join( getTemporaryDirectory(), `payload-${analysis.kind}.json` ); @@ -154439,7 +155410,7 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) { `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}` ); logger.info(`Payload: ${JSON.stringify(payload, null, 2)}`); - fs21.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2)); + fs22.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2)); return "dummy-sarif-id"; } const client = getApiClient(); @@ -154473,12 +155444,12 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) { function findSarifFilesInDir(sarifPath, isSarif) { const sarifFiles = []; const walkSarifFiles = (dir) => { - const entries = fs21.readdirSync(dir, { withFileTypes: true }); + const entries = fs22.readdirSync(dir, { withFileTypes: true }); for (const entry of entries) { if (entry.isFile() && isSarif(entry.name)) { - sarifFiles.push(path18.resolve(dir, entry.name)); + sarifFiles.push(path19.resolve(dir, entry.name)); } else if (entry.isDirectory()) { - walkSarifFiles(path18.resolve(dir, entry.name)); + walkSarifFiles(path19.resolve(dir, entry.name)); } } }; @@ -154486,11 +155457,11 @@ function findSarifFilesInDir(sarifPath, isSarif) { return sarifFiles; } function getSarifFilePaths(sarifPath, isSarif) { - if (!fs21.existsSync(sarifPath)) { + if (!fs22.existsSync(sarifPath)) { throw new ConfigurationError(`Path does not exist: ${sarifPath}`); } let sarifFiles; - if (fs21.lstatSync(sarifPath).isDirectory()) { + if (fs22.lstatSync(sarifPath).isDirectory()) { sarifFiles = findSarifFilesInDir(sarifPath, isSarif); if (sarifFiles.length === 0) { throw new ConfigurationError( @@ -154503,7 +155474,7 @@ function getSarifFilePaths(sarifPath, isSarif) { return sarifFiles; } async function getGroupedSarifFilePaths(logger, sarifPath) { - const stats = fs21.statSync(sarifPath, { throwIfNoEntry: false }); + const stats = fs22.statSync(sarifPath, { throwIfNoEntry: false }); if (stats === void 0) { throw new ConfigurationError(`Path does not exist: ${sarifPath}`); } @@ -154511,7 +155482,7 @@ async function getGroupedSarifFilePaths(logger, sarifPath) { if (stats.isDirectory()) { let unassignedSarifFiles = findSarifFilesInDir( sarifPath, - (name) => path18.extname(name) === ".sarif" + (name) => path19.extname(name) === ".sarif" ); logger.debug( `Found the following .sarif files in ${sarifPath}: ${unassignedSarifFiles.join(", ")}` @@ -154638,7 +155609,7 @@ function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, wo payloadObj.base_sha = mergeBaseCommitOid; } else if (process.env.GITHUB_EVENT_PATH) { const githubEvent = JSON.parse( - fs21.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8") + fs22.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8") ); payloadObj.base_ref = `refs/heads/${githubEvent.pull_request.base.ref}`; payloadObj.base_sha = githubEvent.pull_request.base.sha; @@ -154772,19 +155743,19 @@ async function uploadPostProcessedFiles(logger, checkoutPath, uploadTarget, post }; } function dumpSarifFile(sarifPayload, outputDir, logger, uploadTarget) { - if (!fs21.existsSync(outputDir)) { - fs21.mkdirSync(outputDir, { recursive: true }); - } else if (!fs21.lstatSync(outputDir).isDirectory()) { + if (!fs22.existsSync(outputDir)) { + fs22.mkdirSync(outputDir, { recursive: true }); + } else if (!fs22.lstatSync(outputDir).isDirectory()) { throw new ConfigurationError( `The path that processed SARIF files should be written to exists, but is not a directory: ${outputDir}` ); } - const outputFile = path18.resolve( + const outputFile = path19.resolve( outputDir, `upload${uploadTarget.sarifExtension}` ); logger.info(`Writing processed SARIF file to ${outputFile}`); - fs21.writeFileSync(outputFile, sarifPayload); + fs22.writeFileSync(outputFile, sarifPayload); } var STATUS_CHECK_INITIAL_BACKOFF_MILLISECONDS = 5 * 1e3; var STATUS_CHECK_BACKOFF_MULTIPLIER = 2; @@ -155019,12 +155990,12 @@ function doesGoExtractionOutputExist(config) { config, "go" /* go */ ); - const trapDirectory = import_path4.default.join( + const trapDirectory = import_path5.default.join( golangDbDirectory, "trap", "go" /* go */ ); - return fs22.existsSync(trapDirectory) && fs22.readdirSync(trapDirectory).some( + return fs23.existsSync(trapDirectory) && fs23.readdirSync(trapDirectory).some( (fileName) => [ ".trap", ".trap.gz", @@ -155101,7 +156072,7 @@ async function run({ startedAt, logger }) { "Config file could not be found at expected location. Has the 'init' action been called?" ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (hasBadExpectErrorInput()) { throw new ConfigurationError( "`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork." @@ -155172,7 +156143,7 @@ async function run({ startedAt, logger }) { dbLocations[language] = getCodeQLDatabasePath(config, language); } core16.setOutput("db-locations", dbLocations); - core16.setOutput("sarif-output", import_path4.default.resolve(outputDir)); + core16.setOutput("sarif-output", import_path5.default.resolve(outputDir)); const uploadKind = getUploadValue( getOptionalInput("upload") ); @@ -155320,12 +156291,12 @@ async function runWrapper() { } // src/analyze-action-post.ts -var fs26 = __toESM(require("fs")); +var fs27 = __toESM(require("fs")); var core18 = __toESM(require_core()); // src/debug-artifacts.ts -var fs25 = __toESM(require("fs")); -var path22 = __toESM(require("path")); +var fs26 = __toESM(require("fs")); +var path23 = __toESM(require("path")); var artifact = __toESM(require_artifact2()); var artifactLegacy = __toESM(require_artifact_client2()); var core17 = __toESM(require_core()); @@ -155339,7 +156310,7 @@ function isStream(stream2, { checkOpen = true } = {}) { } // node_modules/readdir-glob/dist/index.mjs -var fs23 = __toESM(require("fs"), 1); +var fs24 = __toESM(require("fs"), 1); var import_events = require("events"); // node_modules/readdir-glob/node_modules/balanced-match/dist/esm/index.js @@ -155412,6 +156383,7 @@ var closePattern = /\\}/g; var commaPattern = /\\,/g; var periodPattern = /\\\./g; var EXPANSION_MAX = 1e5; +var EXPANSION_MAX_LENGTH = 4e6; function numeric(str) { return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); } @@ -155446,11 +156418,11 @@ function expand2(str, options = {}) { if (!str) { return []; } - const { max = EXPANSION_MAX } = options; + const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options; if (str.slice(0, 2) === "{}") { str = "\\{\\}" + str.slice(2); } - return expand_(escapeBraces(str), max, true).map(unescapeBraces); + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); } function embrace(str) { return "{" + str + "}"; @@ -155464,19 +156436,88 @@ function lte(i, y) { function gte6(i, y) { return i >= y; } -function expand_(str, max, isTop) { - const expansions = []; - const m = balanced("{", "}", str); - if (!m) - return [str]; - const pre = m.pre; - const post = m.post.length ? expand_(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (let k = 0; k < post.length && k < max; k++) { - const expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); +function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; +} +function expandSequence(body, isAlphaSequence, max, maxLength) { + const n = body.split(/\.\./); + const N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte6; + } + const pad = n.some(isPadded); + let length = 0; + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) + break; + N.push(c); + length += c.length; + } + return N; +} +function expand_(str, max, maxLength, isTop) { + let acc = [""]; + let dropEmpties = false; + let firstGroup = true; + for (; ; ) { + const m = balanced("{", "}", str); + if (!m) { + return combine(acc, str, [""], max, maxLength, dropEmpties); + } + const pre = m.pre; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + "{" + m.body + "}", [""], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; } - } else { const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); const isSequence = isNumericSequence || isAlphaSequence; @@ -155484,75 +156525,58 @@ function expand_(str, max, isTop) { if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose + m.post; - return expand_(str, max, true); + isTop = true; + continue; } - return [str]; + return combine(acc, pre + "{" + m.body + "}" + m.post, [""], max, maxLength, dropEmpties); } - let n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + let values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts(m.body); + let n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== void 0) { - n = expand_(n[0], max, false).map(embrace); + n = expand_(n[0], max, maxLength, false).map(embrace); if (n.length === 1) { - return post.map((p) => m.pre + n[0] + p); + acc = combine(acc, pre + n[0], [""], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; } } - } - let N; - if (isSequence && n[0] !== void 0 && n[1] !== void 0) { - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte6; - } - const pad = n.some(isPadded); - N = []; - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") { - c = ""; - } - } else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join("0"); - if (i < 0) { - c = "-" + z + c.slice(1); - } else { - c = z + c; - } - } - } + let dropsEmpties = dropEmpties && !m.post.length && !pre; + for (let d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d]) { + dropsEmpties = false; } - N.push(c); } - } else { - N = []; - for (let j = 0; j < n.length; j++) { - N.push.apply(N, expand_(n[j], max, false)); - } - } - for (let j = 0; j < N.length; j++) { - for (let k = 0; k < post.length && expansions.length < max; k++) { - const expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) { - expansions.push(expansion); + values = []; + let valuesLength = 0; + outer: for (let j = 0; j < n.length; j++) { + const expanded = expand_(n[j], max, maxLength, false); + for (let k = 0; k < expanded.length; k++) { + const v = expanded[k]; + if (dropsEmpties && !v) + continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; } } } + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; } - return expansions; + return acc; } // node_modules/readdir-glob/node_modules/minimatch/dist/esm/assert-valid-pattern.js @@ -156394,11 +157418,11 @@ var qmarksTestNoExtDot = ([$0]) => { return (f) => f.length === len && f !== "." && f !== ".."; }; var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix"; -var path20 = { +var path21 = { win32: { sep: "\\" }, posix: { sep: "/" } }; -var sep6 = defaultPlatform === "win32" ? path20.win32.sep : path20.posix.sep; +var sep6 = defaultPlatform === "win32" ? path21.win32.sep : path21.posix.sep; minimatch.sep = sep6; var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **"); minimatch.GLOBSTAR = GLOBSTAR; @@ -157145,10 +158169,10 @@ minimatch.escape = escape2; minimatch.unescape = unescape2; // node_modules/readdir-glob/dist/index.mjs -var import_path5 = require("path"); +var import_path6 = require("path"); function readdir2(dir, strict) { return new Promise((resolve$1, reject) => { - fs23.readdir(dir, { withFileTypes: true }, (err, files) => { + fs24.readdir(dir, { withFileTypes: true }, (err, files) => { if (err) switch (err.code) { case "ENOTDIR": if (strict) reject(err); @@ -157171,7 +158195,7 @@ function readdir2(dir, strict) { } function getStat(file, followSymlinks) { return new Promise((resolve$1) => { - const statFunc = followSymlinks ? fs23.stat : fs23.lstat; + const statFunc = followSymlinks ? fs24.stat : fs24.lstat; statFunc(file, (err, stats) => { if (err) switch (err.code) { case "ENOENT": @@ -157186,13 +158210,13 @@ function getStat(file, followSymlinks) { }); }); } -async function* exploreWalkAsync(dir, path29, followSymlinks, useStat, shouldSkip, strict) { - let files = await readdir2(path29 + dir, strict); +async function* exploreWalkAsync(dir, path30, followSymlinks, useStat, shouldSkip, strict) { + let files = await readdir2(path30 + dir, strict); for (const file of files) { let name = file.name; const filename = dir + "/" + name; const relative3 = filename.slice(1); - const absolute = path29 + "/" + relative3; + const absolute = path30 + "/" + relative3; let stat2 = file; if (useStat || followSymlinks) stat2 = await getStat(absolute, followSymlinks) ?? stat2; if (stat2.isDirectory()) { @@ -157202,7 +158226,7 @@ async function* exploreWalkAsync(dir, path29, followSymlinks, useStat, shouldSki absolute, stat: stat2 }; - yield* exploreWalkAsync(filename, path29, followSymlinks, useStat, shouldSkip, false); + yield* exploreWalkAsync(filename, path30, followSymlinks, useStat, shouldSkip, false); } } else yield { relative: relative3, @@ -157211,8 +158235,8 @@ async function* exploreWalkAsync(dir, path29, followSymlinks, useStat, shouldSki }; } } -async function* explore(path29, followSymlinks, useStat, shouldSkip) { - yield* exploreWalkAsync("", path29, followSymlinks, useStat, shouldSkip, true); +async function* explore(path30, followSymlinks, useStat, shouldSkip) { + yield* exploreWalkAsync("", path30, followSymlinks, useStat, shouldSkip, true); } function readOptions(options) { return { @@ -157267,7 +158291,7 @@ var ReaddirGlob = class extends import_events.EventEmitter { const skipPatterns = Array.isArray(this.options.skip) ? this.options.skip : [this.options.skip]; this.skipMatchers = skipPatterns.map((skip) => new Minimatch(skip, { dot: true })); } - this.iterator = explore((0, import_path5.resolve)(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this)); + this.iterator = explore((0, import_path6.resolve)(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this)); this.paused = false; this.inactive = false; this.aborted = false; @@ -157338,10 +158362,10 @@ var src_default = readdirGlob; // node_modules/archiver/lib/core.js var import_lazystream = __toESM(require_lazystream(), 1); var import_async = __toESM(require_async(), 1); -var import_path6 = require("path"); +var import_path7 = require("path"); // node_modules/archiver/lib/error.js -var import_util32 = __toESM(require("util"), 1); +var import_util34 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157366,7 +158390,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util32.default.inherits(ArchiverError, Error); +import_util34.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -157799,11 +158823,11 @@ var Archiver = class extends import_readable_stream2.Transform { task.source = Buffer.concat([]); } else if (stats.isSymbolicLink() && this._supportsSymlink) { const linkPath = (0, import_fs2.readlinkSync)(task.filepath); - const dirName = (0, import_path6.dirname)(task.filepath); + const dirName = (0, import_path7.dirname)(task.filepath); task.data.type = "symlink"; - task.data.linkname = (0, import_path6.relative)( + task.data.linkname = (0, import_path7.relative)( dirName, - (0, import_path6.resolve)(dirName, linkPath) + (0, import_path7.resolve)(dirName, linkPath) ); task.data.sourceType = "buffer"; task.source = Buffer.concat([]); @@ -159641,9 +160665,9 @@ var ZipArchive = class extends Archiver { }; // src/artifact-scanner.ts -var fs24 = __toESM(require("fs")); +var fs25 = __toESM(require("fs")); var os6 = __toESM(require("os")); -var path21 = __toESM(require("path")); +var path22 = __toESM(require("path")); var exec = __toESM(require_exec()); var GITHUB_PAT_CLASSIC_PATTERN = { type: "Personal Access Token (Classic)" /* PersonalAccessClassic */, @@ -159688,7 +160712,7 @@ function isAuthToken(value, patterns = GITHUB_TOKEN_PATTERNS) { function scanFileForTokens(filePath, relativePath2, logger) { const findings = []; try { - const content = fs24.readFileSync(filePath, "utf8"); + const content = fs25.readFileSync(filePath, "utf8"); for (const { type, pattern } of GITHUB_TOKEN_PATTERNS) { const matches = content.match(pattern); if (matches) { @@ -159721,10 +160745,10 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log findings: [] }; try { - const tempExtractDir = fs24.mkdtempSync( - path21.join(extractDir, `extract-${depth}-`) + const tempExtractDir = fs25.mkdtempSync( + path22.join(extractDir, `extract-${depth}-`) ); - const fileName = path21.basename(archivePath).toLowerCase(); + const fileName = path22.basename(archivePath).toLowerCase(); if (fileName.endsWith(".tar.gz") || fileName.endsWith(".tgz")) { logger.debug(`Extracting tar.gz file: ${archivePath}`); await exec.exec("tar", ["-xzf", archivePath, "-C", tempExtractDir], { @@ -159741,21 +160765,21 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log ); } else if (fileName.endsWith(".zst")) { logger.debug(`Extracting zst file: ${archivePath}`); - const outputFile = path21.join( + const outputFile = path22.join( tempExtractDir, - path21.basename(archivePath, ".zst") + path22.basename(archivePath, ".zst") ); await exec.exec("zstd", ["-d", archivePath, "-o", outputFile], { silent: true }); } else if (fileName.endsWith(".gz")) { logger.debug(`Extracting gz file: ${archivePath}`); - const outputFile = path21.join( + const outputFile = path22.join( tempExtractDir, - path21.basename(archivePath, ".gz") + path22.basename(archivePath, ".gz") ); await exec.exec("gunzip", ["-c", archivePath], { - outStream: fs24.createWriteStream(outputFile), + outStream: fs25.createWriteStream(outputFile), silent: true }); } else if (fileName.endsWith(".zip")) { @@ -159776,7 +160800,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log ); result.scannedFiles += scanResult.scannedFiles; result.findings.push(...scanResult.findings); - fs24.rmSync(tempExtractDir, { recursive: true, force: true }); + fs25.rmSync(tempExtractDir, { recursive: true, force: true }); } catch (e) { logger.debug( `Could not extract or scan archive file ${archivePath}: ${getErrorMessage(e)}` @@ -159789,7 +160813,7 @@ async function scanFile(fullPath, relativePath2, extractDir, logger, depth = 0) scannedFiles: 1, findings: [] }; - const fileName = path21.basename(fullPath).toLowerCase(); + const fileName = path22.basename(fullPath).toLowerCase(); const isArchive = fileName.endsWith(".zip") || fileName.endsWith(".tar.gz") || fileName.endsWith(".tgz") || fileName.endsWith(".tar.zst") || fileName.endsWith(".zst") || fileName.endsWith(".gz"); if (isArchive) { const archiveResult = await scanArchiveFile( @@ -159811,10 +160835,10 @@ async function scanDirectory(dirPath, baseRelativePath, logger, depth = 0) { scannedFiles: 0, findings: [] }; - const entries = fs24.readdirSync(dirPath, { withFileTypes: true }); + const entries = fs25.readdirSync(dirPath, { withFileTypes: true }); for (const entry of entries) { - const fullPath = path21.join(dirPath, entry.name); - const relativePath2 = path21.join(baseRelativePath, entry.name); + const fullPath = path22.join(dirPath, entry.name); + const relativePath2 = path22.join(baseRelativePath, entry.name); if (entry.isDirectory()) { const subResult = await scanDirectory( fullPath, @@ -159828,7 +160852,7 @@ async function scanDirectory(dirPath, baseRelativePath, logger, depth = 0) { const fileResult = await scanFile( fullPath, relativePath2, - path21.dirname(fullPath), + path22.dirname(fullPath), logger, depth ); @@ -159846,11 +160870,11 @@ async function scanArtifactsForTokens(filesToScan, logger) { scannedFiles: 0, findings: [] }; - const tempScanDir = fs24.mkdtempSync(path21.join(os6.tmpdir(), "artifact-scan-")); + const tempScanDir = fs25.mkdtempSync(path22.join(os6.tmpdir(), "artifact-scan-")); try { for (const filePath of filesToScan) { - const stats = fs24.statSync(filePath); - const fileName = path21.basename(filePath); + const stats = fs25.statSync(filePath); + const fileName = path22.basename(filePath); if (stats.isDirectory()) { const dirResult = await scanDirectory(filePath, fileName, logger); result.scannedFiles += dirResult.scannedFiles; @@ -159887,7 +160911,7 @@ async function scanArtifactsForTokens(filesToScan, logger) { } } finally { try { - fs24.rmSync(tempScanDir, { recursive: true, force: true }); + fs25.rmSync(tempScanDir, { recursive: true, force: true }); } catch (e) { logger.debug( `Could not clean up temporary scan directory: ${getErrorMessage(e)}` @@ -159907,14 +160931,14 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion logger.info( "Uploading available combined SARIF files as Actions debugging artifact..." ); - const baseTempDir = path22.resolve(tempDir, "combined-sarif"); + const baseTempDir = path23.resolve(tempDir, "combined-sarif"); const toUpload = []; - if (fs25.existsSync(baseTempDir)) { - const outputDirs = fs25.readdirSync(baseTempDir); + if (fs26.existsSync(baseTempDir)) { + const outputDirs = fs26.readdirSync(baseTempDir); for (const outputDir of outputDirs) { - const sarifFiles = fs25.readdirSync(path22.resolve(baseTempDir, outputDir)).filter((f) => path22.extname(f) === ".sarif"); + const sarifFiles = fs26.readdirSync(path23.resolve(baseTempDir, outputDir)).filter((f) => path23.extname(f) === ".sarif"); for (const sarifFile of sarifFiles) { - toUpload.push(path22.resolve(baseTempDir, outputDir, sarifFile)); + toUpload.push(path23.resolve(baseTempDir, outputDir, sarifFile)); } } } @@ -159940,17 +160964,17 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion function tryPrepareSarifDebugArtifact(config, language, logger) { try { const analyzeActionOutputDir = process.env["CODEQL_ACTION_SARIF_RESULTS_OUTPUT_DIR" /* SARIF_RESULTS_OUTPUT_DIR */]; - if (analyzeActionOutputDir !== void 0 && fs25.existsSync(analyzeActionOutputDir) && fs25.lstatSync(analyzeActionOutputDir).isDirectory()) { - const sarifFile = path22.resolve( + if (analyzeActionOutputDir !== void 0 && fs26.existsSync(analyzeActionOutputDir) && fs26.lstatSync(analyzeActionOutputDir).isDirectory()) { + const sarifFile = path23.resolve( analyzeActionOutputDir, `${language}.sarif` ); - if (fs25.existsSync(sarifFile)) { - const sarifInDbLocation = path22.resolve( + if (fs26.existsSync(sarifFile)) { + const sarifInDbLocation = path23.resolve( config.dbLocation, `${language}.sarif` ); - fs25.copyFileSync(sarifFile, sarifInDbLocation); + fs26.copyFileSync(sarifFile, sarifInDbLocation); return sarifInDbLocation; } } @@ -160001,13 +161025,13 @@ async function tryUploadAllAvailableDebugArtifacts(codeql, config, logger, codeQ } logger.info("Preparing database logs debug artifact..."); const databaseDirectory = getCodeQLDatabasePath(config, language); - const logsDirectory = path22.resolve(databaseDirectory, "log"); + const logsDirectory = path23.resolve(databaseDirectory, "log"); if (doesDirectoryExist(logsDirectory)) { filesToUpload.push(...listFolder(logsDirectory)); logger.info("Database logs debug artifact ready for upload."); } logger.info("Preparing database cluster logs debug artifact..."); - const multiLanguageTracingLogsDirectory = path22.resolve( + const multiLanguageTracingLogsDirectory = path23.resolve( config.dbLocation, "log" ); @@ -160094,8 +161118,8 @@ async function uploadArtifacts(logger, toUpload, rootDir, artifactName, ghVarian try { await artifactUploader.uploadArtifact( sanitizeArtifactName(`${artifactName}${suffix}`), - toUpload.map((file) => path22.normalize(file)), - path22.normalize(rootDir), + toUpload.map((file) => path23.normalize(file)), + path23.normalize(rootDir), { // ensure we don't keep the debug artifacts around for too long since they can be large. retentionDays: 7 @@ -160122,17 +161146,17 @@ async function getArtifactUploaderClient(logger, ghVariant) { } async function createPartialDatabaseBundle(config, language) { const databasePath = getCodeQLDatabasePath(config, language); - const databaseBundlePath = path22.resolve( + const databaseBundlePath = path23.resolve( config.dbLocation, `${config.debugDatabaseName}-${language}-partial.zip` ); core17.info( `${config.debugDatabaseName}-${language} is not finalized. Uploading partial database bundle at ${databaseBundlePath}...` ); - if (fs25.existsSync(databaseBundlePath)) { - await fs25.promises.rm(databaseBundlePath, { force: true }); + if (fs26.existsSync(databaseBundlePath)) { + await fs26.promises.rm(databaseBundlePath, { force: true }); } - const output = fs25.createWriteStream(databaseBundlePath); + const output = fs26.createWriteStream(databaseBundlePath); const zip = new ZipArchive(); zip.on("error", (err) => { throw err; @@ -160171,7 +161195,7 @@ async function runWrapper2() { logger ); if (config !== void 0) { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); const version = await codeql.getVersion(); await uploadCombinedSarifArtifacts( logger, @@ -160185,9 +161209,9 @@ async function runWrapper2() { getCsharpTempDependencyDir() ]; for (const tempDependencyDir of tempDependencyDirs) { - if (fs26.existsSync(tempDependencyDir)) { + if (fs27.existsSync(tempDependencyDir)) { try { - fs26.rmSync(tempDependencyDir, { recursive: true }); + fs27.rmSync(tempDependencyDir, { recursive: true }); } catch (error3) { logger.info( `Failed to remove temporary dependencies directory: ${getErrorMessage(error3)}` @@ -160251,7 +161275,7 @@ async function run2({ startedAt, logger }) { "Config file could not be found at expected location. Has the 'init' action been called?" ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); languages = await determineAutobuildLanguages(codeql, config, logger); if (languages !== void 0) { const workingDirectory = getOptionalInput("working-directory"); @@ -160294,16 +161318,49 @@ async function runWrapper3() { } // src/init-action.ts -var fs28 = __toESM(require("fs")); -var path24 = __toESM(require("path")); +var fs29 = __toESM(require("fs")); +var path25 = __toESM(require("path")); var core21 = __toESM(require_core()); -var github3 = __toESM(require_github()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); +// src/config/inputs.ts +async function getToolsInput(action, repositoryProperties) { + const name = "tools" /* Tools */; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties["github-codeql-tools" /* TOOLS */]; + const allowRepositoryProperty = await action.features.getValue( + "tools_repository_property" /* ToolsRepositoryProperty */ + ); + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}` + ); + return { + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: "repository-property" /* RepositoryProperty */ + }; + } + if (input !== void 0) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { value: input, source: "workflow" /* Workflow */ }; + } + if (allowRepositoryProperty && propertyValue !== void 0) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}` + ); + return { + value: propertyValue, + source: "repository-property" /* RepositoryProperty */ + }; + } + return void 0; +} + // src/workflow.ts -var fs27 = __toESM(require("fs")); -var path23 = __toESM(require("path")); +var fs28 = __toESM(require("fs")); +var path24 = __toESM(require("path")); var import_zlib3 = __toESM(require("zlib")); var core20 = __toESM(require_core()); function toCodedErrors(errors) { @@ -160454,15 +161511,15 @@ async function getWorkflow(logger) { ); } const workflowPath = await getWorkflowAbsolutePath(logger); - return load(fs27.readFileSync(workflowPath, "utf-8")); + return load(fs28.readFileSync(workflowPath, "utf-8")); } async function getWorkflowAbsolutePath(logger) { const relativePath2 = await getWorkflowRelativePath(); - const absolutePath = path23.join( + const absolutePath = path24.join( getRequiredEnvParam("GITHUB_WORKSPACE"), relativePath2 ); - if (fs27.existsSync(absolutePath)) { + if (fs28.existsSync(absolutePath)) { logger.debug( `Derived the following absolute path for the currently executing workflow: ${absolutePath}.` ); @@ -160591,7 +161648,7 @@ async function sendStartingStatusReport(startedAt, config, logger) { await sendStatusReport(statusReportBase); } } -async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { +async function sendCompletedStatusReport2(startedAt, config, configFile, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { const statusReportBase = await createStatusReportBase( "init" /* Init */, getActionsStatus(error3), @@ -160608,11 +161665,14 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDo const workflowLanguages = getOptionalInput("languages"); const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: workflowLanguages || "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -160648,11 +161708,11 @@ async function run3(actionState) { let codeql; let features; let sourceRoot; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; let toolsVersion; - let zstdAvailability; try { initializeEnvironment(getActionVersion()); persistInputs(); @@ -160677,16 +161737,8 @@ async function run3(actionState) { logger ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core21.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties - ); - sourceRoot = path24.resolve( + sourceRoot = path25.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), getOptionalInput("source-root") || "" ); @@ -160698,12 +161750,22 @@ async function run3(actionState) { `Failed to parse analysis kinds for 'starting' status report: ${getErrorMessage(err)}` ); } + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties, + analysisKinds + ); await sendStartingStatusReport(startedAt, { analysisKinds }, logger); if (process.env["CODEQL_ACTION_SETUP_CODEQL_HAS_RUN" /* SETUP_CODEQL_ACTION_HAS_RUN */] === "true") { throw new ConfigurationError( `The 'init' action should not be run in the same workflow as 'setup-codeql'.` ); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -160711,7 +161773,7 @@ async function run3(actionState) { ); const useOverlayAwareDefaultCliVersion = analysisKinds?.length === 1 && analysisKinds[0] === "code-scanning" /* CodeScanning */; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -160725,7 +161787,6 @@ async function run3(actionState) { toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; await checkWorkflow(logger, codeql); if ( // Only enable the experimental features env variable for Rust analysis if the user has explicitly @@ -160856,19 +161917,6 @@ async function run3(actionState) { if (config.overlayDatabaseMode !== "overlay" /* Overlay */) { cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport - ) - ); - } const goFlags = process.env["GOFLAGS"]; if (goFlags) { core21.exportVariable("GOFLAGS", goFlags); @@ -160885,21 +161933,21 @@ async function run3(actionState) { )) { try { logger.debug(`Applying static binary workaround for Go`); - const tempBinPath = path24.resolve( + const tempBinPath = path25.resolve( getTemporaryDirectory(), "codeql-action-go-tracing", "bin" ); - fs28.mkdirSync(tempBinPath, { recursive: true }); + fs29.mkdirSync(tempBinPath, { recursive: true }); core21.addPath(tempBinPath); - const goWrapperPath = path24.resolve(tempBinPath, "go"); - fs28.writeFileSync( + const goWrapperPath = path25.resolve(tempBinPath, "go"); + fs29.writeFileSync( goWrapperPath, `#!/bin/bash exec ${goBinaryPath} "$@"` ); - fs28.chmodSync(goWrapperPath, "755"); + fs29.chmodSync(goWrapperPath, "755"); core21.exportVariable("CODEQL_ACTION_GO_BINARY" /* GO_BINARY_LOCATION */, goWrapperPath); } catch (e) { logger.warning( @@ -160997,8 +162045,7 @@ exec ${goBinaryPath} "$@"` config, sourceRoot, "Runner.Worker.exe", - qlconfigFile, - logger + qlconfigFile ); if (config.overlayDatabaseMode !== "none" /* None */ && !await checkPacksForOverlayCompatibility(codeql, config, logger)) { logger.info( @@ -161014,8 +162061,7 @@ exec ${goBinaryPath} "$@"` config, sourceRoot, "Runner.Worker.exe", - qlconfigFile, - logger + qlconfigFile ); } const tracerConfig = await getCombinedTracerConfig(codeql, config); @@ -161043,6 +162089,7 @@ exec ${goBinaryPath} "$@"` config, void 0, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161060,6 +162107,7 @@ exec ${goBinaryPath} "$@"` startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161069,36 +162117,6 @@ exec ${goBinaryPath} "$@"` logger ); } -async function loadRepositoryProperties(repositoryNwo, logger) { - const repositoryOwnerType = github3.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." - ); - return new Success({}); - } - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error3) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error3)}` - ); - return new Failure(error3); - } -} -async function recordZstdAvailability(config, zstdAvailability) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability - ) - ); -} var init = { name: "init" /* Init */, run: run3 @@ -161112,8 +162130,8 @@ async function runWrapper4() { var core22 = __toESM(require_core()); // src/init-action-post-helper.ts -var fs29 = __toESM(require("fs")); -var import_path7 = __toESM(require("path")); +var fs30 = __toESM(require("fs")); +var import_path8 = __toESM(require("path")); var github4 = __toESM(require_github()); function createFailedUploadFailedSarifResult(error3) { const wrappedError = wrapError(error3); @@ -161145,6 +162163,7 @@ async function prepareFailedSarif(logger, features, config) { const category = `/language:${language}`; const checkoutPath = "."; const result = await generateFailedSarif( + logger, features, config, category, @@ -161165,6 +162184,7 @@ async function prepareFailedSarif(logger, features, config) { const category = getCategoryInputOrThrow(workflow, jobName, matrix); const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); const result = await generateFailedSarif( + logger, features, config, category, @@ -161173,9 +162193,9 @@ async function prepareFailedSarif(logger, features, config) { return new Success(result); } } -async function generateFailedSarif(features, config, category, checkoutPath, sarifFile) { +async function generateFailedSarif(logger, features, config, category, checkoutPath, sarifFile) { const databasePath = config.dbLocation; - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (sarifFile === void 0) { sarifFile = "../codeql-failed-run.sarif"; } @@ -161224,8 +162244,8 @@ async function maybeUploadFailedSarifArtifact(config, features, logger) { const name = sanitizeArtifactName(`sarif-artifact-${suffix}`); await client.uploadArtifact( name, - [import_path7.default.normalize(failedSarif.sarifFile)], - import_path7.default.normalize("..") + [import_path8.default.normalize(failedSarif.sarifFile)], + import_path8.default.normalize("..") ); return { sarifID: name }; } @@ -161300,7 +162320,7 @@ async function uploadFailureInfo(uploadAllAvailableDebugArtifacts, printDebugLog } if (isSelfHostedRunner()) { try { - fs29.rmSync(config.dbLocation, { + fs30.rmSync(config.dbLocation, { recursive: true, force: true, maxRetries: 3 @@ -161441,7 +162461,7 @@ async function run4(startedAt) { "Debugging artifacts are unavailable since the 'init' Action failed before it could produce any." ); } else { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); uploadFailedSarifResult = await uploadFailureInfo( tryUploadAllAvailableDebugArtifacts, printDebugLogs, @@ -161544,7 +162564,7 @@ var core23 = __toESM(require_core()); // src/resolve-environment.ts async function runResolveBuildEnvironment(cmd, logger, workingDir, language) { logger.startGroup(`Attempting to resolve build environment for ${language}`); - const codeql = await getCodeQL(cmd); + const codeql = await getCodeQL(logger, cmd); if (workingDir !== void 0) { logger.info(`Using ${workingDir} as the working directory.`); } @@ -161649,7 +162669,7 @@ async function runWrapper6() { // src/setup-codeql-action.ts var core24 = __toESM(require_core()); -async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { +async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, getActionsStatus(error3), @@ -161665,11 +162685,14 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -161679,11 +162702,10 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } await sendStatusReport({ ...initStatusReport, ...initToolsDownloadFields }); } -async function run6({ - startedAt, - logger -}) { +async function run6(actionState) { + const { logger, startedAt } = actionState; let codeql; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -161706,9 +162728,12 @@ async function run6({ getTemporaryDirectory(), logger ); - const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + const actionStateWithFeatures = { ...actionState, features }; const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, "starting", @@ -161720,6 +162745,10 @@ async function run6({ if (statusReportBase !== void 0) { await sendStatusReport(statusReportBase); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -161727,7 +162756,7 @@ async function run6({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161764,6 +162793,7 @@ async function run6({ } await sendCompletedStatusReport3( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161782,150 +162812,14 @@ async function runWrapper7() { // src/start-proxy-action.ts var import_child_process2 = require("child_process"); -var path28 = __toESM(require("path")); +var path29 = __toESM(require("path")); var core27 = __toESM(require_core()); // src/start-proxy.ts -var path26 = __toESM(require("path")); +var path27 = __toESM(require("path")); var core26 = __toESM(require_core()); var toolcache4 = __toESM(require_tool_cache()); -// src/start-proxy/types.ts -var usernameSchema = { - /** The username needed to authenticate to the package registry, if any. */ - username: optionalOrNull(string) -}; -function hasUsername(config) { - return "username" in config; -} -var usernamePasswordSchema = { - /** The password needed to authenticate to the package registry, if any. */ - password: optionalOrNull(string), - ...usernameSchema -}; -function hasUsernameAndPassword(config) { - return hasUsername(config) && "password" in config; -} -var tokenSchema = { - /** The token needed to authenticate to the package registry, if any. */ - token: optionalOrNull(string), - ...usernameSchema -}; -function hasToken(config) { - return "token" in config; -} -function isToken(config) { - return "token" in config && validateSchema(tokenSchema, config); -} -var azureConfigSchema = { - "tenant-id": string, - "client-id": string -}; -function isAzureConfig(config) { - return validateSchema(azureConfigSchema, config); -} -var awsConfigSchema = { - "aws-region": string, - "account-id": string, - "role-name": string, - domain: string, - "domain-owner": string, - audience: optionalOrNull(string) -}; -function isAWSConfig(config) { - return validateSchema(awsConfigSchema, config); -} -var jfrogConfigSchema = { - "jfrog-oidc-provider-name": string, - audience: optionalOrNull(string), - "identity-mapping-name": optionalOrNull(string) -}; -function isJFrogConfig(config) { - return validateSchema(jfrogConfigSchema, config); -} -var cloudsmithConfigSchema = { - namespace: string, - "service-slug": string, - "api-host": string -}; -function isCloudsmithConfig(config) { - return validateSchema(cloudsmithConfigSchema, config); -} -var gcpConfigSchema = { - "workload-identity-provider": string, - "service-account": optionalOrNull(string), - audience: optionalOrNull(string) -}; -function isGCPConfig(config) { - return validateSchema(gcpConfigSchema, config); -} -var oidcSchemas = [ - { schema: azureConfigSchema, name: "Azure" }, - { schema: awsConfigSchema, name: "AWS" }, - { schema: jfrogConfigSchema, name: "JFrog" }, - { schema: cloudsmithConfigSchema, name: "Cloudsmith" }, - { schema: gcpConfigSchema, name: "GCP" } -]; -function credentialToStr(credential) { - let result = `Type: ${credential.type};`; - const appendIfDefined = (name, val) => { - if (isDefined2(val)) { - result += ` ${name}: ${val};`; - } - }; - appendIfDefined("Url", credential.url); - appendIfDefined("Host", credential.host); - if (hasUsername(credential)) { - appendIfDefined("Username", credential.username); - } - if ("password" in credential) { - appendIfDefined( - "Password", - isDefined2(credential.password) ? "***" : void 0 - ); - } - if (hasToken(credential)) { - appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0); - } - if (isAzureConfig(credential)) { - appendIfDefined("Tenant", credential["tenant-id"]); - appendIfDefined("Client", credential["client-id"]); - } else if (isAWSConfig(credential)) { - appendIfDefined("AWS Region", credential["aws-region"]); - appendIfDefined("AWS Account", credential["account-id"]); - appendIfDefined("AWS Role", credential["role-name"]); - appendIfDefined("AWS Domain", credential.domain); - appendIfDefined("AWS Domain Owner", credential["domain-owner"]); - appendIfDefined("AWS Audience", credential.audience); - } else if (isJFrogConfig(credential)) { - appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]); - appendIfDefined( - "JFrog Identity Mapping", - credential["identity-mapping-name"] - ); - appendIfDefined("JFrog Audience", credential.audience); - } else if (isCloudsmithConfig(credential)) { - appendIfDefined("Cloudsmith Namespace", credential.namespace); - appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]); - appendIfDefined("Cloudsmith API Host", credential["api-host"]); - } else if (isGCPConfig(credential)) { - appendIfDefined( - "GCP Workload Identity Provider", - credential["workload-identity-provider"] - ); - appendIfDefined("GCP Service Account", credential["service-account"]); - appendIfDefined("GCP Audience", credential.audience); - } - return result; -} -function getAddressString(address) { - if (address.url === void 0) { - return address.host; - } else { - return address.url; - } -} - // src/start-proxy/validation.ts var core25 = __toESM(require_core()); function cloneCredential(schema, obj) { @@ -162260,7 +163154,7 @@ async function getProxyBinaryPath(logger, features) { proxyInfo.version ); } - return path26.join(proxyBin, proxyFileName); + return path27.join(proxyBin, proxyFileName); } // src/start-proxy/ca.ts @@ -162325,8 +163219,8 @@ function generateCertificateAuthority() { } // src/start-proxy/environment.ts -var fs30 = __toESM(require("fs")); -var path27 = __toESM(require("path")); +var fs31 = __toESM(require("fs")); +var path28 = __toESM(require("path")); var toolrunner5 = __toESM(require_toolrunner()); var io8 = __toESM(require_io()); function checkEnvVar(logger, name) { @@ -162391,16 +163285,16 @@ function discoverActionsJdks() { function checkJdkSettings(logger, jdkHome) { const filesToCheck = [ // JDK 9+ - path27.join("conf", "net.properties"), + path28.join("conf", "net.properties"), // JDK 8 and below - path27.join("lib", "net.properties") + path28.join("lib", "net.properties") ]; for (const fileToCheck of filesToCheck) { - const file = path27.join(jdkHome, fileToCheck); + const file = path28.join(jdkHome, fileToCheck); try { - if (fs30.existsSync(file)) { + if (fs31.existsSync(file)) { logger.debug(`Found '${file}'.`); - const lines = String(fs30.readFileSync(file)).split("\n"); + const lines = String(fs31.readFileSync(file)).split("\n"); for (const line of lines) { for (const property of javaProperties) { if (line.startsWith(`${property}=`)) { @@ -162468,7 +163362,7 @@ async function checkProxyEnvironment(logger, language) { // src/start-proxy/reachability.ts var https2 = __toESM(require("https")); -var import_https_proxy_agent = __toESM(require_dist2()); +var import_https_proxy_agent = __toESM(require_dist3()); var connectionTestConfig = { nuget_feed: { path: "v3/index.json" } }; @@ -162574,14 +163468,15 @@ async function checkConnections(logger, proxy, backend) { } // src/start-proxy-action.ts -async function run7(startedAt) { - const logger = getActionsLogger(); +async function run7(action) { + const startedAt = action.startedAt; + const logger = action.logger; let features; let language; try { persistInputs(); const tempDir = getTemporaryDirectory(); - const proxyLogFilePath = path28.resolve(tempDir, "proxy.log"); + const proxyLogFilePath = path29.resolve(tempDir, "proxy.log"); core27.saveState("proxy-log-file", proxyLogFilePath); const repositoryNwo = getRepositoryNwo(); const gitHubVersion = await getGitHubVersion(); @@ -162641,20 +163536,13 @@ async function run7(startedAt) { await sendFailedStatusReport(logger, startedAt, language, unwrappedError); } } +var startProxyAction = { + name: "start-proxy" /* StartProxy */, + run: run7, + transformTelemetryError: getSafeErrorMessage +}; async function runWrapper8() { - const startedAt = /* @__PURE__ */ new Date(); - const logger = getActionsLogger(); - try { - await run7(startedAt); - } catch (error3) { - core27.setFailed(`start-proxy action failed: ${getErrorMessage(error3)}`); - await sendUnhandledErrorStatusReport( - "start-proxy" /* StartProxy */, - startedAt, - getSafeErrorMessage(wrapError(error3)), - logger - ); - } + await runInActions(startProxyAction); } async function startProxy(binPath, config, logFilePath, logger) { const host = "127.0.0.1"; @@ -162946,6 +163834,13 @@ undici/lib/web/fetch/body.js: undici/lib/web/websocket/frame.js: (*! ws. MIT License. Einar Otto Stangvik *) +content-type/dist/index.js: + (*! + * content-type + * Copyright(c) 2015 Douglas Christopher Wilson + * MIT Licensed + *) + @octokit/request-error/dist-src/index.js: (* v8 ignore else -- @preserve -- Bug with vitest coverage where it sees an else branch that doesn't exist *) @@ -162953,6 +163848,9 @@ undici/lib/web/websocket/frame.js: (* v8 ignore next -- @preserve *) (* v8 ignore else -- @preserve *) +@octokit/graphql/dist-bundle/index.js: + (* v8 ignore if -- @preserve *) + normalize-path/index.js: (*! * normalize-path @@ -163036,7 +163934,7 @@ tmp/lib/tmp.js: *) js-yaml/dist/js-yaml.mjs: - (*! js-yaml 5.2.1 https://github.com/nodeca/js-yaml @license MIT *) + (*! js-yaml 5.2.3 https://github.com/nodeca/js-yaml @license MIT *) long/index.js: (** diff --git a/package-lock.json b/package-lock.json index d08a05a351..6a74ca0270 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.3", + "version": "4.37.8", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.3", + "version": "4.37.8", "license": "MIT", "workspaces": [ "pr-checks" @@ -14,7 +14,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -22,21 +22,21 @@ "@actions/http-client": "^3.0.0", "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", - "@octokit/plugin-retry": "^8.1.0", + "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.1", + "js-yaml": "^5.2.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", "semver": "^7.8.5", - "undici": "^6.24.0", + "undici": "^6.28.0", "uuid": "^14.0.1" }, "devDependencies": { @@ -50,22 +50,22 @@ "@types/node": "^20.19.43", "@types/node-forge": "^1.3.14", "@types/sarif": "^2.1.7", - "@types/semver": "^7.7.1", + "@types/semver": "^7.8.0", "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.7.0", - "nock": "^14.0.16", - "sinon": "^22.0.0", + "globals": "^17.9.0", + "nock": "^14.0.17", + "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.66.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -374,9 +374,9 @@ "license": "Apache-2.0" }, "node_modules/@actions/artifact/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -459,9 +459,9 @@ } }, "node_modules/@actions/cache": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.1.0.tgz", - "integrity": "sha512-kTIj4YPrjjRPKSGlj7f8eq+Pijoy/SKBEbJcAwNsQTFGEF29NGqj1mqD02/PmhV6r4bRAixycexAWpmUJ2aCwg==", + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz", + "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==", "license": "MIT", "dependencies": { "@actions/core": "^2.0.0", @@ -1498,9 +1498,9 @@ } }, "node_modules/@eslint/eslintrc": { - "version": "3.3.5", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz", - "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==", + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", + "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", "dev": true, "license": "MIT", "dependencies": { @@ -1510,7 +1510,7 @@ "globals": "^14.0.0", "ignore": "^5.2.0", "import-fresh": "^3.2.1", - "js-yaml": "^4.1.1", + "js-yaml": "^4.3.0", "minimatch": "^3.1.5", "strip-json-comments": "^3.1.1" }, @@ -1526,6 +1526,7 @@ "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", "dev": true, + "license": "MIT", "engines": { "node": ">=18" }, @@ -1534,9 +1535,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { @@ -1557,9 +1558,9 @@ } }, "node_modules/@eslint/js": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz", - "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz", + "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==", "dev": true, "license": "MIT", "engines": { @@ -1979,9 +1980,9 @@ } }, "node_modules/@microsoft/eslint-formatter-sarif/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -2086,16 +2087,16 @@ } }, "node_modules/@octokit/core": { - "version": "7.0.6", - "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz", - "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==", + "version": "7.0.7", + "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.7.tgz", + "integrity": "sha512-DcB0M3KFgr9ECI328lhBMVsyFT2DnmNucSBTqEN3exyNKUzkkpUSCHmTRcunF41Eou2TIQKW4seewri8ON9bSA==", "license": "MIT", "dependencies": { "@octokit/auth-token": "^6.0.0", - "@octokit/graphql": "^9.0.3", - "@octokit/request": "^10.0.6", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", + "@octokit/graphql": "^9.0.4", + "@octokit/request": "^10.0.13", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", "before-after-hook": "^4.0.0", "universal-user-agent": "^7.0.0" }, @@ -2103,6 +2104,21 @@ "node": ">= 20" } }, + "node_modules/@octokit/core/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/core/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/core/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2110,18 +2126,33 @@ "license": "ISC" }, "node_modules/@octokit/endpoint": { - "version": "11.0.2", - "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz", - "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==", + "version": "11.0.4", + "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.4.tgz", + "integrity": "sha512-f1cOWoHPmxryJFknxbtDdjODWfV8A9tc8Aae6ermXPNgHFZ/x91AtHIz4gicEjL8hkJiip+u21QHJORfBv/qiA==", "license": "MIT", "dependencies": { - "@octokit/types": "^16.0.0", + "@octokit/types": "^17.0.0", "universal-user-agent": "^7.0.2" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/endpoint/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/endpoint/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2129,19 +2160,34 @@ "license": "ISC" }, "node_modules/@octokit/graphql": { - "version": "9.0.3", - "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz", - "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==", + "version": "9.0.4", + "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.4.tgz", + "integrity": "sha512-5s15CCiY8XXQ+FG+b1YQcl6Z2FA++nwAz/tg2VUrTmnMncP+2nnGUEYANImdnxsA2Fnq+Mbl7hDjUTw7cFAwcg==", "license": "MIT", "dependencies": { - "@octokit/request": "^10.0.6", - "@octokit/types": "^16.0.0", + "@octokit/request": "^10.0.13", + "@octokit/types": "^17.0.0", "universal-user-agent": "^7.0.0" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/graphql/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/graphql/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2194,13 +2240,13 @@ } }, "node_modules/@octokit/plugin-retry": { - "version": "8.1.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz", - "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==", + "version": "8.1.1", + "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.1.tgz", + "integrity": "sha512-VCVvZ/R1+u3WuiBWpNavZ0mY4aaJNAsENrpBP9aLSR2QyOpQgd7DhM5j4AW7z4MQpnJYgwBPf0XqPQoNBRdQwg==", "license": "MIT", "dependencies": { - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", "bottleneck": "^2.15.3" }, "engines": { @@ -2210,16 +2256,32 @@ "@octokit/core": ">=7" } }, + "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/request": { - "version": "10.0.7", - "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz", - "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==", + "version": "10.0.13", + "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.13.tgz", + "integrity": "sha512-v2269YxL9Yf+x3d+gRI63FP0vFQEiWgLyBzxe/Y+0yFDg2B/Tzf5dhh9VNfccVAQnfcfwQWyk/y6Bn7rUXXs7A==", "license": "MIT", "dependencies": { - "@octokit/endpoint": "^11.0.2", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", - "fast-content-type-parse": "^3.0.0", + "@octokit/endpoint": "^11.0.3", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", + "content-type": "^2.0.0", + "json-with-bigint": "^3.5.3", "universal-user-agent": "^7.0.2" }, "engines": { @@ -2227,17 +2289,47 @@ } }, "node_modules/@octokit/request-error": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz", - "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==", + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.1.tgz", + "integrity": "sha512-+eaY7G2VVpSf2pc5Gn1+mph837V/d/TYTJAgWL9Tb0ogGYcpN3IlAVFgjL+Vv93F/sevrxkvsYCedtpLdcFLzA==", "license": "MIT", "dependencies": { - "@octokit/types": "^16.0.0" + "@octokit/types": "^17.0.0" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/request-error/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, + "node_modules/@octokit/request/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/request/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/request/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2569,9 +2661,9 @@ "license": "MIT" }, "node_modules/@types/semver": { - "version": "7.7.1", - "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz", - "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==", + "version": "7.8.0", + "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.8.0.tgz", + "integrity": "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==", "dev": true, "license": "MIT" }, @@ -2591,17 +2683,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.63.0.tgz", - "integrity": "sha512-rvwSgqT+DHpWdzfSzPatRLm02a0GlESt++9iy3hLCDY4BgkaLcl8LBi9Yh7XGFBpwcBE/K3024QuXWTpbz4FfQ==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.66.0.tgz", + "integrity": "sha512-p088eaGrzYz1s+7cov0aMOCkNGTJlVxF4jgubf28c8L0Cv9Rloj8YBHnv4hXLq6IIEE1AsjNWavO+k+8kP2Y0A==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/type-utils": "8.63.0", - "@typescript-eslint/utils": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/type-utils": "8.66.0", + "@typescript-eslint/utils": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2706,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.63.0", + "@typescript-eslint/parser": "^8.66.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2722,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.63.0.tgz", - "integrity": "sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.66.0.tgz", + "integrity": "sha512-X6ypGChaWYk6PBtUg2BwuTZEFFcHJAtGTVJ9/lCTOufhZ4i9fNolQNnktq+kkMCwMj7V8Svsq7+TxSDslmhE0g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2765,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.63.0.tgz", - "integrity": "sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.66.0.tgz", + "integrity": "sha512-7MthGPTt4BP69lSryqpqq8HQqxuzynssckL/jyDyk3+TNMQ3y2jFWkptCrktWvBrP+EH787Nl5N5Qpw7WZg+5g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.63.0", - "@typescript-eslint/types": "^8.63.0", + "@typescript-eslint/tsconfig-utils": "^8.66.0", + "@typescript-eslint/types": "^8.66.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2805,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.63.0.tgz", - "integrity": "sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.66.0.tgz", + "integrity": "sha512-8TGcH25j9zqJ/IULB/ppyhRvxA8QYfFEZ7nfbg6/BN9spDgb8fPWQXlE5l8TWBL50EtUx007uZ1o9VOwrq2/9g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0" + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2823,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.63.0.tgz", - "integrity": "sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.66.0.tgz", + "integrity": "sha512-9D5gLYZG4rOjcoag8MQ/fWI8WqA9wcPDyOGyWtWFhvM1lHRbliqUSPIY5J3zqCU1tvSwzXxnnjhQhz5Ne7mJ4g==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2840,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.63.0.tgz", - "integrity": "sha512-Nzzh/OGxVCOjObjaj1CQF2RUasyYy2Jfuh+zZ3PjLzG2fYRriAiZLib9UKtO+CpQAS3YHiAS+ckZDclwqI1TPA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.66.0.tgz", + "integrity": "sha512-LG2dWfjZQQp0ADtAu/EWJVayefGL2UEZ3CDeI44D9v3rXB/WYUqE/jpO28KrEKul5AySrmI+Zh1v6v+xW2U9+g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/utils": "8.66.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2883,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz", - "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.66.0.tgz", + "integrity": "sha512-H6gcYaSDOyvL3AD/jHUtUFo2jqGgn/F6nuyuZSu0QTesxL+cP4dQoIMrODRofuJC09g64+WgZ6tE19Y1N2YIFQ==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2897,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.63.0.tgz", - "integrity": "sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.66.0.tgz", + "integrity": "sha512-8/x4INiiQb10jGgXYD7116/zQ+OL84ZIFn0za68wwFHCanT/VLbBEroWht8RV8fn0/ZCAoazHLQgwUC0UQcDfg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.63.0", - "@typescript-eslint/tsconfig-utils": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/project-service": "8.66.0", + "@typescript-eslint/tsconfig-utils": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2843,16 +2935,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/debug": { @@ -2874,13 +2966,13 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { - "version": "10.2.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz", - "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==", + "version": "10.2.6", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", + "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.5" + "brace-expansion": "^5.0.8" }, "engines": { "node": "18 || 20 || >=22" @@ -2890,16 +2982,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.63.0.tgz", - "integrity": "sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.66.0.tgz", + "integrity": "sha512-jasearZPolBw5NJNYGMwxzHMF83niVWmMU1VdHzG1CyfI2VS7f7nZltnKtHcg20hW+7Uo5GfK4MeDPoU3qI8EA==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0" + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +3006,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.63.0.tgz", - "integrity": "sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.66.0.tgz", + "integrity": "sha512-dkKR8q+lKciskj1Y3vthHktl+3cMLWGyVUP23bRiPZ5O9BRT++4EqDDV+TVeIKBL1VXVEqrJlz8MYbcnvJcAlg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", + "@typescript-eslint/types": "8.66.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -3864,9 +3956,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -4293,6 +4385,19 @@ "node": "^14.18.0 || >=16.10.0" } }, + "node_modules/content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, "node_modules/convert-to-spaces": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/convert-to-spaces/-/convert-to-spaces-2.0.1.tgz", @@ -4766,9 +4871,9 @@ } }, "node_modules/eslint": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz", - "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz", + "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==", "dev": true, "license": "MIT", "dependencies": { @@ -4777,8 +4882,8 @@ "@eslint/config-array": "^0.21.2", "@eslint/config-helpers": "^0.4.2", "@eslint/core": "^0.17.0", - "@eslint/eslintrc": "^3.3.5", - "@eslint/js": "9.39.4", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "9.39.5", "@eslint/plugin-kit": "^0.4.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", @@ -4988,15 +5093,15 @@ } }, "node_modules/eslint-plugin-github": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.0.tgz", - "integrity": "sha512-+mA0K1/I1JSE9AOiJ4ifMDGu7NplRZX0e3Uy0SjbwyXb2rsDfo5yfT0UCUO+TiOJ/99R1YxFRltizP/PZuB4PQ==", + "version": "6.1.2", + "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.2.tgz", + "integrity": "sha512-XU1fVItfnwYWXG0GqH0MV2VY9EzvgbPxDnUJ9I1915Cpn24z13Vgx1pttrdQy6bhLmDYp+Wl7pX/L1YMKdG+6g==", "dev": true, "license": "MIT", "dependencies": { "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.1.0", - "@eslint/js": "^9.14.0", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "^9.39.5", "@github/browserslist-config": "^1.0.0", "@typescript-eslint/eslint-plugin": "^8.0.0", "@typescript-eslint/parser": "^8.0.0", @@ -5115,16 +5220,16 @@ } }, "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/eslint-plugin-import-x/node_modules/minimatch": { @@ -5590,22 +5695,6 @@ "url": "https://github.com/sindresorhus/execa?sponsor=1" } }, - "node_modules/fast-content-type-parse": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz", - "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "MIT" - }, "node_modules/fast-deep-equal": { "version": "3.1.3", "license": "MIT" @@ -6051,15 +6140,15 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/glob/node_modules/minimatch": { @@ -6078,9 +6167,9 @@ } }, "node_modules/globals": { - "version": "17.7.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz", - "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==", + "version": "17.9.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.9.0.tgz", + "integrity": "sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==", "dev": true, "license": "MIT", "engines": { @@ -6921,9 +7010,9 @@ } }, "node_modules/js-yaml": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz", - "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==", + "version": "5.2.3", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz", + "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==", "funding": [ { "type": "github", @@ -6984,6 +7073,12 @@ "dev": true, "license": "ISC" }, + "node_modules/json-with-bigint": { + "version": "3.5.10", + "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.10.tgz", + "integrity": "sha512-Vcx+JVNEBts/xfcoCS69sKrOhOk/3TVlvlT+XzUOefVKnnrbYSCKpDCm10pohsJFtsJVYnwa/cXRZ4eElzaM6w==", + "license": "MIT" + }, "node_modules/json5": { "version": "1.0.2", "dev": true, @@ -7386,9 +7481,9 @@ "license": "MIT" }, "node_modules/nock": { - "version": "14.0.16", - "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.16.tgz", - "integrity": "sha512-8r4KEc6nT1D/fdLD/R1BO1CPaVEL8o40u/guFRJlXabN7vr3RmMqyjsY5Krt0nMwhsOAwXQ/mtN5vy5Jh3aErg==", + "version": "14.0.17", + "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.17.tgz", + "integrity": "sha512-EjRr1weMa4ALQX35AgZTEnP+weJJjlW1KGDiNM2IQC2069YDHas4f4B4UUYR+TTLyKWxJvOz2wObDKQs/LNreA==", "dev": true, "license": "MIT", "dependencies": { @@ -8030,15 +8125,15 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/readdir-glob/node_modules/minimatch": { @@ -8496,9 +8591,9 @@ } }, "node_modules/sinon": { - "version": "22.0.0", - "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.0.0.tgz", - "integrity": "sha512-sq/6DpdXOrLyfbKlXLg/Usc7xu8YXPeLkOFZRvA3bNUSA2lhbrZ06yuXbH1fkzBPCbz9O10+7hznzUsjaYNm0Q==", + "version": "22.1.0", + "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.1.0.tgz", + "integrity": "sha512-n1ajF2rBWMTtEwbKcw4UdFg4nCnDdq/U6RDoxtOd7oapOlRoJ5ynwFx60owROyhDpA9QhMZi0pCO/xtmwFjG7w==", "dev": true, "license": "BSD-3-Clause", "dependencies": { @@ -9108,9 +9203,9 @@ "license": "0BSD" }, "node_modules/tsx": { - "version": "4.23.0", - "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.0.tgz", - "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==", + "version": "4.23.8", + "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.8.tgz", + "integrity": "sha512-8W675THjbzfFmLOQzjDBIBna+WjqMGIxmSZ1mMc1+o9qoVsEuAgQu5j5ueLhau8inOkDu9OslVg0FmfBs1RIHw==", "dev": true, "license": "MIT", "dependencies": { @@ -9260,16 +9355,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.63.0.tgz", - "integrity": "sha512-xgwXyzG4sK9ALkBxbyGkTMMOS+imnW65iPhxCQMK83KhxyoDNW7l+IDqEf9vMdoUidHpOoS967RCq4eMiTexwQ==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.66.0.tgz", + "integrity": "sha512-QlEbBPz/RuJ1XUHj29nm3t0F/O/cSlEnntozqPOYHnnTGAXFamnMBu5i9Vn6vhUPHGAjR+Vl+5J8vPN/BMUrJw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.63.0", - "@typescript-eslint/parser": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0" + "@typescript-eslint/eslint-plugin": "8.66.0", + "@typescript-eslint/parser": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/utils": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -9303,9 +9398,10 @@ } }, "node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", + "license": "MIT", "engines": { "node": ">=18.17" } @@ -9749,7 +9845,7 @@ "dependencies": { "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": ">=9.2.2", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "semver": "^7.8.5", @@ -9757,7 +9853,7 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.8" } } } diff --git a/package.json b/package.json index 5a2103c244..4e5d1410ce 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.3", + "version": "4.37.8", "private": true, "description": "CodeQL action", "scripts": { @@ -22,7 +22,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -30,22 +30,22 @@ "@actions/http-client": "^3.0.0", "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", - "@octokit/plugin-retry": "^8.1.0", + "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.1", + "js-yaml": "^5.2.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", "semver": "^7.8.5", "uuid": "^14.0.1", - "undici": "^6.24.0" + "undici": "^6.28.0" }, "devDependencies": { "@ava/typescript": "6.0.0", @@ -58,22 +58,22 @@ "@types/node": "^20.19.43", "@types/node-forge": "^1.3.14", "@types/sarif": "^2.1.7", - "@types/semver": "^7.7.1", + "@types/semver": "^7.8.0", "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.7.0", - "nock": "^14.0.16", - "sinon": "^22.0.0", + "globals": "^17.9.0", + "nock": "^14.0.17", + "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.66.0" }, "overrides": { "@actions/tool-cache": { @@ -95,6 +95,6 @@ "semver": ">=6.3.1" }, "glob": "^13.0.6", - "undici": "^6.24.0" + "undici": "^6.28.0" } } diff --git a/pr-checks/bundle-changelog.test.ts b/pr-checks/bundle-changelog.test.ts new file mode 100644 index 0000000000..6cc4d096ba --- /dev/null +++ b/pr-checks/bundle-changelog.test.ts @@ -0,0 +1,142 @@ +/** + * Tests for `bundle-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { + CLI_VERSION_ENV_VAR, + getCLIVersion, + getPRNumber, + getPRUrl, + PR_URL_ENV_VAR, + updateChangelog, +} from "./bundle-changelog"; +import { + EMPTY_CHANGELOG, + NO_CHANGES_STR, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "bundle-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +describe("getCLIVersion", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[CLI_VERSION_ENV_VAR]; + assert.throws(() => getCLIVersion()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[CLI_VERSION_ENV_VAR] = " "; + assert.throws(() => getCLIVersion()); + }); + + await it("returns value of the environment variable if set", async () => { + const testValue = "1.2.3"; + process.env[CLI_VERSION_ENV_VAR] = testValue; + assert.deepEqual(getCLIVersion(), testValue); + }); +}); + +const testPrUrl = "https://github.com/github/codeql-action/pulls/42"; + +describe("getPRUrl", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[PR_URL_ENV_VAR]; + assert.throws(() => getPRUrl()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[PR_URL_ENV_VAR] = " "; + assert.throws(() => getPRUrl()); + }); + + await it("returns value of the environment variable if set", async () => { + process.env[PR_URL_ENV_VAR] = testPrUrl; + assert.deepEqual(getPRUrl(), testPrUrl); + }); +}); + +describe("getPRNumber", async () => { + await it("throws if the last part of the input is not a number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/foo`)); + }); + + await it("throws if the last part of the input is not a positive number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/-100`)); + }); + + await it("returns the PR number from an URL", async () => { + assert.equal(getPRNumber(testPrUrl), 42); + }); +}); + +const testChangelog = `${EMPTY_CHANGELOG.trimEnd()} + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +const expectedChangelog = `# CodeQL Action Changelog + +## ${UNRELEASED_PLACEHOLDER} + +- Update default CodeQL bundle version to + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +describe("updateChangelog", async () => { + await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => { + const result = updateChangelog(EMPTY_CHANGELOG, ""); + assert.ok(!result.includes(NO_CHANGES_STR.trim())); + }); + + await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => { + const result = updateChangelog( + EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"), + "", + ); + assert.ok(result.includes(NO_CHANGES_STR.trim())); + }); + + await it("throws if there are no sections", async () => { + assert.throws(() => { + updateChangelog( + "# CodeQL Action Changelog", + "- Update default CodeQL bundle version to", + ); + }); + }); + + await it("adds note at the end of the first section", async () => { + const result = updateChangelog( + testChangelog, + "- Update default CodeQL bundle version to", + ); + assert.deepEqual(result, expectedChangelog); + }); +}); diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts new file mode 100755 index 0000000000..557a8556c1 --- /dev/null +++ b/pr-checks/bundle-changelog.ts @@ -0,0 +1,127 @@ +#!/usr/bin/env npx tsx + +/** + * Updates the changelog with a change note for an updated CodeQL CLI bundle. + */ + +import * as fs from "node:fs"; + +import { + parseChangelog, + renderChangelog, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; +import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; +import { getErrorMessage } from "./util"; + +export const CLI_VERSION_ENV_VAR = "CLI_VERSION"; +export const PR_URL_ENV_VAR = "PR_URL"; + +/** Gets the CLI version from the environment. */ +export function getCLIVersion() { + const cliVersion = process.env[CLI_VERSION_ENV_VAR]; + + if (cliVersion === undefined || cliVersion.trim() === "") { + throw new Error(`No CLI version was set in '${CLI_VERSION_ENV_VAR}'.`); + } + + return cliVersion; +} + +/** Gets the PR URL from the environment. */ +export function getPRUrl() { + const prUrl = process.env[PR_URL_ENV_VAR]; + + if (prUrl === undefined || prUrl.trim() === "") { + throw new Error(`No PR URL was set in '${PR_URL_ENV_VAR}'.`); + } + + return prUrl; +} + +/** + * Gets the PR number from something like a PR URL. + */ +export function getPRNumber(prUrl: string) { + const prUrlParts = prUrl.split("/"); + const prNumberStr = prUrlParts[prUrlParts.length - 1]; + + const prNumber = Number.parseInt(prNumberStr, 10); + + if (!Number.isInteger(prNumber) || prNumber <= 0) { + throw new Error( + `Invalid PR URL '${prUrl}': last part is not a positive number`, + ); + } + + return prNumber; +} + +/** + * Updates `changelog` by adding `changelogNote` to the first section. + * + * @param contents The existing changelog contents. + * @param changelogNote The note to add to the first section. + */ +export function updateChangelog(contents: string, changelogNote: string) { + // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. + contents = contents.replace( + `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`, + `## ${UNRELEASED_PLACEHOLDER}\n`, + ); + + const changelog = parseChangelog(contents); + + if (changelog.sections.length === 0) { + throw new Error("The changelog contains no existing sections."); + } + + // Add the changelog note to the bottom of the first section. + const firstSection = changelog.sections[0]; + const lastLine = firstSection.bodyLines.pop(); + + if (lastLine !== undefined && lastLine.trim() !== "") { + // We expect the last line to be empty. If it isn't for some reason, + // add it back. + firstSection.bodyLines.push(lastLine); + } + + firstSection.bodyLines.push(changelogNote); + + // If the last line is empty as expected, then add it back in after the new note. + if (lastLine?.trim() === "") { + firstSection.bodyLines.push(lastLine); + } + + return renderChangelog(changelog); +} + +function main() { + try { + const cliVersion = getCLIVersion(); + const prUrl = getPRUrl(); + + // The GitHub Release for the new bundle version. + const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`; + + // Get the PR number from the PR URL. + const prNumber = getPRNumber(prUrl); + const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`; + + let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + + changelog = updateChangelog(changelog, changelogNote); + + fs.writeFileSync(CHANGELOG_FILE, changelog); + + return 0; + } catch (err) { + console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/changelog.test.ts b/pr-checks/changelog.test.ts index 3eddc14591..817852e3e1 100755 --- a/pr-checks/changelog.test.ts +++ b/pr-checks/changelog.test.ts @@ -5,14 +5,18 @@ */ import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; import { describe, it } from "node:test"; import { EMPTY_CHANGELOG, getReleaseDateString, + parseChangelog, processChangelogForBackports, + renderChangelog, setVersionAndDate, } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; const testDate = new Date(2026, 7, 14); @@ -37,6 +41,14 @@ describe("setVersionAndDate", async () => { }); }); +describe("parseChangelog + renderChangelog", async () => { + await it("renderChangelog(parseChangelog(c)) == c", async () => { + const actualChangelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + const roundtrip = renderChangelog(parseChangelog(actualChangelog)); + assert.deepEqual(roundtrip.split("\n"), actualChangelog.split("\n")); + }); +}); + const testChangelog = `# CodeQL Action Changelog ## 4.12.3 - 14 Aug 2026 diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 49011b0361..4cf1e75494 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -2,14 +2,34 @@ import * as fs from "node:fs"; import { CHANGELOG_FILE, DryRunOption } from "./config"; +/** The placeholder in the header for unreleased changes. */ +export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]"; + +/** The default contents for a section in the changelog. */ +export const NO_CHANGES_STR = "No user facing changes.\n\n"; + /** Placeholder changelog content for a new release. */ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog -## [UNRELEASED] +## ${UNRELEASED_PLACEHOLDER} -No user facing changes. +${NO_CHANGES_STR}`; + +/** + * Represents sections in a changelog. + */ +export interface ChangelogSection { + headerLine: string; + bodyLines: string[]; +} -`; +/** + * Represents a changelog. + */ +export interface Changelog { + preamble: string[]; + sections: ChangelogSection[]; +} /** Returns `date` formatted as `DD Mon YYYY`. */ export function getReleaseDateString(today: Date = new Date()): string { @@ -53,7 +73,76 @@ export function setVersionAndDate( date: Date = new Date(), ): string { const versionAndDate = `${version} - ${getReleaseDateString(date)}`; - return content.replace("[UNRELEASED]", versionAndDate); + return content.replace(UNRELEASED_PLACEHOLDER, versionAndDate); +} + +/** + * Parses `content` into a structured representation of a changelog. + * + * @param content The contents of the changelog file. + */ +export function parseChangelog(content: string): Changelog { + const lines = content.split("\n"); + let i = 0; + + const preamble: string[] = []; + const sections: ChangelogSection[] = []; + let currentSection: ChangelogSection | undefined = undefined; + + // Process all lines of the input file. + while (i < lines.length) { + const line = lines[i]; + + // Sections of the changelog start with `## `. + if (line.startsWith("## ")) { + // We have discovered a new section. If `currentSection` is already defined, + // then this marks the end of that section. Push it to the array of sections + // in the changelog. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + // Initialise the new section. + currentSection = { headerLine: line, bodyLines: [] }; + } else if (currentSection !== undefined) { + // Add lines between the section header and the next to the current section. + currentSection.bodyLines.push(line); + } else { + // This is neither a section header nor are we in a section already, + // so this line is part of the preamble. + preamble.push(line); + } + + i++; + } + + // Push the current section to the array of completed sections, if there is + // still one unfinished. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + return { preamble, sections }; +} + +/** + * Combines an array of lines into a single string by adding line breaks. + */ +export function unlines(lines: string[]): string { + return `${lines.join("\n")}`; +} + +/** + * Renders a given changelog to a string. + */ +export function renderChangelog(changelog: Changelog): string { + let result = unlines(changelog.preamble); + + for (const section of changelog.sections) { + result += `\n${section.headerLine}\n${unlines(section.bodyLines)}`; + } + + return result; } /** @@ -66,70 +155,58 @@ export function processChangelogForBackports( targetBranchMajorVersion: string, content: string, ): string { - const lines = content.split("\n"); - // Changelog entries can use the following format to indicate // that they only apply to newer versions const someVersionsOnlyRegex = /\[v(\d+)\+ only\]/; - let output = ""; - let i = 0; - - // Copy lines until we find the first section heading. - let foundFirstSection = false; - while (!foundFirstSection && i < lines.length) { - let line = lines[i]; - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - foundFirstSection = true; - } - output += `${line}\n`; - i++; - } + // Parse the changelog. + const changelog = parseChangelog(content); - if (!foundFirstSection) { + if (changelog.sections.length === 0) { throw new Error("Could not find any change sections in CHANGELOG.md"); } - // Process remaining lines. - // `foundContent` tracks whether we hit two headings in a row - let foundContent = false; - output += "\n"; - - while (i < lines.length) { - let line = lines[i]; - i++; - - // Filter out changelog entries that only apply to newer versions. - const match = someVersionsOnlyRegex.exec(line); - if (match) { + // Filter out changelog entries that only apply to newer versions and + // update the section headings with the backport major version for + // sections we keep. + for (const section of changelog.sections) { + // Update the section headings with the backport major version. + section.headerLine = section.headerLine.replace( + `## ${sourceBranchMajorVersion}`, + `## ${targetBranchMajorVersion}`, + ); + + const filteredEntries: string[] = []; + let foundContent = false; + + for (const line of section.bodyLines) { + // Skip the entry if `someVersionsOnlyRegex` matches and the major version + // of the target branch is smaller than the required version. + const match = someVersionsOnlyRegex.exec(line); if ( + match && Number.parseInt(targetBranchMajorVersion) < Number.parseInt(match[1]) ) { continue; } - } - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - if (!foundContent) { - output += "No user facing changes.\n"; - } - foundContent = false; - output += `\n${line}\n\n`; - } else { + // Keep the line. + filteredEntries.push(line); + + // Set `foundContent` to `true` if the line is not empty. if (line.trim() !== "") { foundContent = true; - output += `${line}\n`; } } + + // Update the section with the retained entries. + section.bodyLines = filteredEntries; + + // Add an entry if we didn't keep any. + if (!foundContent) { + section.bodyLines.push(NO_CHANGES_STR.trim()); + } } - return output; + return renderChangelog(changelog); } diff --git a/pr-checks/checks/bundle-zstd.yml b/pr-checks/checks/bundle-zstd.yml deleted file mode 100644 index a961af3c36..0000000000 --- a/pr-checks/checks/bundle-zstd.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: "Bundle: Zstandard checks" -description: "A Zstandard CodeQL bundle should be extracted on supported operating systems" -versions: - - linked -operatingSystems: - - ubuntu - - macos - - windows -steps: - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 5f90022c04..9d9653c13c 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -5,17 +5,45 @@ versions: - nightly-latest container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest ports: - 3128:3128 env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml index 895dba2b6c..f0b4097d7b 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml @@ -12,7 +12,7 @@ steps: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "1.20" - name: Build code diff --git a/pr-checks/checks/job-run-uuid-sarif.yml b/pr-checks/checks/job-run-uuid-sarif.yml index dc1dd02d43..b86725d944 100644 --- a/pr-checks/checks/job-run-uuid-sarif.yml +++ b/pr-checks/checks/job-run-uuid-sarif.yml @@ -21,8 +21,8 @@ steps: run: | cd "$RUNNER_TEMP/results" actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif) - if [[ "$actual" != "$JOB_RUN_UUID" ]]; then - echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'." + if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then + echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'." exit 1 else echo "Found job run UUID '$actual'." diff --git a/pr-checks/checks/multi-language-autodetect.yml b/pr-checks/checks/multi-language-autodetect.yml index 801f4521a4..b57e90ab4c 100644 --- a/pr-checks/checks/multi-language-autodetect.yml +++ b/pr-checks/checks/multi-language-autodetect.yml @@ -23,7 +23,7 @@ steps: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index 4128c446d9..37c5d36e90 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ versions: - default steps: - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/pr-checks/checks/submit-sarif-failure.yml b/pr-checks/checks/submit-sarif-failure.yml index 9212a5dc79..c33e1322f7 100644 --- a/pr-checks/checks/submit-sarif-failure.yml +++ b/pr-checks/checks/submit-sarif-failure.yml @@ -21,7 +21,7 @@ permissions: security-events: write # needed to upload the SARIF file steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/pr-checks/checks/with-checkout-path.yml b/pr-checks/checks/with-checkout-path.yml index 7a5866b783..a6cde895b6 100644 --- a/pr-checks/checks/with-checkout-path.yml +++ b/pr-checks/checks/with-checkout-path.yml @@ -14,7 +14,7 @@ steps: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/pr-checks/config.ts b/pr-checks/config.ts index 94d34a931d..356fe665f9 100644 --- a/pr-checks/config.ts +++ b/pr-checks/config.ts @@ -37,6 +37,10 @@ export const API_COMPATIBILITY_FILE = path.join( "api-compatibility.json", ); +/** The prefix of CodeQL CLI bundle release URLs. */ +export const CLI_BUNDLE_RELEASE_URL_PREFIX = + "https://github.com/github/codeql-action/releases/tag/codeql-bundle-v"; + /** A common interface for operations that support dry runs. */ export interface DryRunOption { /** A value indicating whether to perform operations with side effects. */ diff --git a/pr-checks/excluded.yml b/pr-checks/excluded.yml index d8d643d107..1a5262fc0b 100644 --- a/pr-checks/excluded.yml +++ b/pr-checks/excluded.yml @@ -10,6 +10,7 @@ is: - "check-expected-release-files" - "Cleanup artifacts" - "CodeQL" + - "copilot-pull-request-reviewer" - "Dependabot" - "Label PR with size" - "Post repo size comment" diff --git a/pr-checks/package.json b/pr-checks/package.json index 63bfa3ddf5..6c23d847f2 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -4,7 +4,7 @@ "dependencies": { "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": ">=9.2.2", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "semver": "^7.8.5", @@ -12,6 +12,6 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.8" } } diff --git a/pr-checks/prepare-changelog.test.ts b/pr-checks/prepare-changelog.test.ts new file mode 100644 index 0000000000..13a302c8f6 --- /dev/null +++ b/pr-checks/prepare-changelog.test.ts @@ -0,0 +1,54 @@ +/** + * Tests for `prepare-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { EMPTY_CHANGELOG, NO_CHANGES_STR } from "./changelog"; +import { extractChangelogSnippet } from "./prepare-changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "prepare-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +const testBody = `- Test change`; +const testChangelog = `${EMPTY_CHANGELOG.replace(NO_CHANGES_STR, testBody)} + +## Another section + +- Other change`; + +describe("extractChangelogSnippet", async () => { + await it("returns the default body if the input doesn't exist", async () => { + const result = extractChangelogSnippet(path.join(testDir, "not-here.md")); + assert.deepEqual(result, NO_CHANGES_STR); + }); + + await it("returns the first section if the input exists", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, testChangelog); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, testBody); + }); + + await it("returns an empty string if there is no first section", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, "# CodeQL Action Changelog\n"); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, ""); + }); +}); diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts new file mode 100755 index 0000000000..0c89699fc8 --- /dev/null +++ b/pr-checks/prepare-changelog.ts @@ -0,0 +1,82 @@ +#!/usr/bin/env npx tsx + +/** + * Extracts the body of the first changelog section and outputs it to either + * stdout or a file. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { NO_CHANGES_STR, parseChangelog } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; + +/** + * Prepare the changelog for the new release + * This function will extract the part of the changelog that + * we want to include in the new release. + * + * @param changelogPath The path to the changelog file. + */ +export function extractChangelogSnippet(changelogPath: string) { + try { + const content = fs.readFileSync(changelogPath, "utf-8"); + const changelog = parseChangelog(content); + + // Return an empty string if we couldn't find the first section. + if (changelog.sections.length === 0) { + return ""; + } + + return changelog.sections[0].bodyLines.join("\n").trim(); + } catch (err) { + if (err instanceof Error && "code" in err && err.code === "ENOENT") { + console.error(`Changelog file at '${changelogPath}' does not exist.`); + return NO_CHANGES_STR; + } else { + throw Error( + `Failed to open changelog file at '${changelogPath}': ${getErrorMessage(err)}`, + ); + } + } +} + +function main() { + try { + const { values } = parseArgs({ + options: { + changelog: { + type: "string", + short: "f", + default: CHANGELOG_FILE, + }, + output: { + type: "string", + short: "o", + }, + }, + strict: true, + }); + + const body = extractChangelogSnippet(values.changelog); + + // If no `output` argument was provided, output to stdout. Otherwise, + // write a file to the specified path. + if (values.output === undefined) { + console.info(body); + } else { + fs.writeFileSync(values.output, body); + } + + return 0; + } catch (err) { + console.error(`Failed to prepare changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/rollback-changelog.test.ts b/pr-checks/rollback-changelog.test.ts new file mode 100644 index 0000000000..5264755a69 --- /dev/null +++ b/pr-checks/rollback-changelog.test.ts @@ -0,0 +1,45 @@ +/** + * Tests for `rollback-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import { describe, it } from "node:test"; + +import { getReleaseDateString, parseChangelog } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { updateChangelog } from "./rollback-changelog"; + +describe("updateChangelog", async () => { + await it("replaces the first section with one for the rollback release", async () => { + const actualChangelog = parseChangelog( + fs.readFileSync(CHANGELOG_FILE, "utf-8"), + ); + const existingFirstSection = actualChangelog.sections[0]; + + const today = new Date(); + updateChangelog(actualChangelog, { + "new-version": "Test.1.3", + "rollback-version": "Test.1.2", + "target-version": "Test.1.1", + today, + }); + + // Check that the old, first section is gone. + for (const section of actualChangelog.sections) { + assert.notDeepEqual(section, existingFirstSection); + } + + // Check that the new, first section matches our expectations. + const newFirstSection = actualChangelog.sections[0]; + assert.deepEqual( + newFirstSection.headerLine, + `## Test.1.3 - ${getReleaseDateString(today)}`, + ); + assert.equal(newFirstSection.bodyLines.length, 3); + assert.deepEqual( + newFirstSection.bodyLines[1], + `This release rolls back Test.1.2 due to issues with that release. It is identical to Test.1.1.`, + ); + }); +}); diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts new file mode 100755 index 0000000000..15a37b1b7c --- /dev/null +++ b/pr-checks/rollback-changelog.ts @@ -0,0 +1,84 @@ +#!/usr/bin/env npx tsx + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { + Changelog, + ChangelogSection, + getReleaseDateString, + parseChangelog, + renderChangelog, +} from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; + +export interface RollbackChangelogInputs { + "target-version": string; + "rollback-version": string; + "new-version": string; + today?: Date; +} + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ +export function updateChangelog( + changelog: Changelog, + versions: RollbackChangelogInputs, +) { + // Drop the existing first section. + changelog.sections.shift(); + + // Construct the section for the rollback version. + const newSection: ChangelogSection = { + headerLine: `## ${versions["new-version"]} - ${getReleaseDateString(versions.today)}`, + bodyLines: [ + "", + `This release rolls back ${versions["rollback-version"]} due to issues with that release. It is identical to ${versions["target-version"]}.`, + "", + ], + }; + + // Add the new section at the top of the changelog. + changelog.sections.unshift(newSection); +} + +function main() { + try { + const options = { + "target-version": { type: "string", short: "t" }, + "rollback-version": { type: "string", short: "r" }, + "new-version": { type: "string", short: "n" }, + } as const; + + const { values } = parseArgs({ options, strict: true }); + + for (const key of Object.keys(options)) { + const val = values[key as keyof typeof values]; + if (val === undefined || val.trim() === "") { + throw new Error(`Argument '--${key}' is required.`); + } + } + + const changelog = parseChangelog(fs.readFileSync(CHANGELOG_FILE, "utf-8")); + updateChangelog(changelog, values as RollbackChangelogInputs); + console.info(renderChangelog(changelog)); + + return 0; + } catch (err) { + console.error( + `Failed to prepare rollback changelog: ${getErrorMessage(err)}`, + ); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..9dcce16fe5 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -233,8 +233,8 @@ const languageSetups: LanguageSetups = { name: "Install Go", uses: pinnedUses( "actions/setup-go", - "924ae3a1cded613372ab5595356fb5720e22ba16", - "v6.5.0", + "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", + "v7.0.0", ), with: { "go-version": `\${{ inputs.go-version || '${defaultLanguageVersions.go}' }}`, @@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = { name: "Install Java", uses: pinnedUses( "actions/setup-java", - "0f481fcb613427c0f801b606911222b5b6f3083a", - "v5.5.0", + "b6effb05e454b25005698d916606bdc6ffcbf961", + "v5.7.0", ), with: { "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`, @@ -271,8 +271,8 @@ const languageSetups: LanguageSetups = { name: "Install Python", uses: pinnedUses( "actions/setup-python", - "ece7cb06caefa5fff74198d8649806c4678c61a1", - "v6.3.0", + "5fda3b95a4ea91299a34e894583c3862153e4b97", + "v7.0.0", ), with: { "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`, @@ -288,8 +288,8 @@ const languageSetups: LanguageSetups = { name: "Install .NET", uses: pinnedUses( "actions/setup-dotnet", - "26b0ec14cb23fa6904739307f278c14f94c95bf1", - "v5.4.0", + "a98b56852c35b8e3190ac28c8c2271da59106c68", + "v6.0.0", ), with: { "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`, @@ -529,8 +529,8 @@ function generateJob( name: "Check out repository", uses: pinnedUses( "actions/checkout", - "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", - "v7.0.0", + "3d3c42e5aac5ba805825da76410c181273ba90b1", + "v7.0.1", ), }, ...setupInfo.steps, diff --git a/pr-checks/util.ts b/pr-checks/util.ts new file mode 100644 index 0000000000..353b2a9654 --- /dev/null +++ b/pr-checks/util.ts @@ -0,0 +1,9 @@ +/** + * Returns an appropriate message for the error. + * + * If the error is an `Error` instance, this returns the error message without + * an `Error: ` prefix. + */ +export function getErrorMessage(error: unknown): string { + return error instanceof Error ? error.message : String(error); +} diff --git a/src/action-common.test.ts b/src/action-common.test.ts new file mode 100644 index 0000000000..fc2e0a9aaa --- /dev/null +++ b/src/action-common.test.ts @@ -0,0 +1,123 @@ +import * as core from "@actions/core"; +import test from "ava"; +import sinon from "sinon"; + +import * as common from "./action-common"; +import * as actionsUtil from "./actions-util"; +import * as environment from "./environment"; +import * as logging from "./logging"; +import { ActionName } from "./status-report"; +import * as statusReport from "./status-report"; +import { + getTestActionsEnv, + getTestEnv, + makeMacro, + RecordingLogger, + setupTests, +} from "./testing-utils"; +import { getErrorMessage } from "./util"; + +setupTests(test); + +interface RunInActionsTestOpts { + runFn?: () => Promise; + expectedErrorMessage?: string; + expectedTelemetryError?: string; +} + +const runInActionsMacro = makeMacro({ + exec: async (t, opts: RunInActionsTestOpts) => { + const expectFailure = opts?.expectedErrorMessage !== undefined; + + const logger = new RecordingLogger(); + const getActionsLogger = sinon + .stub(logging, "getActionsLogger") + .returns(logger); + + const env = getTestEnv(); + const getEnv = sinon.stub(environment, "getEnv").returns(env); + + const actionsEnv = getTestActionsEnv(env); + const getActionsEnv = sinon + .stub(actionsUtil, "getActionsEnv") + .returns(actionsEnv); + + const getJobUUID = sinon + .stub(statusReport, "getJobUUID") + .returns("test-job-uuid"); + + const setFailed = sinon.stub(core, "setFailed"); + const sendUnhandledErrorStatusReport = sinon.stub( + statusReport, + "sendUnhandledErrorStatusReport", + ); + + const name = ActionName.Init; + const run = sinon.stub(); + + if (opts?.runFn) { + run.callsFake(opts.runFn); + } + + const transformTelemetryError = sinon + .stub() + .callsFake((err) => opts?.expectedTelemetryError ?? getErrorMessage(err)); + const testAction: common.Action = { + name, + run, + transformTelemetryError, + }; + + await common.runInActions(testAction); + + // These always should have been called once. + t.true(getActionsLogger.calledOnce); + t.true(getEnv.calledOnce); + t.true(getActionsEnv.calledOnce); + + const expectedActionState = { + actions: actionsEnv, + env, + logger, + name: ActionName.Init, + }; + + t.true(getJobUUID.calledOnceWithExactly(sinon.match(expectedActionState))); + t.true(run.calledOnceWithExactly(sinon.match(expectedActionState))); + + t.is(setFailed.calledOnce, expectFailure ?? false); + t.is(sendUnhandledErrorStatusReport.calledOnce, expectFailure ?? false); + + if (expectFailure) { + t.true( + setFailed.calledOnceWithExactly( + `${statusReport.getDisplayActionName(name)} action failed: ${opts?.expectedErrorMessage}`, + ), + ); + t.true( + sendUnhandledErrorStatusReport.calledOnceWithExactly( + name, + sinon.match.any, + opts?.expectedTelemetryError ?? opts?.expectedErrorMessage, + logger, + ), + ); + } + }, + title: (providedTitle) => `runInActions - ${providedTitle}`, +}); + +runInActionsMacro.serial("calls run", {}); +runInActionsMacro.serial("handles run exceptions", { + runFn: () => { + throw new Error("Test failure"); + }, + expectedErrorMessage: "Test failure", +}); +runInActionsMacro.serial("transforms run exceptions", { + runFn: () => { + throw new Error("Test failure"); + }, + expectedErrorMessage: "Test failure", + expectedTelemetryError: "Transformed failure message", +}); diff --git a/src/action-common.ts b/src/action-common.ts index cbb1cd3422..95323e7f2a 100644 --- a/src/action-common.ts +++ b/src/action-common.ts @@ -8,9 +8,10 @@ import { getActionsLogger, Logger } from "./logging"; import { ActionName, getDisplayActionName, + getJobUUID, sendUnhandledErrorStatusReport, } from "./status-report"; -import { getEnv, getErrorMessage } from "./util"; +import { getEnv, getErrorMessage, wrapError } from "./util"; /** Base state that is available to an Action on startup. */ export interface BaseState { @@ -78,6 +79,12 @@ export interface Action { name: ActionName; /** The entry point for the Action. */ run: ActionMain; + /** + * An optional function that transforms a caught error into a message suitable for + * inclusion in a status report. This is primarily intended for the `start-proxy` + * action to replace the thrown `Error`'s message with a safe one. + */ + transformTelemetryError?: (error: Error) => string; } /** A generic entry point that sets up the basic environment for the `action` and runs it. */ @@ -88,17 +95,32 @@ export async function runInActions(action: Action) { const actionsEnv = getActionsEnv(); try { - await action.run({ + const actionState = { name: action.name, startedAt, logger, env, actions: actionsEnv, - }); + }; + + // Create a unique identifier for this run. + getJobUUID(actionState); + + await action.run(actionState); } catch (error) { core.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error)}`, ); - await sendUnhandledErrorStatusReport(action.name, startedAt, error, logger); + + const statusReportError = + action.transformTelemetryError !== undefined + ? action.transformTelemetryError(wrapError(error)) + : error; + await sendUnhandledErrorStatusReport( + action.name, + startedAt, + statusReportError, + logger, + ); } } diff --git a/src/actions-util.ts b/src/actions-util.ts index 5fd1ebc4fe..dd5124620d 100644 --- a/src/actions-util.ts +++ b/src/actions-util.ts @@ -27,14 +27,20 @@ declare const __CODEQL_ACTION_VERSION__: string; * global functions in tests. */ export interface ActionsEnv { + getRequiredInput: (name: string) => string; getOptionalInput: (name: string) => string | undefined; + exportVariable: (name: string, value: string) => void; } /** * Gets the real `ActionsEnv` used by production code. */ export function getActionsEnv(): ActionsEnv { - return { getOptionalInput }; + return { + getRequiredInput, + getOptionalInput, + exportVariable: core.exportVariable, + }; } /** diff --git a/src/analyze-action-post.ts b/src/analyze-action-post.ts index fe8fbea61c..732b52af19 100644 --- a/src/analyze-action-post.ts +++ b/src/analyze-action-post.ts @@ -38,7 +38,7 @@ export async function runWrapper() { logger, ); if (config !== undefined) { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); const version = await codeql.getVersion(); await debugArtifacts.uploadCombinedSarifArtifacts( logger, diff --git a/src/analyze-action.ts b/src/analyze-action.ts index 5104719bc7..c3c2e40e7f 100644 --- a/src/analyze-action.ts +++ b/src/analyze-action.ts @@ -255,7 +255,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) { ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (hasBadExpectErrorInput()) { throw new util.ConfigurationError( diff --git a/src/api-client.test.ts b/src/api-client.test.ts index e43f16ef29..ae8c6269b1 100644 --- a/src/api-client.test.ts +++ b/src/api-client.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import * as githubUtils from "@actions/github/lib/utils"; import test from "ava"; import * as sinon from "sinon"; +import { ProxyAgent } from "undici"; import * as actionsUtil from "./actions-util"; import * as api from "./api-client"; @@ -251,3 +252,23 @@ test("getRegistryProxyConfig - gets the configuration from the env vars", async ) .passes(t.like, { host, port, ca }); }); + +test("makeProxyRequestOptions - returns defaults without custom proxy", async (t) => { + t.deepEqual( + api.makeProxyRequestOptions(undefined), + githubUtils.defaults.request, + ); +}); + +test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => { + const opts = api.makeProxyRequestOptions( + new ProxyAgent("http://localhost:1080"), + ); + // Fetch should be different from the defaults. + t.notDeepEqual(opts?.fetch, githubUtils.defaults.request?.fetch); + // The options should be the same aside from that. + t.deepEqual( + { ...opts, fetch: githubUtils.defaults.request?.fetch }, + githubUtils.defaults.request, + ); +}); diff --git a/src/api-client.ts b/src/api-client.ts index 7c63b5a6fe..ba800a2587 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -108,12 +108,19 @@ export function getRegistryProxy( * Constructs a `RequestRequestOptions` with a custom `fetch` implementation * that uses `dispatcher` as a proxy for requests. * - * @param dispatcher The proxy to use. + * @param dispatcher The proxy to use, if any. */ export function makeProxyRequestOptions( - dispatcher: ProxyAgent, -): RequestRequestOptions { + dispatcher: ProxyAgent | undefined, +): RequestRequestOptions | undefined { + // If we don't have a custom `ProxyAgent`, return the defaults. + if (dispatcher === undefined) { + return githubUtils.defaults.request; + } + + // Otherwise, construct the custom `fetch` and add it onto the defaults. return { + ...githubUtils.defaults.request, fetch: (req: RequestInfo, init?: RequestInit) => { return undiciFetch(req, { ...init, dispatcher }); }, @@ -136,10 +143,7 @@ function createApiClientWithDetails( const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry.retry); - const requestOptions = - proxy === undefined - ? githubUtils.defaults.request - : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth, { baseUrl: apiDetails.apiURL, diff --git a/src/autobuild-action.ts b/src/autobuild-action.ts index b78bffb9d8..9fa8016578 100644 --- a/src/autobuild-action.ts +++ b/src/autobuild-action.ts @@ -99,7 +99,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) { ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); languages = await determineAutobuildLanguages(codeql, config, logger); if (languages !== undefined) { diff --git a/src/autobuild.ts b/src/autobuild.ts index 7ec6ba9873..49b790102d 100644 --- a/src/autobuild.ts +++ b/src/autobuild.ts @@ -155,7 +155,7 @@ export async function runAutobuild( logger: Logger, ) { logger.startGroup(`Attempting to automatically build ${language} code`); - const codeQL = await getCodeQL(config.codeQLCmd); + const codeQL = await getCodeQL(logger, config.codeQLCmd); if (language === BuiltInLanguage.cpp) { await setupCppAutobuild(codeQL, logger); } diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts new file mode 100644 index 0000000000..d8d8629303 --- /dev/null +++ b/src/cli/output-cache.test.ts @@ -0,0 +1,128 @@ +import * as fs from "fs"; +import path from "path"; + +import test from "ava"; + +import { EnvVar } from "../environment"; +import { getRunnerLogger } from "../logging"; +import { getTestEnv, setupTests } from "../testing-utils"; +import * as util from "../util"; + +import * as outputCache from "./output-cache"; + +setupTests(test); + +const logger = getRunnerLogger(true); + +test.serial( + "getCachedCodeQlVersion reuses a version persisted by an earlier step", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "codeql-action-command-cache.json"); + fs.writeFileSync( + cacheFile, + JSON.stringify({ + cmd: "/path/to/codeql", + entries: { version: { version: "2.20.0" } }, + }), + "utf8", + ); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.deepEqual( + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), + { + version: "2.20.0", + }, + ); + }); + }, +); + +test.serial( + "getCachedCodeQlVersion ignores a persisted version from a different CLI", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + fs.writeFileSync( + cacheFile, + JSON.stringify({ + cmd: "/path/to/other-codeql", + version: { version: "2.20.0" }, + }), + "utf8", + ); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is( + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), + undefined, + ); + }); + }, +); + +test.serial( + "getCachedCodeQlVersion ignores a malformed persisted value", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + fs.writeFileSync(cacheFile, "not valid json", "utf8"); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is( + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), + undefined, + ); + }); + }, +); + +test.serial( + "getCachedCodeQlVersion ignores a persisted value with the wrong structure", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + + const testValues = [ + { cmd: "/path/to/codeql" }, + { entries: { version: { version: "2.20.0" } } }, + { cmd: "/path/to/codeql", entries: {} }, + { cmd: "/path/to/codeql", entries: null }, + { cmd: "/path/to/codeql", entries: { version: {} } }, + { cmd: "/path/to/codeql", entries: { version: null } }, + { cmd: "/path/to/codeql", entries: { version: "2.20.0" } }, + { cmd: "/path/to/codeql", entries: { version: { version: null } } }, + { cmd: "/path/to/codeql", entries: { version: { version: 2.2 } } }, + { cmd: "/path/to/codeql", entries: { version: { version: 2 } } }, + { + cmd: "/path/to/codeql", + entries: { version: { version: "2.20.0", overlayVersion: "1" } }, + }, + { + cmd: "/path/to/codeql", + entries: { version: { version: "2.20.0", features: "nope" } }, + }, + ].map((v) => JSON.stringify(v)); + + for (const value of testValues) { + fs.writeFileSync(cacheFile, value, "utf8"); + t.is( + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), + undefined, + value, + ); + } + }); + }, +); + +test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.notThrows(() => { + t.is( + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), + undefined, + ); + }); + }); +}); diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts new file mode 100644 index 0000000000..8bf8c27abe --- /dev/null +++ b/src/cli/output-cache.ts @@ -0,0 +1,156 @@ +import * as fs from "fs"; +import path from "path"; + +import { getTemporaryDirectory } from "../actions-util"; +import { Env } from "../environment"; +import { Logger } from "../logging"; + +import type { VersionInfo } from "./types"; + +/** + * The keys of the command cache. Each key corresponds to a command whose output we cache. + */ +export type CommandCacheKey = string; + +/** + * The type of the command cache that is persisted to disk. + */ +export interface OutputCache { + cmd: string; + entries: Record; +} + +/** + * The name of the temporary file that backs the on-disk cache of + * CLI responses between workflow steps. + */ +const COMMAND_CACHE_FILENAME = "codeql-action-command-cache.json"; + +/** + * The module-global variable that caches the CodeQL CLI version in-memory. + */ +let cachedCodeQlVersion: undefined | VersionInfo = undefined; + +/** + * Resets the in-process cache of the CodeQL CLI version. Only for use in tests, + * which exercise multiple "steps" within a single process. + */ +export function resetCachedCodeQlVersion(): void { + cachedCodeQlVersion = undefined; +} + +/** + * Returns the path to the temporary file that backs the + * on-disk cache of CLI responses between workflow steps. + */ +function getCommandCacheFilePath(env: Env): string { + return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME); +} + +/** + * Caches the CodeQL CLI version both in-memory and on disk. + * @param env The environment variables to use. + * @param cmd The path to the CodeQL CLI. + * @param version The version information to cache. + */ +export function cacheCodeQlVersion( + env: Env, + cmd: string, + version: VersionInfo, +): void { + if (cachedCodeQlVersion !== undefined) { + throw new Error("cacheCodeQlVersion() should be called only once"); + } + cachedCodeQlVersion = version; + const outputCache = { + cmd, + entries: { version }, + } satisfies OutputCache; + // Persist the version so that subsequent Actions steps, which run in separate + // processes, can reuse it rather than invoking `codeql version` again. We + // record the CLI path so that a different step using a different CodeQL bundle + // doesn't pick up a stale version. + fs.writeFileSync( + getCommandCacheFilePath(env), + JSON.stringify(outputCache), + "utf8", + ); +} + +/** + * Returns the cached CodeQL CLI version, if any. + * @param logger The logger to use for logging messages. + * @param env The environment variables to use. + * @param cmd The path to the CodeQL CLI. + */ +export function getCachedCodeQlVersion( + logger: Logger, + env: Env, + cmd?: string, +): undefined | VersionInfo { + if (cachedCodeQlVersion !== undefined) { + return cachedCodeQlVersion; + } + // Fall back to the value persisted by an earlier Actions step, if any. This is + // best-effort: any malformed or mismatched value is ignored so that the caller + // invokes `codeql version` instead. + let serialized: string; + try { + serialized = fs.readFileSync(getCommandCacheFilePath(env), "utf8"); + } catch (e) { + logger.debug( + `Cannot read CLI-cache file ${getCommandCacheFilePath(env)}: ${e}`, + ); + return undefined; + } + let persisted: unknown; + try { + persisted = JSON.parse(serialized); + } catch (e) { + logger.debug(`Cannot parse CLI-cache data as JSON: ${e}`); + return undefined; + } + if ( + !isOutputCache(persisted) || + (cmd !== undefined && persisted.cmd !== cmd) + ) { + return undefined; + } + // Memoize the parsed value so that subsequent calls in this process don't + // re-parse the environment variable. + cachedCodeQlVersion = persisted.entries.version as VersionInfo; + return cachedCodeQlVersion; +} + +/** + * Determines whether a value is a `VersionInfo` object. + * @param x The value to test + */ +function isVersionInfo(x: unknown): x is VersionInfo { + const candidate = x as Partial | null; + return ( + typeof candidate === "object" && + candidate !== null && + typeof candidate.version === "string" && + (candidate.features === undefined || + (typeof candidate.features === "object" && + candidate.features !== null)) && + (candidate.overlayVersion === undefined || + typeof candidate.overlayVersion === "number") + ); +} + +/** + * Determines whether a value is a `OutputCache` object. + * @param x The value to test + */ +function isOutputCache(x: unknown): x is OutputCache { + const candidate = x as Partial | null; + return ( + typeof candidate === "object" && + candidate !== null && + typeof candidate.cmd === "string" && + candidate.entries !== undefined && + isVersionInfo(candidate.entries.version) + ); +} diff --git a/src/cli/types.ts b/src/cli/types.ts new file mode 100644 index 0000000000..ad48ff29b4 --- /dev/null +++ b/src/cli/types.ts @@ -0,0 +1,13 @@ +export interface VersionInfo { + version: string; + features?: { [name: string]: boolean }; + /** + * The overlay version helps deal with backward incompatible changes for + * overlay analysis. When a precompiled query pack reports the same overlay + * version as the CodeQL CLI, we can use the CodeQL CLI to perform overlay + * analysis with that pack. Otherwise, if the overlay versions are different, + * or if either the pack or the CLI does not report an overlay version, + * we need to revert to non-overlay analysis. + */ + overlayVersion?: number; +} diff --git a/src/codeql.test.ts b/src/codeql.test.ts index dea4cf04af..df4bafe295 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -51,6 +51,31 @@ test.beforeEach(() => { }); }); +test("isDiskConfigurationError - true for expected errors", async (t) => { + t.true( + codeql.isDiskConfigurationError(new Error("ENOSPC: Out of disk space")), + ); + t.true( + codeql.isDiskConfigurationError( + new Error( + "EACCES: permission denied, mkdir /opt/hostedtoolcache/CodeQL/", + ), + ), + ); +}); + +test("isDiskConfigurationError - false for other errors", async (t) => { + t.false(codeql.isDiskConfigurationError("Not an Error instance")); + + const otherMessages = [ + "Does not contain an error code we test for", + "ENOSP: Not quite the full error code", + ]; + for (const otherMessage of otherMessages) { + t.false(codeql.isDiskConfigurationError(new Error(otherMessage))); + } +}); + async function installIntoToolcache({ apiDetails = SAMPLE_DOTCOM_API_DETAILS, cliVersion, @@ -156,6 +181,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `0.0.0-${version}`)); t.is(result.toolsVersion, `0.0.0-${version}`); t.is(result.toolsSource, ToolsSource.Download); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } t.is(toolcache.findAllVersions("CodeQL").length, 2); @@ -191,9 +217,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `2.15.0`)); t.is(result.toolsVersion, `2.15.0`); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -230,9 +254,7 @@ test.serial( t.assert(toolcache.find("CodeQL", "0.0.0-20200610")); t.deepEqual(result.toolsVersion, "0.0.0-20200610"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -282,11 +304,7 @@ for (const { t.assert(toolcache.find("CodeQL", expectedToolcacheVersion)); t.deepEqual(result.toolsVersion, expectedToolcacheVersion); t.is(result.toolsSource, ToolsSource.Download); - t.assert( - Number.isInteger( - result.toolsDownloadStatusReport?.downloadDurationMs, - ), - ); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -330,9 +348,7 @@ for (const toolcacheVersion of [ SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion, ); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); }); }, ); @@ -373,9 +389,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, "0.0.0-20200601"); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -421,9 +435,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -462,9 +474,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -506,9 +516,7 @@ test.serial( t.is(result.toolsVersion, "0.0.0-20230203"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -519,15 +527,11 @@ test.serial( }, ); -function assertDurationsInteger( +function assertDownloadDurationInteger( t: ExecutionContext, - statusReport: ToolsDownloadStatusReport, + statusReport: ToolsDownloadStatusReport | undefined, ) { - t.assert(Number.isInteger(statusReport?.combinedDurationMs)); - if (statusReport.downloadDurationMs !== undefined) { - t.assert(Number.isInteger(statusReport?.downloadDurationMs)); - t.assert(Number.isInteger(statusReport?.extractionDurationMs)); - } + t.assert(Number.isInteger(statusReport?.downloadDurationMs)); } test.serial("getExtraOptions works for explicit paths", (t) => { @@ -601,7 +605,6 @@ const injectedConfigMacro = makeMacro({ "", undefined, undefined, - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as string[]; @@ -877,7 +880,6 @@ test.serial( "", undefined, "/path/to/qlconfig.yml", - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as string[]; @@ -908,7 +910,6 @@ test.serial( "", undefined, undefined, // undefined qlconfigFile - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as any[]; @@ -1087,7 +1088,6 @@ test.serial( "sourceRoot", undefined, undefined, - getRunnerLogger(false), ); t.true(runnerConstructorStub.calledOnce); diff --git a/src/codeql.ts b/src/codeql.ts index f98130f118..117b0d8e65 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -12,10 +12,12 @@ import { runTool, } from "./actions-util"; import * as api from "./api-client"; +import * as outputCache from "./cli/output-cache"; +import type { VersionInfo } from "./cli/types"; import { CliError, wrapCliConfigurationError } from "./cli-errors"; import { appendExtraQueryExclusions, type Config } from "./config-utils"; import { DocUrl } from "./doc-url"; -import { EnvVar } from "./environment"; +import { EnvVar, getEnv } from "./environment"; import { CodeQLDefaultVersionInfo, Feature, @@ -23,11 +25,10 @@ import { } from "./feature-flags"; import { isAnalyzingDefaultBranch } from "./git-utils"; import { Language } from "./languages"; -import { Logger } from "./logging"; +import { getRunnerLogger, Logger } from "./logging"; import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import * as setupCodeql from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature, isSupportedToolsFeature } from "./tools-features"; import { shouldEnableIndirectTracing } from "./tracer-config"; @@ -92,7 +93,6 @@ export interface CodeQL { sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ): Promise; /** * Runs the autobuilder for the given language. @@ -216,20 +216,6 @@ export interface CodeQL { ): Promise; } -export interface VersionInfo { - version: string; - features?: { [name: string]: boolean }; - /** - * The overlay version helps deal with backward incompatible changes for - * overlay analysis. When a precompiled query pack reports the same overlay - * version as the CodeQL CLI, we can use the CodeQL CLI to perform overlay - * analysis with that pack. Otherwise, if the overlay versions are different, - * or if either the pack or the CLI does not report an overlay version, - * we need to revert to non-overlay analysis. - */ - overlayVersion?: number; -} - export interface ResolveDatabaseOutput { overlayBaseSpecifier?: string; } @@ -287,6 +273,26 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01"; /** The CLI verbosity level to use for extraction in debug mode. */ const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++"; +/** + * Decides whether `e` is a disk-related error outside of our control + * that should be classified as a `ConfigurationError`. + * + * @param e The error to check. + * @returns True if the error should be treated as a `ConfigurationError` or false if not. + */ +export function isDiskConfigurationError(e: unknown): boolean { + if (!(e instanceof Error)) { + return false; + } + + return ( + // out of disk space + e.message.includes("ENOSPC") || + // access denied + e.message.includes("EACCES") + ); +} + /** * Set up CodeQL CLI access. * @@ -319,7 +325,6 @@ export async function setupCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: setupCodeql.ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { try { const { @@ -327,7 +332,6 @@ export async function setupCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, } = await setupCodeql.setupCodeQLBundle( toolsInput, apiDetails, @@ -340,12 +344,6 @@ export async function setupCodeQL( logger, ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport, - )}`, - ); - let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; @@ -355,19 +353,17 @@ export async function setupCodeQL( ); } - cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion); + cachedCodeQL = await getCodeQLForCmd(logger, codeqlCmd, checkVersion); return { codeql: cachedCodeQL, toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } catch (rawError) { const e = api.wrapApiConfigurationError(rawError); const ErrorClass = - e instanceof util.ConfigurationError || - (e instanceof Error && e.message.includes("ENOSPC")) // out of disk space + e instanceof util.ConfigurationError || isDiskConfigurationError(e) ? util.ConfigurationError : Error; @@ -382,9 +378,9 @@ export async function setupCodeQL( /** * Use the CodeQL executable located at the given path. */ -export async function getCodeQL(cmd: string): Promise { +export async function getCodeQL(logger: Logger, cmd: string): Promise { if (cachedCodeQL === undefined) { - cachedCodeQL = await getCodeQLForCmd(cmd, true); + cachedCodeQL = await getCodeQLForCmd(logger, cmd, true); } return cachedCodeQL; } @@ -491,8 +487,9 @@ export function createStubCodeQL(partialCodeql: Partial): CodeQL { */ export async function getCodeQLForTesting( cmd = "codeql-for-testing", + logger: Logger = getRunnerLogger(true), ): Promise { - return getCodeQLForCmd(cmd, false); + return getCodeQLForCmd(logger, cmd, false); } /** @@ -504,6 +501,7 @@ export async function getCodeQLForTesting( * @returns A new CodeQL object */ async function getCodeQLForCmd( + logger: Logger, cmd: string, checkVersion: boolean, ): Promise { @@ -512,7 +510,7 @@ async function getCodeQLForCmd( return cmd; }, async getVersion() { - let result = util.getCachedCodeQlVersion(cmd); + let result = outputCache.getCachedCodeQlVersion(logger, getEnv(), cmd); if (result === undefined) { result = await runCliJson( cmd, @@ -521,7 +519,7 @@ async function getCodeQLForCmd( noStreamStdout: true, }, ); - util.cacheCodeQlVersion(cmd, result); + outputCache.cacheCodeQlVersion(getEnv(), cmd, result); } return result; }, @@ -549,7 +547,6 @@ async function getCodeQLForCmd( sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ) { const extraArgs = config.languages.map( (language) => `--language=${language}`, diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index 84c709e72a..29d72f3af4 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -1295,13 +1295,12 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled", + "No overlay-base database on default branch if runner disk space is below minimum", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, ], isDefaultBranch: true, diskUsage: { @@ -1315,13 +1314,12 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled", + "Overlay-base database on default branch if runner disk space is above minimum", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, ], isDefaultBranch: true, diskUsage: { @@ -1335,17 +1333,93 @@ checkOverlayEnablementMacro.serial( }, ); +// Check that each feature flag lowers the limit to the threshold that its name +// declares. Both sides of the boundary are needed to pin the threshold down: a +// mapping to a lower value would still pass the case at the limit, and one to a +// higher value would still fail the case below it. +for (const [feature, thresholdGb] of [ + [Feature.OverlayAnalysisMinDisk8Gb, 8], + [Feature.OverlayAnalysisMinDisk9Gb, 9], + [Feature.OverlayAnalysisMinDisk10Gb, 10], + [Feature.OverlayAnalysisMinDisk11Gb, 11], + [Feature.OverlayAnalysisMinDisk12Gb, 12], + [Feature.OverlayAnalysisMinDisk13Gb, 13], +] as Array<[Feature, number]>) { + const features = [ + Feature.OverlayAnalysis, + Feature.OverlayAnalysisCodeScanningJavascript, + feature, + ]; + + checkOverlayEnablementMacro.serial( + `Overlay-base database on default branch if ${feature} is enabled and runner disk space is at its limit`, + { + languages: [BuiltInLanguage.javascript], + features, + isDefaultBranch: true, + diskUsage: { + numAvailableBytes: thresholdGb * 1_000_000_000, + numTotalBytes: 100_000_000_000, + }, + }, + { + overlayDatabaseMode: OverlayDatabaseMode.OverlayBase, + useOverlayDatabaseCaching: true, + }, + ); + + checkOverlayEnablementMacro.serial( + `No overlay-base database on default branch if ${feature} is enabled and runner disk space is below its limit`, + { + languages: [BuiltInLanguage.javascript], + features, + isDefaultBranch: true, + diskUsage: { + numAvailableBytes: thresholdGb * 1_000_000_000 - 1_000_000, + numTotalBytes: 100_000_000_000, + }, + }, + { + disabledReason: OverlayDisabledReason.InsufficientDiskSpace, + }, + ); +} + checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled", + "Overlay-base database on default branch if runner disk space is exactly at the lowest limit enabled by a feature flag", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, + Feature.OverlayAnalysisMinDisk9Gb, + Feature.OverlayAnalysisMinDisk12Gb, ], isDefaultBranch: true, diskUsage: { - numAvailableBytes: 15_000_000_000, + numAvailableBytes: 9_000_000_000, + numTotalBytes: 100_000_000_000, + }, + }, + { + overlayDatabaseMode: OverlayDatabaseMode.OverlayBase, + useOverlayDatabaseCaching: true, + }, +); + +checkOverlayEnablementMacro.serial( + "No overlay-base database on default branch if runner disk space is below the lowest limit enabled by a feature flag", + { + languages: [BuiltInLanguage.javascript], + features: [ + Feature.OverlayAnalysis, + Feature.OverlayAnalysisCodeScanningJavascript, + Feature.OverlayAnalysisMinDisk9Gb, + Feature.OverlayAnalysisMinDisk12Gb, + ], + isDefaultBranch: true, + diskUsage: { + numAvailableBytes: 8_500_000_000, numTotalBytes: 100_000_000_000, }, }, diff --git a/src/config-utils.ts b/src/config-utils.ts index 040cdc7060..0a6ced00aa 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -48,7 +48,7 @@ import { import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils"; import { EnvVar } from "./environment"; import * as errorMessages from "./error-messages"; -import { Feature, FeatureEnablement } from "./feature-flags"; +import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags"; import { RepositoryProperties, RepositoryPropertyName, @@ -101,19 +101,23 @@ export { type Config } from "./config/action-config"; * whether to perform overlay analysis, then the action will not perform overlay * analysis unless overlay analysis has been explicitly enabled via environment * variable. + * + * This threshold can be lowered by the feature flags in + * `OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE`. */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 20000; -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = - OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1_000_000; +const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14000; /** - * The v2 minimum available disk space (in MB) required to perform overlay - * analysis. This is a lower threshold than the v1 limit, allowing overlay - * analysis to run on runners with less available disk space. + * Minimum available disk space (in MB) enabled by each overlay feature flag. */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14000; -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = - OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1_000_000; +const OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE = { + [Feature.OverlayAnalysisMinDisk8Gb]: 8000, + [Feature.OverlayAnalysisMinDisk9Gb]: 9000, + [Feature.OverlayAnalysisMinDisk10Gb]: 10000, + [Feature.OverlayAnalysisMinDisk11Gb]: 11000, + [Feature.OverlayAnalysisMinDisk12Gb]: 12000, + [Feature.OverlayAnalysisMinDisk13Gb]: 13000, +} satisfies Partial>; /** * The minimum memory (in MB) that must be available for CodeQL to perform overlay analysis. If @@ -588,24 +592,44 @@ async function checkOverlayAnalysisFeatureEnabled( return new Success(undefined); } +/** + * Returns the minimum available disk space (in MB) required to perform overlay + * analysis, which is the lowest threshold enabled by a feature flag, or the + * default threshold if no such feature flag is enabled. + */ +async function getMinimumDiskSpaceMb( + features: FeatureEnablement, +): Promise { + let minimumMb = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB; + for (const [feature, thresholdMb] of Object.entries( + OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE, + )) { + if (await features.getValue(feature as FeatureWithoutCLI)) { + minimumMb = Math.min(minimumMb, thresholdMb); + } + } + return minimumMb; +} + /** Checks if the runner has enough disk space for overlay analysis. */ function runnerHasSufficientDiskSpace( diskUsage: DiskUsage, logger: Logger, - useV2ResourceChecks: boolean, + minimumDiskSpaceMb: number, ): boolean { - const minimumDiskSpaceBytes = useV2ResourceChecks - ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES - : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; - if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { - const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000); - const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1_000_000); + const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000); + if (diskUsage.numAvailableBytes < minimumDiskSpaceMb * 1_000_000) { logger.info( `Setting overlay database mode to ${OverlayDatabaseMode.None} ` + `due to insufficient disk space (${diskSpaceMb} MB, needed ${minimumDiskSpaceMb} MB).`, ); return false; } + + logger.debug( + `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is at or above the ` + + `minimum of ${minimumDiskSpaceMb} MB.`, + ); return true; } @@ -637,7 +661,7 @@ async function runnerHasSufficientMemory( } logger.debug( - `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.`, + `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is at or above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.`, ); return true; } @@ -648,12 +672,13 @@ async function runnerHasSufficientMemory( */ async function checkRunnerResources( codeql: CodeQL, + features: FeatureEnablement, diskUsage: DiskUsage, ramInput: string | undefined, logger: Logger, - useV2ResourceChecks: boolean, ): Promise> { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { + const minimumDiskSpaceMb = await getMinimumDiskSpaceMb(features); + if (!runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb)) { return new Failure(OverlayDisabledReason.InsufficientDiskSpace); } if (!(await runnerHasSufficientMemory(codeql, ramInput, logger))) { @@ -752,9 +777,6 @@ export async function checkOverlayEnablement( Feature.OverlayAnalysisSkipResourceChecks, codeql, )); - const useV2ResourceChecks = await features.getValue( - Feature.OverlayAnalysisResourceChecksV2, - ); const checkOverlayStatus = await features.getValue( Feature.OverlayAnalysisStatusCheck, ); @@ -770,10 +792,10 @@ export async function checkOverlayEnablement( performResourceChecks && diskUsage !== undefined ? await checkRunnerResources( codeql, + features, diskUsage, ramInput, logger, - useV2ResourceChecks, ) : new Success(undefined); if (resourceResult.isFailure()) { @@ -1166,7 +1188,6 @@ export async function initConfig( try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); // Throw the error in test mode so it's more visible, unless the environment @@ -1644,26 +1665,6 @@ export function getPrimaryAnalysisConfig(config: Config): AnalysisConfig { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -/** Logs the Git version as a telemetry diagnostic. */ -async function logGitVersionTelemetry( - config: Config, - gitVersion: GitVersionInfo, -): Promise { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion, - }, - ), - ); - } -} - /** * Logs the time it took to identify generated files and how many were discovered as * a telemetry diagnostic. diff --git a/src/config/file.test.ts b/src/config/file.test.ts index 22e2f795f8..0833ad3d06 100644 --- a/src/config/file.test.ts +++ b/src/config/file.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import test from "ava"; import sinon from "sinon"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import { RegistryProxyVars } from "../environment"; import { Feature } from "../feature-flags"; @@ -18,7 +19,7 @@ setupTests(test); test("getConfigFileInput returns undefined by default", async (t) => { await callee(getConfigFileInput) - .withArgs({}) + .withArgs({}, undefined) .withFeatures([Feature.ConfigFileRepositoryProperty]) .passes(t.is, undefined); }); @@ -40,7 +41,7 @@ test("getConfigFileInput returns input value", async (t) => { .withArgs("config-file") .returns(testInput); }) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from workflow") .passes(t.is, testInput); }); @@ -49,16 +50,48 @@ test("getConfigFileInput returns repository property value", async (t) => { // Since there is no direct input, we should use the repository property. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from repository property") .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); }); +test("getConfigFileInput returns repository property value for Code Scanning", async (t) => { + // Since there is no direct input, we should use the repository property. + await callee(getConfigFileInput) + .withFeatures([Feature.ConfigFileRepositoryProperty]) + .withArgs(repositoryProperties, [AnalysisKind.CodeScanning]) + .logs(t, "Using configuration file input from repository property") + .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); +}); + +test("getConfigFileInput ignores repository property for other analysis kinds", async (t) => { + const unsupportedCases = [ + [AnalysisKind.CodeQuality], + [AnalysisKind.RiskAssessment], + [AnalysisKind.CodeScanning, AnalysisKind.CodeQuality], + ]; + + const target = callee(getConfigFileInput).withFeatures([ + Feature.ConfigFileRepositoryProperty, + ]); + + for (const unsupportedCase of unsupportedCases) { + // Since the analysis kind is unsupported, we should ignore the repository property. + await target + .withArgs(repositoryProperties, unsupportedCase) + .logs( + t, + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ) + .passes(t.is, undefined); + } +}); + test("getConfigFileInput ignores empty repository property value", async (t) => { // Since the repository property value is an empty/whitespace string, we should ignore it. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }) + .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }, undefined) .passes(t.is, undefined); }); @@ -66,7 +99,7 @@ test("getConfigFileInput ignores repository property value when FF is off", asyn // Since the FF is off, we should ignore the repository property value. await callee(getConfigFileInput) .withFeatures([]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .notLogs(t, "Using configuration file input from repository property") .logs( t, diff --git a/src/config/file.ts b/src/config/file.ts index 8cb7bc3a11..be0e415a38 100644 --- a/src/config/file.ts +++ b/src/config/file.ts @@ -1,4 +1,5 @@ import { ActionState } from "../action-common"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import * as errorMessages from "../error-messages"; import { Feature } from "../feature-flags"; @@ -34,6 +35,7 @@ export async function getConfigFileInput( features, }: ActionState<["Logger", "Actions", "FeatureFlags"]>, repositoryProperties: Partial, + analysisKinds: AnalysisKind[] | undefined, ): Promise { const input = actions.getOptionalInput("config-file"); @@ -45,17 +47,29 @@ export async function getConfigFileInput( const propertyValue = repositoryProperties[RepositoryPropertyName.CONFIG_FILE]; + // Only allow the repository property to be used for standard Code Scanning analyses, + // since we don't currently support some customisation options for Code Quality. + // We don't expect customisations for Risk Assessments either. + const analysisKindSupported = + analysisKinds === undefined || + (analysisKinds.includes(AnalysisKind.CodeScanning) && + analysisKinds.length === 1); + if (propertyValue !== undefined && propertyValue.trim().length > 0) { // Only use the repository property value if the FF is enabled. const useRepositoryProperty = await features.getValue( Feature.ConfigFileRepositoryProperty, ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}`, ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled.", diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts new file mode 100644 index 0000000000..851dd72e2f --- /dev/null +++ b/src/config/inputs.test.ts @@ -0,0 +1,89 @@ +import test from "ava"; +import sinon from "sinon"; + +import { ActionsEnv } from "../actions-util"; +import { Feature } from "../feature-flags"; +import { RepositoryPropertyName } from "../feature-flags/properties"; +import { callee } from "../testing-utils"; + +import { ComputedInput, getToolsInput, InputName, InputSource } from "./inputs"; + +test("getToolsInput - undefined if there's no input", async (t) => { + await callee(getToolsInput).withArgs({}).passes(t.is, undefined); +}); + +const expectedWorkflowResult: ComputedInput = { + source: InputSource.Workflow, + value: "workflow-input-value", +}; + +const expectedRepositoryPropertyResult: ComputedInput = { + source: InputSource.RepositoryProperty, + value: "repo-property-input-value", +}; + +function stubGetToolsInput(actions: ActionsEnv) { + sinon + .stub(actions, "getOptionalInput") + .withArgs(InputName.Tools) + .returns(expectedWorkflowResult.value); +} + +const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`; + +test("getToolsInput - returns workflow input if available", async (t) => { + await callee(getToolsInput) + .withActions(stubGetToolsInput) + .withArgs({}) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property value if enforced", async (t) => { + const target = callee(getToolsInput) + .withActions(stubGetToolsInput) + .withArgs({ + [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`, + }); + + // We expect the repository value if provided and the FF is enabled. + const enforcedLogMessage = `Using ${InputName.Tools} input from repository property (enforced):`; + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, enforcedLogMessage) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target + .notLogs(t, enforcedLogMessage) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - prefers workflow input", async (t) => { + const target = callee(getToolsInput) + .withActions(stubGetToolsInput) + .withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the workflow input regardless of the FF state. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); + await target + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property", async (t) => { + const target = callee(getToolsInput).withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the repository property if the FF is enabled or undefined otherwise. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, `Using ${InputName.Tools} input from repository property:`) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target.passes(t.is, undefined); +}); diff --git a/src/config/inputs.ts b/src/config/inputs.ts new file mode 100644 index 0000000000..32a8dfd6f6 --- /dev/null +++ b/src/config/inputs.ts @@ -0,0 +1,80 @@ +import { ActionState } from "../action-common"; +import { Feature } from "../feature-flags"; +import { + RepositoryProperties, + RepositoryPropertyName, +} from "../feature-flags/properties"; + +/** Enumerates input names. */ +export enum InputName { + Tools = "tools", +} + +/** Enumerates input sources. */ +export enum InputSource { + Workflow = "workflow", + RepositoryProperty = "repository-property", +} + +/** + * Represents an effective input to the CodeQL Action. That is, + * the input value that was computed or selected from multiple sources. + */ +export type ComputedInput = { + /** The value of the property. */ + value: string; + /** The source of the property. */ + source: InputSource; +}; + +/** + * Gets the computed `tools` input. This comes from either the workflow or + * the repository property. + * + * @param action The Action state. + * @param repositoryProperties The values of known repository properties. + * @returns The computed input or `undefined` if there is no input. + */ +export async function getToolsInput( + action: ActionState<["Logger", "Actions", "FeatureFlags"]>, + repositoryProperties: Partial, +): Promise { + const name = InputName.Tools; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS]; + const allowRepositoryProperty = await action.features.getValue( + Feature.ToolsRepositoryProperty, + ); + + // The repository property takes precedence if it starts with an '!'. + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}`, + ); + return { + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: InputSource.RepositoryProperty, + }; + } + + // Otherwise, the input from the workflow takes precedence. + if (input !== undefined) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { value: input, source: InputSource.Workflow }; + } + + // Use the repository property if there's no workflow input. + if (allowRepositoryProperty && propertyValue !== undefined) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}`, + ); + return { + value: propertyValue, + source: InputSource.RepositoryProperty, + }; + } + + // There's no input. + return undefined; +} diff --git a/src/config/remote-file.ts b/src/config/remote-file.ts index 236e178207..1052072a28 100644 --- a/src/config/remote-file.ts +++ b/src/config/remote-file.ts @@ -16,7 +16,7 @@ export interface RemoteFileAddress { } /** The default file path to use in configuration file shorthands. */ -export const DEFAULT_CONFIG_FILE_NAME = ".github/codeql-action.yaml"; +export const DEFAULT_CONFIG_FILE_NAME = ".github/codeql-config.yml"; /** The default ref to use in configuration file shorthands. */ export const DEFAULT_CONFIG_FILE_REF = "main"; diff --git a/src/defaults.json b/src/defaults.json index 39ecfc35fa..b5d9f13644 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.3", + "cliVersion": "2.26.3", + "priorBundleVersion": "codeql-bundle-v2.26.2", + "priorCliVersion": "2.26.2" } diff --git a/src/environment.ts b/src/environment.ts index 1b00ab7cfb..29665512c2 100644 --- a/src/environment.ts +++ b/src/environment.ts @@ -39,12 +39,6 @@ export enum EnvVar { */ CODE_SCANNING_REF = "CODE_SCANNING_REF", - /** - * `PersistedVersionInfo` for the CodeQL CLI, so later Actions steps can reuse it instead of - * invoking `codeql version` again. - */ - CODEQL_VERSION_INFO = "CODEQL_ACTION_CLI_VERSION_INFO", - /** Whether the CodeQL Action has invoked the Go autobuilder. */ DID_AUTOBUILD_GOLANG = "CODEQL_ACTION_DID_AUTOBUILD_GOLANG", @@ -88,7 +82,7 @@ export enum EnvVar { LOG_VERSION_DEPRECATION = "CODEQL_ACTION_DID_LOG_VERSION_DEPRECATION", /** UUID representing the current job run. */ - JOB_RUN_UUID = "JOB_RUN_UUID", + JOB_RUN_UUID = "CODEQL_ACTION_JOB_RUN_UUID", /** Status for the entire job, submitted to the status report in `init-post` */ JOB_STATUS = "CODEQL_ACTION_JOB_STATUS", @@ -270,6 +264,11 @@ export class ReadOnlyEnv { return Object.create(this, { vars: { value: { ...this.vars } } }) as this; } + /** Gets a copy of the underlying environment. */ + public get(): Record { + return { ...this.vars }; + } + /** Tries to get the value for `name` and throws if there isn't one. */ public getRequired(name: string): string { return getRequiredEnvVar(this.vars, name); diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 0c92ac69af..7abccf60cb 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -74,7 +74,6 @@ export enum Feature { AllowMergeConfigFiles = "allow_merge_config_files", /** Controls whether we allow multiple values for the `analysis-kinds` input. */ AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds", - AllowToolcacheInput = "allow_toolcache_input", CleanupTrapCaches = "cleanup_trap_caches", /** Whether to allow the `config-file` input to be specified via a repository property. */ ConfigFileRepositoryProperty = "config_file_repository_property", @@ -122,12 +121,37 @@ export enum Feature { * `OverlayAnalysisMatchCodeqlVersion` overrides this flag. */ OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run", - OverlayAnalysisPython = "overlay_analysis_python", /** - * Controls whether lower disk space requirements are used for overlay hardware checks. - * Has no effect if `OverlayAnalysisSkipResourceChecks` is enabled. + * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ + OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb", + /** + * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ + OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb", + /** + * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ + OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb", + /** + * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ + OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb", + /** + * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. */ - OverlayAnalysisResourceChecksV2 = "overlay_analysis_resource_checks_v2", + OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb", + /** + * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ + OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb", + OverlayAnalysisPython = "overlay_analysis_python", OverlayAnalysisRuby = "overlay_analysis_ruby", /** Controls whether hardware checks are skipped for overlay analysis. */ OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks", @@ -141,6 +165,8 @@ export enum Feature { /** Note that this currently only disables baseline file coverage information. */ SkipFileCoverageOnPrs = "skip_file_coverage_on_prs", StartProxyUseFeaturesRelease = "start_proxy_use_features_release", + /** Whether to allow the `tools` input to be specified via a repository property. */ + ToolsRepositoryProperty = "tools_repository_property", UploadOverlayDbToApi = "upload_overlay_db_to_api", ValidateDbConfig = "validate_db_config", } @@ -185,11 +211,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: undefined, }, - [Feature.AllowToolcacheInput]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: undefined, - }, [Feature.CleanupTrapCaches]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", @@ -358,9 +379,34 @@ export const featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: undefined, }, - [Feature.OverlayAnalysisResourceChecksV2]: { + [Feature.OverlayAnalysisMinDisk8Gb]: { defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk9Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_9_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk10Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_10_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk11Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_11_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk12Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_12_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk13Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_13_GB", minimumVersion: undefined, }, [Feature.OverlayAnalysisStatusCheck]: { @@ -400,6 +446,11 @@ export const featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: undefined, }, + [Feature.ToolsRepositoryProperty]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: undefined, + }, [Feature.UploadOverlayDbToApi]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", diff --git a/src/feature-flags/properties.test.ts b/src/feature-flags/properties.test.ts index 66526b1fb2..d3094a8d1c 100644 --- a/src/feature-flags/properties.test.ts +++ b/src/feature-flags/properties.test.ts @@ -72,13 +72,17 @@ test.serial( ); test.serial("loadPropertiesFromApi loads known properties", async (t) => { + const knownProperties = [ + { property_name: "github-codeql-config-file", value: "owner/repo" }, + { property_name: "github-codeql-extra-queries", value: "+queries" }, + { property_name: "github-codeql-tools", value: "nightly" }, + ]; sinon.stub(api, "getRepositoryProperties").resolves({ headers: {}, status: 200, url: "", data: [ - { property_name: "github-codeql-config-file", value: "owner/repo" }, - { property_name: "github-codeql-extra-queries", value: "+queries" }, + ...knownProperties, { property_name: "unknown-property", value: "something" }, ] satisfies properties.GitHubPropertiesResponse, }); @@ -88,10 +92,12 @@ test.serial("loadPropertiesFromApi loads known properties", async (t) => { logger, mockRepositoryNwo, ); - t.deepEqual(response, { - "github-codeql-config-file": "owner/repo", - "github-codeql-extra-queries": "+queries", - }); + t.deepEqual( + response, + Object.fromEntries( + knownProperties.map((prop) => [prop.property_name, prop.value]), + ), + ); }); test.serial("loadPropertiesFromApi parses true boolean property", async (t) => { diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts index e239c71947..4c888bd5ec 100644 --- a/src/feature-flags/properties.ts +++ b/src/feature-flags/properties.ts @@ -1,7 +1,10 @@ +import * as github from "@actions/github"; + import { isDynamicWorkflow } from "../actions-util"; import { getRepositoryProperties } from "../api-client"; import { Logger } from "../logging"; import { RepositoryNwo } from "../repository"; +import { Failure, getErrorMessage, Result, Success } from "../util"; /** The common prefix that we expect all of our repository properties to have. */ export const GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; @@ -14,6 +17,7 @@ export enum RepositoryPropertyName { DISABLE_OVERLAY = "github-codeql-disable-overlay", EXTRA_QUERIES = "github-codeql-extra-queries", FILE_COVERAGE_ON_PRS = "github-codeql-file-coverage-on-prs", + TOOLS = "github-codeql-tools", } /** Parsed types of the known repository properties. */ @@ -22,6 +26,7 @@ export type AllRepositoryProperties = { [RepositoryPropertyName.DISABLE_OVERLAY]: boolean; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: boolean; + [RepositoryPropertyName.TOOLS]: string; }; /** Parsed repository properties. */ @@ -33,6 +38,7 @@ export type RepositoryPropertyApiType = { [RepositoryPropertyName.DISABLE_OVERLAY]: string; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: string; + [RepositoryPropertyName.TOOLS]: string; }; /** The type of functions which take the `value` from the API and try to convert it to the type we want. */ @@ -81,6 +87,7 @@ const repositoryPropertyParsers: { [RepositoryPropertyName.DISABLE_OVERLAY]: booleanProperty, [RepositoryPropertyName.EXTRA_QUERIES]: stringProperty, [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: booleanProperty, + [RepositoryPropertyName.TOOLS]: stringProperty, }; /** @@ -230,3 +237,35 @@ const KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name: string): name is RepositoryPropertyName { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } + +/** + * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. + */ +export async function loadRepositoryProperties( + repositoryNwo: RepositoryNwo, + logger: Logger, +): Promise> { + // See if we can skip loading repository properties early. In particular, + // repositories owned by users cannot have repository properties, so we can + // skip the API call entirely in that case. + const repositoryOwnerType = github.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and " + + "therefore cannot have repository properties.", + ); + return new Success({}); + } + + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error)}`, + ); + return new Failure(error); + } +} diff --git a/src/init-action-post-helper.ts b/src/init-action-post-helper.ts index 23695b6d1c..7b7b056a1c 100644 --- a/src/init-action-post-helper.ts +++ b/src/init-action-post-helper.ts @@ -123,6 +123,7 @@ async function prepareFailedSarif( const category = `/language:${language}`; const checkoutPath = "."; const result = await generateFailedSarif( + logger, features, config, category, @@ -146,6 +147,7 @@ async function prepareFailedSarif( const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); const result = await generateFailedSarif( + logger, features, config, category, @@ -156,6 +158,7 @@ async function prepareFailedSarif( } async function generateFailedSarif( + logger: Logger, features: FeatureEnablement, config: Config, category: string | undefined, @@ -163,7 +166,7 @@ async function generateFailedSarif( sarifFile?: string, ) { const databasePath = config.dbLocation; - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); // Set the filename for the SARIF file if not already set. if (sarifFile === undefined) { diff --git a/src/init-action-post.ts b/src/init-action-post.ts index b407cfb99e..2261b56ea6 100644 --- a/src/init-action-post.ts +++ b/src/init-action-post.ts @@ -75,7 +75,7 @@ async function run(startedAt: Date) { "Debugging artifacts are unavailable since the 'init' Action failed before it could produce any.", ); } else { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); uploadFailedSarifResult = await initActionPostHelper.uploadFailureInfo( debugArtifacts.tryUploadAllAvailableDebugArtifacts, diff --git a/src/init-action.ts b/src/init-action.ts index 8d0434160b..6b5ed392ef 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -2,10 +2,8 @@ import * as fs from "fs"; import * as path from "path"; import * as core from "@actions/core"; -import * as github from "@actions/github"; import * as io from "@actions/io"; import * as semver from "semver"; -import { v4 as uuidV4 } from "uuid"; import { Action, ActionState, runInActions } from "./action-common"; import { @@ -26,6 +24,7 @@ import { } from "./caching-utils"; import { CodeQL } from "./codeql"; import { getConfigFileInput } from "./config/file"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import * as configUtils from "./config-utils"; import { DependencyCacheRestoreStatusReport, @@ -41,10 +40,7 @@ import { } from "./diagnostics"; import { EnvVar } from "./environment"; import { Feature, FeatureEnablement, initFeatures } from "./feature-flags"; -import { - loadPropertiesFromApi, - RepositoryProperties, -} from "./feature-flags/properties"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { checkInstallPython311, checkPacksForOverlayCompatibility, @@ -62,7 +58,7 @@ import { OverlayBaseDatabaseDownloadStats, } from "./overlay/caching"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; -import { getRepositoryNwo, RepositoryNwo } from "./repository"; +import { getRepositoryNwo } from "./repository"; import { ToolsSource } from "./setup-codeql"; import { ActionName, @@ -74,7 +70,6 @@ import { getActionsStatus, sendStatusReport, } from "./status-report"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature } from "./tools-features"; import { getCombinedTracerConfig } from "./tracer-config"; @@ -94,10 +89,7 @@ import { checkActionVersion, getErrorMessage, BuildMode, - Result, getOptionalEnvVar, - Success, - Failure, } from "./util"; import { checkWorkflow } from "./workflow"; @@ -137,6 +129,7 @@ async function sendCompletedStatusReport( startedAt: Date, config: configUtils.Config | undefined, configFile: string | undefined, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -165,12 +158,16 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: workflowLanguages || "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { @@ -218,11 +215,11 @@ async function run( let codeql: CodeQL; let features: FeatureEnablement; let sourceRoot: string; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; let toolsVersion: string; - let zstdAvailability: ZstdAvailability | undefined; try { initializeEnvironment(getActionVersion()); @@ -257,19 +254,8 @@ async function run( ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - // Create a unique identifier for this run. - const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); - core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties, - ); - // path.resolve() respects the intended semantics of source-root. If // source-root is relative, it is relative to the GITHUB_WORKSPACE. If // source-root is absolute, it is used as given. @@ -292,6 +278,14 @@ async function run( ); } + // Compute the value of the `config-file` input. + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties, + analysisKinds, + ); + // Send a status report indicating that an analysis is starting. await sendStartingStatusReport(startedAt, { analysisKinds }, logger); @@ -302,6 +296,12 @@ async function run( ); } + // Get the computed `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -312,7 +312,7 @@ async function run( analysisKinds?.length === 1 && analysisKinds[0] === AnalysisKind.CodeScanning; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -326,7 +326,6 @@ async function run( toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; // Check the workflow for problems. If there are any problems, they are reported // to the workflow log. No exceptions are thrown. @@ -497,22 +496,6 @@ async function run( cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } - - // Log CodeQL download telemetry, if appropriate - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport, - ), - ); - } - // Forward Go flags const goFlags = process.env["GOFLAGS"]; if (goFlags) { @@ -706,7 +689,6 @@ async function run( sourceRoot, "Runner.Worker.exe", qlconfigFile, - logger, ); // To check custom query packs for compatibility with overlay analysis, we @@ -735,7 +717,6 @@ async function run( sourceRoot, "Runner.Worker.exe", qlconfigFile, - logger, ); } @@ -778,6 +759,7 @@ async function run( startedAt, config, undefined, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -795,6 +777,7 @@ async function run( startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -805,52 +788,6 @@ async function run( ); } -/** - * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. - */ -async function loadRepositoryProperties( - repositoryNwo: RepositoryNwo, - logger: Logger, -): Promise> { - // See if we can skip loading repository properties early. In particular, - // repositories owned by users cannot have repository properties, so we can - // skip the API call entirely in that case. - const repositoryOwnerType = github.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and " + - "therefore cannot have repository properties.", - ); - return new Success({}); - } - - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error)}`, - ); - return new Failure(error); - } -} - -async function recordZstdAvailability( - config: configUtils.Config, - zstdAvailability: ZstdAvailability, -) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability, - ), - ); -} - /** Defines the `init` Action. */ const init: Action = { name: ActionName.Init, diff --git a/src/init.ts b/src/init.ts index 53efbe99a3..c6a258e58c 100644 --- a/src/init.ts +++ b/src/init.ts @@ -30,7 +30,6 @@ import { import { BuiltInLanguage, Language } from "./languages"; import { Logger, withGroupAsync } from "./logging"; import { ToolsSource } from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import * as util from "./util"; @@ -49,27 +48,21 @@ export async function initCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion, - zstdAvailability, - } = await setupCodeQL( - toolsInput, - apiDetails, - tempDir, - variant, - defaultCliVersion, - rawLanguages, - useOverlayAwareDefaultCliVersion, - features, - logger, - true, - ); + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = + await setupCodeQL( + toolsInput, + apiDetails, + tempDir, + variant, + defaultCliVersion, + rawLanguages, + useOverlayAwareDefaultCliVersion, + features, + logger, + true, + ); await codeql.printVersion(); logger.endGroup(); return { @@ -77,7 +70,6 @@ export async function initCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } @@ -97,7 +89,6 @@ export async function runDatabaseInitCluster( sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ): Promise { fs.mkdirSync(config.dbLocation, { recursive: true }); await configUtils.wrapEnvironment( @@ -108,7 +99,6 @@ export async function runDatabaseInitCluster( sourceRoot, processName, qlconfigFile, - logger, ), ); } diff --git a/src/json/index.ts b/src/json/index.ts index 78923f8bac..d8764ec478 100644 --- a/src/json/index.ts +++ b/src/json/index.ts @@ -35,6 +35,11 @@ export function isNumber(value: unknown): value is number { return typeof value === "number"; } +/** Asserts that `value` is a boolean. */ +export function isBoolean(value: unknown): value is boolean { + return typeof value === "boolean"; +} + /** Asserts that `value` is either a string or undefined. */ export function isStringOrUndefined( value: unknown, @@ -62,14 +67,11 @@ function defaultCheck( return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); } -function makeValidator( - validate: (arg: unknown) => arg is T, - required: boolean = true, -) { +function makeValidator(validate: (arg: unknown) => arg is T) { return { validate, check: defaultCheck(validate), - required, + required: true, } as const satisfies Validator; } @@ -82,6 +84,9 @@ export const string = makeValidator(isString); /** A validator for number fields in schemas. */ export const number = makeValidator(isNumber); +/** A validator for boolean fields in schemas. */ +export const boolean = makeValidator(isBoolean); + /** A validator for arrays. */ export function array(validator: Validator) { const validate = (val: unknown) => { @@ -221,6 +226,23 @@ export function validateSchema< return result.valid; } +/** + * Validates that `arr` is an array whose elements satisfy at least `elementSchema`. + * Additional keys are accepted in each element. + * + * @param elementSchema The schema to validate the elements against. + * @param arr The array to validate. + * @returns Asserts that `arr` has elements of `schema`'s type if validation is successful. + */ +export function validateArray< + S extends Schema, + T extends UnvalidatedArray = Array>, +>(elementSchema: S, arr: UnvalidatedArray): arr is T { + const elementValidator = object(elementSchema); + + return array(elementValidator).validate(arr); +} + export interface CheckSchemaOptions { /** Whether to stop validation after the first error. */ failFast?: boolean; diff --git a/src/resolve-environment.ts b/src/resolve-environment.ts index d202efa83e..3a1a6ca6bf 100644 --- a/src/resolve-environment.ts +++ b/src/resolve-environment.ts @@ -9,7 +9,7 @@ export async function runResolveBuildEnvironment( ) { logger.startGroup(`Attempting to resolve build environment for ${language}`); - const codeql = await getCodeQL(cmd); + const codeql = await getCodeQL(logger, cmd); if (workingDir !== undefined) { logger.info(`Using ${workingDir} as the working directory.`); diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 3336afc1a2..7873449f9c 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -1,5 +1,4 @@ import * as core from "@actions/core"; -import { v4 as uuidV4 } from "uuid"; import { Action, ActionState, runInActions } from "./action-common"; import { @@ -11,9 +10,11 @@ import { import { AnalysisKind, getAnalysisKinds } from "./analyses"; import { getGitHubVersion } from "./api-client"; import { CodeQL } from "./codeql"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { initCodeQL } from "./init"; import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; @@ -43,6 +44,7 @@ import { */ async function sendCompletedStatusReport( startedAt: Date, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -67,12 +69,16 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { @@ -87,14 +93,15 @@ async function sendCompletedStatusReport( } /** The main behaviour of this action. */ -async function run({ - startedAt, - logger, -}: ActionState<["Base", "Logger"]>): Promise { +async function run( + actionState: ActionState<["Base", "Logger", "Env", "Actions"]>, +): Promise { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. + const { logger, startedAt } = actionState; let codeql: CodeQL; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -123,9 +130,14 @@ async function run({ logger, ); - const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + // Fetch the values of known repository properties that affect us. + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger, + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + + const actionStateWithFeatures = { ...actionState, features }; const statusReportBase = await createStatusReportBase( ActionName.SetupCodeQL, @@ -138,6 +150,13 @@ async function run({ if (statusReportBase !== undefined) { await sendStatusReport(statusReportBase); } + + // Get the computed `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -146,7 +165,7 @@ async function run({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -187,6 +206,7 @@ async function run({ await sendCompletedStatusReport( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index f2ba43c101..219e39984c 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -117,30 +117,69 @@ test.serial( }, ); -test.serial( - "getCodeQLSource correctly returns bundled CLI version when tools == linked", - async (t) => { - const features = createFeatures([]); - - await withTmpDir(async (tmpDir) => { - setupActionsVars(tmpDir, tmpDir); - const source = await setupCodeql.getCodeQLSource( - "linked", - SAMPLE_DEFAULT_CLI_VERSION, - undefined, // rawLanguages - false, // useOverlayAwareDefaultCliVersion - SAMPLE_DOTCOM_API_DETAILS, - GitHubVariant.DOTCOM, - false, - features, - getRunnerLogger(true), - ); - - t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); - t.is(source.sourceType, "download"); - }); +const LINKED_BUNDLE_TEST_CASES = [ + { + platform: "linux", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-linux64.tar.zst", + expectedCompressionMethod: "zstd", }, -); + { + platform: "darwin", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-osx64.tar.zst", + expectedCompressionMethod: "zstd", + }, + { + platform: "win32", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-win64.tar.gz", + expectedCompressionMethod: "gzip", + }, + { + platform: "linux", + tarSupportsZstd: false, + expectedBundleName: "codeql-bundle-linux64.tar.gz", + expectedCompressionMethod: "gzip", + }, +] as const; + +for (const { + platform, + tarSupportsZstd, + expectedBundleName, + expectedCompressionMethod, +} of LINKED_BUNDLE_TEST_CASES) { + test.serial( + `getCodeQLSource selects ${expectedBundleName} for linked tools`, + async (t) => { + const features = createFeatures([]); + sinon.stub(process, "platform").value(platform); + + await withTmpDir(async (tmpDir) => { + setupActionsVars(tmpDir, tmpDir); + const source = await setupCodeql.getCodeQLSource( + "linked", + SAMPLE_DEFAULT_CLI_VERSION, + undefined, // rawLanguages + false, // useOverlayAwareDefaultCliVersion + SAMPLE_DOTCOM_API_DETAILS, + GitHubVariant.DOTCOM, + tarSupportsZstd, + features, + getRunnerLogger(true), + ); + + t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); + t.is(source.sourceType, "download"); + if (source.sourceType === "download") { + t.is(source.compressionMethod, expectedCompressionMethod); + t.true(source.codeqlURL.endsWith(`/${expectedBundleName}`)); + } + }); + }, + ); +} test.serial( "getCodeQLSource correctly returns bundled CLI version when tools == latest", @@ -194,12 +233,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: "toolsUrl", }, toolsVersion: LINKED_CLI_VERSION.cliVersion, }); @@ -251,12 +285,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: bundleUrl, }, toolsVersion: expectedVersion, }); @@ -422,7 +451,7 @@ test.serial( async (t) => { const loggedMessages: LoggedMessage[] = []; const logger = getRecordingLogger(loggedMessages); - const features = createFeatures([Feature.AllowToolcacheInput]); + const features = createFeatures([]); const latestToolcacheVersion = "3.2.1"; const latestVersionPath = "/path/to/latest"; @@ -551,7 +580,7 @@ const toolcacheInputFallbackMacro = makeMacro({ toolcacheInputFallbackMacro.serial( "the toolcache doesn't have a CodeQL CLI when tools == toolcache", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "dynamic" }, [], [ @@ -562,7 +591,7 @@ toolcacheInputFallbackMacro.serial( toolcacheInputFallbackMacro.serial( "the workflow trigger is not `dynamic`", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "pull_request" }, [], [ @@ -570,14 +599,6 @@ toolcacheInputFallbackMacro.serial( ], ); -toolcacheInputFallbackMacro.serial( - "the feature flag is not enabled", - [], - { GITHUB_EVENT_NAME: "dynamic" }, - [], - [`Ignoring 'tools: toolcache' because the feature is not enabled.`], -); - test.serial( 'tryGetTagNameFromUrl extracts the right tag name for a repo name containing "codeql-bundle"', (t) => { diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 3db0b6ca4d..8d374585aa 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -533,11 +533,7 @@ export async function getCodeQLSource( // We only allow `toolsInput === "toolcache"` for `dynamic` events. In general, using `toolsInput === "toolcache"` // can lead to alert wobble and so it shouldn't be used for an analysis where results are intended to be uploaded. // We also allow this in test mode. - const allowToolcacheValueFF = await features.getValue( - Feature.AllowToolcacheInput, - ); - const allowToolcacheValue = - allowToolcacheValueFF && (isDynamicWorkflow() || util.isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || util.isInTestMode(); if (allowToolcacheValue) { // If `toolsInput === "toolcache"`, try to find the latest version of the CLI that's available in the toolcache // and use that. We perform this check here since we can set `cliVersion` directly and don't want to default to @@ -558,15 +554,9 @@ export async function getCodeQLSource( `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`, ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.`, - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, + ); } const version = await resolveDefaultCliVersion( @@ -921,7 +911,6 @@ interface SetupCodeQLResult { toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: tar.ZstdAvailability; } /** @@ -1005,7 +994,6 @@ export async function setupCodeQLBundle( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 3e376ec64f..e8b89732f7 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -3,11 +3,12 @@ import * as path from "path"; import * as core from "@actions/core"; +import { Action, ActionState, runInActions } from "./action-common"; import * as actionsUtil from "./actions-util"; import { getGitHubVersion } from "./api-client"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; -import { getActionsLogger, Logger } from "./logging"; +import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; import { credentialToStr, @@ -23,14 +24,14 @@ import { import { generateCertificateAuthority } from "./start-proxy/ca"; import { checkProxyEnvironment } from "./start-proxy/environment"; import { checkConnections } from "./start-proxy/reachability"; -import { ActionName, sendUnhandledErrorStatusReport } from "./status-report"; +import { ActionName } from "./status-report"; import * as util from "./util"; -async function run(startedAt: Date) { +async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. - - const logger = getActionsLogger(); + const startedAt = action.startedAt; + const logger = action.logger; let features: FeatureEnablement | undefined; let language: BuiltInLanguage | undefined; @@ -122,21 +123,15 @@ async function run(startedAt: Date) { } } -export async function runWrapper() { - const startedAt = new Date(); - const logger = getActionsLogger(); +/** Defines the `start-proxy` Action. */ +const startProxyAction: Action = { + name: ActionName.StartProxy, + run, + transformTelemetryError: getSafeErrorMessage, +}; - try { - await run(startedAt); - } catch (error) { - core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`); - await sendUnhandledErrorStatusReport( - ActionName.StartProxy, - startedAt, - getSafeErrorMessage(util.wrapError(error)), - logger, - ); - } +export async function runWrapper() { + await runInActions(startProxyAction); } async function startProxy( diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 74e0b498c4..caa1b3054a 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -83,12 +83,6 @@ export class StartProxyError extends Error { } } -interface StartProxyStatus extends StatusReportBase { - // A comma-separated list of registry types which are configured for CodeQL. - // This only includes registry types we support, not all that are configured. - registry_types: string; -} - /** * Sends a status report for the `start-proxy` action indicating a successful outcome. * @@ -112,7 +106,7 @@ export async function sendSuccessStatusReport( logger, ); if (statusReportBase !== undefined) { - const statusReport: StartProxyStatus = { + const statusReport: StatusReportBase = { ...statusReportBase, registry_types: registry_types.join(","), }; diff --git a/src/start-proxy/types.ts b/src/start-proxy/types.ts index 13369edbfa..17803e9126 100644 --- a/src/start-proxy/types.ts +++ b/src/start-proxy/types.ts @@ -254,13 +254,19 @@ export function credentialToStr(credential: Credential): string { return result; } -/** A package registry is identified by its type and address. */ -export type Registry = { +/** The schema for `RegistryBase` objects. */ +export const registryBaseSchema = { /** The type of the package registry. */ - type: string; + type: json.string, /** Whether the registry replaces the base registry for the ecosystem. */ - "replaces-base"?: boolean; -} & Address; + "replaces-base": json.optional(json.boolean), +} as const satisfies json.Schema; + +/** Information about a registry, other than its address. */ +export type RegistryBase = json.FromSchema; + +/** A package registry is identified by its type and address. */ +export type Registry = RegistryBase & Address; // If a registry has an `url`, then that takes precedence over the `host` which may or may // not be defined. diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 52132b7649..2b763da700 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -1,17 +1,21 @@ import test from "ava"; import * as sinon from "sinon"; +import * as uuid from "uuid"; import * as actionsUtil from "./actions-util"; import { Config } from "./config-utils"; -import { EnvVar } from "./environment"; +import { EnvVar, RegistryProxyVars } from "./environment"; import { BuiltInLanguage } from "./languages"; import { getRunnerLogger } from "./logging"; import { ToolsSource } from "./setup-codeql"; +import type { Registry } from "./start-proxy"; import { ActionName, createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, + getRegistryTypesFromEnv, + getJobUUID, InitStatusReport, InitWithConfigStatusReport, } from "./status-report"; @@ -20,11 +24,106 @@ import { setupActionsVars, createTestConfig, makeMacro, + getTestEnv, + RecordingLogger, + callee, } from "./testing-utils"; import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); +test("getRegistryTypesFromEnv - gets unique registry types from environment", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ + [RegistryProxyVars.PROXY_URLS]: JSON.stringify([ + { type: "git_source", url: "https://example.com" }, + { type: "git_source", url: "https://github.com" }, + { type: "docker_registry", url: "https://registry.example.com" }, + ] satisfies Array>), + }); + + const result = getRegistryTypesFromEnv(logger, env); + t.deepEqual(result, ["git_source", "docker_registry"].sort().join(",")); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is not set", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({}); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is not valid JSON", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ [RegistryProxyVars.PROXY_URLS]: "[" }); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is unexpected JSON", async (t) => { + const logger = new RecordingLogger(true); + + t.is( + getRegistryTypesFromEnv( + logger, + getTestEnv({ + // Top-level object rather than an array of objects. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }), + }), + ), + undefined, + ); + t.is( + getRegistryTypesFromEnv( + logger, + getTestEnv({ + // Object has no "type" key. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify([{}]), + }), + ), + undefined, + ); +}); + +test("getJobUUID - generates valid UUIDs", async (t) => { + await callee(getJobUUID) + .withArgs() + .logs(t, "Job run UUID is ") + .hasEnv(t, (val) => { + return { + [EnvVar.JOB_RUN_UUID]: val, + }; + }) + .passes((val) => { + t.true(uuid.validate(val)); + }); +}); + +test("getJobUUID - retrieves existing job UUIDs", async (t) => { + const existingJobUuid = uuid.v4(); + await callee(getJobUUID) + .withArgs() + .withEnv((env) => { + env.set(EnvVar.JOB_RUN_UUID, existingJobUuid); + }) + .logs(t, `Existing job run UUID is ${existingJobUuid}.`) + .passes(t.deepEqual, existingJobUuid); +}); + +test("getJobUUID - doesn't retrieve invalid UUIDs", async (t) => { + const existingJobUuid = "not-a-uuid"; + await callee(getJobUUID) + .withArgs() + .withEnv((env) => { + env.set(EnvVar.JOB_RUN_UUID, existingJobUuid); + }) + .logs(t, `Job run UUID is `) + .notLogs(t, `Existing job run UUID is ${existingJobUuid}.`) + .passes(t.notDeepEqual, existingJobUuid); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", @@ -34,6 +133,9 @@ function setupEnvironmentAndStub(tmpDir: string) { process.env[EnvVar.ANALYSIS_KEY] = "analysis-key"; process.env["ImageVersion"] = "2023.05.19.1"; + process.env[RegistryProxyVars.PROXY_URLS] = JSON.stringify([ + { type: "maven_repository" }, + ] satisfies Array>); const getRequiredInput = sinon.stub(actionsUtil, "getRequiredInput"); getRequiredInput.withArgs("matrix").resolves("input/matrix"); @@ -71,11 +173,13 @@ test.serial("createStatusReportBase", async (t) => { t.is(statusReport.build_mode, BuildMode.None); t.is(statusReport.cause, "failure cause"); t.is(statusReport.commit_oid, process.env["GITHUB_SHA"]!); + t.deepEqual(statusReport.computed_inputs, {}); t.is(statusReport.exception, "exception stack trace"); t.is(statusReport.job_name, process.env["GITHUB_JOB"] || ""); t.is(typeof statusReport.job_run_uuid, "string"); t.is(statusReport.languages, "java,swift"); t.is(statusReport.ref, process.env["GITHUB_REF"]!); + t.is(statusReport.registry_types, "maven_repository"); t.is(statusReport.runner_available_disk_space_bytes, 100); t.is(statusReport.runner_image_version, process.env["ImageVersion"]); t.is(statusReport.runner_os, process.env["RUNNER_OS"]!); diff --git a/src/status-report.ts b/src/status-report.ts index a0c0b3ab40..e61b04f9dd 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -1,7 +1,9 @@ import * as os from "os"; import * as core from "@actions/core"; +import * as uuid from "uuid"; +import type { ActionState } from "./action-common"; import { getWorkflowEventName, getOptionalInput, @@ -12,20 +14,23 @@ import { isSelfHostedRunner, } from "./actions-util"; import { getAnalysisKey, getApiClient } from "./api-client"; +import { getCachedCodeQlVersion } from "./cli/output-cache"; import type { Config } from "./config/action-config"; +import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; -import { EnvVar } from "./environment"; +import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment"; import { getRef } from "./git-utils"; +import * as json from "./json"; import type { Logger } from "./logging"; import type { OverlayBaseDatabaseDownloadStats } from "./overlay/caching"; import { getRepositoryNwo } from "./repository"; import type { ToolsSource } from "./setup-codeql"; +import { registryBaseSchema } from "./start-proxy/types"; import { ConfigurationError, getRequiredEnvParam, - getCachedCodeQlVersion, isInTestMode, GITHUB_DOTCOM_URL, DiskUsage, @@ -58,6 +63,30 @@ export function getDisplayActionName(actionName: ActionName): string { return actionName; } +/** + * Either creates a UUIDv4 for the analysis or retrieves an existing one from the + * environment and returns it. + * If a new UUID is generated, it is also exported as an environment variable. + */ +export function getJobUUID( + action: ActionState<["Logger", "ReadOnlyEnv", "Actions"]>, +) { + // Check if we already have a UUID for the analysis and return it if so. + const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID); + + if (existingJobRunUuid !== undefined && uuid.validate(existingJobRunUuid)) { + action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); + return existingJobRunUuid; + } + + // Otherwise generate a new UUID. + const jobRunUuid = uuid.v4(); + action.logger.info(`Job run UUID is ${jobRunUuid}.`); + + action.actions.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + return jobRunUuid; +} + /** * @returns a boolean indicating whether the analysis is considered to be first party. * @@ -122,6 +151,8 @@ export interface StatusReportBase { commit_oid: string; /** Time this action completed, or undefined if not yet completed. */ completed_at?: string; + /** A mapping of input names to their computed values. */ + computed_inputs: Partial>; /** Stack trace of the failure (or undefined if status is not failure). */ exception?: string; /** Whether this is a first-party (CodeQL) run of the action. */ @@ -156,6 +187,12 @@ export interface StatusReportBase { ml_powered_javascript_queries?: string; /** Ref that the workflow was triggered on. */ ref: string; + /** + * A comma-separated list of private registry types which are configured for CodeQL. + * This only includes registry types we support (as determined by the `start-proxy` action), + * not all that are configured. + */ + registry_types?: string; /** Action runner hardware architecture (context runner.arch). */ runner_arch?: string; /** Available disk space on the runner, in bytes. */ @@ -259,6 +296,50 @@ export interface EventReport { started_at: string; } +/** + * Attempts to retrieve a list of private registry types from the `CODEQL_PROXY_URLS` environment + * variable and returns it as a comma-separated string if successful. Returns `undefined` otherwise. + */ +export function getRegistryTypesFromEnv( + logger: Logger, + env: ReadOnlyEnv = getEnv(), +): string | undefined { + // Try to get the value of the environment variable. + const value = env.getOptional(RegistryProxyVars.PROXY_URLS); + + if (value === undefined) { + return undefined; + } + + // Try to parse the JSON we expect to find in it and return the comma-separated list of + // (unique) registry types. + try { + const data = JSON.parse(value) as unknown; + + // Check that the parsed JSON meets our expectations. + if (!json.isArray(data)) { + logger.debug( + `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array, but got '${typeof data}'.`, + ); + return undefined; + } + if (!json.validateArray(registryBaseSchema, data)) { + logger.debug( + `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array of registry objects, but got something else.`, + ); + return undefined; + } + + const types = new Set(data.map((r) => r.type)); + return Array.from(types).sort().join(","); + } catch (err) { + logger.debug( + `Failed to parse '${RegistryProxyVars.PROXY_URLS}': ${getErrorMessage(err)}.`, + ); + return undefined; + } +} + /** * Compose a StatusReport. * @@ -295,7 +376,7 @@ export async function createStatusReportBase( core.exportVariable(EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt); } const runnerOs = getRequiredEnvParam("RUNNER_OS"); - const codeQlCliVersion = getCachedCodeQlVersion(); + const codeQlCliVersion = getCachedCodeQlVersion(logger, getEnv()); const actionRef = process.env["GITHUB_ACTION_REF"] || ""; const testingEnvironment = getTestingEnvironment(); // re-export the testing environment variable so that it is available to subsequent steps, @@ -316,10 +397,12 @@ export async function createStatusReportBase( analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, ref, + registry_types: getRegistryTypesFromEnv(logger), runner_os: runnerOs, started_at: workflowStartedAt, status, diff --git a/src/tar.test.ts b/src/tar.test.ts new file mode 100644 index 0000000000..48f4e866d3 --- /dev/null +++ b/src/tar.test.ts @@ -0,0 +1,33 @@ +import * as path from "path"; +import * as stream from "stream"; + +import test from "ava"; + +import { getRunnerLogger } from "./logging"; +import { extractTarZst } from "./tar"; +import { setupTests } from "./testing-utils"; +import { withTmpDir } from "./util"; + +setupTests(test); + +test("extractTarZst rejects if the input stream errors", async (t) => { + await withTmpDir(async (tmpDir) => { + const archive = new stream.PassThrough(); + const promise = extractTarZst( + archive, + path.join(tmpDir, "dest"), + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + archive.destroy( + Object.assign(new Error("socket hang up"), { + code: "ECONNRESET", + }), + ); + + await t.throwsAsync(promise, { + message: /Error while downloading and extracting tar/, + }); + }); +}); diff --git a/src/tar.ts b/src/tar.ts index 723716b016..3a0d79cc64 100644 --- a/src/tar.ts +++ b/src/tar.ts @@ -194,10 +194,15 @@ export async function extractTarZst( }); if (tar instanceof stream.Readable) { - tar.pipe(tarProcess.stdin).on("error", (err) => { - reject( - new Error(`Error while downloading and extracting tar: ${err}`), - ); + // Use `pipeline` rather than `pipe` so that an error on either stream is reported here + // rather than being emitted as an unhandled `error` event, and so that `tar`'s standard + // input is closed if the download fails partway through. + stream.pipeline(tar, tarProcess.stdin, (err) => { + if (err) { + reject( + new Error(`Error while downloading and extracting tar: ${err}`), + ); + } }); } diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 03354653ac..e4f26daa0f 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -18,6 +18,8 @@ import { AnalysisKind } from "./analyses"; import * as apiClient from "./api-client"; import { GitHubApiDetails } from "./api-client"; import { CachingKind } from "./caching-utils"; +import { resetCachedCodeQlVersion } from "./cli/output-cache"; +import type { VersionInfo } from "./cli/types"; import * as codeql from "./codeql"; import { Config } from "./config-utils"; import * as defaults from "./defaults.json"; @@ -34,11 +36,13 @@ import { ActionName } from "./status-report"; import { DEFAULT_DEBUG_ARTIFACT_NAME, DEFAULT_DEBUG_DATABASE_NAME, + Failure, getEnv, GitHubVariant, GitHubVersion, HTTPError, - resetCachedCodeQlVersion, + Result, + Success, } from "./util"; export const SAMPLE_DOTCOM_API_DETAILS = { @@ -182,13 +186,32 @@ export function getTestEnv(testEnv: NodeJS.ProcessEnv = {}): Env { return getEnv(testEnv); } +/** An implementation of `ActionsEnv` for use in tests. */ +class TestActionsEnv implements ActionsEnv { + constructor(private readonly env: Env) {} + + public clone(env: Env): this { + return Object.create(this, { env: { value: env } }) as this; + } + + public getRequiredInput(name: string): string { + throw new Error(`Input required and not supplied: ${name}`); + } + + public getOptionalInput(_name: string): string | undefined { + return undefined; + } + + public exportVariable(name: string, value: string): void { + this.env.set(name, value); + } +} + /** * Gets an `ActionsEnv` instance for use in tests. */ -export function getTestActionsEnv(): ActionsEnv { - return { - getOptionalInput: () => undefined, - }; +export function getTestActionsEnv(env: Env): TestActionsEnv { + return new TestActionsEnv(env); } /** For testing purposes, we make all available state features accessible in `TestEnv`. */ @@ -206,12 +229,13 @@ type AllState = [ export function initAllState( overrides?: Partial>, ): ActionState { + const env = getTestEnv(); return { name: ActionName.Init, startedAt: new Date(), logger: new RecordingLogger(), - env: getTestEnv(), - actions: getTestActionsEnv(), + env, + actions: getTestActionsEnv(env), apiClient: github.getOctokit("123"), features: createFeatures([]), ...overrides, @@ -222,9 +246,13 @@ type DelayedCheck< Args extends readonly any[], R, Fs extends ReadonlyArray, -> = (env: Readonly>) => Promise; +> = ( + env: Readonly>, + result: Result, ThrownError>, +) => Promise; -export type ValueOrMutation = T | ((val: T) => void); +export type Mutation = (val: T) => void; +export type ValueOrMutation = T | Mutation; /** * Wraps a function that accepts an `ActionState` for testing in different environments. @@ -236,6 +264,7 @@ abstract class BaseEnvBuilder< > { protected readonly fn: (state: ActionState, ...args: Args) => R; private logger: RecordingLogger; + private actions: TestActionsEnv; protected state: ActionState; protected checks: Array>; @@ -245,15 +274,26 @@ abstract class BaseEnvBuilder< ) { this.fn = fn; this.logger = new RecordingLogger(); - this.state = - cloneFrom !== undefined - ? ({ - ...cloneFrom.state, - env: cloneFrom.state.env.clone(), - actions: Object.create(cloneFrom.state.actions), - logger: this.logger, - } satisfies ActionState) - : initAllState({ logger: this.logger }); + + if (cloneFrom !== undefined) { + const env = cloneFrom.state.env.clone(); + this.actions = cloneFrom.actions.clone(env); + this.state = { + ...cloneFrom.state, + env, + actions: this.actions, + logger: this.logger, + } satisfies ActionState; + } else { + const env = getTestEnv(); + this.actions = getTestActionsEnv(env); + this.state = initAllState({ + logger: this.logger, + env, + actions: this.actions, + }); + } + this.checks = [...(cloneFrom?.checks ?? [])]; } @@ -320,13 +360,10 @@ abstract class BaseEnvBuilder< return result; } - public withActions(arg: ValueOrMutation): this { + /** Applies `fn` to the `ActionsEnv`. */ + public withActions(fn: Mutation): this { const result = this.clone(); - if (typeof arg === "function") { - arg(result.state.actions); - } else { - result.state.actions = arg; - } + fn(result.state.actions); return result; } @@ -342,6 +379,28 @@ abstract class BaseEnvBuilder< return result; } + /** + * Adds a delayed check that the environment variables returned by `fn` + * are present in the environment after the main assertion passes. + */ + public hasEnv( + t: ExecutionContext, + fn: ( + value: Awaited | undefined, + error: ThrownError | undefined, + ) => Record, + ): this { + const result = this.clone(); + result.checks.push(async (env, r) => { + const value = r.orElse(undefined); + const error = r.isFailure() ? r.value : undefined; + const expected = fn(value, error); + + t.like(env.getState().env.get(), expected); + }); + return result; + } + /** * Adds a delayed check that `messages` are not logged. The check will be * performed after the main assertion passes. @@ -439,7 +498,7 @@ class CallableEnvBuilder< // Run other delayed checks. for (const delayedCheck of this.checks) { - await delayedCheck(this); + await delayedCheck(this, new Success(result)); } // Return the results of the function call and the main assertion. @@ -465,7 +524,7 @@ class CallableEnvBuilder< // Run other delayed checks. for (const delayedCheck of this.checks) { - await delayedCheck(this); + await delayedCheck(this, new Failure(error)); } // Return the error. @@ -814,7 +873,7 @@ export const makeVersionInfo = ( version: string, features?: { [name: string]: boolean }, overlayVersion?: number, -): codeql.VersionInfo => ({ +): VersionInfo => ({ version, features, overlayVersion, diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts new file mode 100644 index 0000000000..66fe0e72e4 --- /dev/null +++ b/src/tools-download.test.ts @@ -0,0 +1,115 @@ +import { once } from "events"; +import * as path from "path"; + +import * as toolcache from "@actions/tool-cache"; +import test from "ava"; +import nock from "nock"; +import * as sinon from "sinon"; + +import { getRunnerLogger } from "./logging"; +import * as tar from "./tar"; +import { setupTests } from "./testing-utils"; +import { downloadAndExtract } from "./tools-download"; +import { withTmpDir } from "./util"; + +setupTests(test); + +test.serial( + "downloadAndExtract reports the duration when downloading before extracting", + async (t) => { + await withTmpDir(async (tmpDir) => { + const archivePath = path.join(tmpDir, "codeql-bundle.tar.gz"); + const destination = path.join(tmpDir, "codeql"); + sinon.stub(toolcache, "downloadTool").resolves(archivePath); + sinon.stub(tar, "extract").resolves(destination); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.gz", + "gzip", + destination, + undefined, + {}, + undefined, + getRunnerLogger(true), + ); + + t.assert(Number.isInteger(statusReport.downloadDurationMs)); + }); + }, +); + +test.serial( + "downloadAndExtract falls back to downloading before extracting if streaming fails", + async (t) => { + await withTmpDir(async (tmpDir) => { + sinon.stub(process, "platform").value("linux"); + const archivePath = path.join(tmpDir, "codeql-bundle.tar.zst"); + const destination = path.join(tmpDir, "codeql"); + const downloadTool = sinon + .stub(toolcache, "downloadTool") + .resolves(archivePath); + const extract = sinon.stub(tar, "extract").resolves(destination); + const extractTarZst = sinon.stub(tar, "extractTarZst").resolves(); + const request = nock("https://example.com") + .get("/codeql-bundle.tar.zst") + .replyWithError( + Object.assign(new Error("socket hang up"), { code: "ECONNRESET" }), + ); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.zst", + "zstd", + destination, + undefined, + {}, + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + t.assert(Number.isInteger(statusReport.downloadDurationMs)); + t.true(request.isDone()); + t.false(extractTarZst.called); + t.true(downloadTool.calledOnce); + t.true(extract.calledOnce); + }); + }, +); + +test.serial( + "downloadAndExtract omits the download duration when streaming extraction", + async (t) => { + await withTmpDir(async (tmpDir) => { + sinon.stub(process, "platform").value("linux"); + const downloadTool = sinon.stub(toolcache, "downloadTool"); + const extractTarZst = sinon + .stub(tar, "extractTarZst") + .callsFake(async (archive) => { + if (typeof archive === "string") { + t.fail("Expected the Zstandard archive to be streamed."); + return; + } + const end = once(archive, "end"); + archive.resume(); + await end; + }); + const request = nock("https://example.com") + .get("/codeql-bundle.tar.zst") + .reply(200, "archive"); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.zst", + "zstd", + path.join(tmpDir, "codeql"), + undefined, + {}, + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + t.deepEqual(statusReport, {}); + t.false(downloadTool.called); + t.true(extractTarZst.calledOnce); + t.true(request.isDone()); + }); + }, +); diff --git a/src/tools-download.ts b/src/tools-download.ts index 5d8a4c5fb9..9b2fa8723a 100644 --- a/src/tools-download.ts +++ b/src/tools-download.ts @@ -20,65 +20,19 @@ import { cleanUpPath, getErrorMessage, getRequiredEnvParam } from "./util"; const STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; // 4 MiB /** - * The name of the tool cache directory for the CodeQL tools. + * How long the streaming download of the CodeQL tools may stall for before we abort it. This + * applies both to establishing the connection and to gaps between chunks of the response body. */ -const TOOLCACHE_TOOL_NAME = "CodeQL"; +const STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes /** - * Timing information for the download and extraction of the CodeQL tools when - * we fully download the bundle before extracting. - */ -type DownloadFirstToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: number; - extractionDurationMs: number; - streamExtraction: false; -}; - -function makeDownloadFirstToolsDownloadDurations( - downloadDurationMs: number, - extractionDurationMs: number, -): DownloadFirstToolsDownloadDurations { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false, - }; -} - -/** - * Timing information for the download and extraction of the CodeQL tools when - * we stream the download and extraction of the bundle. + * The name of the tool cache directory for the CodeQL tools. */ -type StreamedToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: undefined; - extractionDurationMs: undefined; - streamExtraction: true; -}; - -function makeStreamedToolsDownloadDurations( - combinedDurationMs: number, -): StreamedToolsDownloadDurations { - return { - combinedDurationMs, - downloadDurationMs: undefined, - extractionDurationMs: undefined, - streamExtraction: true, - }; -} - -type ToolsDownloadDurations = - | DownloadFirstToolsDownloadDurations - | StreamedToolsDownloadDurations; +const TOOLCACHE_TOOL_NAME = "CodeQL"; export type ToolsDownloadStatusReport = { - cacheDurationMs?: number; - compressionMethod: tar.CompressionMethod; - toolsUrl: string; - zstdFailureReason?: string; -} & ToolsDownloadDurations; + downloadDurationMs?: number; +}; export async function downloadAndExtract( codeqlURL: string, @@ -116,11 +70,7 @@ export async function downloadAndExtract( )}).`, ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs), - }; + return {}; } } catch (e) { core.warning( @@ -170,14 +120,7 @@ export async function downloadAndExtract( await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs, - ), - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming( @@ -200,8 +143,8 @@ async function downloadAndExtractZstdWithStreaming( authorization ? { authorization } : {}, headers, ); - const response = await new Promise((resolve) => - https.get( + const response = await new Promise((resolve, reject) => { + const request = https.get( codeqlURL, { headers, @@ -211,10 +154,24 @@ async function downloadAndExtractZstdWithStreaming( agent, } as unknown as RequestOptions, (r) => resolve(r), - ), - ); + ); + // Without this listener, connection failures such as `ECONNRESET` are emitted as unhandled + // `error` events, which terminate the process instead of letting us fall back to downloading + // the bundle before extracting it. This listener stays attached after the response arrives, so + // it also handles errors that occur while the response is being streamed. + request.on("error", reject); + request.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => { + request.destroy( + new Error( + `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.`, + ), + ); + }); + }); if (response.statusCode !== 200) { + // Discard the response body so that the connection can be released. + response.resume(); throw new Error( `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.`, ); @@ -241,11 +198,3 @@ export function writeToolcacheMarkerFile( fs.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } - -function sanitizeUrlForStatusReport(url: string): string { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url.startsWith(`https://github.com/${repo}/releases/download/`), - ) - ? url - : "sanitized-value"; -} diff --git a/src/tools-features.ts b/src/tools-features.ts index ff87b754da..4931be65ba 100644 --- a/src/tools-features.ts +++ b/src/tools-features.ts @@ -1,6 +1,6 @@ import * as semver from "semver"; -import type { VersionInfo } from "./codeql"; +import type { VersionInfo } from "./cli/types"; export enum ToolsFeature { BuiltinExtractorsSpecifyDefaultQueries = "builtinExtractorsSpecifyDefaultQueries", diff --git a/src/upload-lib.ts b/src/upload-lib.ts index 83d1eaffb0..da5552cf24 100644 --- a/src/upload-lib.ts +++ b/src/upload-lib.ts @@ -140,7 +140,7 @@ async function combineSarifFilesUsingCLI( const config = await getConfig(tempDir, logger); if (config !== undefined) { - codeQL = await getCodeQL(config.codeQLCmd); + codeQL = await getCodeQL(logger, config.codeQLCmd); tempDir = config.tempDir; } else { logger.info( diff --git a/src/util.test.ts b/src/util.test.ts index 3d27e952af..cca457cbe6 100644 --- a/src/util.test.ts +++ b/src/util.test.ts @@ -532,58 +532,3 @@ test("Failure.orElse returns the default value for a failure result", (t) => { const result = new util.Failure(new Error("test error")); t.is(result.orElse("default value"), "default value"); }); - -test.serial( - "getCachedCodeQlVersion reuses a version persisted by an earlier step", - (t) => { - process.env[EnvVar.CODEQL_VERSION_INFO] = JSON.stringify({ - cmd: "/path/to/codeql", - version: { version: "2.20.0" }, - }); - t.deepEqual(util.getCachedCodeQlVersion("/path/to/codeql"), { - version: "2.20.0", - }); - }, -); - -test.serial( - "getCachedCodeQlVersion ignores a persisted version from a different CLI", - (t) => { - process.env[EnvVar.CODEQL_VERSION_INFO] = JSON.stringify({ - cmd: "/path/to/other-codeql", - version: { version: "2.20.0" }, - }); - t.is(util.getCachedCodeQlVersion("/path/to/codeql"), undefined); - }, -); - -test.serial( - "getCachedCodeQlVersion ignores a malformed persisted value", - (t) => { - process.env[EnvVar.CODEQL_VERSION_INFO] = "not valid json"; - t.is(util.getCachedCodeQlVersion("/path/to/codeql"), undefined); - }, -); - -test.serial( - "getCachedCodeQlVersion ignores a persisted value with the wrong structure", - (t) => { - for (const value of [ - JSON.stringify({ cmd: "/path/to/codeql" }), - JSON.stringify({ cmd: "/path/to/codeql", version: {} }), - JSON.stringify({ cmd: "/path/to/codeql", version: { version: 2 } }), - JSON.stringify({ version: { version: "2.20.0" } }), - JSON.stringify({ - cmd: "/path/to/codeql", - version: { version: "2.20.0", overlayVersion: "1" }, - }), - JSON.stringify({ - cmd: "/path/to/codeql", - version: { version: "2.20.0", features: "nope" }, - }), - ]) { - process.env[EnvVar.CODEQL_VERSION_INFO] = value; - t.is(util.getCachedCodeQlVersion("/path/to/codeql"), undefined, value); - } - }, -); diff --git a/src/util.ts b/src/util.ts index b7d27afae3..2d910dec3b 100644 --- a/src/util.ts +++ b/src/util.ts @@ -10,7 +10,7 @@ import * as yaml from "js-yaml"; import * as semver from "semver"; import * as apiCompatibility from "./api-compatibility.json"; -import type { CodeQL, VersionInfo } from "./codeql"; +import type { CodeQL } from "./codeql"; import type { Pack } from "./config/db-config"; import type { Config } from "./config-utils"; import { EnvVar, getRequiredEnvParam } from "./environment"; @@ -598,90 +598,6 @@ export function asHTTPError(arg: any): HTTPError | undefined { return undefined; } -let cachedCodeQlVersion: undefined | VersionInfo = undefined; - -/** - * Resets the in-process cache of the CodeQL CLI version. Only for use in tests, - * which exercise multiple "steps" within a single process. - */ -export function resetCachedCodeQlVersion(): void { - cachedCodeQlVersion = undefined; -} - -/** The persisted version together with the CLI path it was obtained from. */ -interface PersistedVersionInfo { - cmd: string; - version: VersionInfo; -} - -function isVersionInfo(x: unknown): x is VersionInfo { - const candidate = x as Partial | null; - return ( - typeof candidate === "object" && - candidate !== null && - typeof candidate.version === "string" && - (candidate.features === undefined || - (typeof candidate.features === "object" && - candidate.features !== null)) && - (candidate.overlayVersion === undefined || - typeof candidate.overlayVersion === "number") - ); -} - -function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { - const candidate = x as Partial | null; - return ( - typeof candidate === "object" && - candidate !== null && - typeof candidate.cmd === "string" && - isVersionInfo(candidate.version) - ); -} - -export function cacheCodeQlVersion(cmd: string, version: VersionInfo): void { - if (cachedCodeQlVersion !== undefined) { - throw new Error("cacheCodeQlVersion() should be called only once"); - } - cachedCodeQlVersion = version; - // Persist the version so that subsequent Actions steps, which run in separate - // processes, can reuse it rather than invoking `codeql version` again. We - // record the CLI path so that a different step using a different CodeQL bundle - // doesn't pick up a stale version. - core.exportVariable( - EnvVar.CODEQL_VERSION_INFO, - JSON.stringify({ cmd, version }), - ); -} - -export function getCachedCodeQlVersion(cmd?: string): undefined | VersionInfo { - if (cachedCodeQlVersion !== undefined) { - return cachedCodeQlVersion; - } - // Fall back to the value persisted by an earlier Actions step, if any. This is - // best-effort: any malformed or mismatched value is ignored so that the caller - // invokes `codeql version` instead. - const serialized = process.env[EnvVar.CODEQL_VERSION_INFO]; - if (!serialized) { - return undefined; - } - let persisted: unknown; - try { - persisted = JSON.parse(serialized); - } catch { - return undefined; - } - if ( - !isPersistedVersionInfo(persisted) || - (cmd !== undefined && persisted.cmd !== cmd) - ) { - return undefined; - } - // Memoize the parsed value so that subsequent calls in this process don't - // re-parse the environment variable. - cachedCodeQlVersion = persisted.version; - return cachedCodeQlVersion; -} - export async function codeQlVersionAtLeast( codeql: CodeQL, requiredVersion: string,