From d57cc916e8c983c1ca7f8a7119aa329ed0055b27 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:57:01 +0100 Subject: [PATCH 001/155] Remove Zstandard availability diagnostic Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 30 +++++------------------------- src/codeql.ts | 4 ---- src/init-action.ts | 21 --------------------- src/init.ts | 4 ---- src/setup-codeql.ts | 2 -- 5 files changed, 5 insertions(+), 56 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 41af9350b6..8c72430207 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -151260,8 +151260,7 @@ async function setupCodeQLBundle(toolsInput, apiDetails, tempDir, variant, defau codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function useZstdBundle(cliVersion2, tarSupportsZstd) { @@ -151395,8 +151394,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV codeqlFolder, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion } = await setupCodeQLBundle( toolsInput, apiDetails, @@ -151426,8 +151424,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV codeql: cachedCodeQL, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } catch (rawError) { const e = wrapApiConfigurationError(rawError); @@ -154043,8 +154040,7 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe codeql, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion } = await setupCodeQL( toolsInput, apiDetails, @@ -154063,8 +154059,7 @@ async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVe codeql, toolsDownloadStatusReport, toolsSource, - toolsVersion, - zstdAvailability + toolsVersion }; } async function initConfig2(actionState, inputs) { @@ -160673,7 +160668,6 @@ async function run3(actionState) { let toolsFeatureFlagsValid; let toolsSource; let toolsVersion; - let zstdAvailability; try { initializeEnvironment(getActionVersion()); persistInputs(); @@ -160746,7 +160740,6 @@ async function run3(actionState) { toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; await checkWorkflow(logger, codeql); if ( // Only enable the experimental features env variable for Rust analysis if the user has explicitly @@ -160877,9 +160870,6 @@ async function run3(actionState) { if (config.overlayDatabaseMode !== "overlay" /* Overlay */) { cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } if (toolsDownloadStatusReport) { addNoLanguageDiagnostic( config, @@ -161110,16 +161100,6 @@ async function loadRepositoryProperties(repositoryNwo, logger) { return new Failure(error3); } } -async function recordZstdAvailability(config, zstdAvailability) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability - ) - ); -} var init = { name: "init" /* Init */, run: run3 diff --git a/src/codeql.ts b/src/codeql.ts index f98130f118..78831ccc12 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -27,7 +27,6 @@ import { Logger } from "./logging"; import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import * as setupCodeql from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature, isSupportedToolsFeature } from "./tools-features"; import { shouldEnableIndirectTracing } from "./tracer-config"; @@ -319,7 +318,6 @@ export async function setupCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: setupCodeql.ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { try { const { @@ -327,7 +325,6 @@ export async function setupCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, } = await setupCodeql.setupCodeQLBundle( toolsInput, apiDetails, @@ -361,7 +358,6 @@ export async function setupCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } catch (rawError) { const e = api.wrapApiConfigurationError(rawError); diff --git a/src/init-action.ts b/src/init-action.ts index 8d0434160b..82c6609d93 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -74,7 +74,6 @@ import { getActionsStatus, sendStatusReport, } from "./status-report"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import { ToolsFeature } from "./tools-features"; import { getCombinedTracerConfig } from "./tracer-config"; @@ -222,7 +221,6 @@ async function run( let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; let toolsVersion: string; - let zstdAvailability: ZstdAvailability | undefined; try { initializeEnvironment(getActionVersion()); @@ -326,7 +324,6 @@ async function run( toolsDownloadStatusReport = initCodeQLResult.toolsDownloadStatusReport; toolsVersion = initCodeQLResult.toolsVersion; toolsSource = initCodeQLResult.toolsSource; - zstdAvailability = initCodeQLResult.zstdAvailability; // Check the workflow for problems. If there are any problems, they are reported // to the workflow log. No exceptions are thrown. @@ -497,10 +494,6 @@ async function run( cleanupDatabaseClusterDirectory(config, logger); } - if (zstdAvailability) { - await recordZstdAvailability(config, zstdAvailability); - } - // Log CodeQL download telemetry, if appropriate if (toolsDownloadStatusReport) { addNoLanguageDiagnostic( @@ -837,20 +830,6 @@ async function loadRepositoryProperties( } } -async function recordZstdAvailability( - config: configUtils.Config, - zstdAvailability: ZstdAvailability, -) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/zstd-availability", - "Zstandard availability", - zstdAvailability, - ), - ); -} - /** Defines the `init` Action. */ const init: Action = { name: ActionName.Init, diff --git a/src/init.ts b/src/init.ts index 53efbe99a3..b4dc63a24b 100644 --- a/src/init.ts +++ b/src/init.ts @@ -30,7 +30,6 @@ import { import { BuiltInLanguage, Language } from "./languages"; import { Logger, withGroupAsync } from "./logging"; import { ToolsSource } from "./setup-codeql"; -import { ZstdAvailability } from "./tar"; import { ToolsDownloadStatusReport } from "./tools-download"; import * as util from "./util"; @@ -49,7 +48,6 @@ export async function initCodeQL( toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: ZstdAvailability; }> { logger.startGroup("Setup CodeQL tools"); const { @@ -57,7 +55,6 @@ export async function initCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, } = await setupCodeQL( toolsInput, apiDetails, @@ -77,7 +74,6 @@ export async function initCodeQL( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 3db0b6ca4d..105c544499 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -921,7 +921,6 @@ interface SetupCodeQLResult { toolsDownloadStatusReport?: ToolsDownloadStatusReport; toolsSource: ToolsSource; toolsVersion: string; - zstdAvailability: tar.ZstdAvailability; } /** @@ -1005,7 +1004,6 @@ export async function setupCodeQLBundle( toolsDownloadStatusReport, toolsSource, toolsVersion, - zstdAvailability, }; } From 3f208c9347cd86f3e498906a7a277e51252d8903 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:57:44 +0100 Subject: [PATCH 002/155] Remove bundle download diagnostic Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/__bundle-zstd.yml | 120 ---------------------------- lib/entry-points.js | 10 --- pr-checks/checks/bundle-zstd.yml | 68 ---------------- src/init-action.ts | 12 --- 4 files changed, 210 deletions(-) delete mode 100644 .github/workflows/__bundle-zstd.yml delete mode 100644 pr-checks/checks/bundle-zstd.yml diff --git a/.github/workflows/__bundle-zstd.yml b/.github/workflows/__bundle-zstd.yml deleted file mode 100644 index 7c1f89cfbd..0000000000 --- a/.github/workflows/__bundle-zstd.yml +++ /dev/null @@ -1,120 +0,0 @@ -# Warning: This file is generated automatically, and should not be modified. -# Instead, please modify the template in the pr-checks directory and run: -# pr-checks/sync.sh -# to regenerate this file. - -name: 'PR Check - Bundle: Zstandard checks' -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GO111MODULE: auto -on: - push: - branches: - - main - - releases/v* - pull_request: {} - merge_group: - types: - - checks_requested - schedule: - - cron: '0 5 * * *' - workflow_dispatch: - inputs: {} - workflow_call: - inputs: {} -defaults: - run: - shell: bash -concurrency: - cancel-in-progress: ${{ github.event_name == 'pull_request' || false }} - group: bundle-zstd-${{github.ref}} -jobs: - bundle-zstd: - strategy: - fail-fast: false - matrix: - include: - - os: ubuntu-latest - version: linked - - os: macos-latest - version: linked - - os: windows-latest - version: linked - name: 'Bundle: Zstandard checks' - if: github.triggering_actor != 'dependabot[bot]' - permissions: - contents: read - security-events: read - timeout-minutes: 45 - runs-on: ${{ matrix.os }} - steps: - - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Prepare test - id: prepare-test - uses: ./.github/actions/prepare-test - with: - version: ${{ matrix.version }} - use-all-platform-bundle: 'false' - setup-kotlin: 'true' - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } - env: - CODEQL_ACTION_TEST_MODE: true diff --git a/lib/entry-points.js b/lib/entry-points.js index 8c72430207..3cbfdd9787 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160870,16 +160870,6 @@ async function run3(actionState) { if (config.overlayDatabaseMode !== "overlay" /* Overlay */) { cleanupDatabaseClusterDirectory(config, logger); } - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport - ) - ); - } const goFlags = process.env["GOFLAGS"]; if (goFlags) { core21.exportVariable("GOFLAGS", goFlags); diff --git a/pr-checks/checks/bundle-zstd.yml b/pr-checks/checks/bundle-zstd.yml deleted file mode 100644 index a961af3c36..0000000000 --- a/pr-checks/checks/bundle-zstd.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: "Bundle: Zstandard checks" -description: "A Zstandard CodeQL bundle should be extracted on supported operating systems" -versions: - - linked -operatingSystems: - - ubuntu - - macos - - windows -steps: - - name: Remove CodeQL from toolcache - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - script: | - const fs = require('fs'); - const path = require('path'); - const codeqlPath = path.join(process.env['RUNNER_TOOL_CACHE'], 'CodeQL'); - if (codeqlPath !== undefined) { - fs.rmdirSync(codeqlPath, { recursive: true }); - } - - id: init - uses: ./../action/init - with: - languages: javascript - tools: ${{ steps.prepare-test.outputs.tools-url }} - - uses: ./../action/analyze - with: - output: ${{ runner.temp }}/results - upload-database: false - - name: Upload SARIF - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ matrix.os }}-zstd-bundle.sarif - path: ${{ runner.temp }}/results/javascript.sarif - retention-days: 7 - - name: Check diagnostic with expected tools URL appears in SARIF - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - env: - SARIF_PATH: ${{ runner.temp }}/results/javascript.sarif - with: - script: | - const fs = require('fs'); - - const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8')); - const run = sarif.runs[0]; - - const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications; - const downloadTelemetryNotifications = toolExecutionNotifications.filter(n => - n.descriptor.id === 'codeql-action/bundle-download-telemetry' - ); - if (downloadTelemetryNotifications.length !== 1) { - core.setFailed( - 'Expected exactly one reporting descriptor in the ' + - `'runs[].invocations[].toolExecutionNotifications[]' SARIF property, but found ` + - `${downloadTelemetryNotifications.length}. All notification reporting descriptors: ` + - `${JSON.stringify(toolExecutionNotifications)}.` - ); - } - - const toolsUrl = downloadTelemetryNotifications[0].properties.attributes.toolsUrl; - console.log(`Found tools URL: ${toolsUrl}`); - - const expectedExtension = process.env['RUNNER_OS'] === 'Windows' ? '.tar.gz' : '.tar.zst'; - - if (!toolsUrl.endsWith(expectedExtension)) { - core.setFailed( - `Expected the tools URL to be a ${expectedExtension} file, but found ${toolsUrl}.` - ); - } diff --git a/src/init-action.ts b/src/init-action.ts index 82c6609d93..5a3606de5e 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -494,18 +494,6 @@ async function run( cleanupDatabaseClusterDirectory(config, logger); } - // Log CodeQL download telemetry, if appropriate - if (toolsDownloadStatusReport) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/bundle-download-telemetry", - "CodeQL bundle download telemetry", - toolsDownloadStatusReport, - ), - ); - } - // Forward Go flags const goFlags = process.env["GOFLAGS"]; if (goFlags) { From 14e8bf9e67c1b8333373f8946e704c1f009b860a Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:58:17 +0100 Subject: [PATCH 003/155] Remove Git version diagnostic Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 16 ---------------- src/config-utils.ts | 21 --------------------- 2 files changed, 37 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 3cbfdd9787..dffbcf8e9e 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -149684,7 +149684,6 @@ async function initConfig(actionState, inputs) { try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); if (isInTestMode() && process.env["CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION" /* TOLERATE_MISSING_GIT_VERSION */] !== "true") { @@ -149960,21 +149959,6 @@ function getPrimaryAnalysisKind(config) { function getPrimaryAnalysisConfig(config) { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -async function logGitVersionTelemetry(config, gitVersion) { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion - } - ) - ); - } -} async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount) { if (config.languages.length < 1) { return; diff --git a/src/config-utils.ts b/src/config-utils.ts index 948494f531..3badec7238 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -1170,7 +1170,6 @@ export async function initConfig( try { gitVersion = await getGitVersionOrThrow(); logger.info(`Using Git version ${gitVersion.fullVersion}`); - await logGitVersionTelemetry(config, gitVersion); } catch (e) { logger.warning(`Could not determine Git version: ${getErrorMessage(e)}`); // Throw the error in test mode so it's more visible, unless the environment @@ -1648,26 +1647,6 @@ export function getPrimaryAnalysisConfig(config: Config): AnalysisConfig { return getAnalysisConfig(getPrimaryAnalysisKind(config)); } -/** Logs the Git version as a telemetry diagnostic. */ -async function logGitVersionTelemetry( - config: Config, - gitVersion: GitVersionInfo, -): Promise { - if (config.languages.length > 0) { - addNoLanguageDiagnostic( - config, - makeTelemetryDiagnostic( - "codeql-action/git-version-telemetry", - "Git version telemetry", - { - fullVersion: gitVersion.fullVersion, - truncatedVersion: gitVersion.truncatedVersion, - }, - ), - ); - } -} - /** * Logs the time it took to identify generated files and how many were discovered as * a telemetry diagnostic. From 1040e2a159d012fa07730388886d082f58fbf362 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 17:59:18 +0100 Subject: [PATCH 004/155] Format CodeQL initialization Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 7 +------ src/init.ts | 30 +++++++++++++----------------- 2 files changed, 14 insertions(+), 23 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dffbcf8e9e..0a60d34573 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -154020,12 +154020,7 @@ var github2 = __toESM(require_github()); var io6 = __toESM(require_io()); async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion - } = await setupCodeQL( + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = await setupCodeQL( toolsInput, apiDetails, tempDir, diff --git a/src/init.ts b/src/init.ts index b4dc63a24b..dee62913c2 100644 --- a/src/init.ts +++ b/src/init.ts @@ -50,23 +50,19 @@ export async function initCodeQL( toolsVersion: string; }> { logger.startGroup("Setup CodeQL tools"); - const { - codeql, - toolsDownloadStatusReport, - toolsSource, - toolsVersion, - } = await setupCodeQL( - toolsInput, - apiDetails, - tempDir, - variant, - defaultCliVersion, - rawLanguages, - useOverlayAwareDefaultCliVersion, - features, - logger, - true, - ); + const { codeql, toolsDownloadStatusReport, toolsSource, toolsVersion } = + await setupCodeQL( + toolsInput, + apiDetails, + tempDir, + variant, + defaultCliVersion, + rawLanguages, + useOverlayAwareDefaultCliVersion, + features, + logger, + true, + ); await codeql.printVersion(); logger.endGroup(); return { From 3c20a74df36d7695daf93fc3d7949e3aeabcb1b6 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 20 Jul 2026 18:33:46 +0100 Subject: [PATCH 005/155] Remove unused bundle download fields Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 41 +-------------------- src/codeql.test.ts | 24 +++++------- src/codeql.ts | 6 --- src/setup-codeql.test.ts | 10 ----- src/tools-download.ts | 79 ++-------------------------------------- 5 files changed, 15 insertions(+), 145 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0a60d34573..bed9c354e2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -150495,22 +150495,6 @@ var import_follow_redirects = __toESM(require_follow_redirects()); var semver8 = __toESM(require_semver2()); var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; var TOOLCACHE_TOOL_NAME = "CodeQL"; -function makeDownloadFirstToolsDownloadDurations(downloadDurationMs, extractionDurationMs) { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false - }; -} -function makeStreamedToolsDownloadDurations(combinedDurationMs) { - return { - combinedDurationMs, - downloadDurationMs: void 0, - extractionDurationMs: void 0, - streamExtraction: true - }; -} async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorization, headers, tarVersion, logger) { logger.info( `Downloading CodeQL tools from ${codeqlURL} . This may take a while.` @@ -150535,11 +150519,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat combinedDurationMs )}).` ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs) - }; + return {}; } } catch (e) { core11.warning( @@ -150581,14 +150561,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat } finally { await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs - ) - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger) { fs12.mkdirSync(dest, { recursive: true }); @@ -150631,11 +150604,6 @@ function writeToolcacheMarkerFile(extractedPath, logger) { fs12.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } -function sanitizeUrlForStatusReport(url2) { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url2.startsWith(`https://github.com/${repo}/releases/download/`) - ) ? url2 : "sanitized-value"; -} // src/setup-codeql.ts var CODEQL_DEFAULT_ACTION_REPOSITORY = "github/codeql-action"; @@ -151390,11 +151358,6 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV features, logger ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport - )}` - ); let codeqlCmd = path14.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; diff --git a/src/codeql.test.ts b/src/codeql.test.ts index dea4cf04af..d83bc763be 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -192,7 +192,7 @@ test.serial( t.is(result.toolsVersion, `2.15.0`); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } }); }, @@ -231,7 +231,7 @@ test.serial( t.deepEqual(result.toolsVersion, "0.0.0-20200610"); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } }); }, @@ -330,9 +330,7 @@ for (const toolcacheVersion of [ SAMPLE_DEFAULT_CLI_VERSION.enabledVersions[0].cliVersion, ); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); }); }, ); @@ -373,9 +371,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, "0.0.0-20200601"); t.is(result.toolsSource, ToolsSource.Toolcache); - t.is(result.toolsDownloadStatusReport?.combinedDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.downloadDurationMs, undefined); - t.is(result.toolsDownloadStatusReport?.extractionDurationMs, undefined); + t.is(result.toolsDownloadStatusReport, undefined); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -422,7 +418,7 @@ test.serial( t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } const cachedVersions = toolcache.findAllVersions("CodeQL"); @@ -463,7 +459,7 @@ test.serial( t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } const cachedVersions = toolcache.findAllVersions("CodeQL"); @@ -507,7 +503,7 @@ test.serial( t.is(result.toolsVersion, "0.0.0-20230203"); t.is(result.toolsSource, ToolsSource.Download); if (result.toolsDownloadStatusReport) { - assertDurationsInteger(t, result.toolsDownloadStatusReport); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } const cachedVersions = toolcache.findAllVersions("CodeQL"); @@ -519,14 +515,12 @@ test.serial( }, ); -function assertDurationsInteger( +function assertDownloadDurationInteger( t: ExecutionContext, statusReport: ToolsDownloadStatusReport, ) { - t.assert(Number.isInteger(statusReport?.combinedDurationMs)); if (statusReport.downloadDurationMs !== undefined) { - t.assert(Number.isInteger(statusReport?.downloadDurationMs)); - t.assert(Number.isInteger(statusReport?.extractionDurationMs)); + t.assert(Number.isInteger(statusReport.downloadDurationMs)); } } diff --git a/src/codeql.ts b/src/codeql.ts index 78831ccc12..a29df90865 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -337,12 +337,6 @@ export async function setupCodeQL( logger, ); - logger.debug( - `Bundle download status report: ${JSON.stringify( - toolsDownloadStatusReport, - )}`, - ); - let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index f2ba43c101..1f0318d9f0 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -194,12 +194,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: "toolsUrl", }, toolsVersion: LINKED_CLI_VERSION.cliVersion, }); @@ -251,12 +246,7 @@ test.serial( sinon.stub(setupCodeql, "downloadCodeQL").resolves({ codeqlFolder: "codeql", statusReport: { - combinedDurationMs: 500, - compressionMethod: "gzip", downloadDurationMs: 200, - extractionDurationMs: 300, - streamExtraction: false, - toolsUrl: bundleUrl, }, toolsVersion: expectedVersion, }); diff --git a/src/tools-download.ts b/src/tools-download.ts index 5d8a4c5fb9..c19cedb13e 100644 --- a/src/tools-download.ts +++ b/src/tools-download.ts @@ -24,61 +24,9 @@ const STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; // 4 MiB */ const TOOLCACHE_TOOL_NAME = "CodeQL"; -/** - * Timing information for the download and extraction of the CodeQL tools when - * we fully download the bundle before extracting. - */ -type DownloadFirstToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: number; - extractionDurationMs: number; - streamExtraction: false; -}; - -function makeDownloadFirstToolsDownloadDurations( - downloadDurationMs: number, - extractionDurationMs: number, -): DownloadFirstToolsDownloadDurations { - return { - combinedDurationMs: downloadDurationMs + extractionDurationMs, - downloadDurationMs, - extractionDurationMs, - streamExtraction: false, - }; -} - -/** - * Timing information for the download and extraction of the CodeQL tools when - * we stream the download and extraction of the bundle. - */ -type StreamedToolsDownloadDurations = { - combinedDurationMs: number; - downloadDurationMs: undefined; - extractionDurationMs: undefined; - streamExtraction: true; -}; - -function makeStreamedToolsDownloadDurations( - combinedDurationMs: number, -): StreamedToolsDownloadDurations { - return { - combinedDurationMs, - downloadDurationMs: undefined, - extractionDurationMs: undefined, - streamExtraction: true, - }; -} - -type ToolsDownloadDurations = - | DownloadFirstToolsDownloadDurations - | StreamedToolsDownloadDurations; - export type ToolsDownloadStatusReport = { - cacheDurationMs?: number; - compressionMethod: tar.CompressionMethod; - toolsUrl: string; - zstdFailureReason?: string; -} & ToolsDownloadDurations; + downloadDurationMs?: number; +}; export async function downloadAndExtract( codeqlURL: string, @@ -116,11 +64,7 @@ export async function downloadAndExtract( )}).`, ); - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeStreamedToolsDownloadDurations(combinedDurationMs), - }; + return {}; } } catch (e) { core.warning( @@ -170,14 +114,7 @@ export async function downloadAndExtract( await cleanUpPath(archivedBundlePath, "CodeQL bundle archive", logger); } - return { - compressionMethod, - toolsUrl: sanitizeUrlForStatusReport(codeqlURL), - ...makeDownloadFirstToolsDownloadDurations( - downloadDurationMs, - extractionDurationMs, - ), - }; + return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming( @@ -241,11 +178,3 @@ export function writeToolcacheMarkerFile( fs.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } - -function sanitizeUrlForStatusReport(url: string): string { - return ["github/codeql-action", "dsp-testing/codeql-cli-nightlies"].some( - (repo) => url.startsWith(`https://github.com/${repo}/releases/download/`), - ) - ? url - : "sanitized-value"; -} From 7248c38b8fbf2ab7ada6e1fc8ff649c65275f4fd Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 05:36:40 +0000 Subject: [PATCH 006/155] Update changelog and version after v4.37.3 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index af737811ff..1303638f47 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.3 - 22 Jul 2026 No user facing changes. diff --git a/package-lock.json b/package-lock.json index d08a05a351..b33e544db9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.3", + "version": "4.37.4", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.3", + "version": "4.37.4", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index 5a2103c244..29b329de9f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.3", + "version": "4.37.4", "private": true, "description": "CodeQL action", "scripts": { From 15e2f310e17b3624e42b453d04a22b417af09179 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 05:36:55 +0000 Subject: [PATCH 007/155] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index b7db317324..0183005a70 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145331,7 +145331,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.3"; + return "4.37.4"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From e8e914f04e7dca3327f0e713a5f83bcda5c6084b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 21 Jul 2026 16:43:31 +0100 Subject: [PATCH 008/155] Bump js-yaml and brace-expansion --- lib/entry-points.js | 195 +++++++++++++++++++++++--------------------- package-lock.json | 42 +++++----- 2 files changed, 124 insertions(+), 113 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 70a95fded0..32c3ca9c87 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -31280,84 +31280,87 @@ var require_brace_expansion = __commonJS({ } function expand3(str, max, isTop) { var expansions = []; - var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; - var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); - var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); - var isSequence = isNumericSequence || isAlphaSequence; - var isOptions = m.body.indexOf(",") >= 0; - if (!isSequence && !isOptions) { - if (m.post.match(/,(?!,).*\}/)) { - str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); - } - return [str]; - } - var n; - if (isSequence) { - n = m.body.split(/\.\./); - } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + for (; ; ) { + var m = balanced2("{", "}", str); + if (!m || /\$$/.test(m.pre)) return [str]; + var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); + var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); + var isSequence = isNumericSequence || isAlphaSequence; + var isOptions = m.body.indexOf(",") >= 0; + if (!isSequence && !isOptions) { + if (m.post.match(/,(?!,).*\}/)) { + str = m.pre + "{" + m.body + escClose2 + m.post; + isTop = true; + continue; + } + return [str]; + } + var n; + if (isSequence) { + n = m.body.split(/\.\./); + } else { + n = parseCommaParts2(m.body); if (n.length === 1) { - var post = m.post.length ? expand3(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); + n = expand3(n[0], max, false).map(embrace2); + if (n.length === 1) { + var post = m.post.length ? expand3(m.post, max, false) : [""]; + return post.map(function(p) { + return m.pre + n[0] + p; + }); + } } } - } - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y); i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; + var pre = m.pre; + var post = m.post.length ? expand3(m.post, max, false) : [""]; + var N; + if (isSequence) { + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + N = []; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") + c = ""; + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) + c = "-" + z + c.slice(1); + else + c = z + c; + } } } + N.push(c); } - N.push(c); + } else { + N = concatMap(n, function(el) { + return expand3(el, max, false); + }); } - } else { - N = concatMap(n, function(el) { - return expand3(el, max, false); - }); - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + for (var j = 0; j < N.length; j++) { + for (var k = 0; k < post.length && expansions.length < max; k++) { + var expansion = pre + N[j] + post[k]; + if (!isTop || isSequence || expansion) + expansions.push(expansion); + } } + return expansions; } - return expansions; } } }); @@ -88996,16 +88999,18 @@ var require_brace_expansion2 = __commonJS({ } function expand3(str, max, isTop) { var expansions = []; - var m = balanced2("{", "}", str); - if (!m) return [str]; - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (var k = 0; k < post.length && k < max; k++) { - var expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); + for (; ; ) { + const m = balanced2("{", "}", str); + if (!m) return [str]; + const pre = m.pre; + if (/\$$/.test(m.pre)) { + const post2 = m.post.length ? expand3(m.post, max, false) : [""]; + for (let k2 = 0; k2 < post2.length && k2 < max; k2++) { + const expansion2 = pre + "{" + m.body + "}" + post2[k2]; + expansions.push(expansion2); + } + return expansions; } - } else { var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -89013,10 +89018,12 @@ var require_brace_expansion2 = __commonJS({ if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; - return expand3(str, max, true); + isTop = true; + continue; } return [str]; } + const post = m.post.length ? expand3(m.post, max, false) : [""]; var n; if (isSequence) { n = m.body.split(/\.\./); @@ -89079,8 +89086,8 @@ var require_brace_expansion2 = __commonJS({ expansions.push(expansion); } } + return expansions; } - return expansions; } } }); @@ -155466,17 +155473,19 @@ function gte6(i, y) { } function expand_(str, max, isTop) { const expansions = []; - const m = balanced("{", "}", str); - if (!m) - return [str]; - const pre = m.pre; - const post = m.post.length ? expand_(m.post, max, false) : [""]; - if (/\$$/.test(m.pre)) { - for (let k = 0; k < post.length && k < max; k++) { - const expansion = pre + "{" + m.body + "}" + post[k]; - expansions.push(expansion); + for (; ; ) { + const m = balanced("{", "}", str); + if (!m) + return [str]; + const pre = m.pre; + if (/\$$/.test(m.pre)) { + const post2 = m.post.length ? expand_(m.post, max, false) : [""]; + for (let k = 0; k < post2.length && k < max; k++) { + const expansion = pre + "{" + m.body + "}" + post2[k]; + expansions.push(expansion); + } + return expansions; } - } else { const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); const isSequence = isNumericSequence || isAlphaSequence; @@ -155484,10 +155493,12 @@ function expand_(str, max, isTop) { if (!isSequence && !isOptions) { if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose + m.post; - return expand_(str, max, true); + isTop = true; + continue; } return [str]; } + const post = m.post.length ? expand_(m.post, max, false) : [""]; let n; if (isSequence) { n = m.body.split(/\.\./); @@ -155551,8 +155562,8 @@ function expand_(str, max, isTop) { } } } + return expansions; } - return expansions; } // node_modules/readdir-glob/node_modules/minimatch/dist/esm/assert-valid-pattern.js diff --git a/package-lock.json b/package-lock.json index d08a05a351..2eff997143 100644 --- a/package-lock.json +++ b/package-lock.json @@ -374,9 +374,9 @@ "license": "Apache-2.0" }, "node_modules/@actions/artifact/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -1534,9 +1534,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -1979,9 +1979,9 @@ } }, "node_modules/@microsoft/eslint-formatter-sarif/node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", "dev": true, "funding": [ { @@ -3864,9 +3864,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -5115,9 +5115,9 @@ } }, "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "dev": true, "license": "MIT", "dependencies": { @@ -6051,9 +6051,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" @@ -8030,9 +8030,9 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" From 909828cd53976350516a8ab34d4c50cec7511d32 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 06:43:21 +0100 Subject: [PATCH 009/155] Base custom request options on defaults, and add basic tests for `makeProxyRequestOptions` --- lib/entry-points.js | 6 +++++- src/api-client.test.ts | 21 +++++++++++++++++++++ src/api-client.ts | 18 +++++++++++------- 3 files changed, 37 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0183005a70..b91e8c1e06 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145788,7 +145788,11 @@ function getRegistryProxy(action) { return void 0; } function makeProxyRequestOptions(dispatcher) { + if (dispatcher === void 0) { + return githubUtils.defaults.request; + } return { + ...githubUtils.defaults.request, fetch: (req, init2) => { return (0, import_undici.fetch)(req, { ...init2, dispatcher }); } @@ -145797,7 +145801,7 @@ function makeProxyRequestOptions(dispatcher) { function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) { const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry); - const requestOptions = proxy === void 0 ? githubUtils.defaults.request : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth2, { baseUrl: apiDetails.apiURL, diff --git a/src/api-client.test.ts b/src/api-client.test.ts index e43f16ef29..ae8c6269b1 100644 --- a/src/api-client.test.ts +++ b/src/api-client.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import * as githubUtils from "@actions/github/lib/utils"; import test from "ava"; import * as sinon from "sinon"; +import { ProxyAgent } from "undici"; import * as actionsUtil from "./actions-util"; import * as api from "./api-client"; @@ -251,3 +252,23 @@ test("getRegistryProxyConfig - gets the configuration from the env vars", async ) .passes(t.like, { host, port, ca }); }); + +test("makeProxyRequestOptions - returns defaults without custom proxy", async (t) => { + t.deepEqual( + api.makeProxyRequestOptions(undefined), + githubUtils.defaults.request, + ); +}); + +test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => { + const opts = api.makeProxyRequestOptions( + new ProxyAgent("http://localhost:1080"), + ); + // Fetch should be different from the defaults. + t.notDeepEqual(opts?.fetch, githubUtils.defaults.request?.fetch); + // The options should be the same aside from that. + t.deepEqual( + { ...opts, fetch: githubUtils.defaults.request?.fetch }, + githubUtils.defaults.request, + ); +}); diff --git a/src/api-client.ts b/src/api-client.ts index 7c63b5a6fe..ba800a2587 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -108,12 +108,19 @@ export function getRegistryProxy( * Constructs a `RequestRequestOptions` with a custom `fetch` implementation * that uses `dispatcher` as a proxy for requests. * - * @param dispatcher The proxy to use. + * @param dispatcher The proxy to use, if any. */ export function makeProxyRequestOptions( - dispatcher: ProxyAgent, -): RequestRequestOptions { + dispatcher: ProxyAgent | undefined, +): RequestRequestOptions | undefined { + // If we don't have a custom `ProxyAgent`, return the defaults. + if (dispatcher === undefined) { + return githubUtils.defaults.request; + } + + // Otherwise, construct the custom `fetch` and add it onto the defaults. return { + ...githubUtils.defaults.request, fetch: (req: RequestInfo, init?: RequestInit) => { return undiciFetch(req, { ...init, dispatcher }); }, @@ -136,10 +143,7 @@ function createApiClientWithDetails( const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry.retry); - const requestOptions = - proxy === undefined - ? githubUtils.defaults.request - : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth, { baseUrl: apiDetails.apiURL, From 84ae30d972fec62c064734759d8ba9c3ee34746c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 07:23:08 +0100 Subject: [PATCH 010/155] Only allow traffic via the proxy in `global-proxy` test --- .github/workflows/__global-proxy.yml | 19 +++++++++++++++++++ pr-checks/checks/global-proxy.yml | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index e3ba6ff101..6fc7a2da59 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -55,6 +55,24 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'false' + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" - uses: ./../action/init with: languages: javascript @@ -66,6 +84,7 @@ jobs: CODEQL_ACTION_TEST_MODE: true container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 5f90022c04..8debe3c5b9 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -5,6 +5,7 @@ versions: - nightly-latest container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest @@ -14,6 +15,24 @@ env: https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" - uses: ./../action/init with: languages: javascript From a2bfb64790ec008b14f219b15582931a21495a31 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 07:26:00 +0100 Subject: [PATCH 011/155] Set other proxy env vars --- .github/workflows/__global-proxy.yml | 11 ++++++++++- pr-checks/checks/global-proxy.yml | 11 ++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index 6fc7a2da59..45df36f268 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -73,13 +73,22 @@ jobs: iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true CODEQL_ACTION_TEST_MODE: true container: diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 8debe3c5b9..9d9653c13c 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -12,7 +12,6 @@ services: ports: - 3128:3128 env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: - name: Block direct internet access to force proxy usage @@ -33,8 +32,18 @@ steps: iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze From f342ca924759c9d70dc7d5cdd8afb977f2747921 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 21 Jul 2026 13:05:33 +0100 Subject: [PATCH 012/155] Preserve bundle compression coverage Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/setup-codeql.test.ts | 85 +++++++++++++++++++++++++++++----------- 1 file changed, 62 insertions(+), 23 deletions(-) diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 1f0318d9f0..33dfc079ba 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -117,30 +117,69 @@ test.serial( }, ); -test.serial( - "getCodeQLSource correctly returns bundled CLI version when tools == linked", - async (t) => { - const features = createFeatures([]); - - await withTmpDir(async (tmpDir) => { - setupActionsVars(tmpDir, tmpDir); - const source = await setupCodeql.getCodeQLSource( - "linked", - SAMPLE_DEFAULT_CLI_VERSION, - undefined, // rawLanguages - false, // useOverlayAwareDefaultCliVersion - SAMPLE_DOTCOM_API_DETAILS, - GitHubVariant.DOTCOM, - false, - features, - getRunnerLogger(true), - ); - - t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); - t.is(source.sourceType, "download"); - }); +const LINKED_BUNDLE_TEST_CASES = [ + { + platform: "linux", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-linux64.tar.zst", + expectedCompressionMethod: "zstd", }, -); + { + platform: "darwin", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-osx64.tar.zst", + expectedCompressionMethod: "zstd", + }, + { + platform: "win32", + tarSupportsZstd: true, + expectedBundleName: "codeql-bundle-win64.tar.gz", + expectedCompressionMethod: "gzip", + }, + { + platform: "linux", + tarSupportsZstd: false, + expectedBundleName: "codeql-bundle-linux64.tar.gz", + expectedCompressionMethod: "gzip", + }, +] as const; + +for (const { + platform, + tarSupportsZstd, + expectedBundleName, + expectedCompressionMethod, +} of LINKED_BUNDLE_TEST_CASES) { + test.serial( + `getCodeQLSource selects ${expectedBundleName} for linked tools`, + async (t) => { + const features = createFeatures([]); + sinon.stub(process, "platform").value(platform); + + await withTmpDir(async (tmpDir) => { + setupActionsVars(tmpDir, tmpDir); + const source = await setupCodeql.getCodeQLSource( + "linked", + SAMPLE_DEFAULT_CLI_VERSION, + undefined, // rawLanguages + false, // useOverlayAwareDefaultCliVersion + SAMPLE_DOTCOM_API_DETAILS, + GitHubVariant.DOTCOM, + tarSupportsZstd, + features, + getRunnerLogger(true), + ); + + t.is(source.toolsVersion, LINKED_CLI_VERSION.cliVersion); + t.is(source.sourceType, "download"); + if (source.sourceType === "download") { + t.is(source.compressionMethod, expectedCompressionMethod); + t.true(source.codeqlURL.endsWith(`/${expectedBundleName}`)); + } + }); + }, + ); +} test.serial( "getCodeQLSource correctly returns bundled CLI version when tools == latest", From 90ea144182f24a0744e76f0d12f930690f566933 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 21 Jul 2026 13:08:21 +0100 Subject: [PATCH 013/155] Strengthen download status report tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/codeql.test.ts | 33 +++++----------- src/tools-download.test.ts | 78 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+), 24 deletions(-) create mode 100644 src/tools-download.test.ts diff --git a/src/codeql.test.ts b/src/codeql.test.ts index d83bc763be..84f48b83c9 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -156,6 +156,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `0.0.0-${version}`)); t.is(result.toolsVersion, `0.0.0-${version}`); t.is(result.toolsSource, ToolsSource.Download); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); } t.is(toolcache.findAllVersions("CodeQL").length, 2); @@ -191,9 +192,7 @@ test.serial( t.assert(toolcache.find("CodeQL", `2.15.0`)); t.is(result.toolsVersion, `2.15.0`); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -230,9 +229,7 @@ test.serial( t.assert(toolcache.find("CodeQL", "0.0.0-20200610")); t.deepEqual(result.toolsVersion, "0.0.0-20200610"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -282,11 +279,7 @@ for (const { t.assert(toolcache.find("CodeQL", expectedToolcacheVersion)); t.deepEqual(result.toolsVersion, expectedToolcacheVersion); t.is(result.toolsSource, ToolsSource.Download); - t.assert( - Number.isInteger( - result.toolsDownloadStatusReport?.downloadDurationMs, - ), - ); + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); }); }, ); @@ -417,9 +410,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -458,9 +449,7 @@ test.serial( ); t.deepEqual(result.toolsVersion, defaults.cliVersion); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + t.truthy(result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 2); @@ -502,9 +491,7 @@ test.serial( t.is(result.toolsVersion, "0.0.0-20230203"); t.is(result.toolsSource, ToolsSource.Download); - if (result.toolsDownloadStatusReport) { - assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); - } + assertDownloadDurationInteger(t, result.toolsDownloadStatusReport); const cachedVersions = toolcache.findAllVersions("CodeQL"); t.is(cachedVersions.length, 1); @@ -517,11 +504,9 @@ test.serial( function assertDownloadDurationInteger( t: ExecutionContext, - statusReport: ToolsDownloadStatusReport, + statusReport: ToolsDownloadStatusReport | undefined, ) { - if (statusReport.downloadDurationMs !== undefined) { - t.assert(Number.isInteger(statusReport.downloadDurationMs)); - } + t.assert(Number.isInteger(statusReport?.downloadDurationMs)); } test.serial("getExtraOptions works for explicit paths", (t) => { diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts new file mode 100644 index 0000000000..e17d38c5be --- /dev/null +++ b/src/tools-download.test.ts @@ -0,0 +1,78 @@ +import { once } from "events"; +import * as path from "path"; + +import * as toolcache from "@actions/tool-cache"; +import test from "ava"; +import nock from "nock"; +import * as sinon from "sinon"; + +import { getRunnerLogger } from "./logging"; +import * as tar from "./tar"; +import { setupTests } from "./testing-utils"; +import { downloadAndExtract } from "./tools-download"; +import { withTmpDir } from "./util"; + +setupTests(test); + +test.serial( + "downloadAndExtract reports the duration when downloading before extracting", + async (t) => { + await withTmpDir(async (tmpDir) => { + const archivePath = path.join(tmpDir, "codeql-bundle.tar.gz"); + const destination = path.join(tmpDir, "codeql"); + sinon.stub(toolcache, "downloadTool").resolves(archivePath); + sinon.stub(tar, "extract").resolves(destination); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.gz", + "gzip", + destination, + undefined, + {}, + undefined, + getRunnerLogger(true), + ); + + t.assert(Number.isInteger(statusReport.downloadDurationMs)); + }); + }, +); + +test.serial( + "downloadAndExtract omits the download duration when streaming extraction", + async (t) => { + await withTmpDir(async (tmpDir) => { + sinon.stub(process, "platform").value("linux"); + const downloadTool = sinon.stub(toolcache, "downloadTool"); + const extractTarZst = sinon + .stub(tar, "extractTarZst") + .callsFake(async (archive) => { + if (typeof archive === "string") { + t.fail("Expected the Zstandard archive to be streamed."); + return; + } + const end = once(archive, "end"); + archive.resume(); + await end; + }); + const request = nock("https://example.com") + .get("/codeql-bundle.tar.zst") + .reply(200, "archive"); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.zst", + "zstd", + path.join(tmpDir, "codeql"), + undefined, + {}, + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + t.deepEqual(statusReport, {}); + t.false(downloadTool.called); + t.true(extractTarZst.calledOnce); + t.true(request.isDone()); + }); + }, +); From 009715ddbfe6fa887b1ac76fe840f953d7bf8db8 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 13:28:48 +0100 Subject: [PATCH 014/155] Add `github-codeql-tools` property --- lib/entry-points.js | 4 +++- src/feature-flags/properties.test.ts | 18 ++++++++++++------ src/feature-flags/properties.ts | 4 ++++ 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0183005a70..6d64de80e2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147902,6 +147902,7 @@ var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => { RepositoryPropertyName2["DISABLE_OVERLAY"] = "github-codeql-disable-overlay"; RepositoryPropertyName2["EXTRA_QUERIES"] = "github-codeql-extra-queries"; RepositoryPropertyName2["FILE_COVERAGE_ON_PRS"] = "github-codeql-file-coverage-on-prs"; + RepositoryPropertyName2["TOOLS"] = "github-codeql-tools"; return RepositoryPropertyName2; })(RepositoryPropertyName || {}); function isString2(value) { @@ -147920,7 +147921,8 @@ var repositoryPropertyParsers = { ["github-codeql-config-file" /* CONFIG_FILE */]: stringProperty, ["github-codeql-disable-overlay" /* DISABLE_OVERLAY */]: booleanProperty, ["github-codeql-extra-queries" /* EXTRA_QUERIES */]: stringProperty, - ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty + ["github-codeql-file-coverage-on-prs" /* FILE_COVERAGE_ON_PRS */]: booleanProperty, + ["github-codeql-tools" /* TOOLS */]: stringProperty }; async function loadPropertiesFromApi(logger, repositoryNwo) { try { diff --git a/src/feature-flags/properties.test.ts b/src/feature-flags/properties.test.ts index 66526b1fb2..d3094a8d1c 100644 --- a/src/feature-flags/properties.test.ts +++ b/src/feature-flags/properties.test.ts @@ -72,13 +72,17 @@ test.serial( ); test.serial("loadPropertiesFromApi loads known properties", async (t) => { + const knownProperties = [ + { property_name: "github-codeql-config-file", value: "owner/repo" }, + { property_name: "github-codeql-extra-queries", value: "+queries" }, + { property_name: "github-codeql-tools", value: "nightly" }, + ]; sinon.stub(api, "getRepositoryProperties").resolves({ headers: {}, status: 200, url: "", data: [ - { property_name: "github-codeql-config-file", value: "owner/repo" }, - { property_name: "github-codeql-extra-queries", value: "+queries" }, + ...knownProperties, { property_name: "unknown-property", value: "something" }, ] satisfies properties.GitHubPropertiesResponse, }); @@ -88,10 +92,12 @@ test.serial("loadPropertiesFromApi loads known properties", async (t) => { logger, mockRepositoryNwo, ); - t.deepEqual(response, { - "github-codeql-config-file": "owner/repo", - "github-codeql-extra-queries": "+queries", - }); + t.deepEqual( + response, + Object.fromEntries( + knownProperties.map((prop) => [prop.property_name, prop.value]), + ), + ); }); test.serial("loadPropertiesFromApi parses true boolean property", async (t) => { diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts index e239c71947..82c1c748e0 100644 --- a/src/feature-flags/properties.ts +++ b/src/feature-flags/properties.ts @@ -14,6 +14,7 @@ export enum RepositoryPropertyName { DISABLE_OVERLAY = "github-codeql-disable-overlay", EXTRA_QUERIES = "github-codeql-extra-queries", FILE_COVERAGE_ON_PRS = "github-codeql-file-coverage-on-prs", + TOOLS = "github-codeql-tools", } /** Parsed types of the known repository properties. */ @@ -22,6 +23,7 @@ export type AllRepositoryProperties = { [RepositoryPropertyName.DISABLE_OVERLAY]: boolean; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: boolean; + [RepositoryPropertyName.TOOLS]: string; }; /** Parsed repository properties. */ @@ -33,6 +35,7 @@ export type RepositoryPropertyApiType = { [RepositoryPropertyName.DISABLE_OVERLAY]: string; [RepositoryPropertyName.EXTRA_QUERIES]: string; [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: string; + [RepositoryPropertyName.TOOLS]: string; }; /** The type of functions which take the `value` from the API and try to convert it to the type we want. */ @@ -81,6 +84,7 @@ const repositoryPropertyParsers: { [RepositoryPropertyName.DISABLE_OVERLAY]: booleanProperty, [RepositoryPropertyName.EXTRA_QUERIES]: stringProperty, [RepositoryPropertyName.FILE_COVERAGE_ON_PRS]: booleanProperty, + [RepositoryPropertyName.TOOLS]: stringProperty, }; /** From 1f57eb0ff5042ed1e738ac840f6adfe9f20bd269 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 13:43:43 +0100 Subject: [PATCH 015/155] Add FF for `tools` repository property --- lib/entry-points.js | 5 +++++ src/feature-flags.ts | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/lib/entry-points.js b/lib/entry-points.js index 6d64de80e2..04be134c22 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146931,6 +146931,11 @@ var featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: void 0 }, + ["tools_repository_property" /* ToolsRepositoryProperty */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: void 0 + }, ["upload_overlay_db_to_api" /* UploadOverlayDbToApi */]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 0c92ac69af..33c02c13eb 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -141,6 +141,8 @@ export enum Feature { /** Note that this currently only disables baseline file coverage information. */ SkipFileCoverageOnPrs = "skip_file_coverage_on_prs", StartProxyUseFeaturesRelease = "start_proxy_use_features_release", + /** Whether to allow the `tools` input to be specified via a repository property. */ + ToolsRepositoryProperty = "tools_repository_property", UploadOverlayDbToApi = "upload_overlay_db_to_api", ValidateDbConfig = "validate_db_config", } @@ -400,6 +402,11 @@ export const featureConfig = { envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE", minimumVersion: undefined, }, + [Feature.ToolsRepositoryProperty]: { + defaultValue: false, + envVar: "CODEQL_ACTION_TOOLS_REPOSITORY_PROPERTY", + minimumVersion: undefined, + }, [Feature.UploadOverlayDbToApi]: { defaultValue: false, envVar: "CODEQL_ACTION_UPLOAD_OVERLAY_DB_TO_API", From f58d69685da7d9984428bdabe7f997f5ebe782fe Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:16:24 +0100 Subject: [PATCH 016/155] Move `loadRepositoryProperties` to `properties.ts` --- lib/entry-points.js | 50 ++++++++++++++++----------------- src/feature-flags/properties.ts | 35 +++++++++++++++++++++++ src/init-action.ts | 43 ++-------------------------- 3 files changed, 62 insertions(+), 66 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 04be134c22..1994e3b7c8 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147901,6 +147901,7 @@ function getUnknownLanguagesError(languages) { } // src/feature-flags/properties.ts +var github2 = __toESM(require_github()); var GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; var RepositoryPropertyName = /* @__PURE__ */ ((RepositoryPropertyName2) => { RepositoryPropertyName2["CONFIG_FILE"] = "github-codeql-config-file"; @@ -148007,6 +148008,26 @@ var KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name) { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } +async function loadRepositoryProperties(repositoryNwo, logger) { + const repositoryOwnerType = github2.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." + ); + return new Success({}); + } + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error3) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error3)}` + ); + return new Failure(error3); + } +} // src/config/db-config.ts var ORG_SCHEMA = { @@ -154021,7 +154042,7 @@ var fs19 = __toESM(require("fs")); var path17 = __toESM(require("path")); var core14 = __toESM(require_core()); var toolrunner4 = __toESM(require_toolrunner()); -var github2 = __toESM(require_github()); +var github3 = __toESM(require_github()); var io6 = __toESM(require_io()); async function initCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger) { logger.startGroup("Setup CodeQL tools"); @@ -154225,7 +154246,7 @@ function logFileCoverageOnPrsDeprecationWarning(logger) { if (process.env["CODEQL_ACTION_DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION" /* DID_LOG_FILE_COVERAGE_ON_PRS_DEPRECATION */]) { return; } - const repositoryOwnerType = github2.context.payload.repository?.owner.type; + const repositoryOwnerType = github3.context.payload.repository?.owner.type; let message = "Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses."; const envVarOptOut = "set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`."; const repoPropertyOptOut = 'create a custom repository property with the name `github-codeql-file-coverage-on-prs` and the type "True/false", then set this property to `true` in the repository\'s settings.'; @@ -157348,7 +157369,7 @@ var import_async = __toESM(require_async(), 1); var import_path6 = require("path"); // node_modules/archiver/lib/error.js -var import_util32 = __toESM(require("util"), 1); +var import_util33 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157373,7 +157394,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util32.default.inherits(ArchiverError, Error); +import_util33.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -160304,7 +160325,6 @@ async function runWrapper3() { var fs28 = __toESM(require("fs")); var path24 = __toESM(require("path")); var core21 = __toESM(require_core()); -var github3 = __toESM(require_github()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); @@ -161076,26 +161096,6 @@ exec ${goBinaryPath} "$@"` logger ); } -async function loadRepositoryProperties(repositoryNwo, logger) { - const repositoryOwnerType = github3.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.` - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and therefore cannot have repository properties." - ); - return new Success({}); - } - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error3) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error3)}` - ); - return new Failure(error3); - } -} async function recordZstdAvailability(config, zstdAvailability) { addNoLanguageDiagnostic( config, diff --git a/src/feature-flags/properties.ts b/src/feature-flags/properties.ts index 82c1c748e0..4c888bd5ec 100644 --- a/src/feature-flags/properties.ts +++ b/src/feature-flags/properties.ts @@ -1,7 +1,10 @@ +import * as github from "@actions/github"; + import { isDynamicWorkflow } from "../actions-util"; import { getRepositoryProperties } from "../api-client"; import { Logger } from "../logging"; import { RepositoryNwo } from "../repository"; +import { Failure, getErrorMessage, Result, Success } from "../util"; /** The common prefix that we expect all of our repository properties to have. */ export const GITHUB_CODEQL_PROPERTY_PREFIX = "github-codeql-"; @@ -234,3 +237,35 @@ const KNOWN_REPOSITORY_PROPERTY_NAMES = new Set( function isKnownPropertyName(name: string): name is RepositoryPropertyName { return KNOWN_REPOSITORY_PROPERTY_NAMES.has(name); } + +/** + * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. + */ +export async function loadRepositoryProperties( + repositoryNwo: RepositoryNwo, + logger: Logger, +): Promise> { + // See if we can skip loading repository properties early. In particular, + // repositories owned by users cannot have repository properties, so we can + // skip the API call entirely in that case. + const repositoryOwnerType = github.context.payload.repository?.owner.type; + logger.debug( + `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, + ); + if (repositoryOwnerType === "User") { + logger.debug( + "Skipping loading repository properties because the repository is owned by a user and " + + "therefore cannot have repository properties.", + ); + return new Success({}); + } + + try { + return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); + } catch (error) { + logger.warning( + `Failed to load repository properties: ${getErrorMessage(error)}`, + ); + return new Failure(error); + } +} diff --git a/src/init-action.ts b/src/init-action.ts index 8d0434160b..4dc3132302 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -2,7 +2,6 @@ import * as fs from "fs"; import * as path from "path"; import * as core from "@actions/core"; -import * as github from "@actions/github"; import * as io from "@actions/io"; import * as semver from "semver"; import { v4 as uuidV4 } from "uuid"; @@ -41,10 +40,7 @@ import { } from "./diagnostics"; import { EnvVar } from "./environment"; import { Feature, FeatureEnablement, initFeatures } from "./feature-flags"; -import { - loadPropertiesFromApi, - RepositoryProperties, -} from "./feature-flags/properties"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { checkInstallPython311, checkPacksForOverlayCompatibility, @@ -62,7 +58,7 @@ import { OverlayBaseDatabaseDownloadStats, } from "./overlay/caching"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; -import { getRepositoryNwo, RepositoryNwo } from "./repository"; +import { getRepositoryNwo } from "./repository"; import { ToolsSource } from "./setup-codeql"; import { ActionName, @@ -94,10 +90,7 @@ import { checkActionVersion, getErrorMessage, BuildMode, - Result, getOptionalEnvVar, - Success, - Failure, } from "./util"; import { checkWorkflow } from "./workflow"; @@ -805,38 +798,6 @@ async function run( ); } -/** - * Loads [repository properties](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization) if applicable. - */ -async function loadRepositoryProperties( - repositoryNwo: RepositoryNwo, - logger: Logger, -): Promise> { - // See if we can skip loading repository properties early. In particular, - // repositories owned by users cannot have repository properties, so we can - // skip the API call entirely in that case. - const repositoryOwnerType = github.context.payload.repository?.owner.type; - logger.debug( - `Repository owner type is '${repositoryOwnerType ?? "unknown"}'.`, - ); - if (repositoryOwnerType === "User") { - logger.debug( - "Skipping loading repository properties because the repository is owned by a user and " + - "therefore cannot have repository properties.", - ); - return new Success({}); - } - - try { - return new Success(await loadPropertiesFromApi(logger, repositoryNwo)); - } catch (error) { - logger.warning( - `Failed to load repository properties: ${getErrorMessage(error)}`, - ); - return new Failure(error); - } -} - async function recordZstdAvailability( config: configUtils.Config, zstdAvailability: ZstdAvailability, From 3479f3fca19dc5dc7df5dba2e016f6a8de6a2748 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:21:53 +0100 Subject: [PATCH 017/155] Load repository properties in `setup-codeql` action --- src/setup-codeql-action.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 3336afc1a2..d592ea8401 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -14,6 +14,7 @@ import { CodeQL } from "./codeql"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; +import { loadRepositoryProperties } from "./feature-flags/properties"; import { initCodeQL } from "./init"; import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; @@ -123,6 +124,13 @@ async function run({ logger, ); + // Fetch the values of known repository properties that affect us. + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger, + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + const jobRunUuid = uuidV4(); logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); From 49f2e373108b82d79ac36307bc528470f6b6ca60 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:23:46 +0100 Subject: [PATCH 018/155] Add and use `getToolsInput` --- lib/entry-points.js | 73 +++++++++++++++++++++++++----- src/config/inputs.test.ts | 92 ++++++++++++++++++++++++++++++++++++++ src/config/inputs.ts | 84 ++++++++++++++++++++++++++++++++++ src/init-action.ts | 15 ++++++- src/setup-codeql-action.ts | 25 ++++++++--- 5 files changed, 271 insertions(+), 18 deletions(-) create mode 100644 src/config/inputs.test.ts create mode 100644 src/config/inputs.ts diff --git a/lib/entry-points.js b/lib/entry-points.js index 1994e3b7c8..3219bacfd6 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160328,6 +160328,42 @@ var core21 = __toESM(require_core()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); +// src/config/inputs.ts +async function getToolsInput(action, repositoryProperties) { + const name = "tools" /* Tools */; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties["github-codeql-tools" /* TOOLS */]; + const allowRepositoryProperty = await action.features.getValue( + "tools_repository_property" /* ToolsRepositoryProperty */ + ); + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}` + ); + return { + name, + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: "repository-property" /* RepositoryProperty */ + }; + } + if (input !== void 0) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { name, value: input, source: "workflow" /* Workflow */ }; + } + if (allowRepositoryProperty && propertyValue !== void 0) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}` + ); + return { + name, + value: propertyValue, + source: "repository-property" /* RepositoryProperty */ + }; + } + return void 0; +} + // src/workflow.ts var fs27 = __toESM(require("fs")); var path23 = __toESM(require("path")); @@ -160618,7 +160654,7 @@ async function sendStartingStatusReport(startedAt, config, logger) { await sendStatusReport(statusReportBase); } } -async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { +async function sendCompletedStatusReport2(startedAt, config, configFile, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, overlayBaseDatabaseStats, dependencyCachingResults, logger, error3) { const statusReportBase = await createStatusReportBase( "init" /* Init */, getActionsStatus(error3), @@ -160635,7 +160671,7 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsDo const workflowLanguages = getOptionalInput("languages"); const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: workflowLanguages || "" @@ -160675,6 +160711,7 @@ async function run3(actionState) { let codeql; let features; let sourceRoot; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -160731,6 +160768,10 @@ async function run3(actionState) { `The 'init' action should not be run in the same workflow as 'setup-codeql'.` ); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -160738,7 +160779,7 @@ async function run3(actionState) { ); const useOverlayAwareDefaultCliVersion = analysisKinds?.length === 1 && analysisKinds[0] === "code-scanning" /* CodeScanning */; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161070,6 +161111,7 @@ exec ${goBinaryPath} "$@"` config, void 0, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161087,6 +161129,7 @@ exec ${goBinaryPath} "$@"` startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -161656,7 +161699,7 @@ async function runWrapper6() { // src/setup-codeql-action.ts var core24 = __toESM(require_core()); -async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { +async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, toolsVersion, logger, error3) { const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, getActionsStatus(error3), @@ -161672,7 +161715,7 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } const initStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: "" @@ -161686,11 +161729,10 @@ async function sendCompletedStatusReport3(startedAt, toolsDownloadStatusReport, } await sendStatusReport({ ...initStatusReport, ...initToolsDownloadFields }); } -async function run6({ - startedAt, - logger -}) { +async function run6(actionState) { + const { logger, startedAt } = actionState; let codeql; + let toolsInput; let toolsDownloadStatusReport; let toolsFeatureFlagsValid; let toolsSource; @@ -161713,6 +161755,12 @@ async function run6({ getTemporaryDirectory(), logger ); + const repositoryPropertiesResult = await loadRepositoryProperties( + repositoryNwo, + logger + ); + const repositoryProperties = repositoryPropertiesResult.orElse({}); + const actionStateWithFeatures = { ...actionState, features }; const jobRunUuid = v4_default(); logger.info(`Job run UUID is ${jobRunUuid}.`); core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); @@ -161727,6 +161775,10 @@ async function run6({ if (statusReportBase !== void 0) { await sendStatusReport(statusReportBase); } + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties + ); const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; const rawLanguages = getRawLanguagesNoAutodetect( @@ -161734,7 +161786,7 @@ async function run6({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -161771,6 +161823,7 @@ async function run6({ } await sendCompletedStatusReport3( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts new file mode 100644 index 0000000000..bf200bcf1f --- /dev/null +++ b/src/config/inputs.test.ts @@ -0,0 +1,92 @@ +import test from "ava"; +import sinon from "sinon"; + +import { getActionsEnv } from "../actions-util"; +import { Feature } from "../feature-flags"; +import { RepositoryPropertyName } from "../feature-flags/properties"; +import { callee } from "../testing-utils"; + +import { + EffectiveInput, + getToolsInput, + InputName, + InputSource, +} from "./inputs"; + +test("getToolsInput - undefined if there's no input", async (t) => { + await callee(getToolsInput).withArgs({}).passes(t.is, undefined); +}); + +const expectedWorkflowResult: EffectiveInput = { + name: InputName.Tools, + source: InputSource.Workflow, + value: "workflow-input-value", +}; + +const expectedRepositoryPropertyResult: EffectiveInput = { + name: InputName.Tools, + source: InputSource.RepositoryProperty, + value: "repo-property-input-value", +}; + +function stubGetToolsInput() { + const actions = getActionsEnv(); + sinon + .stub(actions, "getOptionalInput") + .withArgs(InputName.Tools) + .returns(expectedWorkflowResult.value); + return actions; +} + +test("getToolsInput - returns workflow input if available", async (t) => { + const actions = stubGetToolsInput(); + + await callee(getToolsInput) + .withActions(actions) + .withArgs({}) + .passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property value if enforced", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`, + }); + + // We expect the repository value if provided and the FF is enabled. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target.passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - prefers workflow input", async (t) => { + const actions = stubGetToolsInput(); + + const target = callee(getToolsInput) + .withActions(actions) + .withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the workflow input regardless of the FF state. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .passes(t.deepEqual, expectedWorkflowResult); + await target.passes(t.deepEqual, expectedWorkflowResult); +}); + +test("getToolsInput - returns repository property", async (t) => { + const target = callee(getToolsInput).withArgs({ + [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, + }); + + // We expect the repository property if the FF is enabled or undefined otherwise. + await target + .withFeatures([Feature.ToolsRepositoryProperty]) + .passes(t.deepEqual, expectedRepositoryPropertyResult); + await target.passes(t.is, undefined); +}); diff --git a/src/config/inputs.ts b/src/config/inputs.ts new file mode 100644 index 0000000000..1e3baa9218 --- /dev/null +++ b/src/config/inputs.ts @@ -0,0 +1,84 @@ +import { ActionState } from "../action-common"; +import { Feature } from "../feature-flags"; +import { + RepositoryProperties, + RepositoryPropertyName, +} from "../feature-flags/properties"; + +/** Enumerates input names. */ +export enum InputName { + Tools = "tools", +} + +/** Enumerates input sources. */ +export enum InputSource { + Workflow = "workflow", + RepositoryProperty = "repository-property", +} + +/** + * Represents an effective input to the CodeQL Action. That is, + * the input value that was computed or selected from multiple sources. + */ +export type EffectiveInput = { + /** The name of the property. */ + name: InputName; + /** The value of the property. */ + value: string; + /** The source of the property. */ + source: InputSource; +}; + +/** + * Gets the effective `tools` input. This comes from either the workflow or + * the repository property. + * + * @param action The Action state. + * @param repositoryProperties The values of known repository properties. + * @returns The effective input or `undefined` if there is no input. + */ +export async function getToolsInput( + action: ActionState<["Logger", "Actions", "FeatureFlags"]>, + repositoryProperties: Partial, +): Promise { + const name = InputName.Tools; + const input = action.actions.getOptionalInput(name); + const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS]; + const allowRepositoryProperty = await action.features.getValue( + Feature.ToolsRepositoryProperty, + ); + + // The repository property takes precedence if it starts with an '!'. + if (allowRepositoryProperty && propertyValue?.startsWith("!")) { + action.logger.info( + `Using ${name} input from repository property (enforced): ${propertyValue}`, + ); + return { + name, + // Drop the '!' from the value. + value: propertyValue.substring(1), + source: InputSource.RepositoryProperty, + }; + } + + // Otherwise, the input from the workflow takes precedence. + if (input !== undefined) { + action.logger.info(`Using ${name} input from workflow: ${input}`); + return { name, value: input, source: InputSource.Workflow }; + } + + // Use the repository property if there's no workflow input. + if (allowRepositoryProperty && propertyValue !== undefined) { + action.logger.info( + `Using ${name} input from repository property: ${propertyValue}`, + ); + return { + name, + value: propertyValue, + source: InputSource.RepositoryProperty, + }; + } + + // There's no input. + return undefined; +} diff --git a/src/init-action.ts b/src/init-action.ts index 4dc3132302..899a6d54e6 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -25,6 +25,7 @@ import { } from "./caching-utils"; import { CodeQL } from "./codeql"; import { getConfigFileInput } from "./config/file"; +import { EffectiveInput, getToolsInput } from "./config/inputs"; import * as configUtils from "./config-utils"; import { DependencyCacheRestoreStatusReport, @@ -130,6 +131,7 @@ async function sendCompletedStatusReport( startedAt: Date, config: configUtils.Config | undefined, configFile: string | undefined, + toolsInput: EffectiveInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -158,7 +160,7 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: workflowLanguages || "", @@ -211,6 +213,7 @@ async function run( let codeql: CodeQL; let features: FeatureEnablement; let sourceRoot: string; + let toolsInput: EffectiveInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -295,6 +298,12 @@ async function run( ); } + // Get the effective `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -305,7 +314,7 @@ async function run( analysisKinds?.length === 1 && analysisKinds[0] === AnalysisKind.CodeScanning; const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -771,6 +780,7 @@ async function run( startedAt, config, undefined, // We only report config info on success. + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, @@ -788,6 +798,7 @@ async function run( startedAt, config, configFile, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index d592ea8401..6ebe6b3ce2 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -11,6 +11,7 @@ import { import { AnalysisKind, getAnalysisKinds } from "./analyses"; import { getGitHubVersion } from "./api-client"; import { CodeQL } from "./codeql"; +import { EffectiveInput, getToolsInput } from "./config/inputs"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; @@ -44,6 +45,7 @@ import { */ async function sendCompletedStatusReport( startedAt: Date, + toolsInput: EffectiveInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -68,7 +70,7 @@ async function sendCompletedStatusReport( const initStatusReport: InitStatusReport = { ...statusReportBase, - tools_input: getOptionalInput("tools") || "", + tools_input: toolsInput?.value || "", tools_resolved_version: toolsVersion, tools_source: toolsSource || ToolsSource.Unknown, workflow_languages: "", @@ -88,14 +90,15 @@ async function sendCompletedStatusReport( } /** The main behaviour of this action. */ -async function run({ - startedAt, - logger, -}: ActionState<["Base", "Logger"]>): Promise { +async function run( + actionState: ActionState<["Base", "Logger", "Actions"]>, +): Promise { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. + const { logger, startedAt } = actionState; let codeql: CodeQL; + let toolsInput: EffectiveInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -131,6 +134,8 @@ async function run({ ); const repositoryProperties = repositoryPropertiesResult.orElse({}); + const actionStateWithFeatures = { ...actionState, features }; + const jobRunUuid = uuidV4(); logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); @@ -146,6 +151,13 @@ async function run({ if (statusReportBase !== undefined) { await sendStatusReport(statusReportBase); } + + // Get the effective `tools` input. + toolsInput = await getToolsInput( + actionStateWithFeatures, + repositoryProperties, + ); + const codeQLDefaultVersionInfo = await features.getEnabledDefaultCliVersions(gitHubVersion.type); toolsFeatureFlagsValid = codeQLDefaultVersionInfo.toolsFeatureFlagsValid; @@ -154,7 +166,7 @@ async function run({ ); const analysisKinds = await getAnalysisKinds(logger, features); const initCodeQLResult = await initCodeQL( - getOptionalInput("tools"), + toolsInput?.value, apiDetails, getTemporaryDirectory(), gitHubVersion.type, @@ -195,6 +207,7 @@ async function run({ await sendCompletedStatusReport( startedAt, + toolsInput, toolsDownloadStatusReport, toolsFeatureFlagsValid, toolsSource, From 32ed58dc59670b008aef189b9337abd58ea2f870 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 14:27:33 +0100 Subject: [PATCH 019/155] Check log messages in tests --- src/config/inputs.test.ts | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index bf200bcf1f..ae0299d2ee 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -38,12 +38,15 @@ function stubGetToolsInput() { return actions; } +const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`; + test("getToolsInput - returns workflow input if available", async (t) => { const actions = stubGetToolsInput(); await callee(getToolsInput) .withActions(actions) .withArgs({}) + .logs(t, workflowLogMessage) .passes(t.deepEqual, expectedWorkflowResult); }); @@ -57,10 +60,15 @@ test("getToolsInput - returns repository property value if enforced", async (t) }); // We expect the repository value if provided and the FF is enabled. + const enforcedLogMessage = `Using ${InputName.Tools} input from repository property (enforced):`; await target .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, enforcedLogMessage) .passes(t.deepEqual, expectedRepositoryPropertyResult); - await target.passes(t.deepEqual, expectedWorkflowResult); + await target + .notLogs(t, enforcedLogMessage) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); }); test("getToolsInput - prefers workflow input", async (t) => { @@ -75,8 +83,11 @@ test("getToolsInput - prefers workflow input", async (t) => { // We expect the workflow input regardless of the FF state. await target .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, workflowLogMessage) + .passes(t.deepEqual, expectedWorkflowResult); + await target + .logs(t, workflowLogMessage) .passes(t.deepEqual, expectedWorkflowResult); - await target.passes(t.deepEqual, expectedWorkflowResult); }); test("getToolsInput - returns repository property", async (t) => { @@ -87,6 +98,7 @@ test("getToolsInput - returns repository property", async (t) => { // We expect the repository property if the FF is enabled or undefined otherwise. await target .withFeatures([Feature.ToolsRepositoryProperty]) + .logs(t, `Using ${InputName.Tools} input from repository property:`) .passes(t.deepEqual, expectedRepositoryPropertyResult); await target.passes(t.is, undefined); }); From 60339edd56fae4f0289b4dbab6b47999b93ec25c Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 22 Jul 2026 15:45:01 +0100 Subject: [PATCH 020/155] Exclude Copilot review from required checks Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- pr-checks/excluded.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/pr-checks/excluded.yml b/pr-checks/excluded.yml index d8d643d107..1a5262fc0b 100644 --- a/pr-checks/excluded.yml +++ b/pr-checks/excluded.yml @@ -10,6 +10,7 @@ is: - "check-expected-release-files" - "Cleanup artifacts" - "CodeQL" + - "copilot-pull-request-reviewer" - "Dependabot" - "Label PR with size" - "Post repo size comment" From be24c11a39168a91880fdb86e4db14793d0969d2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 16:54:09 +0100 Subject: [PATCH 021/155] Rename to `ComputedInput` --- src/config/inputs.test.ts | 11 +++-------- src/config/inputs.ts | 8 ++++---- src/init-action.ts | 8 ++++---- src/setup-codeql-action.ts | 8 ++++---- 4 files changed, 15 insertions(+), 20 deletions(-) diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index ae0299d2ee..a484c76d73 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -6,24 +6,19 @@ import { Feature } from "../feature-flags"; import { RepositoryPropertyName } from "../feature-flags/properties"; import { callee } from "../testing-utils"; -import { - EffectiveInput, - getToolsInput, - InputName, - InputSource, -} from "./inputs"; +import { ComputedInput, getToolsInput, InputName, InputSource } from "./inputs"; test("getToolsInput - undefined if there's no input", async (t) => { await callee(getToolsInput).withArgs({}).passes(t.is, undefined); }); -const expectedWorkflowResult: EffectiveInput = { +const expectedWorkflowResult: ComputedInput = { name: InputName.Tools, source: InputSource.Workflow, value: "workflow-input-value", }; -const expectedRepositoryPropertyResult: EffectiveInput = { +const expectedRepositoryPropertyResult: ComputedInput = { name: InputName.Tools, source: InputSource.RepositoryProperty, value: "repo-property-input-value", diff --git a/src/config/inputs.ts b/src/config/inputs.ts index 1e3baa9218..06cfcfdb6c 100644 --- a/src/config/inputs.ts +++ b/src/config/inputs.ts @@ -20,7 +20,7 @@ export enum InputSource { * Represents an effective input to the CodeQL Action. That is, * the input value that was computed or selected from multiple sources. */ -export type EffectiveInput = { +export type ComputedInput = { /** The name of the property. */ name: InputName; /** The value of the property. */ @@ -30,17 +30,17 @@ export type EffectiveInput = { }; /** - * Gets the effective `tools` input. This comes from either the workflow or + * Gets the computed `tools` input. This comes from either the workflow or * the repository property. * * @param action The Action state. * @param repositoryProperties The values of known repository properties. - * @returns The effective input or `undefined` if there is no input. + * @returns The computed input or `undefined` if there is no input. */ export async function getToolsInput( action: ActionState<["Logger", "Actions", "FeatureFlags"]>, repositoryProperties: Partial, -): Promise { +): Promise { const name = InputName.Tools; const input = action.actions.getOptionalInput(name); const propertyValue = repositoryProperties[RepositoryPropertyName.TOOLS]; diff --git a/src/init-action.ts b/src/init-action.ts index 899a6d54e6..051a4a4908 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -25,7 +25,7 @@ import { } from "./caching-utils"; import { CodeQL } from "./codeql"; import { getConfigFileInput } from "./config/file"; -import { EffectiveInput, getToolsInput } from "./config/inputs"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import * as configUtils from "./config-utils"; import { DependencyCacheRestoreStatusReport, @@ -131,7 +131,7 @@ async function sendCompletedStatusReport( startedAt: Date, config: configUtils.Config | undefined, configFile: string | undefined, - toolsInput: EffectiveInput | undefined, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -213,7 +213,7 @@ async function run( let codeql: CodeQL; let features: FeatureEnablement; let sourceRoot: string; - let toolsInput: EffectiveInput | undefined; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -298,7 +298,7 @@ async function run( ); } - // Get the effective `tools` input. + // Get the computed `tools` input. toolsInput = await getToolsInput( actionStateWithFeatures, repositoryProperties, diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 6ebe6b3ce2..a64e05b17a 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -11,7 +11,7 @@ import { import { AnalysisKind, getAnalysisKinds } from "./analyses"; import { getGitHubVersion } from "./api-client"; import { CodeQL } from "./codeql"; -import { EffectiveInput, getToolsInput } from "./config/inputs"; +import { ComputedInput, getToolsInput } from "./config/inputs"; import { getRawLanguagesNoAutodetect } from "./config-utils"; import { EnvVar } from "./environment"; import { initFeatures } from "./feature-flags"; @@ -45,7 +45,7 @@ import { */ async function sendCompletedStatusReport( startedAt: Date, - toolsInput: EffectiveInput | undefined, + toolsInput: ComputedInput | undefined, toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined, toolsFeatureFlagsValid: boolean | undefined, toolsSource: ToolsSource, @@ -98,7 +98,7 @@ async function run( const { logger, startedAt } = actionState; let codeql: CodeQL; - let toolsInput: EffectiveInput | undefined; + let toolsInput: ComputedInput | undefined; let toolsDownloadStatusReport: ToolsDownloadStatusReport | undefined; let toolsFeatureFlagsValid: boolean | undefined; let toolsSource: ToolsSource; @@ -152,7 +152,7 @@ async function run( await sendStatusReport(statusReportBase); } - // Get the effective `tools` input. + // Get the computed `tools` input. toolsInput = await getToolsInput( actionStateWithFeatures, repositoryProperties, From f9442c40ccb97381cac788e90ff807e85a473827 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 17:03:32 +0100 Subject: [PATCH 022/155] Include computed `tools` value in `computed_inputs` --- lib/entry-points.js | 7 +++++++ src/init-action.ts | 4 ++++ src/setup-codeql-action.ts | 4 ++++ src/status-report.test.ts | 1 + src/status-report.ts | 4 ++++ 5 files changed, 20 insertions(+) diff --git a/lib/entry-points.js b/lib/entry-points.js index 3219bacfd6..93f26642ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146353,6 +146353,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, @@ -160676,6 +160677,9 @@ async function sendCompletedStatusReport2(startedAt, config, configFile, toolsIn tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: workflowLanguages || "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; @@ -161720,6 +161724,9 @@ async function sendCompletedStatusReport3(startedAt, toolsInput, toolsDownloadSt tools_source: toolsSource || "UNKNOWN" /* Unknown */, workflow_languages: "" }; + if (toolsInput !== void 0) { + initStatusReport.computed_inputs.tools = toolsInput; + } const initToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== void 0) { initToolsDownloadFields.tools_download_duration_ms = toolsDownloadStatusReport.downloadDurationMs; diff --git a/src/init-action.ts b/src/init-action.ts index 051a4a4908..0fdff05721 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -166,6 +166,10 @@ async function sendCompletedStatusReport( workflow_languages: workflowLanguages || "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index a64e05b17a..b2a9e90f36 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -76,6 +76,10 @@ async function sendCompletedStatusReport( workflow_languages: "", }; + if (toolsInput !== undefined) { + initStatusReport.computed_inputs.tools = toolsInput; + } + const initToolsDownloadFields: InitToolsDownloadFields = {}; if (toolsDownloadStatusReport?.downloadDurationMs !== undefined) { diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 52132b7649..9086dd34ef 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -71,6 +71,7 @@ test.serial("createStatusReportBase", async (t) => { t.is(statusReport.build_mode, BuildMode.None); t.is(statusReport.cause, "failure cause"); t.is(statusReport.commit_oid, process.env["GITHUB_SHA"]!); + t.deepEqual(statusReport.computed_inputs, {}); t.is(statusReport.exception, "exception stack trace"); t.is(statusReport.job_name, process.env["GITHUB_JOB"] || ""); t.is(typeof statusReport.job_run_uuid, "string"); diff --git a/src/status-report.ts b/src/status-report.ts index a0c0b3ab40..d9d2a7ba4c 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -13,6 +13,7 @@ import { } from "./actions-util"; import { getAnalysisKey, getApiClient } from "./api-client"; import type { Config } from "./config/action-config"; +import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; @@ -122,6 +123,8 @@ export interface StatusReportBase { commit_oid: string; /** Time this action completed, or undefined if not yet completed. */ completed_at?: string; + /** A mapping of input names to their computed values. */ + computed_inputs: Partial>; /** Stack trace of the failure (or undefined if status is not failure). */ exception?: string; /** Whether this is a first-party (CodeQL) run of the action. */ @@ -316,6 +319,7 @@ export async function createStatusReportBase( analysis_key, build_mode: config?.buildMode, commit_oid: commitOid, + computed_inputs: {}, first_party_analysis: isFirstPartyAnalysis(actionName), job_name: jobName, job_run_uuid: jobRunUUID, From 96bc4c7e0f09ae05ee2909af7fdada8de6a7b2b5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:55:12 +0000 Subject: [PATCH 023/155] Bump the npm-minor group across 1 directory with 5 updates Bumps the npm-minor group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@actions/cache](https://github.com/actions/toolkit/tree/HEAD/packages/cache) | `5.1.0` | `5.2.0` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `9.39.5` | | [eslint-plugin-github](https://github.com/github/eslint-plugin-github) | `6.1.0` | `6.1.1` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.63.0` | `8.64.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.0` | `4.23.1` | Updates `@actions/cache` from 5.1.0 to 5.2.0 - [Changelog](https://github.com/actions/toolkit/blob/main/packages/cache/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/cache) Updates `eslint` from 9.39.4 to 9.39.5 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v9.39.5) Updates `eslint-plugin-github` from 6.1.0 to 6.1.1 - [Release notes](https://github.com/github/eslint-plugin-github/releases) - [Commits](https://github.com/github/eslint-plugin-github/compare/v6.1.0...v6.1.1) Updates `typescript-eslint` from 8.63.0 to 8.64.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/typescript-eslint) Updates `tsx` from 4.23.0 to 4.23.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](https://github.com/privatenumber/tsx/compare/v4.23.0...v4.23.1) --- updated-dependencies: - dependency-name: "@actions/cache" dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: eslint dependency-version: 9.39.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: eslint-plugin-github dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: tsx dependency-version: 4.23.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 226 ++++++++++++++++++++++++++--------------- package.json | 8 +- pr-checks/package.json | 2 +- 3 files changed, 148 insertions(+), 88 deletions(-) diff --git a/package-lock.json b/package-lock.json index b33e544db9..536f92c652 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14,7 +14,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -54,9 +54,9 @@ "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.1", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", @@ -65,7 +65,7 @@ "nock": "^14.0.16", "sinon": "^22.0.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.64.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -459,9 +459,9 @@ } }, "node_modules/@actions/cache": { - "version": "5.1.0", - "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.1.0.tgz", - "integrity": "sha512-kTIj4YPrjjRPKSGlj7f8eq+Pijoy/SKBEbJcAwNsQTFGEF29NGqj1mqD02/PmhV6r4bRAixycexAWpmUJ2aCwg==", + "version": "5.2.0", + "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-5.2.0.tgz", + "integrity": "sha512-1R1Oc8cuDNCygsIP7gLiKLGCymOw/k5FkGQkXZFcLz6/RWyMImkfP0dZX6kjA9SRAmANcKNocI2XrsIaZ1it8w==", "license": "MIT", "dependencies": { "@actions/core": "^2.0.0", @@ -1557,9 +1557,9 @@ } }, "node_modules/@eslint/js": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz", - "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz", + "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==", "dev": true, "license": "MIT", "engines": { @@ -2591,17 +2591,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.63.0.tgz", - "integrity": "sha512-rvwSgqT+DHpWdzfSzPatRLm02a0GlESt++9iy3hLCDY4BgkaLcl8LBi9Yh7XGFBpwcBE/K3024QuXWTpbz4FfQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.64.0.tgz", + "integrity": "sha512-CGvQPBxN3wZLu6Rz2kFUpZeoCm78xUic92ck39KPePkO1NPOwjCqdQnm5Q87tpWw9vcBvW8XLrDXjH9PWYtJ3Q==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/type-utils": "8.63.0", - "@typescript-eslint/utils": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/type-utils": "8.64.0", + "@typescript-eslint/utils": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2614,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.63.0", + "@typescript-eslint/parser": "^8.64.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2630,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.63.0.tgz", - "integrity": "sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.64.0.tgz", + "integrity": "sha512-KA0OshtlcCCXmbfqyZkM5pV3/WNraJf7DkJRLpyrmwPtud57H5BDX7C3k0LPSPxpprfRL+cJDGabF10mvNCoCw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2673,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.63.0.tgz", - "integrity": "sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.64.0.tgz", + "integrity": "sha512-tk4WpOJ6IEbGrVHaNmM0YRrwAD3exZlIK3iadQNAxh4YKk6jvUQ4ecq18n+v7+meh+cJ3j+D8nbk8sRKhlwLQg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.63.0", - "@typescript-eslint/types": "^8.63.0", + "@typescript-eslint/tsconfig-utils": "^8.64.0", + "@typescript-eslint/types": "^8.64.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2713,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.63.0.tgz", - "integrity": "sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.64.0.tgz", + "integrity": "sha512-CXEaFdYXjSTgKhisNkwCcJwTP8Pl+fmRrEQrri4nm3vU743bALrxzLmq7fHG/7e6a5xO0lDYeURpZmBuhHk54w==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0" + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2731,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.63.0.tgz", - "integrity": "sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.64.0.tgz", + "integrity": "sha512-2yo8rRNKuzbVWQp5kslhANqZ2uDAeROQHBRZNPu8JDsHmeFNj/XJJhX/FhNUWmkHHvoNsKa6+tHJiig87EzsQw==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2748,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.63.0.tgz", - "integrity": "sha512-Nzzh/OGxVCOjObjaj1CQF2RUasyYy2Jfuh+zZ3PjLzG2fYRriAiZLib9UKtO+CpQAS3YHiAS+ckZDclwqI1TPA==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.64.0.tgz", + "integrity": "sha512-XWG4Fmmv/6SvyS9nH8jWrKs6terwJvE8cyRt1CzYYqzp9OrPhCT4cMc/f7C6RZCwG+qMmiffJS1/qJP8G1URtg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/utils": "8.64.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2791,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz", - "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.64.0.tgz", + "integrity": "sha512-qjhfuTfLXjA4IOzXvz0rTjT01BqEiIgPoUeMwiEjnaHKJMTNo8rH5pYW1a2L/0Dnux2fPC85AeyJoWaGa8WxTA==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2805,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.63.0.tgz", - "integrity": "sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.64.0.tgz", + "integrity": "sha512-Pztpsn1aCE1oWDvDEfUk31nngvvF7vUB5SwHFEaZIFpvw7WJtqUHHL4plBZDA9HfWJJjL13BdG0YrJInTUvoVA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.63.0", - "@typescript-eslint/tsconfig-utils": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/visitor-keys": "8.63.0", + "@typescript-eslint/project-service": "8.64.0", + "@typescript-eslint/tsconfig-utils": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/visitor-keys": "8.64.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2890,16 +2890,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.63.0.tgz", - "integrity": "sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.64.0.tgz", + "integrity": "sha512-aJUGVB3+U0htrrCjoA8qukw8cm8fNCGAxK/tVoS70k8aeb7DETKeFozRiVFIwEeN9WJLsjaP3ph8I60tY2XZoQ==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.63.0", - "@typescript-eslint/types": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0" + "@typescript-eslint/scope-manager": "8.64.0", + "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +2914,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.63.0.tgz", - "integrity": "sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.64.0.tgz", + "integrity": "sha512-mrtuL8Nsn6gi2H4mo5KMTp823M+3Q19Ew/i+Zlikq20tIMm99C3Ez0dCmkWWnxut20esQvTg8aUSEhMcAOXhEw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.63.0", + "@typescript-eslint/types": "8.64.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -4766,9 +4766,9 @@ } }, "node_modules/eslint": { - "version": "9.39.4", - "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz", - "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==", + "version": "9.39.5", + "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.5.tgz", + "integrity": "sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==", "dev": true, "license": "MIT", "dependencies": { @@ -4777,8 +4777,8 @@ "@eslint/config-array": "^0.21.2", "@eslint/config-helpers": "^0.4.2", "@eslint/core": "^0.17.0", - "@eslint/eslintrc": "^3.3.5", - "@eslint/js": "9.39.4", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "9.39.5", "@eslint/plugin-kit": "^0.4.1", "@humanfs/node": "^0.16.6", "@humanwhocodes/module-importer": "^1.0.1", @@ -4988,9 +4988,9 @@ } }, "node_modules/eslint-plugin-github": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.0.tgz", - "integrity": "sha512-+mA0K1/I1JSE9AOiJ4ifMDGu7NplRZX0e3Uy0SjbwyXb2rsDfo5yfT0UCUO+TiOJ/99R1YxFRltizP/PZuB4PQ==", + "version": "6.1.1", + "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.1.tgz", + "integrity": "sha512-xCqu1S/s/CCvoRLafaXNvwiVrxhroNOFLGyG9Dhi4i1PWZgPHlipjXysH6wccPFQyhSKE7gAjSLqdSdM204bZQ==", "dev": true, "license": "MIT", "dependencies": { @@ -5391,6 +5391,30 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, + "node_modules/eslint/node_modules/@eslint/eslintrc": { + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", + "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", + "dev": true, + "license": "MIT", + "dependencies": { + "ajv": "^6.14.0", + "debug": "^4.3.2", + "espree": "^10.0.1", + "globals": "^14.0.0", + "ignore": "^5.2.0", + "import-fresh": "^3.2.1", + "js-yaml": "^4.3.0", + "minimatch": "^3.1.5", + "strip-json-comments": "^3.1.1" + }, + "engines": { + "node": "^18.18.0 || ^20.9.0 || >=21.1.0" + }, + "funding": { + "url": "https://opencollective.com/eslint" + } + }, "node_modules/eslint/node_modules/ansi-styles": { "version": "4.2.1", "dev": true, @@ -5456,6 +5480,42 @@ "node": ">=10.13.0" } }, + "node_modules/eslint/node_modules/globals": { + "version": "14.0.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", + "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/eslint/node_modules/js-yaml": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", @@ -9108,9 +9168,9 @@ "license": "0BSD" }, "node_modules/tsx": { - "version": "4.23.0", - "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.0.tgz", - "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==", + "version": "4.23.1", + "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz", + "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==", "dev": true, "license": "MIT", "dependencies": { @@ -9260,16 +9320,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.63.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.63.0.tgz", - "integrity": "sha512-xgwXyzG4sK9ALkBxbyGkTMMOS+imnW65iPhxCQMK83KhxyoDNW7l+IDqEf9vMdoUidHpOoS967RCq4eMiTexwQ==", + "version": "8.64.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.64.0.tgz", + "integrity": "sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.63.0", - "@typescript-eslint/parser": "8.63.0", - "@typescript-eslint/typescript-estree": "8.63.0", - "@typescript-eslint/utils": "8.63.0" + "@typescript-eslint/eslint-plugin": "8.64.0", + "@typescript-eslint/parser": "8.64.0", + "@typescript-eslint/typescript-estree": "8.64.0", + "@typescript-eslint/utils": "8.64.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -9757,7 +9817,7 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.1" } } } diff --git a/package.json b/package.json index 29b329de9f..cdd58cd167 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "dependencies": { "@actions/artifact": "^5.0.3", "@actions/artifact-legacy": "npm:@actions/artifact@^1.1.2", - "@actions/cache": "^5.1.0", + "@actions/cache": "^5.2.0", "@actions/core": "^2.0.3", "@actions/exec": "^2.0.0", "@actions/github": "^8.0.1", @@ -62,9 +62,9 @@ "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", - "eslint": "^9.39.4", + "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.0", + "eslint-plugin-github": "^6.1.1", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", @@ -73,7 +73,7 @@ "nock": "^14.0.16", "sinon": "^22.0.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.63.0" + "typescript-eslint": "^8.64.0" }, "overrides": { "@actions/tool-cache": { diff --git a/pr-checks/package.json b/pr-checks/package.json index 63bfa3ddf5..07d599bb68 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -12,6 +12,6 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.0" + "tsx": "^4.23.1" } } From f6ed33c7e4b29f7a113fa8f0a10fd94881b2de81 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:57:19 +0000 Subject: [PATCH 024/155] Rebuild --- lib/entry-points.js | 82 ++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 74 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c2428f924a..c1ed4c8f26 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -34030,7 +34030,7 @@ var require_constants7 = __commonJS({ "node_modules/@actions/cache/lib/internal/constants.js"(exports2) { "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; + exports2.CacheReadDeniedMessagePrefix = exports2.CacheFileSizeLimit = exports2.ManifestFilename = exports2.TarFilename = exports2.SystemTarPathOnWindows = exports2.GnuTarPathOnWindows = exports2.SocketTimeout = exports2.DefaultRetryDelay = exports2.DefaultRetryAttempts = exports2.ArchiveToolType = exports2.CompressionMethod = exports2.CacheFilename = void 0; var CacheFilename; (function(CacheFilename2) { CacheFilename2["Gzip"] = "cache.tgz"; @@ -34055,6 +34055,7 @@ var require_constants7 = __commonJS({ exports2.TarFilename = "cache.tar"; exports2.ManifestFilename = "manifest.txt"; exports2.CacheFileSizeLimit = 10 * Math.pow(1024, 3); + exports2.CacheReadDeniedMessagePrefix = "cache read denied:"; } }); @@ -75482,6 +75483,9 @@ var require_config = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.isGhes = isGhes; exports2.getCacheServiceVersion = getCacheServiceVersion; + exports2.getCacheMode = getCacheMode; + exports2.isCacheReadable = isCacheReadable; + exports2.isCacheWritable = isCacheWritable; exports2.getCacheServiceURL = getCacheServiceURL; function isGhes() { const ghUrl = new URL(process.env["GITHUB_SERVER_URL"] || "https://github.com"); @@ -75496,6 +75500,20 @@ var require_config = __commonJS({ return "v1"; return process.env["ACTIONS_CACHE_SERVICE_V2"] ? "v2" : "v1"; } + var KNOWN_CACHE_MODES = ["none", "read", "write", "write-only"]; + function getCacheMode() { + return (process.env["ACTIONS_CACHE_MODE"] || "").trim().toLowerCase(); + } + function isCacheReadable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "read" || mode === "write"; + } + function isCacheWritable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === "write" || mode === "write-only"; + } function getCacheServiceURL() { const version = getCacheServiceVersion(); switch (version) { @@ -75515,7 +75533,7 @@ var require_package = __commonJS({ "node_modules/@actions/cache/package.json"(exports2, module2) { module2.exports = { name: "@actions/cache", - version: "5.1.0", + version: "5.2.0", preview: true, description: "Actions cache lib", keywords: [ @@ -75674,6 +75692,7 @@ var require_cacheHttpClient = __commonJS({ var options_1 = require_options(); var requestUtils_1 = require_requestUtils(); var config_1 = require_config(); + var constants_1 = require_constants7(); var user_agent_1 = require_user_agent(); function getCacheApiUrl(resource) { const baseUrl = (0, config_1.getCacheServiceURL)(); @@ -75702,6 +75721,7 @@ var require_cacheHttpClient = __commonJS({ } function getCacheEntry(keys, paths, options) { return __awaiter2(this, void 0, void 0, function* () { + var _a2; const httpClient = createHttpClient(); const version = utils.getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive); const resource = `cache?keys=${encodeURIComponent(keys.join(","))}&version=${version}`; @@ -75715,6 +75735,10 @@ var require_cacheHttpClient = __commonJS({ return null; } if (!(0, requestUtils_1.isSuccessStatusCode)(response.statusCode)) { + const errorMessage = (_a2 = response.error) === null || _a2 === void 0 ? void 0 : _a2.message; + if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(constants_1.CacheReadDeniedMessagePrefix)) { + throw new Error(errorMessage); + } throw new Error(`Cache service responded with ${response.statusCode}`); } const cacheResult = response.result; @@ -81337,7 +81361,7 @@ var require_cache4 = __commonJS({ }); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.FinalizeCacheError = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; + exports2.FinalizeCacheError = exports2.CacheReadDeniedError = exports2.CACHE_READ_DENIED_PREFIX = exports2.CacheWriteDeniedError = exports2.CACHE_WRITE_DENIED_PREFIX = exports2.ReserveCacheError = exports2.ValidationError = void 0; exports2.isFeatureAvailable = isFeatureAvailable; exports2.restoreCache = restoreCache5; exports2.saveCache = saveCache5; @@ -81349,6 +81373,7 @@ var require_cache4 = __commonJS({ var config_1 = require_config(); var tar_1 = require_tar(); var http_client_1 = require_lib(); + var constants_1 = require_constants7(); var ValidationError = class _ValidationError extends Error { constructor(message) { super(message); @@ -81374,6 +81399,15 @@ var require_cache4 = __commonJS({ } }; exports2.CacheWriteDeniedError = CacheWriteDeniedError; + exports2.CACHE_READ_DENIED_PREFIX = constants_1.CacheReadDeniedMessagePrefix; + var CacheReadDeniedError = class _CacheReadDeniedError extends Error { + constructor(message) { + super(message); + this.name = "CacheReadDeniedError"; + Object.setPrototypeOf(this, _CacheReadDeniedError.prototype); + } + }; + exports2.CacheReadDeniedError = CacheReadDeniedError; var FinalizeCacheError = class _FinalizeCacheError extends Error { constructor(message) { super(message); @@ -81411,6 +81445,12 @@ var require_cache4 = __commonJS({ const cacheServiceVersion = (0, config_1.getCacheServiceVersion)(); core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheReadable)(cacheMode)) { + core31.info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`); + core31.debug(`Skipped restore for paths [${paths.join(", ")}] with primary key '${primaryKey}'.`); + return void 0; + } switch (cacheServiceVersion) { case "v2": return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive); @@ -81422,6 +81462,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; core31.debug("Resolved Keys:"); @@ -81435,10 +81476,19 @@ var require_cache4 = __commonJS({ const compressionMethod = yield utils.getCompressionMethod(); let archivePath = ""; try { - const cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { - compressionMethod, - enableCrossOsArchive - }); + let cacheEntry; + try { + cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { + compressionMethod, + enableCrossOsArchive + }); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) { return void 0; } @@ -81480,6 +81530,7 @@ var require_cache4 = __commonJS({ } function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { return __awaiter2(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a2; options = Object.assign(Object.assign({}, options), { useAzureSdk: true }); restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; @@ -81500,7 +81551,16 @@ var require_cache4 = __commonJS({ restoreKeys, version: utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive) }; - const response = yield twirpClient.GetCacheEntryDownloadURL(request3); + let response; + try { + response = yield twirpClient.GetCacheEntryDownloadURL(request3); + } catch (error3) { + const errorMessage = (_a2 = error3 === null || error3 === void 0 ? void 0 : error3.message) !== null && _a2 !== void 0 ? _a2 : ""; + if (errorMessage.includes(exports2.CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error3; + } if (!response.ok) { core31.debug(`Cache not found for version ${request3.version} of keys: ${keys.join(", ")}`); return void 0; @@ -81556,6 +81616,12 @@ var require_cache4 = __commonJS({ core31.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); checkKey(key); + const cacheMode = (0, config_1.getCacheMode)(); + if (!(0, config_1.isCacheWritable)(cacheMode)) { + core31.info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`); + core31.debug(`Skipped save for paths [${paths.join(", ")}] with key '${key}'.`); + return -1; + } switch (cacheServiceVersion) { case "v2": return yield saveCacheV2(paths, key, options, enableCrossOsArchive); From 8a0be82efa1620906930810a0a77dbcbb1d0c217 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:57:43 +0000 Subject: [PATCH 025/155] Bump the actions-minor group across 1 directory with 3 updates Bumps the actions-minor group with 3 updates in the /.github/workflows directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/0f481fcb613427c0f801b606911222b5b6f3083a...03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) Updates `ruby/setup-ruby` from 1.316.0 to 1.319.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/d45b1a4e94b71acab930e56e79c6aa188764e7f9...003a5c4d8d6321bd302e38f6f0ec593f77f06600) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: ruby/setup-ruby dependency-version: 1.319.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/__all-platform-bundle.yml | 2 +- .github/workflows/__analysis-kinds.yml | 2 +- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__autobuild-action.yml | 2 +- .../__autobuild-direct-tracing-with-working-dir.yml | 4 ++-- .github/workflows/__autobuild-working-dir.yml | 2 +- .github/workflows/__build-mode-autobuild.yml | 4 ++-- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__build-mode-none.yml | 2 +- .github/workflows/__build-mode-rollback.yml | 2 +- .github/workflows/__bundle-from-nightly.yml | 2 +- .github/workflows/__bundle-from-toolcache.yml | 2 +- .github/workflows/__bundle-toolcache.yml | 2 +- .github/workflows/__cleanup-db-cluster-dir.yml | 2 +- .github/workflows/__config-export.yml | 2 +- .github/workflows/__config-input.yml | 2 +- .github/workflows/__cpp-deptrace-disabled.yml | 2 +- .github/workflows/__cpp-deptrace-enabled-on-macos.yml | 2 +- .github/workflows/__cpp-deptrace-enabled.yml | 2 +- .github/workflows/__diagnostics-export.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__extractor-ram-threads.yml | 2 +- .github/workflows/__global-proxy.yml | 2 +- .github/workflows/__go-custom-queries.yml | 2 +- .../__go-indirect-tracing-workaround-diagnostic.yml | 2 +- .../__go-indirect-tracing-workaround-no-file-program.yml | 2 +- .github/workflows/__go-indirect-tracing-workaround.yml | 2 +- .github/workflows/__go-tracing-autobuilder.yml | 2 +- .github/workflows/__go-tracing-custom-build-steps.yml | 2 +- .github/workflows/__go-tracing-legacy-workflow.yml | 2 +- .github/workflows/__init-with-registries.yml | 2 +- .github/workflows/__javascript-source-root.yml | 2 +- .github/workflows/__job-run-uuid-sarif.yml | 2 +- .github/workflows/__language-aliases.yml | 2 +- .github/workflows/__local-bundle.yml | 2 +- .github/workflows/__multi-language-autodetect.yml | 2 +- .github/workflows/__overlay-init-fallback.yml | 2 +- .../workflows/__packaging-codescanning-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-js.yml | 2 +- .github/workflows/__packaging-inputs-js.yml | 2 +- .github/workflows/__remote-config.yml | 2 +- .github/workflows/__resolve-environment-action.yml | 2 +- .github/workflows/__rubocop-multi-language.yml | 4 ++-- .github/workflows/__ruby.yml | 2 +- .github/workflows/__rust.yml | 2 +- .github/workflows/__split-workflow.yml | 2 +- .github/workflows/__start-proxy.yml | 2 +- .github/workflows/__submit-sarif-failure.yml | 4 ++-- .github/workflows/__swift-autobuild.yml | 2 +- .github/workflows/__swift-custom-build.yml | 2 +- .github/workflows/__unset-environment.yml | 2 +- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__upload-sarif.yml | 2 +- .github/workflows/__with-checkout-path.yml | 4 ++-- .github/workflows/check-expected-release-files.yml | 2 +- .github/workflows/codeql.yml | 6 +++--- .github/workflows/codescanning-config-cli.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/pr-checks.yml | 6 +++--- .github/workflows/prepare-release.yml | 2 +- .github/workflows/publish-immutable-action.yml | 2 +- .github/workflows/python312-windows.yml | 2 +- .github/workflows/query-filters.yml | 2 +- .github/workflows/rebuild.yml | 2 +- .github/workflows/rollback-release.yml | 2 +- .github/workflows/test-codeql-bundle-all.yml | 2 +- .github/workflows/update-bundle.yml | 2 +- .github/workflows/update-release-branch.yml | 4 ++-- .../update-supported-enterprise-server-versions.yml | 4 ++-- 72 files changed, 83 insertions(+), 83 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..aa07c91efc 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__analysis-kinds.yml b/.github/workflows/__analysis-kinds.yml index 53c8834eea..5d0576e2f6 100644 --- a/.github/workflows/__analysis-kinds.yml +++ b/.github/workflows/__analysis-kinds.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..bc46c9f49f 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index 2d655b2eef..0e51343a97 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -59,7 +59,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index 13918e5395..f3bc58c691 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__autobuild-working-dir.yml b/.github/workflows/__autobuild-working-dir.yml index 71dd9d1df8..fac4ef9f54 100644 --- a/.github/workflows/__autobuild-working-dir.yml +++ b/.github/workflows/__autobuild-working-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 74881301cf..280dbf569c 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -61,9 +61,9 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0 + uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..3a250433f6 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__build-mode-none.yml b/.github/workflows/__build-mode-none.yml index dc97aa3d99..da7aa76383 100644 --- a/.github/workflows/__build-mode-none.yml +++ b/.github/workflows/__build-mode-none.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__build-mode-rollback.yml b/.github/workflows/__build-mode-rollback.yml index 4383024f3b..fcc77ea36e 100644 --- a/.github/workflows/__build-mode-rollback.yml +++ b/.github/workflows/__build-mode-rollback.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-nightly.yml b/.github/workflows/__bundle-from-nightly.yml index 9ccb507866..6c414fb67e 100644 --- a/.github/workflows/__bundle-from-nightly.yml +++ b/.github/workflows/__bundle-from-nightly.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-from-toolcache.yml b/.github/workflows/__bundle-from-toolcache.yml index 036262395e..a1c1fade09 100644 --- a/.github/workflows/__bundle-from-toolcache.yml +++ b/.github/workflows/__bundle-from-toolcache.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__bundle-toolcache.yml b/.github/workflows/__bundle-toolcache.yml index 0bdfd45082..9cc983a843 100644 --- a/.github/workflows/__bundle-toolcache.yml +++ b/.github/workflows/__bundle-toolcache.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cleanup-db-cluster-dir.yml b/.github/workflows/__cleanup-db-cluster-dir.yml index 921228910e..3153041401 100644 --- a/.github/workflows/__cleanup-db-cluster-dir.yml +++ b/.github/workflows/__cleanup-db-cluster-dir.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-export.yml b/.github/workflows/__config-export.yml index dedf559719..0c7a2cc151 100644 --- a/.github/workflows/__config-export.yml +++ b/.github/workflows/__config-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__config-input.yml b/.github/workflows/__config-input.yml index 7dbaed852e..4267e00584 100644 --- a/.github/workflows/__config-input.yml +++ b/.github/workflows/__config-input.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/__cpp-deptrace-disabled.yml b/.github/workflows/__cpp-deptrace-disabled.yml index 5eba27ed63..e2434f4256 100644 --- a/.github/workflows/__cpp-deptrace-disabled.yml +++ b/.github/workflows/__cpp-deptrace-disabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml index d26cd7dca7..344ed8d1ea 100644 --- a/.github/workflows/__cpp-deptrace-enabled-on-macos.yml +++ b/.github/workflows/__cpp-deptrace-enabled-on-macos.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__cpp-deptrace-enabled.yml b/.github/workflows/__cpp-deptrace-enabled.yml index d3b04db26d..ab1a70584b 100644 --- a/.github/workflows/__cpp-deptrace-enabled.yml +++ b/.github/workflows/__cpp-deptrace-enabled.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__diagnostics-export.yml b/.github/workflows/__diagnostics-export.yml index 7f788ef0a2..c55f3de9b8 100644 --- a/.github/workflows/__diagnostics-export.yml +++ b/.github/workflows/__diagnostics-export.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..f2eba3691a 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__extractor-ram-threads.yml b/.github/workflows/__extractor-ram-threads.yml index 28487388df..5bd5c8b940 100644 --- a/.github/workflows/__extractor-ram-threads.yml +++ b/.github/workflows/__extractor-ram-threads.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index e3ba6ff101..6f32e4be78 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..be5c35f7f5 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index ced2df5982..a577111d23 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 32ebaee34a..215ee36a7a 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 8696063265..5a4d61e1b6 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index d8ef15b5a9..f006505fe4 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index 077382459f..573b3cb050 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 2c4031b388..f36cc8beea 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: diff --git a/.github/workflows/__init-with-registries.yml b/.github/workflows/__init-with-registries.yml index 623afdee97..9293dcc196 100644 --- a/.github/workflows/__init-with-registries.yml +++ b/.github/workflows/__init-with-registries.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__javascript-source-root.yml b/.github/workflows/__javascript-source-root.yml index 622156ce4d..1dcbd38a85 100644 --- a/.github/workflows/__javascript-source-root.yml +++ b/.github/workflows/__javascript-source-root.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index 989b28fc53..cd47fb577e 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__language-aliases.yml b/.github/workflows/__language-aliases.yml index 3a1656eef7..731d975ce3 100644 --- a/.github/workflows/__language-aliases.yml +++ b/.github/workflows/__language-aliases.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..f6f6837189 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..3d5ae46993 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -99,7 +99,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__overlay-init-fallback.yml b/.github/workflows/__overlay-init-fallback.yml index 9a4ffa71f2..b6c99efcef 100644 --- a/.github/workflows/__overlay-init-fallback.yml +++ b/.github/workflows/__overlay-init-fallback.yml @@ -47,7 +47,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..c030616d8c 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..f414ba1c89 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..dcf9ecec62 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..d7de305196 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..082ac4953a 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__resolve-environment-action.yml b/.github/workflows/__resolve-environment-action.yml index 29a042ae2b..11a31fdabc 100644 --- a/.github/workflows/__resolve-environment-action.yml +++ b/.github/workflows/__resolve-environment-action.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 7ee8f1fdc7..4809b680ab 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -54,7 +54,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/.github/workflows/__ruby.yml b/.github/workflows/__ruby.yml index 3558be85e4..98f8ec6a2a 100644 --- a/.github/workflows/__ruby.yml +++ b/.github/workflows/__ruby.yml @@ -55,7 +55,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__rust.yml b/.github/workflows/__rust.yml index e74daa4e4a..b3638ca6df 100644 --- a/.github/workflows/__rust.yml +++ b/.github/workflows/__rust.yml @@ -53,7 +53,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..953c1a4eb3 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -75,7 +75,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__start-proxy.yml b/.github/workflows/__start-proxy.yml index 51751680c3..edc6aa1cc5 100644 --- a/.github/workflows/__start-proxy.yml +++ b/.github/workflows/__start-proxy.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__submit-sarif-failure.yml b/.github/workflows/__submit-sarif-failure.yml index 339d6a07cb..099e93001f 100644 --- a/.github/workflows/__submit-sarif-failure.yml +++ b/.github/workflows/__submit-sarif-failure.yml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test @@ -57,7 +57,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'true' - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/.github/workflows/__swift-autobuild.yml b/.github/workflows/__swift-autobuild.yml index e59a87e3aa..52c189f3a8 100644 --- a/.github/workflows/__swift-autobuild.yml +++ b/.github/workflows/__swift-autobuild.yml @@ -45,7 +45,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..617a41c07e 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -69,7 +69,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..50480ab665 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -67,7 +67,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..d51dda2c36 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -65,7 +65,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..02e49e11f5 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -72,7 +72,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..35a5f64334 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -66,7 +66,7 @@ jobs: steps: # This ensures we don't accidentally use the original checkout for any part of the test. - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install .NET uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: @@ -91,7 +91,7 @@ jobs: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/.github/workflows/check-expected-release-files.yml b/.github/workflows/check-expected-release-files.yml index 670f146566..6cabd0454b 100644 --- a/.github/workflows/check-expected-release-files.yml +++ b/.github/workflows/check-expected-release-files.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check Expected Release Files run: | bundle_version="$(cat "./src/defaults.json" | jq -r ".bundleVersion")" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c5efa1731a..9f1b9e770b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,7 +32,7 @@ jobs: security-events: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up default CodeQL bundle id: setup-default uses: ./setup-codeql @@ -84,7 +84,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init id: init @@ -121,7 +121,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL uses: ./init with: diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml index ee1ecea3d1..7bc6718e35 100644 --- a/.github/workflows/codescanning-config-cli.yml +++ b/.github/workflows/codescanning-config-cli.yml @@ -54,7 +54,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..03d2c91b82 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -48,7 +48,7 @@ jobs: - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..bb2c87bb41 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -44,7 +44,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 0050c5da85..64a62c1320 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -44,7 +44,7 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "${GITHUB_CONTEXT}" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # ensure we have all tags and can push commits - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index ae21707826..ac61475d62 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -39,7 +39,7 @@ jobs: if: runner.os == 'Windows' run: git config --global core.autocrlf false - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -88,7 +88,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -161,7 +161,7 @@ jobs: - name: 'Backport: Check out base ref' id: checkout-base if: ${{ startsWith(github.head_ref, 'backport-') }} - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ github.base_ref }} diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 8bab54557a..4eb300704d 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -44,7 +44,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs diff --git a/.github/workflows/publish-immutable-action.yml b/.github/workflows/publish-immutable-action.yml index ec9a6518aa..5e5623bb07 100644 --- a/.github/workflows/publish-immutable-action.yml +++ b/.github/workflows/publish-immutable-action.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Publish immutable release id: publish diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 5722289fad..a3fdd64d65 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -36,7 +36,7 @@ jobs: with: python-version: 3.12 - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 182b64b9c1..87b934eb6b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -30,7 +30,7 @@ jobs: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index f1d2a1a4f4..faa32c65d9 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -24,7 +24,7 @@ jobs: pull-requests: write # needed to comment on the PR steps: - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 ref: ${{ env.HEAD_REF }} diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index b830a827dd..6e6b127905 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -52,7 +52,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index e7cd9aab15..a2fee5a8fe 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -38,7 +38,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: Check out repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test id: prepare-test uses: ./.github/actions/prepare-test diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index f5e79075e6..701cb0b865 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -33,7 +33,7 @@ jobs: GITHUB_CONTEXT: '${{ toJson(github) }}' run: echo "$GITHUB_CONTEXT" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Update git config run: | diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index f690c3847e..9f38f0f0b4 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,7 +38,7 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs - uses: ./.github/actions/release-initialise @@ -101,7 +101,7 @@ jobs: private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }} - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 30f926d7a6..4bcdb73796 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -28,7 +28,7 @@ jobs: python-version: "3.13" - name: Checkout CodeQL Action - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -40,7 +40,7 @@ jobs: run: npm ci - name: Checkout Enterprise Releases - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: github/enterprise-releases token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }} From 05f56be836fbaca42a028b1fc50e0c4b24b8d34c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:57:55 +0000 Subject: [PATCH 026/155] Bump actions/setup-python from 6.3.0 to 7.0.0 in /.github/workflows Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/__multi-language-autodetect.yml | 2 +- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/python312-windows.yml | 2 +- .github/workflows/update-bundle.yml | 2 +- .../workflows/update-supported-enterprise-server-versions.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..1cc25cce99 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -120,7 +120,7 @@ jobs: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.13' diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 0050c5da85..82de0100cb 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -51,7 +51,7 @@ jobs: with: node-version: 24 cache: 'npm' - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index 5722289fad..4c931c5a24 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -32,7 +32,7 @@ jobs: runs-on: windows-latest steps: - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.12 diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index f5e79075e6..aa9fe86fe7 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -41,7 +41,7 @@ jobs: git config --global user.name "github-actions[bot]" - name: Set up Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: '3.12' diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 30f926d7a6..bc6d6859d1 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Setup Python - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" From 6cce0e741f6ac7ab0c45717b3553c246d139760f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:58:15 +0000 Subject: [PATCH 027/155] Bump actions/setup-go from 6.5.0 to 7.0.0 in /.github/workflows Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.5.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/__all-platform-bundle.yml | 2 +- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__go-custom-queries.yml | 2 +- .../workflows/__go-indirect-tracing-workaround-diagnostic.yml | 4 ++-- .../__go-indirect-tracing-workaround-no-file-program.yml | 2 +- .github/workflows/__go-indirect-tracing-workaround.yml | 2 +- .github/workflows/__go-tracing-autobuilder.yml | 2 +- .github/workflows/__go-tracing-custom-build-steps.yml | 2 +- .github/workflows/__go-tracing-legacy-workflow.yml | 2 +- .github/workflows/__local-bundle.yml | 2 +- .github/workflows/__multi-language-autodetect.yml | 2 +- .../workflows/__packaging-codescanning-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-js.yml | 2 +- .github/workflows/__packaging-inputs-js.yml | 2 +- .github/workflows/__remote-config.yml | 2 +- .github/workflows/__split-workflow.yml | 2 +- .github/workflows/__swift-custom-build.yml | 2 +- .github/workflows/__unset-environment.yml | 2 +- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__upload-sarif.yml | 2 +- .github/workflows/__with-checkout-path.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- 26 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..b085825302 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..fe8a565cd2 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..4ec1e6b826 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..707523543b 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..e19cfab559 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -73,7 +73,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml index ced2df5982..82fcf85e3e 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-diagnostic.yml @@ -57,7 +57,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false @@ -73,7 +73,7 @@ jobs: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.20' - name: Build code diff --git a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml index 32ebaee34a..5dd849263d 100644 --- a/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml +++ b/.github/workflows/__go-indirect-tracing-workaround-no-file-program.yml @@ -57,7 +57,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-indirect-tracing-workaround.yml b/.github/workflows/__go-indirect-tracing-workaround.yml index 8696063265..6a0a165810 100644 --- a/.github/workflows/__go-indirect-tracing-workaround.yml +++ b/.github/workflows/__go-indirect-tracing-workaround.yml @@ -57,7 +57,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-autobuilder.yml b/.github/workflows/__go-tracing-autobuilder.yml index d8ef15b5a9..26d5fded48 100644 --- a/.github/workflows/__go-tracing-autobuilder.yml +++ b/.github/workflows/__go-tracing-autobuilder.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-custom-build-steps.yml b/.github/workflows/__go-tracing-custom-build-steps.yml index 077382459f..69387bc7b4 100644 --- a/.github/workflows/__go-tracing-custom-build-steps.yml +++ b/.github/workflows/__go-tracing-custom-build-steps.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__go-tracing-legacy-workflow.yml b/.github/workflows/__go-tracing-legacy-workflow.yml index 2c4031b388..5d4c983d2d 100644 --- a/.github/workflows/__go-tracing-legacy-workflow.yml +++ b/.github/workflows/__go-tracing-legacy-workflow.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..7de41f28c4 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..e0276cdb42 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -105,7 +105,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..6da05bd16c 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..24e6333f55 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..9db483cb26 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..5a529dedb8 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..c146e4fc04 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -73,7 +73,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..880daa969a 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -81,7 +81,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..fe222f3be6 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -75,7 +75,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..7752a3bd76 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -73,7 +73,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..7dfc0daabb 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -71,7 +71,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..edca805e52 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -78,7 +78,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..ed1d636c49 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -72,7 +72,7 @@ jobs: with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ inputs.go-version || '>=1.21.0' }} cache: false diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..0a34e59736 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -54,7 +54,7 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..d563fb4e0c 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -50,7 +50,7 @@ jobs: uses: ./.github/actions/prepare-test with: version: ${{ matrix.version }} - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ^1.13.1 - name: Install .NET From 5c0fb499d4aacd87c141533d4acdeae6c282e371 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:58:30 +0000 Subject: [PATCH 028/155] Bump actions/setup-dotnet from 5.4.0 to 6.0.0 in /.github/workflows Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 5.4.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](https://github.com/actions/setup-dotnet/compare/26b0ec14cb23fa6904739307f278c14f94c95bf1...a98b56852c35b8e3190ac28c8c2271da59106c68) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/__all-platform-bundle.yml | 2 +- .github/workflows/__analyze-ref-input.yml | 2 +- .github/workflows/__autobuild-action.yml | 2 +- .github/workflows/__build-mode-manual.yml | 2 +- .github/workflows/__export-file-baseline-information.yml | 2 +- .github/workflows/__go-custom-queries.yml | 2 +- .github/workflows/__local-bundle.yml | 2 +- .github/workflows/__multi-language-autodetect.yml | 2 +- .github/workflows/__packaging-codescanning-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-inputs-js.yml | 2 +- .github/workflows/__packaging-config-js.yml | 2 +- .github/workflows/__packaging-inputs-js.yml | 2 +- .github/workflows/__remote-config.yml | 2 +- .github/workflows/__split-workflow.yml | 2 +- .github/workflows/__swift-custom-build.yml | 2 +- .github/workflows/__unset-environment.yml | 2 +- .github/workflows/__upload-ref-sha-input.yml | 2 +- .github/workflows/__upload-sarif.yml | 2 +- .github/workflows/__with-checkout-path.yml | 2 +- .github/workflows/debug-artifacts-failure-safe.yml | 2 +- .github/workflows/debug-artifacts-safe.yml | 2 +- .github/workflows/test-codeql-bundle-all.yml | 2 +- 22 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/__all-platform-bundle.yml b/.github/workflows/__all-platform-bundle.yml index d4daf95d8b..d33b2100b2 100644 --- a/.github/workflows/__all-platform-bundle.yml +++ b/.github/workflows/__all-platform-bundle.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__analyze-ref-input.yml b/.github/workflows/__analyze-ref-input.yml index da40def244..ebf388c67a 100644 --- a/.github/workflows/__analyze-ref-input.yml +++ b/.github/workflows/__analyze-ref-input.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__autobuild-action.yml b/.github/workflows/__autobuild-action.yml index 2d655b2eef..8f778e74ca 100644 --- a/.github/workflows/__autobuild-action.yml +++ b/.github/workflows/__autobuild-action.yml @@ -61,7 +61,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Prepare test diff --git a/.github/workflows/__build-mode-manual.yml b/.github/workflows/__build-mode-manual.yml index efc63b6405..06619aa539 100644 --- a/.github/workflows/__build-mode-manual.yml +++ b/.github/workflows/__build-mode-manual.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__export-file-baseline-information.yml b/.github/workflows/__export-file-baseline-information.yml index 8d4cfc8f8e..88760654b6 100644 --- a/.github/workflows/__export-file-baseline-information.yml +++ b/.github/workflows/__export-file-baseline-information.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__go-custom-queries.yml b/.github/workflows/__go-custom-queries.yml index a522b602f4..f321da0ad0 100644 --- a/.github/workflows/__go-custom-queries.yml +++ b/.github/workflows/__go-custom-queries.yml @@ -69,7 +69,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__local-bundle.yml b/.github/workflows/__local-bundle.yml index 98d56aa7ef..439ce4e9ee 100644 --- a/.github/workflows/__local-bundle.yml +++ b/.github/workflows/__local-bundle.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__multi-language-autodetect.yml b/.github/workflows/__multi-language-autodetect.yml index e211d0bcd8..0d2b5be943 100644 --- a/.github/workflows/__multi-language-autodetect.yml +++ b/.github/workflows/__multi-language-autodetect.yml @@ -101,7 +101,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-codescanning-config-inputs-js.yml b/.github/workflows/__packaging-codescanning-config-inputs-js.yml index 42c3ff95ef..f39346ff9e 100644 --- a/.github/workflows/__packaging-codescanning-config-inputs-js.yml +++ b/.github/workflows/__packaging-codescanning-config-inputs-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-config-inputs-js.yml b/.github/workflows/__packaging-config-inputs-js.yml index 717f4f0b95..b8567e6a09 100644 --- a/.github/workflows/__packaging-config-inputs-js.yml +++ b/.github/workflows/__packaging-config-inputs-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-config-js.yml b/.github/workflows/__packaging-config-js.yml index 2b59922249..af25ba1587 100644 --- a/.github/workflows/__packaging-config-js.yml +++ b/.github/workflows/__packaging-config-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__packaging-inputs-js.yml b/.github/workflows/__packaging-inputs-js.yml index 7c8da5b3db..ab6ad3411a 100644 --- a/.github/workflows/__packaging-inputs-js.yml +++ b/.github/workflows/__packaging-inputs-js.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__remote-config.yml b/.github/workflows/__remote-config.yml index 853a3909e6..4d08fff584 100644 --- a/.github/workflows/__remote-config.yml +++ b/.github/workflows/__remote-config.yml @@ -69,7 +69,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__split-workflow.yml b/.github/workflows/__split-workflow.yml index 9b49aeceb8..0684a3d341 100644 --- a/.github/workflows/__split-workflow.yml +++ b/.github/workflows/__split-workflow.yml @@ -77,7 +77,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__swift-custom-build.yml b/.github/workflows/__swift-custom-build.yml index 638e2c58fc..67567b6635 100644 --- a/.github/workflows/__swift-custom-build.yml +++ b/.github/workflows/__swift-custom-build.yml @@ -71,7 +71,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__unset-environment.yml b/.github/workflows/__unset-environment.yml index 263139dc89..7430720f12 100644 --- a/.github/workflows/__unset-environment.yml +++ b/.github/workflows/__unset-environment.yml @@ -69,7 +69,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__upload-ref-sha-input.yml b/.github/workflows/__upload-ref-sha-input.yml index e7f942df1d..f2364e204e 100644 --- a/.github/workflows/__upload-ref-sha-input.yml +++ b/.github/workflows/__upload-ref-sha-input.yml @@ -67,7 +67,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__upload-sarif.yml b/.github/workflows/__upload-sarif.yml index 36e5d9f053..d0c9815fd2 100644 --- a/.github/workflows/__upload-sarif.yml +++ b/.github/workflows/__upload-sarif.yml @@ -74,7 +74,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/__with-checkout-path.yml b/.github/workflows/__with-checkout-path.yml index c4a0c9218c..0ebfaa9e17 100644 --- a/.github/workflows/__with-checkout-path.yml +++ b/.github/workflows/__with-checkout-path.yml @@ -68,7 +68,7 @@ jobs: - name: Check out repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: ${{ inputs.dotnet-version || '9.x' }} - name: Install Go diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index 665d0799de..e50d9c8a9e 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -58,7 +58,7 @@ jobs: with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index 997cfe623a..2afec4ff78 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -54,7 +54,7 @@ jobs: with: go-version: ^1.13.1 - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - name: Assert best-effort artifact scan completed diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml index e7cd9aab15..0dd6c5f6c4 100644 --- a/.github/workflows/test-codeql-bundle-all.yml +++ b/.github/workflows/test-codeql-bundle-all.yml @@ -46,7 +46,7 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: true - name: Install .NET - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 + uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 with: dotnet-version: '9.x' - id: init From 11b8f752cfc2b4983a124c7c0d1ac46ee3dffdc6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:59:36 +0000 Subject: [PATCH 029/155] Rebuild --- pr-checks/checks/rubocop-multi-language.yml | 2 +- pr-checks/checks/submit-sarif-failure.yml | 2 +- pr-checks/checks/with-checkout-path.yml | 2 +- pr-checks/sync.ts | 8 ++++---- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index 4128c446d9..7879653f38 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ versions: - default steps: - name: Set up Ruby - uses: ruby/setup-ruby@d45b1a4e94b71acab930e56e79c6aa188764e7f9 # v1.316.0 + uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 with: ruby-version: 2.6 - name: Install Code Scanning integration diff --git a/pr-checks/checks/submit-sarif-failure.yml b/pr-checks/checks/submit-sarif-failure.yml index 9212a5dc79..c33e1322f7 100644 --- a/pr-checks/checks/submit-sarif-failure.yml +++ b/pr-checks/checks/submit-sarif-failure.yml @@ -21,7 +21,7 @@ permissions: security-events: write # needed to upload the SARIF file steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: ./init with: languages: javascript diff --git a/pr-checks/checks/with-checkout-path.yml b/pr-checks/checks/with-checkout-path.yml index 7a5866b783..a6cde895b6 100644 --- a/pr-checks/checks/with-checkout-path.yml +++ b/pr-checks/checks/with-checkout-path.yml @@ -14,7 +14,7 @@ steps: rm -rf ./* .github .git # Check out the actions repo again, but at a different location. # choose an arbitrary SHA so that we can later test that the commit_oid is not from main - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: 474bbf07f9247ffe1856c6a0f94aeeb10e7afee6 path: x/y/z/some-path diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..7f5638cf94 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = { name: "Install Java", uses: pinnedUses( "actions/setup-java", - "0f481fcb613427c0f801b606911222b5b6f3083a", - "v5.5.0", + "03ad4de0992f5dab5e18fcb136590ce7c4a0ac95", + "v5.6.0", ), with: { "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`, @@ -529,8 +529,8 @@ function generateJob( name: "Check out repository", uses: pinnedUses( "actions/checkout", - "9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0", - "v7.0.0", + "3d3c42e5aac5ba805825da76410c181273ba90b1", + "v7.0.1", ), }, ...setupInfo.steps, From d146d63292d5edd61074ffcfb11c191072eaae0b Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 17:59:52 +0000 Subject: [PATCH 030/155] Rebuild --- pr-checks/checks/multi-language-autodetect.yml | 2 +- pr-checks/sync.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pr-checks/checks/multi-language-autodetect.yml b/pr-checks/checks/multi-language-autodetect.yml index 801f4521a4..b57e90ab4c 100644 --- a/pr-checks/checks/multi-language-autodetect.yml +++ b/pr-checks/checks/multi-language-autodetect.yml @@ -23,7 +23,7 @@ steps: # We need Python 3.13 for older CLI versions because they are not compatible with Python 3.14 or newer. # See https://github.com/github/codeql-action/pull/3212 if: matrix.version != 'nightly-latest' && matrix.version != 'linked' - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: "3.13" diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..ae7dc8c6a4 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -271,8 +271,8 @@ const languageSetups: LanguageSetups = { name: "Install Python", uses: pinnedUses( "actions/setup-python", - "ece7cb06caefa5fff74198d8649806c4678c61a1", - "v6.3.0", + "5fda3b95a4ea91299a34e894583c3862153e4b97", + "v7.0.0", ), with: { "python-version": `\${{ inputs.python-version || '${defaultLanguageVersions.python}' }}`, From 1eb720cacc18437568023e14d8b2f5997371c844 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:00:14 +0000 Subject: [PATCH 031/155] Rebuild --- .../checks/go-indirect-tracing-workaround-diagnostic.yml | 2 +- pr-checks/sync.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml index 895dba2b6c..f0b4097d7b 100644 --- a/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml +++ b/pr-checks/checks/go-indirect-tracing-workaround-diagnostic.yml @@ -12,7 +12,7 @@ steps: languages: go tools: ${{ steps.prepare-test.outputs.tools-url }} # Deliberately change Go after the `init` step - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: "1.20" - name: Build code diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..770a30282a 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -233,8 +233,8 @@ const languageSetups: LanguageSetups = { name: "Install Go", uses: pinnedUses( "actions/setup-go", - "924ae3a1cded613372ab5595356fb5720e22ba16", - "v6.5.0", + "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", + "v7.0.0", ), with: { "go-version": `\${{ inputs.go-version || '${defaultLanguageVersions.go}' }}`, From 4671ecc1f6889d33b51149df491479ed9573ccb4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 18:00:23 +0000 Subject: [PATCH 032/155] Rebuild --- pr-checks/sync.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 4329fc01e0..fb62f1639e 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -288,8 +288,8 @@ const languageSetups: LanguageSetups = { name: "Install .NET", uses: pinnedUses( "actions/setup-dotnet", - "26b0ec14cb23fa6904739307f278c14f94c95bf1", - "v5.4.0", + "a98b56852c35b8e3190ac28c8c2271da59106c68", + "v6.0.0", ), with: { "dotnet-version": `\${{ inputs.dotnet-version || '${defaultLanguageVersions.csharp}' }}`, From f170b3a3213fcc24e3372b0c4b58450398eebbfa Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 14:27:08 +0100 Subject: [PATCH 033/155] Remove `name` field from `ComputedInput` --- lib/entry-points.js | 4 +--- src/config/inputs.test.ts | 2 -- src/config/inputs.ts | 6 +----- 3 files changed, 2 insertions(+), 10 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0df1d5b967..814db7c2af 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160356,7 +160356,6 @@ async function getToolsInput(action, repositoryProperties) { `Using ${name} input from repository property (enforced): ${propertyValue}` ); return { - name, // Drop the '!' from the value. value: propertyValue.substring(1), source: "repository-property" /* RepositoryProperty */ @@ -160364,14 +160363,13 @@ async function getToolsInput(action, repositoryProperties) { } if (input !== void 0) { action.logger.info(`Using ${name} input from workflow: ${input}`); - return { name, value: input, source: "workflow" /* Workflow */ }; + return { value: input, source: "workflow" /* Workflow */ }; } if (allowRepositoryProperty && propertyValue !== void 0) { action.logger.info( `Using ${name} input from repository property: ${propertyValue}` ); return { - name, value: propertyValue, source: "repository-property" /* RepositoryProperty */ }; diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index a484c76d73..a91dc258ea 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -13,13 +13,11 @@ test("getToolsInput - undefined if there's no input", async (t) => { }); const expectedWorkflowResult: ComputedInput = { - name: InputName.Tools, source: InputSource.Workflow, value: "workflow-input-value", }; const expectedRepositoryPropertyResult: ComputedInput = { - name: InputName.Tools, source: InputSource.RepositoryProperty, value: "repo-property-input-value", }; diff --git a/src/config/inputs.ts b/src/config/inputs.ts index 06cfcfdb6c..32a8dfd6f6 100644 --- a/src/config/inputs.ts +++ b/src/config/inputs.ts @@ -21,8 +21,6 @@ export enum InputSource { * the input value that was computed or selected from multiple sources. */ export type ComputedInput = { - /** The name of the property. */ - name: InputName; /** The value of the property. */ value: string; /** The source of the property. */ @@ -54,7 +52,6 @@ export async function getToolsInput( `Using ${name} input from repository property (enforced): ${propertyValue}`, ); return { - name, // Drop the '!' from the value. value: propertyValue.substring(1), source: InputSource.RepositoryProperty, @@ -64,7 +61,7 @@ export async function getToolsInput( // Otherwise, the input from the workflow takes precedence. if (input !== undefined) { action.logger.info(`Using ${name} input from workflow: ${input}`); - return { name, value: input, source: InputSource.Workflow }; + return { value: input, source: InputSource.Workflow }; } // Use the repository property if there's no workflow input. @@ -73,7 +70,6 @@ export async function getToolsInput( `Using ${name} input from repository property: ${propertyValue}`, ); return { - name, value: propertyValue, source: InputSource.RepositoryProperty, }; From 1564bfa3257034750e3a3ca326e2a630f1aa0d63 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 14:39:27 +0100 Subject: [PATCH 034/155] Add changelog entry --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1303638f47..170e03cc37 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) ## 4.37.3 - 22 Jul 2026 From 2d14f71964fc76b4d4951317784ee6b4c9440830 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:35:05 +0100 Subject: [PATCH 035/155] Add `NO_CHANGES_STR` constant --- pr-checks/changelog.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 49011b0361..1351cd8c2f 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -2,14 +2,15 @@ import * as fs from "node:fs"; import { CHANGELOG_FILE, DryRunOption } from "./config"; +/** The default contents for a section in the changelog. */ +export const NO_CHANGES_STR = "No user facing changes.\n\n"; + /** Placeholder changelog content for a new release. */ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog ## [UNRELEASED] -No user facing changes. - -`; +${NO_CHANGES_STR}`; /** Returns `date` formatted as `DD Mon YYYY`. */ export function getReleaseDateString(today: Date = new Date()): string { From 85d157095f7ec93f7aa17909634728937fe6921d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:48:01 +0100 Subject: [PATCH 036/155] Add `prepare-changelog.ts` with tests --- pr-checks/prepare-changelog.test.ts | 46 ++++++++++++++ pr-checks/prepare-changelog.ts | 96 +++++++++++++++++++++++++++++ 2 files changed, 142 insertions(+) create mode 100644 pr-checks/prepare-changelog.test.ts create mode 100755 pr-checks/prepare-changelog.ts diff --git a/pr-checks/prepare-changelog.test.ts b/pr-checks/prepare-changelog.test.ts new file mode 100644 index 0000000000..53804d7fd9 --- /dev/null +++ b/pr-checks/prepare-changelog.test.ts @@ -0,0 +1,46 @@ +/** + * Tests for `prepare-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { EMPTY_CHANGELOG, NO_CHANGES_STR } from "./changelog"; +import { extractChangelogSnippet } from "./prepare-changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "prepare-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +const testBody = `- Test change`; +const testChangelog = `${EMPTY_CHANGELOG.replace(NO_CHANGES_STR, testBody)} + +## Another section + +- Other change`; + +describe("extractChangelogSnippet", async () => { + await it("returns the default body if the input doesn't exist", async () => { + const result = extractChangelogSnippet(path.join(testDir, "not-here.md")); + assert.deepEqual(result, NO_CHANGES_STR); + }); + + await it("returns the first section if the input exists", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, testChangelog); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, testBody); + }); +}); diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts new file mode 100755 index 0000000000..8add7dcf9f --- /dev/null +++ b/pr-checks/prepare-changelog.ts @@ -0,0 +1,96 @@ +#!/usr/bin/env npx tsx + +/** + * Extracts the body of the first changelog section and outputs it to either + * stdout or a file. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { getErrorMessage } from "../src/util"; + +import { NO_CHANGES_STR } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; + +/** + * Prepare the changelog for the new release + * This function will extract the part of the changelog that + * we want to include in the new release. + * + * @param changelogPath The path to the changelog file. + */ +export function extractChangelogSnippet(changelogPath: string) { + try { + const lines = fs.readFileSync(changelogPath, "utf-8").split("\n"); + const output: string[] = []; + let foundFirstSection = false; + + // Extract the body of the first section in the changelog file. + for (const line of lines) { + if (line.startsWith("## ")) { + if (foundFirstSection) { + // This is the second section header we have found, which means that we have + // captured all lines in the first section in `output`. We can stop here. + break; + } + + // We have discovered the first section header. + foundFirstSection = true; + } else if (foundFirstSection) { + // Add lines between the first section header (if any) and the next to the output. + output.push(line); + } + } + + return output.join("\n").trim(); + } catch (err) { + if (err instanceof Error && "code" in err && err.code === "ENOENT") { + console.error(`Changelog file at '${changelogPath}' does not exist.`); + return NO_CHANGES_STR; + } else { + throw Error( + `Failed to open changelog file at '${changelogPath}': ${getErrorMessage(err)}`, + ); + } + } +} + +function main() { + try { + const { values } = parseArgs({ + options: { + changelog: { + type: "string", + short: "f", + default: CHANGELOG_FILE, + }, + output: { + type: "string", + short: "o", + }, + }, + strict: true, + }); + + const body = extractChangelogSnippet(values.changelog); + + // If no `output` argument was provided, output to stdout. Otherwise, + // write a file to the specified path. + if (values.output === undefined) { + console.info(body); + } else { + fs.writeFileSync(values.output, body); + } + + return 0; + } catch (err) { + console.error(`Failed to prepare changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} From b69467ce8bd149c52676a584a728ab412d2645ea Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:53:04 +0100 Subject: [PATCH 037/155] Update workflows to use `prepare-changelog.ts` --- .github/workflows/post-release-mergeback.yml | 2 +- .github/workflows/rollback-release.yml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 170b309de1..22215eea1a 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -127,7 +127,7 @@ jobs: env: PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py CHANGELOG.md > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index 6e6b127905..16680565d2 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -128,7 +128,9 @@ jobs: NEW_CHANGELOG: "${{ runner.temp }}/new_changelog.md" PARTIAL_CHANGELOG: "${{ runner.temp }}/partial_changelog.md" run: | - python .github/workflows/script/prepare_changelog.py $NEW_CHANGELOG > $PARTIAL_CHANGELOG + npx tsx pr-checks/prepare-changelog.ts \ + --changelog="$NEW_CHANGELOG" \ + --output="$PARTIAL_CHANGELOG" echo "::group::Partial CHANGELOG" cat $PARTIAL_CHANGELOG From 5901394530153b6f8919d08615334908398cc2b2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 12:54:11 +0100 Subject: [PATCH 038/155] Remove `prepare_changelog.py` --- .github/workflows/script/prepare_changelog.py | 35 ------------------- 1 file changed, 35 deletions(-) delete mode 100755 .github/workflows/script/prepare_changelog.py diff --git a/.github/workflows/script/prepare_changelog.py b/.github/workflows/script/prepare_changelog.py deleted file mode 100755 index dafb84b39c..0000000000 --- a/.github/workflows/script/prepare_changelog.py +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/env python3 -import os -import sys - -EMPTY_CHANGELOG = 'No changes.\n\n' - -# Prepare the changelog for the new release -# This function will extract the part of the changelog that -# we want to include in the new release. -def extract_changelog_snippet(changelog_file): - output = '' - if (not os.path.exists(changelog_file)): - output = EMPTY_CHANGELOG - - else: - with open(changelog_file, 'r') as f: - lines = f.readlines() - - # Include only the contents of the first section - found_first_section = False - for line in lines: - if line.startswith('## '): - if found_first_section: - break - found_first_section = True - elif found_first_section: - output += line - - return output.strip() - - -if len(sys.argv) < 2: - raise Exception('Expecting argument: changelog_file') -changelog_file = sys.argv[1] -print(extract_changelog_snippet(changelog_file)) From 57eb44123f42baf689ff4e4eb31eba3627666bc1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 13:32:04 +0100 Subject: [PATCH 039/155] Add constant for unreleased placeholder --- pr-checks/changelog.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 1351cd8c2f..3fe03a399f 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -2,13 +2,16 @@ import * as fs from "node:fs"; import { CHANGELOG_FILE, DryRunOption } from "./config"; +/** The placeholder in the header for unreleased changes. */ +export const UNRELEASED_PLACEHOLDER = "[UNRELEASED]"; + /** The default contents for a section in the changelog. */ export const NO_CHANGES_STR = "No user facing changes.\n\n"; /** Placeholder changelog content for a new release. */ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog -## [UNRELEASED] +## ${UNRELEASED_PLACEHOLDER} ${NO_CHANGES_STR}`; @@ -54,7 +57,7 @@ export function setVersionAndDate( date: Date = new Date(), ): string { const versionAndDate = `${version} - ${getReleaseDateString(date)}`; - return content.replace("[UNRELEASED]", versionAndDate); + return content.replace(UNRELEASED_PLACEHOLDER, versionAndDate); } /** From 093dce6cc2d6fcbbe0e87a60af7aba4687f57f72 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 13:41:35 +0100 Subject: [PATCH 040/155] Add `extractChangelogSnippet` test for the case where there is no first section --- pr-checks/prepare-changelog.test.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pr-checks/prepare-changelog.test.ts b/pr-checks/prepare-changelog.test.ts index 53804d7fd9..13a302c8f6 100644 --- a/pr-checks/prepare-changelog.test.ts +++ b/pr-checks/prepare-changelog.test.ts @@ -43,4 +43,12 @@ describe("extractChangelogSnippet", async () => { const result = extractChangelogSnippet(changelogPath); assert.deepEqual(result, testBody); }); + + await it("returns an empty string if there is no first section", async () => { + const changelogPath = path.join(testDir, "test-readme.md"); + fs.writeFileSync(changelogPath, "# CodeQL Action Changelog\n"); + + const result = extractChangelogSnippet(changelogPath); + assert.deepEqual(result, ""); + }); }); From 916098aa8d13708f92e6c439083f7832ba3b89c7 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 14:59:57 +0100 Subject: [PATCH 041/155] Add `parseChangelog` and `renderChangelog` --- pr-checks/changelog.test.ts | 12 ++++++ pr-checks/changelog.ts | 85 +++++++++++++++++++++++++++++++++++++ 2 files changed, 97 insertions(+) diff --git a/pr-checks/changelog.test.ts b/pr-checks/changelog.test.ts index 3eddc14591..817852e3e1 100755 --- a/pr-checks/changelog.test.ts +++ b/pr-checks/changelog.test.ts @@ -5,14 +5,18 @@ */ import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; import { describe, it } from "node:test"; import { EMPTY_CHANGELOG, getReleaseDateString, + parseChangelog, processChangelogForBackports, + renderChangelog, setVersionAndDate, } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; const testDate = new Date(2026, 7, 14); @@ -37,6 +41,14 @@ describe("setVersionAndDate", async () => { }); }); +describe("parseChangelog + renderChangelog", async () => { + await it("renderChangelog(parseChangelog(c)) == c", async () => { + const actualChangelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + const roundtrip = renderChangelog(parseChangelog(actualChangelog)); + assert.deepEqual(roundtrip.split("\n"), actualChangelog.split("\n")); + }); +}); + const testChangelog = `# CodeQL Action Changelog ## 4.12.3 - 14 Aug 2026 diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index 3fe03a399f..db3a99b153 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -15,6 +15,22 @@ export const EMPTY_CHANGELOG = `# CodeQL Action Changelog ${NO_CHANGES_STR}`; +/** + * Represents sections in a changelog. + */ +export interface ChangelogSection { + headerLine: string; + bodyLines: string[]; +} + +/** + * Represents a changelog. + */ +export interface Changelog { + preamble: string[]; + sections: ChangelogSection[]; +} + /** Returns `date` formatted as `DD Mon YYYY`. */ export function getReleaseDateString(today: Date = new Date()): string { return today.toLocaleDateString("en-GB", { @@ -60,6 +76,75 @@ export function setVersionAndDate( return content.replace(UNRELEASED_PLACEHOLDER, versionAndDate); } +/** + * Parses `content` into a structured representation of a changelog. + * + * @param content The contents of the changelog file. + */ +export function parseChangelog(content: string): Changelog { + const lines = content.split("\n"); + let i = 0; + + const preamble: string[] = []; + const sections: ChangelogSection[] = []; + let currentSection: ChangelogSection | undefined = undefined; + + // Process all lines of the input file. + while (i < lines.length) { + const line = lines[i]; + + // Sections of the changelog start with `## `. + if (line.startsWith("## ")) { + // We have discovered a new section. If `currentSection` is already defined, + // then this marks the end of that section. Push it to the array of sections + // in the changelog. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + // Initialise the new section. + currentSection = { headerLine: line, bodyLines: [] }; + } else if (currentSection !== undefined) { + // Add lines between the section header and the next to the current section. + currentSection.bodyLines.push(line); + } else { + // This is neither a section header nor are we in a section already, + // so this line is part of the preamble. + preamble.push(line); + } + + i++; + } + + // Push the current section to the array of completed sections, if there is + // still one unfinished. + if (currentSection !== undefined) { + sections.push(currentSection); + } + + return { preamble, sections }; +} + +/** + * Combines an array of lines into a single string by adding line breaks. + */ +export function unlines(lines: string[]): string { + return `${lines.join("\n")}`; +} + +/** + * Renders a given changelog to a string. + */ +export function renderChangelog(changelog: Changelog): string { + let result = unlines(changelog.preamble); + + for (const section of changelog.sections) { + result += `\n${section.headerLine}\n${unlines(section.bodyLines)}`; + } + + return result; +} + /** * Processes changelog entries for a backport, converting version references * from the source major version to the target major version and filtering From adba0868a4038cf2cc306da86d5c53024f0109b4 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:00:44 +0100 Subject: [PATCH 042/155] Update `processChangelogForBackports` to use `parseChangelog` --- pr-checks/changelog.ts | 80 ++++++++++++++++++------------------------ 1 file changed, 34 insertions(+), 46 deletions(-) diff --git a/pr-checks/changelog.ts b/pr-checks/changelog.ts index db3a99b153..4cf1e75494 100644 --- a/pr-checks/changelog.ts +++ b/pr-checks/changelog.ts @@ -155,70 +155,58 @@ export function processChangelogForBackports( targetBranchMajorVersion: string, content: string, ): string { - const lines = content.split("\n"); - // Changelog entries can use the following format to indicate // that they only apply to newer versions const someVersionsOnlyRegex = /\[v(\d+)\+ only\]/; - let output = ""; - let i = 0; + // Parse the changelog. + const changelog = parseChangelog(content); - // Copy lines until we find the first section heading. - let foundFirstSection = false; - while (!foundFirstSection && i < lines.length) { - let line = lines[i]; - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - foundFirstSection = true; - } - output += `${line}\n`; - i++; - } - - if (!foundFirstSection) { + if (changelog.sections.length === 0) { throw new Error("Could not find any change sections in CHANGELOG.md"); } - // Process remaining lines. - // `foundContent` tracks whether we hit two headings in a row - let foundContent = false; - output += "\n"; - - while (i < lines.length) { - let line = lines[i]; - i++; - - // Filter out changelog entries that only apply to newer versions. - const match = someVersionsOnlyRegex.exec(line); - if (match) { + // Filter out changelog entries that only apply to newer versions and + // update the section headings with the backport major version for + // sections we keep. + for (const section of changelog.sections) { + // Update the section headings with the backport major version. + section.headerLine = section.headerLine.replace( + `## ${sourceBranchMajorVersion}`, + `## ${targetBranchMajorVersion}`, + ); + + const filteredEntries: string[] = []; + let foundContent = false; + + for (const line of section.bodyLines) { + // Skip the entry if `someVersionsOnlyRegex` matches and the major version + // of the target branch is smaller than the required version. + const match = someVersionsOnlyRegex.exec(line); if ( + match && Number.parseInt(targetBranchMajorVersion) < Number.parseInt(match[1]) ) { continue; } - } - if (line.startsWith("## ")) { - line = line.replace( - `## ${sourceBranchMajorVersion}`, - `## ${targetBranchMajorVersion}`, - ); - if (!foundContent) { - output += "No user facing changes.\n"; - } - foundContent = false; - output += `\n${line}\n\n`; - } else { + // Keep the line. + filteredEntries.push(line); + + // Set `foundContent` to `true` if the line is not empty. if (line.trim() !== "") { foundContent = true; - output += `${line}\n`; } } + + // Update the section with the retained entries. + section.bodyLines = filteredEntries; + + // Add an entry if we didn't keep any. + if (!foundContent) { + section.bodyLines.push(NO_CHANGES_STR.trim()); + } } - return output; + return renderChangelog(changelog); } From c5d621238d047125431ab165a2c991d3097c735d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:01:07 +0100 Subject: [PATCH 043/155] Update `extractChangelogSnippet` to use `parseChangelog` --- pr-checks/prepare-changelog.ts | 27 +++++++-------------------- 1 file changed, 7 insertions(+), 20 deletions(-) diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts index 8add7dcf9f..9ee89767bb 100755 --- a/pr-checks/prepare-changelog.ts +++ b/pr-checks/prepare-changelog.ts @@ -10,7 +10,7 @@ import { parseArgs } from "node:util"; import { getErrorMessage } from "../src/util"; -import { NO_CHANGES_STR } from "./changelog"; +import { NO_CHANGES_STR, parseChangelog } from "./changelog"; import { CHANGELOG_FILE } from "./config"; /** @@ -22,28 +22,15 @@ import { CHANGELOG_FILE } from "./config"; */ export function extractChangelogSnippet(changelogPath: string) { try { - const lines = fs.readFileSync(changelogPath, "utf-8").split("\n"); - const output: string[] = []; - let foundFirstSection = false; + const content = fs.readFileSync(changelogPath, "utf-8"); + const changelog = parseChangelog(content); - // Extract the body of the first section in the changelog file. - for (const line of lines) { - if (line.startsWith("## ")) { - if (foundFirstSection) { - // This is the second section header we have found, which means that we have - // captured all lines in the first section in `output`. We can stop here. - break; - } - - // We have discovered the first section header. - foundFirstSection = true; - } else if (foundFirstSection) { - // Add lines between the first section header (if any) and the next to the output. - output.push(line); - } + // Return an empty string if we couldn't find the first section. + if (changelog.sections.length === 0) { + return ""; } - return output.join("\n").trim(); + return changelog.sections[0].bodyLines.join("\n").trim(); } catch (err) { if (err instanceof Error && "code" in err && err.code === "ENOENT") { console.error(`Changelog file at '${changelogPath}' does not exist.`); From 66a6f42f0a3913dd88868e788503602498b26925 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:23:11 +0100 Subject: [PATCH 044/155] Add `bundle-changelog.ts` with tests --- pr-checks/bundle-changelog.test.ts | 142 +++++++++++++++++++++++++++++ pr-checks/bundle-changelog.ts | 128 ++++++++++++++++++++++++++ pr-checks/config.ts | 4 + 3 files changed, 274 insertions(+) create mode 100644 pr-checks/bundle-changelog.test.ts create mode 100755 pr-checks/bundle-changelog.ts diff --git a/pr-checks/bundle-changelog.test.ts b/pr-checks/bundle-changelog.test.ts new file mode 100644 index 0000000000..6cc4d096ba --- /dev/null +++ b/pr-checks/bundle-changelog.test.ts @@ -0,0 +1,142 @@ +/** + * Tests for `bundle-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import * as os from "node:os"; +import * as path from "node:path"; +import { afterEach, beforeEach, describe, it } from "node:test"; + +import { + CLI_VERSION_ENV_VAR, + getCLIVersion, + getPRNumber, + getPRUrl, + PR_URL_ENV_VAR, + updateChangelog, +} from "./bundle-changelog"; +import { + EMPTY_CHANGELOG, + NO_CHANGES_STR, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; + +let testDir: string; + +beforeEach(() => { + // Set up a temporary directory for testing + testDir = fs.mkdtempSync(path.join(os.tmpdir(), "bundle-changelog-test-")); +}); + +afterEach(() => { + /** Clean up temporary directories. */ + fs.rmSync(testDir, { recursive: true, force: true }); +}); + +describe("getCLIVersion", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[CLI_VERSION_ENV_VAR]; + assert.throws(() => getCLIVersion()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[CLI_VERSION_ENV_VAR] = " "; + assert.throws(() => getCLIVersion()); + }); + + await it("returns value of the environment variable if set", async () => { + const testValue = "1.2.3"; + process.env[CLI_VERSION_ENV_VAR] = testValue; + assert.deepEqual(getCLIVersion(), testValue); + }); +}); + +const testPrUrl = "https://github.com/github/codeql-action/pulls/42"; + +describe("getPRUrl", async () => { + await it("throws if the environment variable is not set", async () => { + delete process.env[PR_URL_ENV_VAR]; + assert.throws(() => getPRUrl()); + }); + + await it("throws if the environment variable is empty", async () => { + process.env[PR_URL_ENV_VAR] = " "; + assert.throws(() => getPRUrl()); + }); + + await it("returns value of the environment variable if set", async () => { + process.env[PR_URL_ENV_VAR] = testPrUrl; + assert.deepEqual(getPRUrl(), testPrUrl); + }); +}); + +describe("getPRNumber", async () => { + await it("throws if the last part of the input is not a number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/foo`)); + }); + + await it("throws if the last part of the input is not a positive number", async () => { + assert.throws(() => getPRNumber(`${testPrUrl}/-100`)); + }); + + await it("returns the PR number from an URL", async () => { + assert.equal(getPRNumber(testPrUrl), 42); + }); +}); + +const testChangelog = `${EMPTY_CHANGELOG.trimEnd()} + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +const expectedChangelog = `# CodeQL Action Changelog + +## ${UNRELEASED_PLACEHOLDER} + +- Update default CodeQL bundle version to + +## 4.23.7 + +- Other change + +## 4.23.6 + +${NO_CHANGES_STR}`; + +describe("updateChangelog", async () => { + await it("removes `NO_CHANGES_STR` if present in [UNRELEASED] section", async () => { + const result = updateChangelog(EMPTY_CHANGELOG, ""); + assert.ok(!result.includes(NO_CHANGES_STR.trim())); + }); + + await it("doesn't remove `NO_CHANGES_STR` if present in versioned section", async () => { + const result = updateChangelog( + EMPTY_CHANGELOG.replace(UNRELEASED_PLACEHOLDER, "1.2.3"), + "", + ); + assert.ok(result.includes(NO_CHANGES_STR.trim())); + }); + + await it("throws if there are no sections", async () => { + assert.throws(() => { + updateChangelog( + "# CodeQL Action Changelog", + "- Update default CodeQL bundle version to", + ); + }); + }); + + await it("adds note at the end of the first section", async () => { + const result = updateChangelog( + testChangelog, + "- Update default CodeQL bundle version to", + ); + assert.deepEqual(result, expectedChangelog); + }); +}); diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts new file mode 100755 index 0000000000..243cbd86b6 --- /dev/null +++ b/pr-checks/bundle-changelog.ts @@ -0,0 +1,128 @@ +#!/usr/bin/env npx tsx + +/** + * Updates the changelog with a change note for an updated CodeQL CLI bundle. + */ + +import * as fs from "node:fs"; + +import { getErrorMessage } from "../src/util"; + +import { + parseChangelog, + renderChangelog, + UNRELEASED_PLACEHOLDER, +} from "./changelog"; +import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; + +export const CLI_VERSION_ENV_VAR = "CLI_VERSION"; +export const PR_URL_ENV_VAR = "PR_URL"; + +/** Gets the CLI version from the environment. */ +export function getCLIVersion() { + const cliVersion = process.env[CLI_VERSION_ENV_VAR]; + + if (cliVersion === undefined || cliVersion.trim() === "") { + throw new Error(`No CLI version was set in '${CLI_VERSION_ENV_VAR}'.`); + } + + return cliVersion; +} + +/** Gets the PR URL from the environment. */ +export function getPRUrl() { + const prUrl = process.env[PR_URL_ENV_VAR]; + + if (prUrl === undefined || prUrl.trim() === "") { + throw new Error(`No PR URL was set in '${PR_URL_ENV_VAR}'.`); + } + + return prUrl; +} + +/** + * Gets the PR number from something like a PR URL. + */ +export function getPRNumber(prUrl: string) { + const prUrlParts = prUrl.split("/"); + const prNumberStr = prUrlParts[prUrlParts.length - 1]; + + const prNumber = Number.parseInt(prNumberStr, 10); + + if (!Number.isInteger(prNumber) || prNumber <= 0) { + throw new Error( + `Invalid PR URL '${prUrl}': last part is not a positive number`, + ); + } + + return prNumber; +} + +/** + * Updates `changelog` by adding `changelogNote` to the first section. + * + * @param contents The existing changelog contents. + * @param changelogNote The note to add to the first section. + */ +export function updateChangelog(contents: string, changelogNote: string) { + // If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. + contents = contents.replace( + `## ${UNRELEASED_PLACEHOLDER}\n\nNo user facing changes.`, + `## ${UNRELEASED_PLACEHOLDER}\n`, + ); + + const changelog = parseChangelog(contents); + + if (changelog.sections.length === 0) { + throw new Error("The changelog contains no existing sections."); + } + + // Add the changelog note to the bottom of the first section. + const firstSection = changelog.sections[0]; + const lastLine = firstSection.bodyLines.pop(); + + if (lastLine !== undefined && lastLine.trim() !== "") { + // We expect the last line to be empty. If it isn't for some reason, + // add it back. + firstSection.bodyLines.push(lastLine); + } + + firstSection.bodyLines.push(changelogNote); + + // If the last line is empty as expected, then add it back in after the new note. + if (lastLine?.trim() === "") { + firstSection.bodyLines.push(lastLine); + } + + return renderChangelog(changelog); +} + +function main() { + try { + const cliVersion = getCLIVersion(); + const prUrl = getPRUrl(); + + // The GitHub Release for the new bundle version. + const bundleReleaseUrl = `${CLI_BUNDLE_RELEASE_URL_PREFIX}${cliVersion}`; + + // Get the PR number from the PR URL. + const prNumber = getPRNumber(prUrl); + const changelogNote = `- Update default CodeQL bundle version to [${cliVersion}](${bundleReleaseUrl}). [#${prNumber}](${prUrl})`; + + let changelog = fs.readFileSync(CHANGELOG_FILE, "utf-8"); + + changelog = updateChangelog(changelog, changelogNote); + + fs.writeFileSync(CHANGELOG_FILE, changelog); + + return 0; + } catch (err) { + console.error(`Failed to bundle changelog: ${getErrorMessage(err)}`); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} diff --git a/pr-checks/config.ts b/pr-checks/config.ts index 94d34a931d..356fe665f9 100644 --- a/pr-checks/config.ts +++ b/pr-checks/config.ts @@ -37,6 +37,10 @@ export const API_COMPATIBILITY_FILE = path.join( "api-compatibility.json", ); +/** The prefix of CodeQL CLI bundle release URLs. */ +export const CLI_BUNDLE_RELEASE_URL_PREFIX = + "https://github.com/github/codeql-action/releases/tag/codeql-bundle-v"; + /** A common interface for operations that support dry runs. */ export interface DryRunOption { /** A value indicating whether to perform operations with side effects. */ From 027ac05d3b9f135622bc03943be850da84e8ad3b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:24:33 +0100 Subject: [PATCH 045/155] Use `bundle-changelog.ts` and remove Python version --- .github/workflows/script/bundle_changelog.py | 23 -------------------- .github/workflows/update-bundle.yml | 2 +- 2 files changed, 1 insertion(+), 24 deletions(-) delete mode 100755 .github/workflows/script/bundle_changelog.py diff --git a/.github/workflows/script/bundle_changelog.py b/.github/workflows/script/bundle_changelog.py deleted file mode 100755 index d8ced87d8d..0000000000 --- a/.github/workflows/script/bundle_changelog.py +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/env python3 -import os -import re - -cli_version = os.environ['CLI_VERSION'] - -# The GitHub Release for the new bundle version. -bundle_release_url = f"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v{cli_version}" -# Get the PR number from the PR URL. -pr_number = os.environ['PR_URL'].split('/')[-1] -changelog_note = f"- Update default CodeQL bundle version to [{cli_version}]({bundle_release_url}). [#{pr_number}]({os.environ['PR_URL']})" - -# If the "[UNRELEASED]" section starts with "no user facing changes", remove that line. -with open('CHANGELOG.md', 'r') as f: - changelog = f.read() - -changelog = changelog.replace('## [UNRELEASED]\n\nNo user facing changes.', '## [UNRELEASED]\n') - -# Add the changelog note to the bottom of the "[UNRELEASED]" section. -changelog = re.sub(r'\n## (\d+\.\d+\.\d+)', f'{changelog_note}\n\n## \\1', changelog, count=1) - -with open('CHANGELOG.md', 'w') as f: - f.write(changelog) diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index 8dcf058591..72eacf1397 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -120,7 +120,7 @@ jobs: - name: Create changelog note run: | - python .github/workflows/script/bundle_changelog.py + npx tsx pr-checks/bundle-changelog.ts - name: Push changelog note run: | From d71461774b5cf2296505e568335a3415b840aa5a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:48:35 +0100 Subject: [PATCH 046/155] Add `rollback-changelog.ts` with tests --- pr-checks/rollback-changelog.test.ts | 45 +++++++++++++ pr-checks/rollback-changelog.ts | 94 ++++++++++++++++++++++++++++ 2 files changed, 139 insertions(+) create mode 100644 pr-checks/rollback-changelog.test.ts create mode 100755 pr-checks/rollback-changelog.ts diff --git a/pr-checks/rollback-changelog.test.ts b/pr-checks/rollback-changelog.test.ts new file mode 100644 index 0000000000..5264755a69 --- /dev/null +++ b/pr-checks/rollback-changelog.test.ts @@ -0,0 +1,45 @@ +/** + * Tests for `rollback-changelog.ts`. + */ + +import * as assert from "node:assert/strict"; +import * as fs from "node:fs"; +import { describe, it } from "node:test"; + +import { getReleaseDateString, parseChangelog } from "./changelog"; +import { CHANGELOG_FILE } from "./config"; +import { updateChangelog } from "./rollback-changelog"; + +describe("updateChangelog", async () => { + await it("replaces the first section with one for the rollback release", async () => { + const actualChangelog = parseChangelog( + fs.readFileSync(CHANGELOG_FILE, "utf-8"), + ); + const existingFirstSection = actualChangelog.sections[0]; + + const today = new Date(); + updateChangelog(actualChangelog, { + "new-version": "Test.1.3", + "rollback-version": "Test.1.2", + "target-version": "Test.1.1", + today, + }); + + // Check that the old, first section is gone. + for (const section of actualChangelog.sections) { + assert.notDeepEqual(section, existingFirstSection); + } + + // Check that the new, first section matches our expectations. + const newFirstSection = actualChangelog.sections[0]; + assert.deepEqual( + newFirstSection.headerLine, + `## Test.1.3 - ${getReleaseDateString(today)}`, + ); + assert.equal(newFirstSection.bodyLines.length, 3); + assert.deepEqual( + newFirstSection.bodyLines[1], + `This release rolls back Test.1.2 due to issues with that release. It is identical to Test.1.1.`, + ); + }); +}); diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts new file mode 100755 index 0000000000..23b10c9357 --- /dev/null +++ b/pr-checks/rollback-changelog.ts @@ -0,0 +1,94 @@ +#!/usr/bin/env npx tsx + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ + +import * as fs from "node:fs"; +import { parseArgs } from "node:util"; + +import { getErrorMessage } from "../src/util"; + +import { + Changelog, + ChangelogSection, + getReleaseDateString, + parseChangelog, + renderChangelog, +} from "./changelog"; +import { CHANGELOG_FILE } from "./config"; + +export interface RollbackChangelogInputs { + "target-version": string; + "rollback-version": string; + "new-version": string; + today?: Date; +} + +/** + * Replaces the current, first section of the changelog with a new one for the rollback release. + */ +export function updateChangelog( + changelog: Changelog, + versions: RollbackChangelogInputs, +) { + // Drop the existing first section. + changelog.sections.shift(); + + // Construct the section for the rollback version. + const newSection: ChangelogSection = { + headerLine: `## ${versions["new-version"]} - ${getReleaseDateString(versions.today)}`, + bodyLines: [ + "", + `This release rolls back ${versions["rollback-version"]} due to issues with that release. It is identical to ${versions["target-version"]}.`, + "", + ], + }; + + // Add the new section at the top of the changelog. + changelog.sections.unshift(newSection); +} + +function main() { + try { + const { values } = parseArgs({ + options: { + "target-version": { + type: "string", + short: "t", + }, + "rollback-version": { + type: "string", + short: "r", + }, + "new-version": { + type: "string", + short: "n", + }, + }, + strict: true, + }); + + for (const key of Object.keys(values)) { + if (key === undefined || key.trim() === "") { + throw new Error(`Argument '--${key}' is required.`); + } + } + + const changelog = parseChangelog(fs.readFileSync(CHANGELOG_FILE, "utf-8")); + updateChangelog(changelog, values as RollbackChangelogInputs); + console.info(renderChangelog(changelog)); + + return 0; + } catch (err) { + console.error( + `Failed to prepare rollback changelog: ${getErrorMessage(err)}`, + ); + return -1; + } +} + +// Only call `main` if this script was run directly. +if (require.main === module) { + process.exit(main()); +} From 961b583f9ac26ed437c0f5abb5609fe16d8e29fa Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:52:50 +0100 Subject: [PATCH 047/155] Use `rollback-changelog.ts` and remove Python version --- .github/workflows/rollback-release.yml | 2 +- .../workflows/script/rollback_changelog.py | 62 ------------------- 2 files changed, 1 insertion(+), 63 deletions(-) delete mode 100644 .github/workflows/script/rollback_changelog.py diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index 16680565d2..c37f8a79ae 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -93,7 +93,7 @@ jobs: LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }} VERSION: "${{ needs.prepare.outputs.version }}" run: | - python .github/workflows/script/rollback_changelog.py \ + npx tsx pr-checks/rollback-changelog.ts \ --target-version "${ROLLBACK_TAG:1}" \ --rollback-version "${LATEST_TAG:1}" \ --new-version "$VERSION" > $NEW_CHANGELOG diff --git a/.github/workflows/script/rollback_changelog.py b/.github/workflows/script/rollback_changelog.py deleted file mode 100644 index 5e06f83455..0000000000 --- a/.github/workflows/script/rollback_changelog.py +++ /dev/null @@ -1,62 +0,0 @@ -import datetime -import os -import argparse - -EMPTY_CHANGELOG = """# CodeQL Action Changelog - -""" - -def get_today_string(): - today = datetime.datetime.today() - return '{:%d %b %Y}'.format(today) - -# Include everything up to and after the first heading, -# but not the first heading and body. -def drop_unreleased_section(lines: list[str]): - before_first_section = '' - after_first_section = '' - found_first_section = False - skipped_first_section = False - - for i, line in enumerate(lines): - if line.startswith('## ') and not found_first_section: - found_first_section = True - elif line.startswith('## ') and found_first_section: - skipped_first_section = True - - if not found_first_section: - before_first_section += line - if skipped_first_section: - after_first_section += line - - return (before_first_section, after_first_section) - -def update_changelog(target_version, rollback_version, new_version): - before_first_section = EMPTY_CHANGELOG - after_first_section = '' - - if (os.path.exists('CHANGELOG.md')): - with open('CHANGELOG.md', 'r') as f: - (before_first_section, after_first_section) = drop_unreleased_section(f.readlines()) - - newHeader = f'## {new_version} - {get_today_string()}\n' - - print(before_first_section, end="") - print(newHeader) - print(f"This release rolls back {rollback_version} due to issues with that release. It is identical to {target_version}.\n") - print(after_first_section) - -# We expect three version strings as input: -# -# - target_version: the version that we are re-releasing as `new_version` -# - rollback_version: the version that we are rolling back, typically the one that followed `target_version` -# - new_version: the new version that we are releasing `target_version` as, typically the one that follows `rollback_version` -# -# Example: python3 .github/workflows/script/rollback_changelog.py --target-version "1.2.3" --rollback-version "1.2.4" --new-version "1.2.5" -parser = argparse.ArgumentParser(description="Update CHANGELOG.md for a rollback release.") -parser.add_argument("--target-version", "-t", required=True, help="Version to re-release as new_version.") -parser.add_argument("--rollback-version", "-r", required=True, help="Version being rolled back.") -parser.add_argument("--new-version", "-n", required=True, help="New version to publish for target_version.") -args = parser.parse_args() - -update_changelog(args.target_version, args.rollback_version, args.new_version) From ab44eb939db84ba2eebaa9ead83e1e833bde6df6 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 15:58:27 +0100 Subject: [PATCH 048/155] Remove `python` from CodeQL workflow There is no more (non-test) Python code left to analyse, so CodeQL analysis would fail now --- .github/workflows/codeql.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9f1b9e770b..f27de17fd8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -113,7 +113,6 @@ jobs: matrix: include: - language: actions - - language: python permissions: contents: read From cbad145443761aa6d61cbac486cf37b1bf610a15 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:01:33 +0100 Subject: [PATCH 049/155] Remove Python-specific steps from workflows that no longer need them --- .github/actions/release-initialise/action.yml | 11 ----------- .github/workflows/post-release-mergeback.yml | 3 --- .github/workflows/update-bundle.yml | 5 ----- .../update-supported-enterprise-server-versions.yml | 5 ----- 4 files changed, 24 deletions(-) diff --git a/.github/actions/release-initialise/action.yml b/.github/actions/release-initialise/action.yml index be16f03950..239dfa9428 100644 --- a/.github/actions/release-initialise/action.yml +++ b/.github/actions/release-initialise/action.yml @@ -25,17 +25,6 @@ runs: shell: bash run: npm ci - - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 - with: - python-version: '3.12' - - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install PyGithub==2.3.0 requests - shell: bash - - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index 22215eea1a..ceb220b3a0 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -51,9 +51,6 @@ jobs: with: node-version: 24 cache: 'npm' - - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: '3.12' - name: Update git config run: | diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index 72eacf1397..d3ee924e59 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -40,11 +40,6 @@ jobs: git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" git config --global user.name "github-actions[bot]" - - name: Set up Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: '3.12' - - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index fc7873711d..01cd6ab8fb 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -22,11 +22,6 @@ jobs: pull-requests: write # needed to create pull request steps: - - name: Setup Python - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - with: - python-version: "3.13" - - name: Checkout CodeQL Action uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From 0953dc00da12a0b089198632e7283ce52dc21c35 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:08:18 +0100 Subject: [PATCH 050/155] Add `getErrorMessage` to `pr-checks`-local `util.ts` to avoid pulling in `src/util.ts` dependencies --- pr-checks/bundle-changelog.ts | 3 +-- pr-checks/prepare-changelog.ts | 3 +-- pr-checks/rollback-changelog.ts | 3 +-- pr-checks/util.ts | 9 +++++++++ 4 files changed, 12 insertions(+), 6 deletions(-) create mode 100644 pr-checks/util.ts diff --git a/pr-checks/bundle-changelog.ts b/pr-checks/bundle-changelog.ts index 243cbd86b6..557a8556c1 100755 --- a/pr-checks/bundle-changelog.ts +++ b/pr-checks/bundle-changelog.ts @@ -6,14 +6,13 @@ import * as fs from "node:fs"; -import { getErrorMessage } from "../src/util"; - import { parseChangelog, renderChangelog, UNRELEASED_PLACEHOLDER, } from "./changelog"; import { CHANGELOG_FILE, CLI_BUNDLE_RELEASE_URL_PREFIX } from "./config"; +import { getErrorMessage } from "./util"; export const CLI_VERSION_ENV_VAR = "CLI_VERSION"; export const PR_URL_ENV_VAR = "PR_URL"; diff --git a/pr-checks/prepare-changelog.ts b/pr-checks/prepare-changelog.ts index 9ee89767bb..0c89699fc8 100755 --- a/pr-checks/prepare-changelog.ts +++ b/pr-checks/prepare-changelog.ts @@ -8,10 +8,9 @@ import * as fs from "node:fs"; import { parseArgs } from "node:util"; -import { getErrorMessage } from "../src/util"; - import { NO_CHANGES_STR, parseChangelog } from "./changelog"; import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; /** * Prepare the changelog for the new release diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts index 23b10c9357..e0b3634daa 100755 --- a/pr-checks/rollback-changelog.ts +++ b/pr-checks/rollback-changelog.ts @@ -7,8 +7,6 @@ import * as fs from "node:fs"; import { parseArgs } from "node:util"; -import { getErrorMessage } from "../src/util"; - import { Changelog, ChangelogSection, @@ -17,6 +15,7 @@ import { renderChangelog, } from "./changelog"; import { CHANGELOG_FILE } from "./config"; +import { getErrorMessage } from "./util"; export interface RollbackChangelogInputs { "target-version": string; diff --git a/pr-checks/util.ts b/pr-checks/util.ts new file mode 100644 index 0000000000..353b2a9654 --- /dev/null +++ b/pr-checks/util.ts @@ -0,0 +1,9 @@ +/** + * Returns an appropriate message for the error. + * + * If the error is an `Error` instance, this returns the error message without + * an `Error: ` prefix. + */ +export function getErrorMessage(error: unknown): string { + return error instanceof Error ? error.message : String(error); +} From f00f809405a0571f02079a483378ba1102bd3d1e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:17:04 +0100 Subject: [PATCH 051/155] Fix checking keys rather than values --- pr-checks/rollback-changelog.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts index e0b3634daa..6f2edb4b94 100755 --- a/pr-checks/rollback-changelog.ts +++ b/pr-checks/rollback-changelog.ts @@ -68,8 +68,8 @@ function main() { strict: true, }); - for (const key of Object.keys(values)) { - if (key === undefined || key.trim() === "") { + for (const [key, val] of Object.entries(values)) { + if (val === undefined || val.trim() === "") { throw new Error(`Argument '--${key}' is required.`); } } From 74b15aa2c6c649153cb2e5f7a9d3bd2f0c8f82d1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:19:45 +0100 Subject: [PATCH 052/155] Install JS deps if needed in `post-release-mergeback` workflow --- .github/workflows/post-release-mergeback.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index ceb220b3a0..c493c2a382 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -52,6 +52,9 @@ jobs: node-version: 24 cache: 'npm' + - name: Install JavaScript dependencies + run: npm ci + - name: Update git config run: | git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" From 3013ac07bdb913cf5b7a1a8a63fe51422ce5a91e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 16:28:21 +0100 Subject: [PATCH 053/155] Promote `AllowToolcacheInput` feature --- lib/entry-points.js | 22 ++++------------------ src/feature-flags.ts | 6 ------ src/setup-codeql.test.ts | 14 +++----------- src/setup-codeql.ts | 18 ++++-------------- 4 files changed, 11 insertions(+), 49 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 33d389269f..cc8d81960f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146793,11 +146793,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: void 0 }, - ["allow_toolcache_input" /* AllowToolcacheInput */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: void 0 - }, ["cleanup_trap_caches" /* CleanupTrapCaches */]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", @@ -150951,10 +150946,7 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO } } else if (toolsInput !== void 0 && toolsInput === CODEQL_TOOLCACHE_INPUT) { let latestToolcacheVersion; - const allowToolcacheValueFF = await features.getValue( - "allow_toolcache_input" /* AllowToolcacheInput */ - ); - const allowToolcacheValue = allowToolcacheValueFF && (isDynamicWorkflow() || isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || isInTestMode(); if (allowToolcacheValue) { logger.info( `Attempting to use the latest CodeQL CLI version in the toolcache, as requested by 'tools: ${toolsInput}'.` @@ -150970,15 +150962,9 @@ async function getCodeQLSource(toolsInput, defaultCliVersion, rawLanguages, useO `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...` ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.` - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.` + ); } const version = await resolveDefaultCliVersion( defaultCliVersion, diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 0c92ac69af..bb05c0b4e2 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -74,7 +74,6 @@ export enum Feature { AllowMergeConfigFiles = "allow_merge_config_files", /** Controls whether we allow multiple values for the `analysis-kinds` input. */ AllowMultipleAnalysisKinds = "allow_multiple_analysis_kinds", - AllowToolcacheInput = "allow_toolcache_input", CleanupTrapCaches = "cleanup_trap_caches", /** Whether to allow the `config-file` input to be specified via a repository property. */ ConfigFileRepositoryProperty = "config_file_repository_property", @@ -185,11 +184,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_ALLOW_MULTIPLE_ANALYSIS_KINDS", minimumVersion: undefined, }, - [Feature.AllowToolcacheInput]: { - defaultValue: false, - envVar: "CODEQL_ACTION_ALLOW_TOOLCACHE_INPUT", - minimumVersion: undefined, - }, [Feature.CleanupTrapCaches]: { defaultValue: false, envVar: "CODEQL_ACTION_CLEANUP_TRAP_CACHES", diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts index 33dfc079ba..219e39984c 100644 --- a/src/setup-codeql.test.ts +++ b/src/setup-codeql.test.ts @@ -451,7 +451,7 @@ test.serial( async (t) => { const loggedMessages: LoggedMessage[] = []; const logger = getRecordingLogger(loggedMessages); - const features = createFeatures([Feature.AllowToolcacheInput]); + const features = createFeatures([]); const latestToolcacheVersion = "3.2.1"; const latestVersionPath = "/path/to/latest"; @@ -580,7 +580,7 @@ const toolcacheInputFallbackMacro = makeMacro({ toolcacheInputFallbackMacro.serial( "the toolcache doesn't have a CodeQL CLI when tools == toolcache", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "dynamic" }, [], [ @@ -591,7 +591,7 @@ toolcacheInputFallbackMacro.serial( toolcacheInputFallbackMacro.serial( "the workflow trigger is not `dynamic`", - [Feature.AllowToolcacheInput], + [], { GITHUB_EVENT_NAME: "pull_request" }, [], [ @@ -599,14 +599,6 @@ toolcacheInputFallbackMacro.serial( ], ); -toolcacheInputFallbackMacro.serial( - "the feature flag is not enabled", - [], - { GITHUB_EVENT_NAME: "dynamic" }, - [], - [`Ignoring 'tools: toolcache' because the feature is not enabled.`], -); - test.serial( 'tryGetTagNameFromUrl extracts the right tag name for a repo name containing "codeql-bundle"', (t) => { diff --git a/src/setup-codeql.ts b/src/setup-codeql.ts index 105c544499..8d374585aa 100644 --- a/src/setup-codeql.ts +++ b/src/setup-codeql.ts @@ -533,11 +533,7 @@ export async function getCodeQLSource( // We only allow `toolsInput === "toolcache"` for `dynamic` events. In general, using `toolsInput === "toolcache"` // can lead to alert wobble and so it shouldn't be used for an analysis where results are intended to be uploaded. // We also allow this in test mode. - const allowToolcacheValueFF = await features.getValue( - Feature.AllowToolcacheInput, - ); - const allowToolcacheValue = - allowToolcacheValueFF && (isDynamicWorkflow() || util.isInTestMode()); + const allowToolcacheValue = isDynamicWorkflow() || util.isInTestMode(); if (allowToolcacheValue) { // If `toolsInput === "toolcache"`, try to find the latest version of the CLI that's available in the toolcache // and use that. We perform this check here since we can set `cliVersion` directly and don't want to default to @@ -558,15 +554,9 @@ export async function getCodeQLSource( `Found no CodeQL CLI in the toolcache, ignoring 'tools: ${toolsInput}'...`, ); } else { - if (allowToolcacheValueFF) { - logger.warning( - `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, - ); - } else { - logger.info( - `Ignoring 'tools: ${toolsInput}' because the feature is not enabled.`, - ); - } + logger.warning( + `Ignoring 'tools: ${toolsInput}' because the workflow was not triggered dynamically.`, + ); } const version = await resolveDefaultCliVersion( From 2a8731cc0636c612147a349ccc88166bd482a9e1 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 27 Jul 2026 13:10:34 +0100 Subject: [PATCH 054/155] Move `config-file` computation after determining the `analysisKinds` --- lib/entry-points.js | 10 +++++----- src/init-action.ts | 13 +++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 528f258a87..c522b43c4a 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -160750,11 +160750,6 @@ async function run3(actionState) { logger.info(`Job run UUID is ${jobRunUuid}.`); core21.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties - ); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), getOptionalInput("source-root") || "" @@ -160767,6 +160762,11 @@ async function run3(actionState) { `Failed to parse analysis kinds for 'starting' status report: ${getErrorMessage(err)}` ); } + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties + ); await sendStartingStatusReport(startedAt, { analysisKinds }, logger); if (process.env["CODEQL_ACTION_SETUP_CODEQL_HAS_RUN" /* SETUP_CODEQL_ACTION_HAS_RUN */] === "true") { throw new ConfigurationError( diff --git a/src/init-action.ts b/src/init-action.ts index c7837c6eed..ec7983b76c 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -262,12 +262,6 @@ async function run( core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); - const actionStateWithFeatures = { ...actionState, features }; - configFile = await getConfigFileInput( - actionStateWithFeatures, - repositoryProperties, - ); - // path.resolve() respects the intended semantics of source-root. If // source-root is relative, it is relative to the GITHUB_WORKSPACE. If // source-root is absolute, it is used as given. @@ -290,6 +284,13 @@ async function run( ); } + // Compute the value of the `config-file` input. + const actionStateWithFeatures = { ...actionState, features }; + configFile = await getConfigFileInput( + actionStateWithFeatures, + repositoryProperties, + ); + // Send a status report indicating that an analysis is starting. await sendStartingStatusReport(startedAt, { analysisKinds }, logger); From 8289a49271cbb335d374e7e2e7a50c1576be0afe Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 27 Jul 2026 13:23:39 +0100 Subject: [PATCH 055/155] Ignore repository property for unsupported analysis kinds --- lib/entry-points.js | 8 +++++--- src/config/file.test.ts | 39 ++++++++++++++++++++++++++++++++++----- src/config/file.ts | 16 +++++++++++++++- src/init-action.ts | 1 + 4 files changed, 55 insertions(+), 9 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c522b43c4a..5904ad07ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -148495,14 +148495,15 @@ async function getConfigFileInput({ logger, actions, features -}, repositoryProperties) { +}, repositoryProperties, analysisKinds) { const input = actions.getOptionalInput("config-file"); if (input !== void 0) { logger.info(`Using configuration file input from workflow: ${input}`); return input; } const propertyValue = repositoryProperties["github-codeql-config-file" /* CONFIG_FILE */]; - if (propertyValue !== void 0 && propertyValue.trim().length > 0) { + const analysisKindSupported = analysisKinds === void 0 || analysisKinds.includes("code-scanning" /* CodeScanning */) && analysisKinds.length === 1; + if (analysisKindSupported && propertyValue !== void 0 && propertyValue.trim().length > 0) { const useRepositoryProperty = await features.getValue( "config_file_repository_property" /* ConfigFileRepositoryProperty */ ); @@ -160765,7 +160766,8 @@ async function run3(actionState) { const actionStateWithFeatures = { ...actionState, features }; configFile = await getConfigFileInput( actionStateWithFeatures, - repositoryProperties + repositoryProperties, + analysisKinds ); await sendStartingStatusReport(startedAt, { analysisKinds }, logger); if (process.env["CODEQL_ACTION_SETUP_CODEQL_HAS_RUN" /* SETUP_CODEQL_ACTION_HAS_RUN */] === "true") { diff --git a/src/config/file.test.ts b/src/config/file.test.ts index 22e2f795f8..17ac21d565 100644 --- a/src/config/file.test.ts +++ b/src/config/file.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import test from "ava"; import sinon from "sinon"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import { RegistryProxyVars } from "../environment"; import { Feature } from "../feature-flags"; @@ -18,7 +19,7 @@ setupTests(test); test("getConfigFileInput returns undefined by default", async (t) => { await callee(getConfigFileInput) - .withArgs({}) + .withArgs({}, undefined) .withFeatures([Feature.ConfigFileRepositoryProperty]) .passes(t.is, undefined); }); @@ -40,7 +41,7 @@ test("getConfigFileInput returns input value", async (t) => { .withArgs("config-file") .returns(testInput); }) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from workflow") .passes(t.is, testInput); }); @@ -49,16 +50,44 @@ test("getConfigFileInput returns repository property value", async (t) => { // Since there is no direct input, we should use the repository property. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .logs(t, "Using configuration file input from repository property") .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); }); +test("getConfigFileInput returns repository property value for Code Scanning", async (t) => { + // Since there is no direct input, we should use the repository property. + await callee(getConfigFileInput) + .withFeatures([Feature.ConfigFileRepositoryProperty]) + .withArgs(repositoryProperties, [AnalysisKind.CodeScanning]) + .logs(t, "Using configuration file input from repository property") + .passes(t.is, repositoryProperties[RepositoryPropertyName.CONFIG_FILE]); +}); + +test("getConfigFileInput ignores repository property for other analysis kinds", async (t) => { + const unsupportedCases = [ + [AnalysisKind.CodeQuality], + [AnalysisKind.RiskAssessment], + [AnalysisKind.CodeScanning, AnalysisKind.CodeQuality], + ]; + + const target = callee(getConfigFileInput).withFeatures([ + Feature.ConfigFileRepositoryProperty, + ]); + + for (const unsupportedCase of unsupportedCases) { + // Since the analysis kind is unsupported, we should ignore the repository property. + await target + .withArgs(repositoryProperties, unsupportedCase) + .passes(t.is, undefined); + } +}); + test("getConfigFileInput ignores empty repository property value", async (t) => { // Since the repository property value is an empty/whitespace string, we should ignore it. await callee(getConfigFileInput) .withFeatures([Feature.ConfigFileRepositoryProperty]) - .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }) + .withArgs({ [RepositoryPropertyName.CONFIG_FILE]: " " }, undefined) .passes(t.is, undefined); }); @@ -66,7 +95,7 @@ test("getConfigFileInput ignores repository property value when FF is off", asyn // Since the FF is off, we should ignore the repository property value. await callee(getConfigFileInput) .withFeatures([]) - .withArgs(repositoryProperties) + .withArgs(repositoryProperties, undefined) .notLogs(t, "Using configuration file input from repository property") .logs( t, diff --git a/src/config/file.ts b/src/config/file.ts index 8cb7bc3a11..9858328e11 100644 --- a/src/config/file.ts +++ b/src/config/file.ts @@ -1,4 +1,5 @@ import { ActionState } from "../action-common"; +import { AnalysisKind } from "../analyses"; import * as api from "../api-client"; import * as errorMessages from "../error-messages"; import { Feature } from "../feature-flags"; @@ -34,6 +35,7 @@ export async function getConfigFileInput( features, }: ActionState<["Logger", "Actions", "FeatureFlags"]>, repositoryProperties: Partial, + analysisKinds: AnalysisKind[] | undefined, ): Promise { const input = actions.getOptionalInput("config-file"); @@ -45,7 +47,19 @@ export async function getConfigFileInput( const propertyValue = repositoryProperties[RepositoryPropertyName.CONFIG_FILE]; - if (propertyValue !== undefined && propertyValue.trim().length > 0) { + // Only allow the repository property to be used for standard Code Scanning analyses, + // since we don't currently support some customisation options for Code Quality. + // We don't expect customisations for Risk Assessments either. + const analysisKindSupported = + analysisKinds === undefined || + (analysisKinds.includes(AnalysisKind.CodeScanning) && + analysisKinds.length === 1); + + if ( + analysisKindSupported && + propertyValue !== undefined && + propertyValue.trim().length > 0 + ) { // Only use the repository property value if the FF is enabled. const useRepositoryProperty = await features.getValue( Feature.ConfigFileRepositoryProperty, diff --git a/src/init-action.ts b/src/init-action.ts index ec7983b76c..4b52ba6ec6 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -289,6 +289,7 @@ async function run( configFile = await getConfigFileInput( actionStateWithFeatures, repositoryProperties, + analysisKinds, ); // Send a status report indicating that an analysis is starting. From 98c05a17d327d7c4055fca83114434ab56baacf6 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 11:51:13 +0100 Subject: [PATCH 056/155] Fix argument validation in `rollback-changelog.ts` Co-authored-by: Mads Navntoft --- pr-checks/rollback-changelog.ts | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/pr-checks/rollback-changelog.ts b/pr-checks/rollback-changelog.ts index 6f2edb4b94..15a37b1b7c 100755 --- a/pr-checks/rollback-changelog.ts +++ b/pr-checks/rollback-changelog.ts @@ -50,25 +50,16 @@ export function updateChangelog( function main() { try { - const { values } = parseArgs({ - options: { - "target-version": { - type: "string", - short: "t", - }, - "rollback-version": { - type: "string", - short: "r", - }, - "new-version": { - type: "string", - short: "n", - }, - }, - strict: true, - }); + const options = { + "target-version": { type: "string", short: "t" }, + "rollback-version": { type: "string", short: "r" }, + "new-version": { type: "string", short: "n" }, + } as const; - for (const [key, val] of Object.entries(values)) { + const { values } = parseArgs({ options, strict: true }); + + for (const key of Object.keys(options)) { + const val = values[key as keyof typeof values]; if (val === undefined || val.trim() === "") { throw new Error(`Argument '--${key}' is required.`); } From 2d4c474c2ca5ea2965b9e53fabb7b67b0100016c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 12:02:41 +0100 Subject: [PATCH 057/155] Log `!analysisKindSupported` case --- lib/entry-points.js | 8 ++++++-- src/config/file.test.ts | 4 ++++ src/config/file.ts | 12 ++++++------ 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 5904ad07ae..46c44a8183 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -148503,15 +148503,19 @@ async function getConfigFileInput({ } const propertyValue = repositoryProperties["github-codeql-config-file" /* CONFIG_FILE */]; const analysisKindSupported = analysisKinds === void 0 || analysisKinds.includes("code-scanning" /* CodeScanning */) && analysisKinds.length === 1; - if (analysisKindSupported && propertyValue !== void 0 && propertyValue.trim().length > 0) { + if (propertyValue !== void 0 && propertyValue.trim().length > 0) { const useRepositoryProperty = await features.getValue( "config_file_repository_property" /* ConfigFileRepositoryProperty */ ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}` ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind." + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled." diff --git a/src/config/file.test.ts b/src/config/file.test.ts index 17ac21d565..0833ad3d06 100644 --- a/src/config/file.test.ts +++ b/src/config/file.test.ts @@ -79,6 +79,10 @@ test("getConfigFileInput ignores repository property for other analysis kinds", // Since the analysis kind is unsupported, we should ignore the repository property. await target .withArgs(repositoryProperties, unsupportedCase) + .logs( + t, + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ) .passes(t.is, undefined); } }); diff --git a/src/config/file.ts b/src/config/file.ts index 9858328e11..be0e415a38 100644 --- a/src/config/file.ts +++ b/src/config/file.ts @@ -55,21 +55,21 @@ export async function getConfigFileInput( (analysisKinds.includes(AnalysisKind.CodeScanning) && analysisKinds.length === 1); - if ( - analysisKindSupported && - propertyValue !== undefined && - propertyValue.trim().length > 0 - ) { + if (propertyValue !== undefined && propertyValue.trim().length > 0) { // Only use the repository property value if the FF is enabled. const useRepositoryProperty = await features.getValue( Feature.ConfigFileRepositoryProperty, ); - if (useRepositoryProperty) { + if (analysisKindSupported && useRepositoryProperty) { logger.info( `Using configuration file input from repository property: ${propertyValue}`, ); return propertyValue; + } else if (!analysisKindSupported) { + logger.info( + "Ignoring configuration file input from repository property, because it is unsupported for the current analysis kind.", + ); } else { logger.info( "Ignoring configuration file input from repository property, because the corresponding feature flag is disabled.", From 1f9caf0118e0ac28ca8795236cb9d8db9c5c4658 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:37:01 +0100 Subject: [PATCH 058/155] Refactor `jobRunUuid` init into a function Use in `init` and `setup-codeql` actions --- lib/entry-points.js | 102 +++++++++++++++++++------------------ src/init-action.ts | 6 +-- src/setup-codeql-action.ts | 7 ++- src/status-report.ts | 13 +++++ 4 files changed, 70 insertions(+), 58 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 46c44a8183..287d8a127e 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145728,6 +145728,50 @@ function formatDuration(durationMs) { var os3 = __toESM(require("os")); var core7 = __toESM(require_core()); +// node_modules/uuid/dist-node/stringify.js +var byteToHex = []; +for (let i = 0; i < 256; ++i) { + byteToHex.push((i + 256).toString(16).slice(1)); +} +function unsafeStringify(arr, offset = 0) { + return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); +} + +// node_modules/uuid/dist-node/rng.js +var rnds8 = new Uint8Array(16); +function rng() { + return crypto.getRandomValues(rnds8); +} + +// node_modules/uuid/dist-node/v4.js +function v4(options, buf, offset) { + if (!buf && !options && crypto.randomUUID) { + return crypto.randomUUID(); + } + return _v4(options, buf, offset); +} +function _v4(options, buf, offset) { + options = options || {}; + const rnds = options.random ?? options.rng?.() ?? rng(); + if (rnds.length < 16) { + throw new Error("Random bytes length must be >= 16"); + } + rnds[6] = rnds[6] & 15 | 64; + rnds[8] = rnds[8] & 63 | 128; + if (buf) { + offset = offset || 0; + if (offset < 0 || offset + 16 > buf.length) { + throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); + } + for (let i = 0; i < 16; ++i) { + buf[offset + i] = rnds[i]; + } + return buf; + } + return unsafeStringify(rnds); +} +var v4_default = v4; + // src/api-client.ts var core5 = __toESM(require_core()); var githubUtils = __toESM(require_utils4()); @@ -146346,6 +146390,12 @@ function getDisplayActionName(actionName) { } return actionName; } +function getJobUUID(logger) { + const jobRunUuid = v4_default(); + logger.info(`Job run UUID is ${jobRunUuid}.`); + core7.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + return jobRunUuid; +} function isFirstPartyAnalysis(actionName) { if (actionName !== "upload-sarif" /* UploadSarif */) { return true; @@ -150068,50 +150118,6 @@ var toolcache3 = __toESM(require_tool_cache()); var import_fast_deep_equal = __toESM(require_fast_deep_equal()); var semver9 = __toESM(require_semver2()); -// node_modules/uuid/dist-node/stringify.js -var byteToHex = []; -for (let i = 0; i < 256; ++i) { - byteToHex.push((i + 256).toString(16).slice(1)); -} -function unsafeStringify(arr, offset = 0) { - return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); -} - -// node_modules/uuid/dist-node/rng.js -var rnds8 = new Uint8Array(16); -function rng() { - return crypto.getRandomValues(rnds8); -} - -// node_modules/uuid/dist-node/v4.js -function v4(options, buf, offset) { - if (!buf && !options && crypto.randomUUID) { - return crypto.randomUUID(); - } - return _v4(options, buf, offset); -} -function _v4(options, buf, offset) { - options = options || {}; - const rnds = options.random ?? options.rng?.() ?? rng(); - if (rnds.length < 16) { - throw new Error("Random bytes length must be >= 16"); - } - rnds[6] = rnds[6] & 15 | 64; - rnds[8] = rnds[8] & 63 | 128; - if (buf) { - offset = offset || 0; - if (offset < 0 || offset + 16 > buf.length) { - throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`); - } - for (let i = 0; i < 16; ++i) { - buf[offset + i] = rnds[i]; - } - return buf; - } - return unsafeStringify(rnds); -} -var v4_default = v4; - // src/overlay/caching.ts var fs10 = __toESM(require("fs")); var actionsCache3 = __toESM(require_cache4()); @@ -160751,9 +160757,7 @@ async function run3(actionState) { logger ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core21.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + getJobUUID(logger); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), @@ -161751,9 +161755,7 @@ async function run6(actionState) { ); const repositoryProperties = repositoryPropertiesResult.orElse({}); const actionStateWithFeatures = { ...actionState, features }; - const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core24.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + getJobUUID(logger); const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, "starting", diff --git a/src/init-action.ts b/src/init-action.ts index 4b52ba6ec6..a2ae0918be 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -4,7 +4,6 @@ import * as path from "path"; import * as core from "@actions/core"; import * as io from "@actions/io"; import * as semver from "semver"; -import { v4 as uuidV4 } from "uuid"; import { Action, ActionState, runInActions } from "./action-common"; import { @@ -69,6 +68,7 @@ import { createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, + getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -256,9 +256,7 @@ async function run( const repositoryProperties = repositoryPropertiesResult.orElse({}); // Create a unique identifier for this run. - const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + getJobUUID(logger); core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index b2a9e90f36..810931f672 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -1,5 +1,4 @@ import * as core from "@actions/core"; -import { v4 as uuidV4 } from "uuid"; import { Action, ActionState, runInActions } from "./action-common"; import { @@ -26,6 +25,7 @@ import { InitToolsDownloadFields, createStatusReportBase, getActionsStatus, + getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -140,9 +140,8 @@ async function run( const actionStateWithFeatures = { ...actionState, features }; - const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + // Create a unique identifier for this run. + getJobUUID(logger); const statusReportBase = await createStatusReportBase( ActionName.SetupCodeQL, diff --git a/src/status-report.ts b/src/status-report.ts index d9d2a7ba4c..13cfe8ac39 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -1,6 +1,7 @@ import * as os from "os"; import * as core from "@actions/core"; +import { v4 as uuidV4 } from "uuid"; import { getWorkflowEventName, @@ -59,6 +60,18 @@ export function getDisplayActionName(actionName: ActionName): string { return actionName; } +/** + * Creates a UUIDv4 for the analysis and returns it. + * The generated UUID is also exported as an environment variable. + */ +export function getJobUUID(logger: Logger) { + const jobRunUuid = uuidV4(); + logger.info(`Job run UUID is ${jobRunUuid}.`); + + core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + return jobRunUuid; +} + /** * @returns a boolean indicating whether the analysis is considered to be first party. * From c7ae51bb2daea524f6967b00fec6cceaa7b607b5 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:41:41 +0100 Subject: [PATCH 059/155] Make `ActionState` available and add test --- src/init-action.ts | 2 +- src/setup-codeql-action.ts | 4 ++-- src/status-report.test.ts | 9 +++++++++ src/status-report.ts | 5 +++-- 4 files changed, 15 insertions(+), 5 deletions(-) diff --git a/src/init-action.ts b/src/init-action.ts index a2ae0918be..f1c3916318 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -256,7 +256,7 @@ async function run( const repositoryProperties = repositoryPropertiesResult.orElse({}); // Create a unique identifier for this run. - getJobUUID(logger); + getJobUUID(actionState); core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index 810931f672..d2f8c6104b 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -95,7 +95,7 @@ async function sendCompletedStatusReport( /** The main behaviour of this action. */ async function run( - actionState: ActionState<["Base", "Logger", "Actions"]>, + actionState: ActionState<["Base", "Logger", "Env", "Actions"]>, ): Promise { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. @@ -141,7 +141,7 @@ async function run( const actionStateWithFeatures = { ...actionState, features }; // Create a unique identifier for this run. - getJobUUID(logger); + getJobUUID(actionState); const statusReportBase = await createStatusReportBase( ActionName.SetupCodeQL, diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9086dd34ef..0d8fe8108e 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -1,5 +1,6 @@ import test from "ava"; import * as sinon from "sinon"; +import * as uuid from "uuid"; import * as actionsUtil from "./actions-util"; import { Config } from "./config-utils"; @@ -12,6 +13,7 @@ import { createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, + getJobUUID, InitStatusReport, InitWithConfigStatusReport, } from "./status-report"; @@ -20,11 +22,18 @@ import { setupActionsVars, createTestConfig, makeMacro, + callee, } from "./testing-utils"; import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); +test("getJobUUID - generates valid UUIDs", async (t) => { + await callee(getJobUUID) + .withArgs() + .passes((val) => t.true(uuid.validate(val))); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", diff --git a/src/status-report.ts b/src/status-report.ts index 13cfe8ac39..08cb05ff93 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -3,6 +3,7 @@ import * as os from "os"; import * as core from "@actions/core"; import { v4 as uuidV4 } from "uuid"; +import type { ActionState } from "./action-common"; import { getWorkflowEventName, getOptionalInput, @@ -64,9 +65,9 @@ export function getDisplayActionName(actionName: ActionName): string { * Creates a UUIDv4 for the analysis and returns it. * The generated UUID is also exported as an environment variable. */ -export function getJobUUID(logger: Logger) { +export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { const jobRunUuid = uuidV4(); - logger.info(`Job run UUID is ${jobRunUuid}.`); + action.logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); return jobRunUuid; From 049af32c592249a000289bd518b3592923901db3 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:47:23 +0100 Subject: [PATCH 060/155] Allow `getJobUUID` to retrieve the UUID from the environment --- lib/entry-points.js | 38 ++++++++++++++++++++++++++------------ src/status-report.test.ts | 12 ++++++++++++ src/status-report.ts | 18 ++++++++++++++---- 3 files changed, 52 insertions(+), 16 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 287d8a127e..ade2488356 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -30477,7 +30477,7 @@ var require_validator = __commonJS({ Validator3.prototype.getSchema = function getSchema(urn) { return this.schemas[urn]; }; - Validator3.prototype.validate = function validate(instance, schema, options, ctx) { + Validator3.prototype.validate = function validate2(instance, schema, options, ctx) { if (typeof schema !== "boolean" && typeof schema !== "object" || schema === null) { throw new SchemaError("Expected `schema` to be an object or boolean"); } @@ -144595,24 +144595,24 @@ function isNumber(value) { function isStringOrUndefined(value) { return value === void 0 || isString(value); } -function defaultCheck(validate) { - return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); +function defaultCheck(validate2) { + return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate2(arg) }); } -function makeValidator(validate, required = true) { +function makeValidator(validate2, required = true) { return { - validate, - check: defaultCheck(validate), + validate: validate2, + check: defaultCheck(validate2), required }; } var string = makeValidator(isString); var number = makeValidator(isNumber); function array(validator) { - const validate = (val) => { + const validate2 = (val) => { return isArray(val) && val.every((e) => validator.validate(e)); }; return { - validate, + validate: validate2, check: (val, opts, path29) => { const result = successfulCheckSchema(); if (!isArray(val)) { @@ -145728,6 +145728,15 @@ function formatDuration(durationMs) { var os3 = __toESM(require("os")); var core7 = __toESM(require_core()); +// node_modules/uuid/dist-node/regex.js +var regex_default = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i; + +// node_modules/uuid/dist-node/validate.js +function validate(uuid) { + return typeof uuid === "string" && regex_default.test(uuid); +} +var validate_default = validate; + // node_modules/uuid/dist-node/stringify.js var byteToHex = []; for (let i = 0; i < 256; ++i) { @@ -146390,9 +146399,14 @@ function getDisplayActionName(actionName) { } return actionName; } -function getJobUUID(logger) { +function getJobUUID(action) { + const existingJobRunUuid = action.env.getOptional("JOB_RUN_UUID" /* JOB_RUN_UUID */); + if (existingJobRunUuid !== void 0 && validate_default(existingJobRunUuid)) { + action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); + return existingJobRunUuid; + } const jobRunUuid = v4_default(); - logger.info(`Job run UUID is ${jobRunUuid}.`); + action.logger.info(`Job run UUID is ${jobRunUuid}.`); core7.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); return jobRunUuid; } @@ -160757,7 +160771,7 @@ async function run3(actionState) { logger ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - getJobUUID(logger); + getJobUUID(actionState); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), @@ -161755,7 +161769,7 @@ async function run6(actionState) { ); const repositoryProperties = repositoryPropertiesResult.orElse({}); const actionStateWithFeatures = { ...actionState, features }; - getJobUUID(logger); + getJobUUID(actionState); const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, "starting", diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 0d8fe8108e..6f2c0164b1 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -31,9 +31,21 @@ setupTests(test); test("getJobUUID - generates valid UUIDs", async (t) => { await callee(getJobUUID) .withArgs() + .logs(t, "Job run UUID is ") .passes((val) => t.true(uuid.validate(val))); }); +test("getJobUUID - retrieves existing job UUIDs", async (t) => { + const existingJobUuid = uuid.v4(); + await callee(getJobUUID) + .withArgs() + .withEnv((env) => { + env.set(EnvVar.JOB_RUN_UUID, existingJobUuid); + }) + .logs(t, `Existing job run UUID is ${existingJobUuid}.`) + .passes(t.deepEqual, existingJobUuid); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", diff --git a/src/status-report.ts b/src/status-report.ts index 08cb05ff93..ae1e0172ce 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -1,7 +1,7 @@ import * as os from "os"; import * as core from "@actions/core"; -import { v4 as uuidV4 } from "uuid"; +import * as uuid from "uuid"; import type { ActionState } from "./action-common"; import { @@ -62,11 +62,21 @@ export function getDisplayActionName(actionName: ActionName): string { } /** - * Creates a UUIDv4 for the analysis and returns it. - * The generated UUID is also exported as an environment variable. + * Either creates a UUIDv4 for the analysis or retrieves an existing one from the + * environment and returns it. + * If a new UUID is generated, it is also exported as an environment variable. */ export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { - const jobRunUuid = uuidV4(); + // Check if we already have a UUID for the analysis and return it if so. + const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID); + + if (existingJobRunUuid !== undefined && uuid.validate(existingJobRunUuid)) { + action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); + return existingJobRunUuid; + } + + // Otherwise generate a new UUID. + const jobRunUuid = uuid.v4(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); From 766928d055114dfca04d7ad722bbc9fe4b928c3e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 18:50:56 +0100 Subject: [PATCH 061/155] Call `getJobUUID` in `start-proxy` The `start-proxy` step precedes `init` in Default Setup --- lib/entry-points.js | 5 +++++ src/start-proxy-action.ts | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index ade2488356..6eee65e05d 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -162645,6 +162645,11 @@ async function run7(startedAt) { let features; let language; try { + const action = { + logger, + env: new Env(process.env) + }; + getJobUUID(action); persistInputs(); const tempDir = getTemporaryDirectory(); const proxyLogFilePath = path28.resolve(tempDir, "proxy.log"); diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 3e376ec64f..9da2069df9 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -3,8 +3,10 @@ import * as path from "path"; import * as core from "@actions/core"; +import { ActionState } from "./action-common"; import * as actionsUtil from "./actions-util"; import { getGitHubVersion } from "./api-client"; +import { Env } from "./environment"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; import { getActionsLogger, Logger } from "./logging"; @@ -23,7 +25,11 @@ import { import { generateCertificateAuthority } from "./start-proxy/ca"; import { checkProxyEnvironment } from "./start-proxy/environment"; import { checkConnections } from "./start-proxy/reachability"; -import { ActionName, sendUnhandledErrorStatusReport } from "./status-report"; +import { + ActionName, + getJobUUID, + sendUnhandledErrorStatusReport, +} from "./status-report"; import * as util from "./util"; async function run(startedAt: Date) { @@ -35,6 +41,14 @@ async function run(startedAt: Date) { let language: BuiltInLanguage | undefined; try { + const action: ActionState<["Logger", "Env"]> = { + logger, + env: new Env(process.env), + }; + + // Create a unique identifier for this run. + getJobUUID(action); + // Make inputs accessible in the `post` step. actionsUtil.persistInputs(); From e9831f72a27e863fb32ccac5d65261114809b6fd Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 17:40:26 +0100 Subject: [PATCH 062/155] Add `getRequiredInput` to `ActionsEnv` --- lib/entry-points.js | 2 +- src/actions-util.ts | 3 ++- src/testing-utils.ts | 3 +++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 6eee65e05d..35a0b20922 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145383,7 +145383,7 @@ var Failure = class { // src/actions-util.ts function getActionsEnv() { - return { getOptionalInput }; + return { getRequiredInput, getOptionalInput }; } var getRequiredInput = function(name) { const value = core3.getInput(name); diff --git a/src/actions-util.ts b/src/actions-util.ts index 5fd1ebc4fe..6731f8ef4e 100644 --- a/src/actions-util.ts +++ b/src/actions-util.ts @@ -27,6 +27,7 @@ declare const __CODEQL_ACTION_VERSION__: string; * global functions in tests. */ export interface ActionsEnv { + getRequiredInput: (name: string) => string; getOptionalInput: (name: string) => string | undefined; } @@ -34,7 +35,7 @@ export interface ActionsEnv { * Gets the real `ActionsEnv` used by production code. */ export function getActionsEnv(): ActionsEnv { - return { getOptionalInput }; + return { getRequiredInput, getOptionalInput }; } /** diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 03354653ac..e4fb9adf6f 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -187,6 +187,9 @@ export function getTestEnv(testEnv: NodeJS.ProcessEnv = {}): Env { */ export function getTestActionsEnv(): ActionsEnv { return { + getRequiredInput: (name) => { + throw new Error(`Input required and not supplied: ${name}`); + }, getOptionalInput: () => undefined, }; } From 60834a0cd9645a12daf4e2e76f667afb0f4cbed2 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 24 Jul 2026 22:02:49 +0100 Subject: [PATCH 063/155] Add `exportVariable` to `ActionsEnv` --- lib/entry-points.js | 14 +++++++++----- src/actions-util.ts | 7 ++++++- src/testing-utils.ts | 1 + 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 35a0b20922..7ad13ddc55 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -21559,7 +21559,7 @@ var require_core = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.platform = exports2.toPlatformPath = exports2.toWin32Path = exports2.toPosixPath = exports2.markdownSummary = exports2.summary = exports2.ExitCode = void 0; - exports2.exportVariable = exportVariable15; + exports2.exportVariable = exportVariable16; exports2.setSecret = setSecret2; exports2.addPath = addPath2; exports2.getInput = getInput2; @@ -21591,7 +21591,7 @@ var require_core = __commonJS({ ExitCode2[ExitCode2["Success"] = 0] = "Success"; ExitCode2[ExitCode2["Failure"] = 1] = "Failure"; })(ExitCode || (exports2.ExitCode = ExitCode = {})); - function exportVariable15(name, val) { + function exportVariable16(name, val) { const convertedVal = (0, utils_1.toCommandValue)(val); process.env[name] = convertedVal; const filePath = process.env["GITHUB_ENV"] || ""; @@ -121026,7 +121026,7 @@ var require_core3 = __commonJS({ ExitCode2[ExitCode2["Success"] = 0] = "Success"; ExitCode2[ExitCode2["Failure"] = 1] = "Failure"; })(ExitCode || (exports2.ExitCode = ExitCode = {})); - function exportVariable15(name, val) { + function exportVariable16(name, val) { const convertedVal = (0, utils_1.toCommandValue)(val); process.env[name] = convertedVal; const filePath = process.env["GITHUB_ENV"] || ""; @@ -121035,7 +121035,7 @@ var require_core3 = __commonJS({ } (0, command_1.issueCommand)("set-env", { name }, convertedVal); } - exports2.exportVariable = exportVariable15; + exports2.exportVariable = exportVariable16; function setSecret2(secret) { (0, command_1.issueCommand)("add-mask", {}, secret); } @@ -145383,7 +145383,11 @@ var Failure = class { // src/actions-util.ts function getActionsEnv() { - return { getRequiredInput, getOptionalInput }; + return { + getRequiredInput, + getOptionalInput, + exportVariable: core3.exportVariable + }; } var getRequiredInput = function(name) { const value = core3.getInput(name); diff --git a/src/actions-util.ts b/src/actions-util.ts index 6731f8ef4e..dd5124620d 100644 --- a/src/actions-util.ts +++ b/src/actions-util.ts @@ -29,13 +29,18 @@ declare const __CODEQL_ACTION_VERSION__: string; export interface ActionsEnv { getRequiredInput: (name: string) => string; getOptionalInput: (name: string) => string | undefined; + exportVariable: (name: string, value: string) => void; } /** * Gets the real `ActionsEnv` used by production code. */ export function getActionsEnv(): ActionsEnv { - return { getRequiredInput, getOptionalInput }; + return { + getRequiredInput, + getOptionalInput, + exportVariable: core.exportVariable, + }; } /** diff --git a/src/testing-utils.ts b/src/testing-utils.ts index e4fb9adf6f..4402458d82 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -191,6 +191,7 @@ export function getTestActionsEnv(): ActionsEnv { throw new Error(`Input required and not supplied: ${name}`); }, getOptionalInput: () => undefined, + exportVariable: () => {}, }; } From e28cbacfa115612a23d42a9425bfa0aa072443df Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 19:13:35 +0100 Subject: [PATCH 064/155] Test that `getJobUUID` calls `exportVariable` --- lib/entry-points.js | 5 +++-- src/start-proxy-action.ts | 3 ++- src/status-report.test.ts | 14 +++++++++++++- src/status-report.ts | 6 ++++-- 4 files changed, 22 insertions(+), 6 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 7ad13ddc55..0bc32b8bfa 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146411,7 +146411,7 @@ function getJobUUID(action) { } const jobRunUuid = v4_default(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); - core7.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + action.actions.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); return jobRunUuid; } function isFirstPartyAnalysis(actionName) { @@ -162651,7 +162651,8 @@ async function run7(startedAt) { try { const action = { logger, - env: new Env(process.env) + env: new Env(process.env), + actions: getActionsEnv() }; getJobUUID(action); persistInputs(); diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 9da2069df9..ee587c04df 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -41,9 +41,10 @@ async function run(startedAt: Date) { let language: BuiltInLanguage | undefined; try { - const action: ActionState<["Logger", "Env"]> = { + const action: ActionState<["Logger", "Env", "Actions"]> = { logger, env: new Env(process.env), + actions: actionsUtil.getActionsEnv(), }; // Create a unique identifier for this run. diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 6f2c0164b1..efe272faeb 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -29,10 +29,22 @@ import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); test("getJobUUID - generates valid UUIDs", async (t) => { + const exportVariableStub: sinon.SinonStub<[string, string], void> = + sinon.stub(); + await callee(getJobUUID) .withArgs() + .withActions((env) => { + env.exportVariable = exportVariableStub; + }) .logs(t, "Job run UUID is ") - .passes((val) => t.true(uuid.validate(val))); + .passes((val) => { + t.true(uuid.validate(val)); + + const calls = exportVariableStub.getCalls(); + t.is(calls.length, 1); + t.deepEqual(calls[0].args, [EnvVar.JOB_RUN_UUID, val]); + }); }); test("getJobUUID - retrieves existing job UUIDs", async (t) => { diff --git a/src/status-report.ts b/src/status-report.ts index ae1e0172ce..69cac8a05d 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -66,7 +66,9 @@ export function getDisplayActionName(actionName: ActionName): string { * environment and returns it. * If a new UUID is generated, it is also exported as an environment variable. */ -export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { +export function getJobUUID( + action: ActionState<["Logger", "ReadOnlyEnv", "Actions"]>, +) { // Check if we already have a UUID for the analysis and return it if so. const existingJobRunUuid = action.env.getOptional(EnvVar.JOB_RUN_UUID); @@ -79,7 +81,7 @@ export function getJobUUID(action: ActionState<["Logger", "ReadOnlyEnv"]>) { const jobRunUuid = uuid.v4(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); - core.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); + action.actions.exportVariable(EnvVar.JOB_RUN_UUID, jobRunUuid); return jobRunUuid; } From 94a12eb6f6fa716ef39d1cd9c61231f08577b870 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 28 Jul 2026 19:14:57 +0100 Subject: [PATCH 065/155] Add a test for invalid values --- src/status-report.test.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/status-report.test.ts b/src/status-report.test.ts index efe272faeb..9d0c62efb1 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -58,6 +58,18 @@ test("getJobUUID - retrieves existing job UUIDs", async (t) => { .passes(t.deepEqual, existingJobUuid); }); +test("getJobUUID - doesn't retrieve invalid UUIDs", async (t) => { + const existingJobUuid = "not-a-uuid"; + await callee(getJobUUID) + .withArgs() + .withEnv((env) => { + env.set(EnvVar.JOB_RUN_UUID, existingJobUuid); + }) + .logs(t, `Job run UUID is `) + .notLogs(t, `Existing job run UUID is ${existingJobUuid}.`) + .passes(t.notDeepEqual, existingJobUuid); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", From 2e251072b0a905f36699df95f6deabbff6a6ec5a Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:19:14 +0100 Subject: [PATCH 066/155] Use `getEnv()` --- lib/entry-points.js | 2 +- src/start-proxy-action.ts | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0bc32b8bfa..0f35b11dfd 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -162651,7 +162651,7 @@ async function run7(startedAt) { try { const action = { logger, - env: new Env(process.env), + env: getEnv(), actions: getActionsEnv() }; getJobUUID(action); diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index ee587c04df..67f6d50177 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -6,7 +6,6 @@ import * as core from "@actions/core"; import { ActionState } from "./action-common"; import * as actionsUtil from "./actions-util"; import { getGitHubVersion } from "./api-client"; -import { Env } from "./environment"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; import { getActionsLogger, Logger } from "./logging"; @@ -43,7 +42,7 @@ async function run(startedAt: Date) { try { const action: ActionState<["Logger", "Env", "Actions"]> = { logger, - env: new Env(process.env), + env: util.getEnv(), actions: actionsUtil.getActionsEnv(), }; From de57c4a441d83a777b077184c67bfa79f5bd4457 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:38:08 +0100 Subject: [PATCH 067/155] Move `registry_types` to `StatusReportBase` --- src/start-proxy.ts | 8 +------- src/status-report.ts | 6 ++++++ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/start-proxy.ts b/src/start-proxy.ts index 74e0b498c4..caa1b3054a 100644 --- a/src/start-proxy.ts +++ b/src/start-proxy.ts @@ -83,12 +83,6 @@ export class StartProxyError extends Error { } } -interface StartProxyStatus extends StatusReportBase { - // A comma-separated list of registry types which are configured for CodeQL. - // This only includes registry types we support, not all that are configured. - registry_types: string; -} - /** * Sends a status report for the `start-proxy` action indicating a successful outcome. * @@ -112,7 +106,7 @@ export async function sendSuccessStatusReport( logger, ); if (statusReportBase !== undefined) { - const statusReport: StartProxyStatus = { + const statusReport: StatusReportBase = { ...statusReportBase, registry_types: registry_types.join(","), }; diff --git a/src/status-report.ts b/src/status-report.ts index d9d2a7ba4c..c61bbb828b 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -159,6 +159,12 @@ export interface StatusReportBase { ml_powered_javascript_queries?: string; /** Ref that the workflow was triggered on. */ ref: string; + /** + * A comma-separated list of private registry types which are configured for CodeQL. + * This only includes registry types we support (as determined by the `start-proxy` action), + * not all that are configured. + */ + registry_types?: string; /** Action runner hardware architecture (context runner.arch). */ runner_arch?: string; /** Available disk space on the runner, in bytes. */ From aac07d2a4154cf30c74193cd5c01955a5a0d817e Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:55:46 +0100 Subject: [PATCH 068/155] Include `registry_types` whenever `CODEQL_PROXY_URLS` is set --- lib/entry-points.js | 17 ++++++++++++++ src/status-report.test.ts | 47 ++++++++++++++++++++++++++++++++++++++- src/status-report.ts | 33 ++++++++++++++++++++++++++- 3 files changed, 95 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 46c44a8183..24a7eb5c70 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146396,6 +146396,22 @@ function setJobStatusIfUnsuccessful(actionStatus) { ); } } +function getRegistryTypesFromEnv(logger, env = getEnv()) { + const value = env.getOptional("CODEQL_PROXY_URLS" /* PROXY_URLS */); + if (value === void 0) { + return void 0; + } + try { + const data = JSON.parse(value); + const types2 = new Set(data.map((r) => r.type)); + return Array.from(types2).sort().join(","); + } catch (err) { + logger.debug( + `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' containing '${value}': ${getErrorMessage(err)}.` + ); + return void 0; + } +} async function createStatusReportBase(actionName, status, actionStartedAt, config, diskInfo, logger, cause, exception) { try { const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || ""; @@ -146435,6 +146451,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi job_name: jobName, job_run_uuid: jobRunUUID, ref, + registry_types: getRegistryTypesFromEnv(logger), runner_os: runnerOs, started_at: workflowStartedAt, status, diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9086dd34ef..d8ce1b40b4 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -3,15 +3,17 @@ import * as sinon from "sinon"; import * as actionsUtil from "./actions-util"; import { Config } from "./config-utils"; -import { EnvVar } from "./environment"; +import { EnvVar, RegistryProxyVars } from "./environment"; import { BuiltInLanguage } from "./languages"; import { getRunnerLogger } from "./logging"; import { ToolsSource } from "./setup-codeql"; +import type { Registry } from "./start-proxy"; import { ActionName, createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, + getRegistryTypesFromEnv, InitStatusReport, InitWithConfigStatusReport, } from "./status-report"; @@ -20,11 +22,54 @@ import { setupActionsVars, createTestConfig, makeMacro, + getTestEnv, + RecordingLogger, } from "./testing-utils"; import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); +test("getRegistryTypesFromEnv - gets unique registry types from environment", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ + [RegistryProxyVars.PROXY_URLS]: JSON.stringify([ + { type: "git_source", url: "https://example.com" }, + { type: "git_source", url: "https://github.com" }, + { type: "docker_registry", url: "https://registry.example.com" }, + ] satisfies Array>), + }); + + const result = getRegistryTypesFromEnv(logger, env); + t.deepEqual(result, ["git_source", "docker_registry"].sort().join(",")); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is not set", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({}); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is not valid JSON", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ [RegistryProxyVars.PROXY_URLS]: "[" }); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + +test("getRegistryTypesFromEnv - returns undefined if the env var is unexpected JSON", async (t) => { + const logger = new RecordingLogger(true); + const env = getTestEnv({ + // Top-level object rather than an array of objects. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }), + }); + + const result = getRegistryTypesFromEnv(logger, env); + t.is(result, undefined); +}); + function setupEnvironmentAndStub(tmpDir: string) { setupActionsVars(tmpDir, tmpDir, { GITHUB_EVENT_NAME: "dynamic", diff --git a/src/status-report.ts b/src/status-report.ts index c61bbb828b..5778081153 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -17,12 +17,13 @@ import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; -import { EnvVar } from "./environment"; +import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment"; import { getRef } from "./git-utils"; import type { Logger } from "./logging"; import type { OverlayBaseDatabaseDownloadStats } from "./overlay/caching"; import { getRepositoryNwo } from "./repository"; import type { ToolsSource } from "./setup-codeql"; +import type { Registry } from "./start-proxy"; import { ConfigurationError, getRequiredEnvParam, @@ -268,6 +269,35 @@ export interface EventReport { started_at: string; } +/** + * Attempts to retrieve a list of private registry types from the `CODEQL_PROXY_URLS` environment + * variable and returns it as a comma-separated string if successful. Returns `undefined` otherwise. + */ +export function getRegistryTypesFromEnv( + logger: Logger, + env: ReadOnlyEnv = getEnv(), +): string | undefined { + // Try to get the value of the environment variable. + const value = env.getOptional(RegistryProxyVars.PROXY_URLS); + + if (value === undefined) { + return undefined; + } + + // Try to parse the JSON we expect to find in it and return the comma-separated list of + // (unique) registry types. + try { + const data = JSON.parse(value) as Registry[]; + const types = new Set(data.map((r) => r.type)); + return Array.from(types).sort().join(","); + } catch (err) { + logger.debug( + `Failed to parse '${RegistryProxyVars.PROXY_URLS}' containing '${value}': ${getErrorMessage(err)}.`, + ); + return undefined; + } +} + /** * Compose a StatusReport. * @@ -330,6 +360,7 @@ export async function createStatusReportBase( job_name: jobName, job_run_uuid: jobRunUUID, ref, + registry_types: getRegistryTypesFromEnv(logger), runner_os: runnerOs, started_at: workflowStartedAt, status, From eb692f8b49def92b0d25277bd2be0639251c8a81 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 10:57:52 +0100 Subject: [PATCH 069/155] Add check to `createStatusReportBase` test --- src/status-report.test.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/status-report.test.ts b/src/status-report.test.ts index d8ce1b40b4..9d3ce0f555 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -79,6 +79,9 @@ function setupEnvironmentAndStub(tmpDir: string) { process.env[EnvVar.ANALYSIS_KEY] = "analysis-key"; process.env["ImageVersion"] = "2023.05.19.1"; + process.env[RegistryProxyVars.PROXY_URLS] = JSON.stringify([ + { type: "maven_repository" }, + ] satisfies Array>); const getRequiredInput = sinon.stub(actionsUtil, "getRequiredInput"); getRequiredInput.withArgs("matrix").resolves("input/matrix"); @@ -122,6 +125,7 @@ test.serial("createStatusReportBase", async (t) => { t.is(typeof statusReport.job_run_uuid, "string"); t.is(statusReport.languages, "java,swift"); t.is(statusReport.ref, process.env["GITHUB_REF"]!); + t.is(statusReport.registry_types, "maven_repository"); t.is(statusReport.runner_available_disk_space_bytes, 100); t.is(statusReport.runner_image_version, process.env["ImageVersion"]); t.is(statusReport.runner_os, process.env["RUNNER_OS"]!); From e893985e8b57c9f9c845bc3320a4fb540653da70 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:19:21 +0100 Subject: [PATCH 070/155] Fix `makeValidator` returning `required: boolean` --- lib/entry-points.js | 4 ++-- src/json/index.ts | 7 ++----- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 24a7eb5c70..a69c9c02fd 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -144598,11 +144598,11 @@ function isStringOrUndefined(value) { function defaultCheck(validate) { return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); } -function makeValidator(validate, required = true) { +function makeValidator(validate) { return { validate, check: defaultCheck(validate), - required + required: true }; } var string = makeValidator(isString); diff --git a/src/json/index.ts b/src/json/index.ts index 78923f8bac..f040acc932 100644 --- a/src/json/index.ts +++ b/src/json/index.ts @@ -62,14 +62,11 @@ function defaultCheck( return (arg) => ({ unknownKeys: [], invalidKeys: [], valid: validate(arg) }); } -function makeValidator( - validate: (arg: unknown) => arg is T, - required: boolean = true, -) { +function makeValidator(validate: (arg: unknown) => arg is T) { return { validate, check: defaultCheck(validate), - required, + required: true, } as const satisfies Validator; } From 51d51e81216d2a2764c063e5c4ca37c12aa92eb9 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:19:57 +0100 Subject: [PATCH 071/155] Add `boolean` `Validator` to `json` module --- lib/entry-points.js | 8 ++++++-- src/json/index.ts | 8 ++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index a69c9c02fd..302bff49af 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -92812,10 +92812,10 @@ var require_util12 = __commonJS({ return objectToString(arg) === "[object Array]"; } exports2.isArray = isArray2; - function isBoolean(arg) { + function isBoolean2(arg) { return typeof arg === "boolean"; } - exports2.isBoolean = isBoolean; + exports2.isBoolean = isBoolean2; function isNull(arg) { return arg === null; } @@ -144592,6 +144592,9 @@ function isString(value) { function isNumber(value) { return typeof value === "number"; } +function isBoolean(value) { + return typeof value === "boolean"; +} function isStringOrUndefined(value) { return value === void 0 || isString(value); } @@ -144607,6 +144610,7 @@ function makeValidator(validate) { } var string = makeValidator(isString); var number = makeValidator(isNumber); +var boolean = makeValidator(isBoolean); function array(validator) { const validate = (val) => { return isArray(val) && val.every((e) => validator.validate(e)); diff --git a/src/json/index.ts b/src/json/index.ts index f040acc932..d3d3abac0c 100644 --- a/src/json/index.ts +++ b/src/json/index.ts @@ -35,6 +35,11 @@ export function isNumber(value: unknown): value is number { return typeof value === "number"; } +/** Asserts that `value` is a boolean. */ +export function isBoolean(value: unknown): value is boolean { + return typeof value === "boolean"; +} + /** Asserts that `value` is either a string or undefined. */ export function isStringOrUndefined( value: unknown, @@ -79,6 +84,9 @@ export const string = makeValidator(isString); /** A validator for number fields in schemas. */ export const number = makeValidator(isNumber); +/** A validator for boolean fields in schemas. */ +export const boolean = makeValidator(isBoolean); + /** A validator for arrays. */ export function array(validator: Validator) { const validate = (val: unknown) => { From e55a57b808525a6830cbf9c336f7ae221169a3a3 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:21:19 +0100 Subject: [PATCH 072/155] Add `RegistryBase` schema and type --- lib/entry-points.js | 6 ++++++ src/start-proxy/types.ts | 16 +++++++++++----- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 302bff49af..d52d8169cd 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -161989,6 +161989,12 @@ function credentialToStr(credential) { } return result; } +var registryBaseSchema = { + /** The type of the package registry. */ + type: string, + /** Whether the registry replaces the base registry for the ecosystem. */ + "replaces-base": optional(boolean) +}; function getAddressString(address) { if (address.url === void 0) { return address.host; diff --git a/src/start-proxy/types.ts b/src/start-proxy/types.ts index 13369edbfa..17803e9126 100644 --- a/src/start-proxy/types.ts +++ b/src/start-proxy/types.ts @@ -254,13 +254,19 @@ export function credentialToStr(credential: Credential): string { return result; } -/** A package registry is identified by its type and address. */ -export type Registry = { +/** The schema for `RegistryBase` objects. */ +export const registryBaseSchema = { /** The type of the package registry. */ - type: string; + type: json.string, /** Whether the registry replaces the base registry for the ecosystem. */ - "replaces-base"?: boolean; -} & Address; + "replaces-base": json.optional(json.boolean), +} as const satisfies json.Schema; + +/** Information about a registry, other than its address. */ +export type RegistryBase = json.FromSchema; + +/** A package registry is identified by its type and address. */ +export type Registry = RegistryBase & Address; // If a registry has an `url`, then that takes precedence over the `host` which may or may // not be defined. From 13d4882649ba1a2a6abb6c2303df10658daa41f7 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:35:46 +0100 Subject: [PATCH 073/155] Validate JSON more --- lib/entry-points.js | 316 ++++++++++++++++++++------------------ src/json/index.ts | 17 ++ src/status-report.test.ts | 26 +++- src/status-report.ts | 22 ++- 4 files changed, 222 insertions(+), 159 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index d52d8169cd..53b7f491af 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -96885,7 +96885,7 @@ var require_validators = __commonJS({ throw new ERR_INVALID_ARG_TYPE(name, "a dictionary", value); } }); - var validateArray = hideStackFrames((value, name, minLength = 0) => { + var validateArray2 = hideStackFrames((value, name, minLength = 0) => { if (!ArrayIsArray(value)) { throw new ERR_INVALID_ARG_TYPE(name, "Array", value); } @@ -96895,19 +96895,19 @@ var require_validators = __commonJS({ } }); function validateStringArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { validateString(value[i], `${name}[${i}]`); } } function validateBooleanArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { validateBoolean(value[i], `${name}[${i}]`); } } function validateAbortSignalArray(value, name) { - validateArray(value, name); + validateArray2(value, name); for (let i = 0; i < value.length; i++) { const signal = value[i]; const indexedName = `${name}[${i}]`; @@ -97003,7 +97003,7 @@ var require_validators = __commonJS({ isInt32, isUint32, parseFileMode, - validateArray, + validateArray: validateArray2, validateStringArray, validateBooleanArray, validateAbortSignalArray, @@ -144692,6 +144692,10 @@ function validateSchema(schema, obj) { const result = checkSchema(schema, obj, { failFast: true }); return result.valid; } +function validateArray(elementSchema, arr) { + const elementValidator = object(elementSchema); + return array(elementValidator).validate(arr); +} function successfulCheckSchema() { return { valid: true, @@ -146343,6 +146347,148 @@ async function getGeneratedFiles(workingDirectory) { return generatedFiles; } +// src/start-proxy/types.ts +var usernameSchema = { + /** The username needed to authenticate to the package registry, if any. */ + username: optionalOrNull(string) +}; +function hasUsername(config) { + return "username" in config; +} +var usernamePasswordSchema = { + /** The password needed to authenticate to the package registry, if any. */ + password: optionalOrNull(string), + ...usernameSchema +}; +function hasUsernameAndPassword(config) { + return hasUsername(config) && "password" in config; +} +var tokenSchema = { + /** The token needed to authenticate to the package registry, if any. */ + token: optionalOrNull(string), + ...usernameSchema +}; +function hasToken(config) { + return "token" in config; +} +function isToken(config) { + return "token" in config && validateSchema(tokenSchema, config); +} +var azureConfigSchema = { + "tenant-id": string, + "client-id": string +}; +function isAzureConfig(config) { + return validateSchema(azureConfigSchema, config); +} +var awsConfigSchema = { + "aws-region": string, + "account-id": string, + "role-name": string, + domain: string, + "domain-owner": string, + audience: optionalOrNull(string) +}; +function isAWSConfig(config) { + return validateSchema(awsConfigSchema, config); +} +var jfrogConfigSchema = { + "jfrog-oidc-provider-name": string, + audience: optionalOrNull(string), + "identity-mapping-name": optionalOrNull(string) +}; +function isJFrogConfig(config) { + return validateSchema(jfrogConfigSchema, config); +} +var cloudsmithConfigSchema = { + namespace: string, + "service-slug": string, + "api-host": string +}; +function isCloudsmithConfig(config) { + return validateSchema(cloudsmithConfigSchema, config); +} +var gcpConfigSchema = { + "workload-identity-provider": string, + "service-account": optionalOrNull(string), + audience: optionalOrNull(string) +}; +function isGCPConfig(config) { + return validateSchema(gcpConfigSchema, config); +} +var oidcSchemas = [ + { schema: azureConfigSchema, name: "Azure" }, + { schema: awsConfigSchema, name: "AWS" }, + { schema: jfrogConfigSchema, name: "JFrog" }, + { schema: cloudsmithConfigSchema, name: "Cloudsmith" }, + { schema: gcpConfigSchema, name: "GCP" } +]; +function credentialToStr(credential) { + let result = `Type: ${credential.type};`; + const appendIfDefined = (name, val) => { + if (isDefined2(val)) { + result += ` ${name}: ${val};`; + } + }; + appendIfDefined("Url", credential.url); + appendIfDefined("Host", credential.host); + if (hasUsername(credential)) { + appendIfDefined("Username", credential.username); + } + if ("password" in credential) { + appendIfDefined( + "Password", + isDefined2(credential.password) ? "***" : void 0 + ); + } + if (hasToken(credential)) { + appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0); + } + if (isAzureConfig(credential)) { + appendIfDefined("Tenant", credential["tenant-id"]); + appendIfDefined("Client", credential["client-id"]); + } else if (isAWSConfig(credential)) { + appendIfDefined("AWS Region", credential["aws-region"]); + appendIfDefined("AWS Account", credential["account-id"]); + appendIfDefined("AWS Role", credential["role-name"]); + appendIfDefined("AWS Domain", credential.domain); + appendIfDefined("AWS Domain Owner", credential["domain-owner"]); + appendIfDefined("AWS Audience", credential.audience); + } else if (isJFrogConfig(credential)) { + appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]); + appendIfDefined( + "JFrog Identity Mapping", + credential["identity-mapping-name"] + ); + appendIfDefined("JFrog Audience", credential.audience); + } else if (isCloudsmithConfig(credential)) { + appendIfDefined("Cloudsmith Namespace", credential.namespace); + appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]); + appendIfDefined("Cloudsmith API Host", credential["api-host"]); + } else if (isGCPConfig(credential)) { + appendIfDefined( + "GCP Workload Identity Provider", + credential["workload-identity-provider"] + ); + appendIfDefined("GCP Service Account", credential["service-account"]); + appendIfDefined("GCP Audience", credential.audience); + } + return result; +} +var registryBaseSchema = { + /** The type of the package registry. */ + type: string, + /** Whether the registry replaces the base registry for the ecosystem. */ + "replaces-base": optional(boolean) +}; +function getAddressString(address) { + if (address.url === void 0) { + return address.host; + } else { + return address.url; + } +} + // src/status-report.ts function getDisplayActionName(actionName) { if (actionName === "finish" /* Analyze */) { @@ -146407,11 +146553,23 @@ function getRegistryTypesFromEnv(logger, env = getEnv()) { } try { const data = JSON.parse(value); + if (!isArray(data)) { + logger.debug( + `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array, but got '${typeof data}'.` + ); + return void 0; + } + if (!validateArray(registryBaseSchema, data)) { + logger.debug( + `Expected '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' to contain a JSON array of registry objects, but got something else.` + ); + return void 0; + } const types2 = new Set(data.map((r) => r.type)); return Array.from(types2).sort().join(","); } catch (err) { logger.debug( - `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}' containing '${value}': ${getErrorMessage(err)}.` + `Failed to parse '${"CODEQL_PROXY_URLS" /* PROXY_URLS */}': ${getErrorMessage(err)}.` ); return void 0; } @@ -157400,7 +157558,7 @@ var import_async = __toESM(require_async(), 1); var import_path6 = require("path"); // node_modules/archiver/lib/error.js -var import_util33 = __toESM(require("util"), 1); +var import_util34 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157425,7 +157583,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util33.default.inherits(ArchiverError, Error); +import_util34.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -161861,148 +162019,6 @@ var path26 = __toESM(require("path")); var core26 = __toESM(require_core()); var toolcache4 = __toESM(require_tool_cache()); -// src/start-proxy/types.ts -var usernameSchema = { - /** The username needed to authenticate to the package registry, if any. */ - username: optionalOrNull(string) -}; -function hasUsername(config) { - return "username" in config; -} -var usernamePasswordSchema = { - /** The password needed to authenticate to the package registry, if any. */ - password: optionalOrNull(string), - ...usernameSchema -}; -function hasUsernameAndPassword(config) { - return hasUsername(config) && "password" in config; -} -var tokenSchema = { - /** The token needed to authenticate to the package registry, if any. */ - token: optionalOrNull(string), - ...usernameSchema -}; -function hasToken(config) { - return "token" in config; -} -function isToken(config) { - return "token" in config && validateSchema(tokenSchema, config); -} -var azureConfigSchema = { - "tenant-id": string, - "client-id": string -}; -function isAzureConfig(config) { - return validateSchema(azureConfigSchema, config); -} -var awsConfigSchema = { - "aws-region": string, - "account-id": string, - "role-name": string, - domain: string, - "domain-owner": string, - audience: optionalOrNull(string) -}; -function isAWSConfig(config) { - return validateSchema(awsConfigSchema, config); -} -var jfrogConfigSchema = { - "jfrog-oidc-provider-name": string, - audience: optionalOrNull(string), - "identity-mapping-name": optionalOrNull(string) -}; -function isJFrogConfig(config) { - return validateSchema(jfrogConfigSchema, config); -} -var cloudsmithConfigSchema = { - namespace: string, - "service-slug": string, - "api-host": string -}; -function isCloudsmithConfig(config) { - return validateSchema(cloudsmithConfigSchema, config); -} -var gcpConfigSchema = { - "workload-identity-provider": string, - "service-account": optionalOrNull(string), - audience: optionalOrNull(string) -}; -function isGCPConfig(config) { - return validateSchema(gcpConfigSchema, config); -} -var oidcSchemas = [ - { schema: azureConfigSchema, name: "Azure" }, - { schema: awsConfigSchema, name: "AWS" }, - { schema: jfrogConfigSchema, name: "JFrog" }, - { schema: cloudsmithConfigSchema, name: "Cloudsmith" }, - { schema: gcpConfigSchema, name: "GCP" } -]; -function credentialToStr(credential) { - let result = `Type: ${credential.type};`; - const appendIfDefined = (name, val) => { - if (isDefined2(val)) { - result += ` ${name}: ${val};`; - } - }; - appendIfDefined("Url", credential.url); - appendIfDefined("Host", credential.host); - if (hasUsername(credential)) { - appendIfDefined("Username", credential.username); - } - if ("password" in credential) { - appendIfDefined( - "Password", - isDefined2(credential.password) ? "***" : void 0 - ); - } - if (hasToken(credential)) { - appendIfDefined("Token", isDefined2(credential.token) ? "***" : void 0); - } - if (isAzureConfig(credential)) { - appendIfDefined("Tenant", credential["tenant-id"]); - appendIfDefined("Client", credential["client-id"]); - } else if (isAWSConfig(credential)) { - appendIfDefined("AWS Region", credential["aws-region"]); - appendIfDefined("AWS Account", credential["account-id"]); - appendIfDefined("AWS Role", credential["role-name"]); - appendIfDefined("AWS Domain", credential.domain); - appendIfDefined("AWS Domain Owner", credential["domain-owner"]); - appendIfDefined("AWS Audience", credential.audience); - } else if (isJFrogConfig(credential)) { - appendIfDefined("JFrog Provider", credential["jfrog-oidc-provider-name"]); - appendIfDefined( - "JFrog Identity Mapping", - credential["identity-mapping-name"] - ); - appendIfDefined("JFrog Audience", credential.audience); - } else if (isCloudsmithConfig(credential)) { - appendIfDefined("Cloudsmith Namespace", credential.namespace); - appendIfDefined("Cloudsmith Service Slug", credential["service-slug"]); - appendIfDefined("Cloudsmith API Host", credential["api-host"]); - } else if (isGCPConfig(credential)) { - appendIfDefined( - "GCP Workload Identity Provider", - credential["workload-identity-provider"] - ); - appendIfDefined("GCP Service Account", credential["service-account"]); - appendIfDefined("GCP Audience", credential.audience); - } - return result; -} -var registryBaseSchema = { - /** The type of the package registry. */ - type: string, - /** Whether the registry replaces the base registry for the ecosystem. */ - "replaces-base": optional(boolean) -}; -function getAddressString(address) { - if (address.url === void 0) { - return address.host; - } else { - return address.url; - } -} - // src/start-proxy/validation.ts var core25 = __toESM(require_core()); function cloneCredential(schema, obj) { diff --git a/src/json/index.ts b/src/json/index.ts index d3d3abac0c..d8764ec478 100644 --- a/src/json/index.ts +++ b/src/json/index.ts @@ -226,6 +226,23 @@ export function validateSchema< return result.valid; } +/** + * Validates that `arr` is an array whose elements satisfy at least `elementSchema`. + * Additional keys are accepted in each element. + * + * @param elementSchema The schema to validate the elements against. + * @param arr The array to validate. + * @returns Asserts that `arr` has elements of `schema`'s type if validation is successful. + */ +export function validateArray< + S extends Schema, + T extends UnvalidatedArray = Array>, +>(elementSchema: S, arr: UnvalidatedArray): arr is T { + const elementValidator = object(elementSchema); + + return array(elementValidator).validate(arr); +} + export interface CheckSchemaOptions { /** Whether to stop validation after the first error. */ failFast?: boolean; diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9d3ce0f555..917a2e4d8e 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -61,13 +61,27 @@ test("getRegistryTypesFromEnv - returns undefined if the env var is not valid JS test("getRegistryTypesFromEnv - returns undefined if the env var is unexpected JSON", async (t) => { const logger = new RecordingLogger(true); - const env = getTestEnv({ - // Top-level object rather than an array of objects. - [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }), - }); - const result = getRegistryTypesFromEnv(logger, env); - t.is(result, undefined); + t.is( + getRegistryTypesFromEnv( + logger, + getTestEnv({ + // Top-level object rather than an array of objects. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify({ type: "git_source" }), + }), + ), + undefined, + ); + t.is( + getRegistryTypesFromEnv( + logger, + getTestEnv({ + // Object has no "type" key. + [RegistryProxyVars.PROXY_URLS]: JSON.stringify([{}]), + }), + ), + undefined, + ); }); function setupEnvironmentAndStub(tmpDir: string) { diff --git a/src/status-report.ts b/src/status-report.ts index 5778081153..a6b263ee08 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -19,11 +19,12 @@ import type { DependencyCacheRestoreStatusReport } from "./dependency-caching"; import { DocUrl } from "./doc-url"; import { EnvVar, getEnv, ReadOnlyEnv, RegistryProxyVars } from "./environment"; import { getRef } from "./git-utils"; +import * as json from "./json"; import type { Logger } from "./logging"; import type { OverlayBaseDatabaseDownloadStats } from "./overlay/caching"; import { getRepositoryNwo } from "./repository"; import type { ToolsSource } from "./setup-codeql"; -import type { Registry } from "./start-proxy"; +import { registryBaseSchema } from "./start-proxy/types"; import { ConfigurationError, getRequiredEnvParam, @@ -287,12 +288,27 @@ export function getRegistryTypesFromEnv( // Try to parse the JSON we expect to find in it and return the comma-separated list of // (unique) registry types. try { - const data = JSON.parse(value) as Registry[]; + const data = JSON.parse(value) as unknown; + + // Check that the parsed JSON meets our expectations. + if (!json.isArray(data)) { + logger.debug( + `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array, but got '${typeof data}'.`, + ); + return undefined; + } + if (!json.validateArray(registryBaseSchema, data)) { + logger.debug( + `Expected '${RegistryProxyVars.PROXY_URLS}' to contain a JSON array of registry objects, but got something else.`, + ); + return undefined; + } + const types = new Set(data.map((r) => r.type)); return Array.from(types).sort().join(","); } catch (err) { logger.debug( - `Failed to parse '${RegistryProxyVars.PROXY_URLS}' containing '${value}': ${getErrorMessage(err)}.`, + `Failed to parse '${RegistryProxyVars.PROXY_URLS}': ${getErrorMessage(err)}.`, ); return undefined; } From 42a3b947902ef5aef0cda3594c9e0cb60f8f4820 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 11:58:44 +0100 Subject: [PATCH 074/155] Add `CODEQL_ACTION_` prefix to `JOB_RUN_UUID` --- .github/workflows/__job-run-uuid-sarif.yml | 4 ++-- lib/entry-points.js | 8 ++++---- pr-checks/checks/job-run-uuid-sarif.yml | 4 ++-- src/environment.ts | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/__job-run-uuid-sarif.yml b/.github/workflows/__job-run-uuid-sarif.yml index cd47fb577e..429a694947 100644 --- a/.github/workflows/__job-run-uuid-sarif.yml +++ b/.github/workflows/__job-run-uuid-sarif.yml @@ -71,8 +71,8 @@ jobs: run: | cd "$RUNNER_TEMP/results" actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif) - if [[ "$actual" != "$JOB_RUN_UUID" ]]; then - echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'." + if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then + echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'." exit 1 else echo "Found job run UUID '$actual'." diff --git a/lib/entry-points.js b/lib/entry-points.js index 0f35b11dfd..a2f6d22c52 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146404,14 +146404,14 @@ function getDisplayActionName(actionName) { return actionName; } function getJobUUID(action) { - const existingJobRunUuid = action.env.getOptional("JOB_RUN_UUID" /* JOB_RUN_UUID */); + const existingJobRunUuid = action.env.getOptional("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */); if (existingJobRunUuid !== void 0 && validate_default(existingJobRunUuid)) { action.logger.info(`Existing job run UUID is ${existingJobRunUuid}.`); return existingJobRunUuid; } const jobRunUuid = v4_default(); action.logger.info(`Job run UUID is ${jobRunUuid}.`); - action.actions.exportVariable("JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); + action.actions.exportVariable("CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */, jobRunUuid); return jobRunUuid; } function isFirstPartyAnalysis(actionName) { @@ -146468,7 +146468,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi try { const commitOid = getOptionalInput("sha") || process.env["GITHUB_SHA"] || ""; const ref = await getRef(); - const jobRunUUID = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */] || ""; + const jobRunUUID = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */] || ""; const workflowRunID = getWorkflowRunID(); const workflowRunAttempt = getWorkflowRunAttempt(); const workflowName = process.env["GITHUB_WORKFLOW"] || ""; @@ -152008,7 +152008,7 @@ function applyAutobuildAzurePipelinesTimeoutFix() { ].join(" "); } async function getJobRunUuidSarifOptions() { - const jobRunUuid = process.env["JOB_RUN_UUID" /* JOB_RUN_UUID */]; + const jobRunUuid = process.env["CODEQL_ACTION_JOB_RUN_UUID" /* JOB_RUN_UUID */]; return jobRunUuid ? [`--sarif-run-property=jobRunUuid=${jobRunUuid}`] : []; } diff --git a/pr-checks/checks/job-run-uuid-sarif.yml b/pr-checks/checks/job-run-uuid-sarif.yml index dc1dd02d43..b86725d944 100644 --- a/pr-checks/checks/job-run-uuid-sarif.yml +++ b/pr-checks/checks/job-run-uuid-sarif.yml @@ -21,8 +21,8 @@ steps: run: | cd "$RUNNER_TEMP/results" actual=$(jq -r '.runs[0].properties.jobRunUuid' javascript.sarif) - if [[ "$actual" != "$JOB_RUN_UUID" ]]; then - echo "Expected SARIF output to contain job run UUID '$JOB_RUN_UUID', but found '$actual'." + if [[ "$actual" != "$CODEQL_ACTION_JOB_RUN_UUID" ]]; then + echo "Expected SARIF output to contain job run UUID '$CODEQL_ACTION_JOB_RUN_UUID', but found '$actual'." exit 1 else echo "Found job run UUID '$actual'." diff --git a/src/environment.ts b/src/environment.ts index 1b00ab7cfb..fea553d602 100644 --- a/src/environment.ts +++ b/src/environment.ts @@ -88,7 +88,7 @@ export enum EnvVar { LOG_VERSION_DEPRECATION = "CODEQL_ACTION_DID_LOG_VERSION_DEPRECATION", /** UUID representing the current job run. */ - JOB_RUN_UUID = "JOB_RUN_UUID", + JOB_RUN_UUID = "CODEQL_ACTION_JOB_RUN_UUID", /** Status for the entire job, submitted to the status report in `init-post` */ JOB_STATUS = "CODEQL_ACTION_JOB_STATUS", From 3ca82bb259b52fe4d0f27055fa58f0fb99694b80 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 12:55:16 +0100 Subject: [PATCH 075/155] Change `withActions` to only allow mutations --- src/config/inputs.test.ts | 18 +++++------------- src/testing-utils.ts | 12 +++++------- 2 files changed, 10 insertions(+), 20 deletions(-) diff --git a/src/config/inputs.test.ts b/src/config/inputs.test.ts index a91dc258ea..851dd72e2f 100644 --- a/src/config/inputs.test.ts +++ b/src/config/inputs.test.ts @@ -1,7 +1,7 @@ import test from "ava"; import sinon from "sinon"; -import { getActionsEnv } from "../actions-util"; +import { ActionsEnv } from "../actions-util"; import { Feature } from "../feature-flags"; import { RepositoryPropertyName } from "../feature-flags/properties"; import { callee } from "../testing-utils"; @@ -22,32 +22,26 @@ const expectedRepositoryPropertyResult: ComputedInput = { value: "repo-property-input-value", }; -function stubGetToolsInput() { - const actions = getActionsEnv(); +function stubGetToolsInput(actions: ActionsEnv) { sinon .stub(actions, "getOptionalInput") .withArgs(InputName.Tools) .returns(expectedWorkflowResult.value); - return actions; } const workflowLogMessage = `Using ${InputName.Tools} input from workflow:`; test("getToolsInput - returns workflow input if available", async (t) => { - const actions = stubGetToolsInput(); - await callee(getToolsInput) - .withActions(actions) + .withActions(stubGetToolsInput) .withArgs({}) .logs(t, workflowLogMessage) .passes(t.deepEqual, expectedWorkflowResult); }); test("getToolsInput - returns repository property value if enforced", async (t) => { - const actions = stubGetToolsInput(); - const target = callee(getToolsInput) - .withActions(actions) + .withActions(stubGetToolsInput) .withArgs({ [RepositoryPropertyName.TOOLS]: `!${expectedRepositoryPropertyResult.value}`, }); @@ -65,10 +59,8 @@ test("getToolsInput - returns repository property value if enforced", async (t) }); test("getToolsInput - prefers workflow input", async (t) => { - const actions = stubGetToolsInput(); - const target = callee(getToolsInput) - .withActions(actions) + .withActions(stubGetToolsInput) .withArgs({ [RepositoryPropertyName.TOOLS]: expectedRepositoryPropertyResult.value, }); diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 4402458d82..553a775e93 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -228,7 +228,8 @@ type DelayedCheck< Fs extends ReadonlyArray, > = (env: Readonly>) => Promise; -export type ValueOrMutation = T | ((val: T) => void); +export type Mutation = (val: T) => void; +export type ValueOrMutation = T | Mutation; /** * Wraps a function that accepts an `ActionState` for testing in different environments. @@ -324,13 +325,10 @@ abstract class BaseEnvBuilder< return result; } - public withActions(arg: ValueOrMutation): this { + /** Applies `fn` to the `ActionsEnv`. */ + public withActions(fn: Mutation): this { const result = this.clone(); - if (typeof arg === "function") { - arg(result.state.actions); - } else { - result.state.actions = arg; - } + fn(result.state.actions); return result; } From 30c33c9286fa4a7c5325301b5a2aa0c5b67a51ec Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 12:56:51 +0100 Subject: [PATCH 076/155] Make results of function call available to delayed checks --- src/testing-utils.ts | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 553a775e93..d6fffb69b1 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -34,11 +34,14 @@ import { ActionName } from "./status-report"; import { DEFAULT_DEBUG_ARTIFACT_NAME, DEFAULT_DEBUG_DATABASE_NAME, + Failure, getEnv, GitHubVariant, GitHubVersion, HTTPError, resetCachedCodeQlVersion, + Result, + Success, } from "./util"; export const SAMPLE_DOTCOM_API_DETAILS = { @@ -226,7 +229,10 @@ type DelayedCheck< Args extends readonly any[], R, Fs extends ReadonlyArray, -> = (env: Readonly>) => Promise; +> = ( + env: Readonly>, + result: Result, ThrownError>, +) => Promise; export type Mutation = (val: T) => void; export type ValueOrMutation = T | Mutation; @@ -441,7 +447,7 @@ class CallableEnvBuilder< // Run other delayed checks. for (const delayedCheck of this.checks) { - await delayedCheck(this); + await delayedCheck(this, new Success(result)); } // Return the results of the function call and the main assertion. @@ -467,7 +473,7 @@ class CallableEnvBuilder< // Run other delayed checks. for (const delayedCheck of this.checks) { - await delayedCheck(this); + await delayedCheck(this, new Failure(error)); } // Return the error. From 36737508ece41f7da5ed9862108928b78f5c24ff Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 13:00:31 +0100 Subject: [PATCH 077/155] Add `Env`-backed `ActionsEnv` implementation for tests --- src/testing-utils.ts | 66 +++++++++++++++++++++++++++++++------------- 1 file changed, 47 insertions(+), 19 deletions(-) diff --git a/src/testing-utils.ts b/src/testing-utils.ts index d6fffb69b1..94c8435218 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -185,17 +185,32 @@ export function getTestEnv(testEnv: NodeJS.ProcessEnv = {}): Env { return getEnv(testEnv); } +/** An implementation of `ActionsEnv` for use in tests. */ +class TestActionsEnv implements ActionsEnv { + constructor(private readonly env: Env) {} + + public clone(env: Env): this { + return Object.create(this, { env: { value: env } }) as this; + } + + public getRequiredInput(name: string): string { + throw new Error(`Input required and not supplied: ${name}`); + } + + public getOptionalInput(_name: string): string | undefined { + return undefined; + } + + public exportVariable(name: string, value: string): void { + this.env.set(name, value); + } +} + /** * Gets an `ActionsEnv` instance for use in tests. */ -export function getTestActionsEnv(): ActionsEnv { - return { - getRequiredInput: (name) => { - throw new Error(`Input required and not supplied: ${name}`); - }, - getOptionalInput: () => undefined, - exportVariable: () => {}, - }; +export function getTestActionsEnv(env: Env): TestActionsEnv { + return new TestActionsEnv(env); } /** For testing purposes, we make all available state features accessible in `TestEnv`. */ @@ -213,12 +228,13 @@ type AllState = [ export function initAllState( overrides?: Partial>, ): ActionState { + const env = getTestEnv(); return { name: ActionName.Init, startedAt: new Date(), logger: new RecordingLogger(), - env: getTestEnv(), - actions: getTestActionsEnv(), + env, + actions: getTestActionsEnv(env), apiClient: github.getOctokit("123"), features: createFeatures([]), ...overrides, @@ -247,6 +263,7 @@ abstract class BaseEnvBuilder< > { protected readonly fn: (state: ActionState, ...args: Args) => R; private logger: RecordingLogger; + private actions: TestActionsEnv; protected state: ActionState; protected checks: Array>; @@ -256,15 +273,26 @@ abstract class BaseEnvBuilder< ) { this.fn = fn; this.logger = new RecordingLogger(); - this.state = - cloneFrom !== undefined - ? ({ - ...cloneFrom.state, - env: cloneFrom.state.env.clone(), - actions: Object.create(cloneFrom.state.actions), - logger: this.logger, - } satisfies ActionState) - : initAllState({ logger: this.logger }); + + if (cloneFrom !== undefined) { + const env = cloneFrom.state.env.clone(); + this.actions = cloneFrom.actions.clone(env); + this.state = { + ...cloneFrom.state, + env, + actions: this.actions, + logger: this.logger, + } satisfies ActionState; + } else { + const env = getTestEnv(); + this.actions = getTestActionsEnv(env); + this.state = initAllState({ + logger: this.logger, + env, + actions: this.actions, + }); + } + this.checks = [...(cloneFrom?.checks ?? [])]; } From da0c1901011e62af9c02aae8bf5b8885b11f7741 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 12:22:25 +0000 Subject: [PATCH 078/155] Update default bundle to codeql-bundle-v2.26.2 --- lib/defaults.json | 8 ++++---- lib/entry-points.js | 4 ++-- src/defaults.json | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/lib/defaults.json b/lib/defaults.json index 39ecfc35fa..558dce6e24 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.2", + "cliVersion": "2.26.2", + "priorBundleVersion": "codeql-bundle-v2.26.1", + "priorCliVersion": "2.26.1" } diff --git a/lib/entry-points.js b/lib/entry-points.js index 46c44a8183..eb81affd67 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146649,8 +146649,8 @@ var path5 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.26.1"; -var cliVersion = "2.26.1"; +var bundleVersion = "codeql-bundle-v2.26.2"; +var cliVersion = "2.26.2"; // src/overlay/index.ts var fs4 = __toESM(require("fs")); diff --git a/src/defaults.json b/src/defaults.json index 39ecfc35fa..558dce6e24 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.1", - "cliVersion": "2.26.1", - "priorBundleVersion": "codeql-bundle-v2.26.0", - "priorCliVersion": "2.26.0" + "bundleVersion": "codeql-bundle-v2.26.2", + "cliVersion": "2.26.2", + "priorBundleVersion": "codeql-bundle-v2.26.1", + "priorCliVersion": "2.26.1" } From c62d82468641dca0f8df108ab73e2a8407ac9cf7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 12:22:31 +0000 Subject: [PATCH 079/155] Add changelog note --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 170e03cc37..5fca32b978 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) +- Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) ## 4.37.3 - 22 Jul 2026 From d2f5cbbe919141b077e54396de7bb0c31da73912 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 13:22:46 +0100 Subject: [PATCH 080/155] Add `get` method to `ReadOnlyEnv` --- lib/entry-points.js | 4 ++++ src/environment.ts | 5 +++++ 2 files changed, 9 insertions(+) diff --git a/lib/entry-points.js b/lib/entry-points.js index a2f6d22c52..9a7fbaa8e2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -141565,6 +141565,10 @@ var ReadOnlyEnv = class { clone() { return Object.create(this, { vars: { value: { ...this.vars } } }); } + /** Gets a copy of the underlying environment. */ + get() { + return { ...this.vars }; + } /** Tries to get the value for `name` and throws if there isn't one. */ getRequired(name) { return getRequiredEnvVar(this.vars, name); diff --git a/src/environment.ts b/src/environment.ts index fea553d602..d6ff20391a 100644 --- a/src/environment.ts +++ b/src/environment.ts @@ -270,6 +270,11 @@ export class ReadOnlyEnv { return Object.create(this, { vars: { value: { ...this.vars } } }) as this; } + /** Gets a copy of the underlying environment. */ + public get(): Record { + return { ...this.vars }; + } + /** Tries to get the value for `name` and throws if there isn't one. */ public getRequired(name: string): string { return getRequiredEnvVar(this.vars, name); From 0cebd1d28d761cf2fceb2a3a9ed79dff79ea5a8c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 13:24:33 +0100 Subject: [PATCH 081/155] Add `hasEnv` delayed assertion and use for `getJobUUID` test --- src/status-report.test.ts | 15 +++++---------- src/testing-utils.ts | 22 ++++++++++++++++++++++ 2 files changed, 27 insertions(+), 10 deletions(-) diff --git a/src/status-report.test.ts b/src/status-report.test.ts index 9d0c62efb1..17490a60cb 100644 --- a/src/status-report.test.ts +++ b/src/status-report.test.ts @@ -29,21 +29,16 @@ import { BuildMode, ConfigurationError, withTmpDir, wrapError } from "./util"; setupTests(test); test("getJobUUID - generates valid UUIDs", async (t) => { - const exportVariableStub: sinon.SinonStub<[string, string], void> = - sinon.stub(); - await callee(getJobUUID) .withArgs() - .withActions((env) => { - env.exportVariable = exportVariableStub; - }) .logs(t, "Job run UUID is ") + .hasEnv(t, (val) => { + return { + [EnvVar.JOB_RUN_UUID]: val, + }; + }) .passes((val) => { t.true(uuid.validate(val)); - - const calls = exportVariableStub.getCalls(); - t.is(calls.length, 1); - t.deepEqual(calls[0].args, [EnvVar.JOB_RUN_UUID, val]); }); }); diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 94c8435218..279459275d 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -378,6 +378,28 @@ abstract class BaseEnvBuilder< return result; } + /** + * Adds a delayed check that the environment variables returned by `fn` + * are present in the environment after the main assertion passes. + */ + public hasEnv( + t: ExecutionContext, + fn: ( + value: Awaited | undefined, + error: ThrownError | undefined, + ) => Record, + ): this { + const result = this.clone(); + result.checks.push(async (env, r) => { + const value = r.orElse(undefined); + const error = r.isFailure() ? r.value : undefined; + const expected = fn(value, error); + + t.like(env.getState().env.get(), expected); + }); + return result; + } + /** * Adds a delayed check that `messages` are not logged. The check will be * performed after the main assertion passes. From b411bbcd4ad96437e66f359abc5b628477549c83 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 14:27:24 +0100 Subject: [PATCH 082/155] Move `getJobUUID` call into `runInActions` for `init` and `setup-codeql` --- lib/entry-points.js | 8 ++++---- src/action-common.ts | 10 ++++++++-- src/init-action.ts | 4 ---- src/setup-codeql-action.ts | 4 ---- 4 files changed, 12 insertions(+), 14 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 9a7fbaa8e2..c56f671098 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146700,13 +146700,15 @@ async function runInActions(action) { const env = getEnv(); const actionsEnv = getActionsEnv(); try { - await action.run({ + const actionState = { name: action.name, startedAt, logger, env, actions: actionsEnv - }); + }; + getJobUUID(actionState); + await action.run(actionState); } catch (error3) { core8.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error3)}` @@ -160779,7 +160781,6 @@ async function run3(actionState) { logger ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - getJobUUID(actionState); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); sourceRoot = path24.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), @@ -161777,7 +161778,6 @@ async function run6(actionState) { ); const repositoryProperties = repositoryPropertiesResult.orElse({}); const actionStateWithFeatures = { ...actionState, features }; - getJobUUID(actionState); const statusReportBase = await createStatusReportBase( "setup-codeql" /* SetupCodeQL */, "starting", diff --git a/src/action-common.ts b/src/action-common.ts index cbb1cd3422..be8629addf 100644 --- a/src/action-common.ts +++ b/src/action-common.ts @@ -8,6 +8,7 @@ import { getActionsLogger, Logger } from "./logging"; import { ActionName, getDisplayActionName, + getJobUUID, sendUnhandledErrorStatusReport, } from "./status-report"; import { getEnv, getErrorMessage } from "./util"; @@ -88,13 +89,18 @@ export async function runInActions(action: Action) { const actionsEnv = getActionsEnv(); try { - await action.run({ + const actionState = { name: action.name, startedAt, logger, env, actions: actionsEnv, - }); + }; + + // Create a unique identifier for this run. + getJobUUID(actionState); + + await action.run(actionState); } catch (error) { core.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error)}`, diff --git a/src/init-action.ts b/src/init-action.ts index f1c3916318..00143df427 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -68,7 +68,6 @@ import { createInitWithConfigStatusReport, createStatusReportBase, getActionsStatus, - getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -255,9 +254,6 @@ async function run( ); const repositoryProperties = repositoryPropertiesResult.orElse({}); - // Create a unique identifier for this run. - getJobUUID(actionState); - core.exportVariable(EnvVar.INIT_ACTION_HAS_RUN, "true"); // path.resolve() respects the intended semantics of source-root. If diff --git a/src/setup-codeql-action.ts b/src/setup-codeql-action.ts index d2f8c6104b..7873449f9c 100644 --- a/src/setup-codeql-action.ts +++ b/src/setup-codeql-action.ts @@ -25,7 +25,6 @@ import { InitToolsDownloadFields, createStatusReportBase, getActionsStatus, - getJobUUID, sendStatusReport, } from "./status-report"; import { ToolsDownloadStatusReport } from "./tools-download"; @@ -140,9 +139,6 @@ async function run( const actionStateWithFeatures = { ...actionState, features }; - // Create a unique identifier for this run. - getJobUUID(actionState); - const statusReportBase = await createStatusReportBase( ActionName.SetupCodeQL, "starting", From ba46ff760e2acb42dc881f443ad2bb3cd9de9d28 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 14:39:30 +0100 Subject: [PATCH 083/155] Add `transformTelemetryError` option to `Action` --- lib/entry-points.js | 8 +++++++- src/action-common.ts | 20 ++++++++++++++++++-- 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c56f671098..456ce1be7f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146713,7 +146713,13 @@ async function runInActions(action) { core8.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error3)}` ); - await sendUnhandledErrorStatusReport(action.name, startedAt, error3, logger); + const statusReportError = action.transformTelemetryError !== void 0 ? action.transformTelemetryError(wrapError(error3)) : error3; + await sendUnhandledErrorStatusReport( + action.name, + startedAt, + statusReportError, + logger + ); } } diff --git a/src/action-common.ts b/src/action-common.ts index be8629addf..95323e7f2a 100644 --- a/src/action-common.ts +++ b/src/action-common.ts @@ -11,7 +11,7 @@ import { getJobUUID, sendUnhandledErrorStatusReport, } from "./status-report"; -import { getEnv, getErrorMessage } from "./util"; +import { getEnv, getErrorMessage, wrapError } from "./util"; /** Base state that is available to an Action on startup. */ export interface BaseState { @@ -79,6 +79,12 @@ export interface Action { name: ActionName; /** The entry point for the Action. */ run: ActionMain; + /** + * An optional function that transforms a caught error into a message suitable for + * inclusion in a status report. This is primarily intended for the `start-proxy` + * action to replace the thrown `Error`'s message with a safe one. + */ + transformTelemetryError?: (error: Error) => string; } /** A generic entry point that sets up the basic environment for the `action` and runs it. */ @@ -105,6 +111,16 @@ export async function runInActions(action: Action) { core.setFailed( `${getDisplayActionName(action.name)} action failed: ${getErrorMessage(error)}`, ); - await sendUnhandledErrorStatusReport(action.name, startedAt, error, logger); + + const statusReportError = + action.transformTelemetryError !== undefined + ? action.transformTelemetryError(wrapError(error)) + : error; + await sendUnhandledErrorStatusReport( + action.name, + startedAt, + statusReportError, + logger, + ); } } From 8e6fdffc3205654e6d9f7e9a5976eaf55dee895b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 14:44:24 +0100 Subject: [PATCH 084/155] Use `runInActions` for `start-proxy` --- lib/entry-points.js | 38 +++++++++++-------------------- src/start-proxy-action.ts | 47 ++++++++++++--------------------------- 2 files changed, 27 insertions(+), 58 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 456ce1be7f..66e153b792 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -21567,7 +21567,7 @@ var require_core = __commonJS({ exports2.getBooleanInput = getBooleanInput; exports2.setOutput = setOutput7; exports2.setCommandEcho = setCommandEcho; - exports2.setFailed = setFailed13; + exports2.setFailed = setFailed12; exports2.isDebug = isDebug5; exports2.debug = debug6; exports2.error = error3; @@ -21651,7 +21651,7 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``); function setCommandEcho(enabled) { (0, command_1.issue)("echo", enabled ? "on" : "off"); } - function setFailed13(message) { + function setFailed12(message) { process.exitCode = ExitCode.Failure; error3(message); } @@ -121094,11 +121094,11 @@ Support boolean input list: \`true | True | TRUE | false | False | FALSE\``); (0, command_1.issue)("echo", enabled ? "on" : "off"); } exports2.setCommandEcho = setCommandEcho; - function setFailed13(message) { + function setFailed12(message) { process.exitCode = ExitCode.Failure; error3(message); } - exports2.setFailed = setFailed13; + exports2.setFailed = setFailed12; function isDebug5() { return process.env["RUNNER_DEBUG"] === "1"; } @@ -162654,17 +162654,12 @@ async function checkConnections(logger, proxy, backend) { } // src/start-proxy-action.ts -async function run7(startedAt) { - const logger = getActionsLogger(); +async function run7(action) { + const startedAt = action.startedAt; + const logger = action.logger; let features; let language; try { - const action = { - logger, - env: getEnv(), - actions: getActionsEnv() - }; - getJobUUID(action); persistInputs(); const tempDir = getTemporaryDirectory(); const proxyLogFilePath = path28.resolve(tempDir, "proxy.log"); @@ -162727,20 +162722,13 @@ async function run7(startedAt) { await sendFailedStatusReport(logger, startedAt, language, unwrappedError); } } +var startProxyAction = { + name: "start-proxy" /* StartProxy */, + run: run7, + transformTelemetryError: getSafeErrorMessage +}; async function runWrapper8() { - const startedAt = /* @__PURE__ */ new Date(); - const logger = getActionsLogger(); - try { - await run7(startedAt); - } catch (error3) { - core27.setFailed(`start-proxy action failed: ${getErrorMessage(error3)}`); - await sendUnhandledErrorStatusReport( - "start-proxy" /* StartProxy */, - startedAt, - getSafeErrorMessage(wrapError(error3)), - logger - ); - } + await runInActions(startProxyAction); } async function startProxy(binPath, config, logFilePath, logger) { const host = "127.0.0.1"; diff --git a/src/start-proxy-action.ts b/src/start-proxy-action.ts index 67f6d50177..e8b89732f7 100644 --- a/src/start-proxy-action.ts +++ b/src/start-proxy-action.ts @@ -3,12 +3,12 @@ import * as path from "path"; import * as core from "@actions/core"; -import { ActionState } from "./action-common"; +import { Action, ActionState, runInActions } from "./action-common"; import * as actionsUtil from "./actions-util"; import { getGitHubVersion } from "./api-client"; import { FeatureEnablement, initFeatures } from "./feature-flags"; import { BuiltInLanguage, parseBuiltInLanguage } from "./languages"; -import { getActionsLogger, Logger } from "./logging"; +import { Logger } from "./logging"; import { getRepositoryNwo } from "./repository"; import { credentialToStr, @@ -24,31 +24,18 @@ import { import { generateCertificateAuthority } from "./start-proxy/ca"; import { checkProxyEnvironment } from "./start-proxy/environment"; import { checkConnections } from "./start-proxy/reachability"; -import { - ActionName, - getJobUUID, - sendUnhandledErrorStatusReport, -} from "./status-report"; +import { ActionName } from "./status-report"; import * as util from "./util"; -async function run(startedAt: Date) { +async function run(action: ActionState<["Base", "Logger", "Env", "Actions"]>) { // To capture errors appropriately, keep as much code within the try-catch as // possible, and only use safe functions outside. - - const logger = getActionsLogger(); + const startedAt = action.startedAt; + const logger = action.logger; let features: FeatureEnablement | undefined; let language: BuiltInLanguage | undefined; try { - const action: ActionState<["Logger", "Env", "Actions"]> = { - logger, - env: util.getEnv(), - actions: actionsUtil.getActionsEnv(), - }; - - // Create a unique identifier for this run. - getJobUUID(action); - // Make inputs accessible in the `post` step. actionsUtil.persistInputs(); @@ -136,21 +123,15 @@ async function run(startedAt: Date) { } } -export async function runWrapper() { - const startedAt = new Date(); - const logger = getActionsLogger(); +/** Defines the `start-proxy` Action. */ +const startProxyAction: Action = { + name: ActionName.StartProxy, + run, + transformTelemetryError: getSafeErrorMessage, +}; - try { - await run(startedAt); - } catch (error) { - core.setFailed(`start-proxy action failed: ${util.getErrorMessage(error)}`); - await sendUnhandledErrorStatusReport( - ActionName.StartProxy, - startedAt, - getSafeErrorMessage(util.wrapError(error)), - logger, - ); - } +export async function runWrapper() { + await runInActions(startProxyAction); } async function startProxy( From e40d079dd9dd4a5c74f625cecd83867c8208aa71 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 14:37:39 +0000 Subject: [PATCH 085/155] Update changelog for v4.37.4 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5fca32b978..51bb95d5c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.4 - 29 Jul 2026 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) - Update default CodeQL bundle version to [2.26.2](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2). [#4051](https://github.com/github/codeql-action/pull/4051) From d57c3ffcba10414c396e4bc89f526c3875e18a0d Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 29 Jul 2026 15:38:27 +0100 Subject: [PATCH 086/155] Add tests for `runInActions` --- src/action-common.test.ts | 123 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 src/action-common.test.ts diff --git a/src/action-common.test.ts b/src/action-common.test.ts new file mode 100644 index 0000000000..fc2e0a9aaa --- /dev/null +++ b/src/action-common.test.ts @@ -0,0 +1,123 @@ +import * as core from "@actions/core"; +import test from "ava"; +import sinon from "sinon"; + +import * as common from "./action-common"; +import * as actionsUtil from "./actions-util"; +import * as environment from "./environment"; +import * as logging from "./logging"; +import { ActionName } from "./status-report"; +import * as statusReport from "./status-report"; +import { + getTestActionsEnv, + getTestEnv, + makeMacro, + RecordingLogger, + setupTests, +} from "./testing-utils"; +import { getErrorMessage } from "./util"; + +setupTests(test); + +interface RunInActionsTestOpts { + runFn?: () => Promise; + expectedErrorMessage?: string; + expectedTelemetryError?: string; +} + +const runInActionsMacro = makeMacro({ + exec: async (t, opts: RunInActionsTestOpts) => { + const expectFailure = opts?.expectedErrorMessage !== undefined; + + const logger = new RecordingLogger(); + const getActionsLogger = sinon + .stub(logging, "getActionsLogger") + .returns(logger); + + const env = getTestEnv(); + const getEnv = sinon.stub(environment, "getEnv").returns(env); + + const actionsEnv = getTestActionsEnv(env); + const getActionsEnv = sinon + .stub(actionsUtil, "getActionsEnv") + .returns(actionsEnv); + + const getJobUUID = sinon + .stub(statusReport, "getJobUUID") + .returns("test-job-uuid"); + + const setFailed = sinon.stub(core, "setFailed"); + const sendUnhandledErrorStatusReport = sinon.stub( + statusReport, + "sendUnhandledErrorStatusReport", + ); + + const name = ActionName.Init; + const run = sinon.stub(); + + if (opts?.runFn) { + run.callsFake(opts.runFn); + } + + const transformTelemetryError = sinon + .stub() + .callsFake((err) => opts?.expectedTelemetryError ?? getErrorMessage(err)); + const testAction: common.Action = { + name, + run, + transformTelemetryError, + }; + + await common.runInActions(testAction); + + // These always should have been called once. + t.true(getActionsLogger.calledOnce); + t.true(getEnv.calledOnce); + t.true(getActionsEnv.calledOnce); + + const expectedActionState = { + actions: actionsEnv, + env, + logger, + name: ActionName.Init, + }; + + t.true(getJobUUID.calledOnceWithExactly(sinon.match(expectedActionState))); + t.true(run.calledOnceWithExactly(sinon.match(expectedActionState))); + + t.is(setFailed.calledOnce, expectFailure ?? false); + t.is(sendUnhandledErrorStatusReport.calledOnce, expectFailure ?? false); + + if (expectFailure) { + t.true( + setFailed.calledOnceWithExactly( + `${statusReport.getDisplayActionName(name)} action failed: ${opts?.expectedErrorMessage}`, + ), + ); + t.true( + sendUnhandledErrorStatusReport.calledOnceWithExactly( + name, + sinon.match.any, + opts?.expectedTelemetryError ?? opts?.expectedErrorMessage, + logger, + ), + ); + } + }, + title: (providedTitle) => `runInActions - ${providedTitle}`, +}); + +runInActionsMacro.serial("calls run", {}); +runInActionsMacro.serial("handles run exceptions", { + runFn: () => { + throw new Error("Test failure"); + }, + expectedErrorMessage: "Test failure", +}); +runInActionsMacro.serial("transforms run exceptions", { + runFn: () => { + throw new Error("Test failure"); + }, + expectedErrorMessage: "Test failure", + expectedTelemetryError: "Transformed failure message", +}); From 8f0a4f23c4e6fd3bdc74965a57db44f356b5ee32 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 17:54:52 +0000 Subject: [PATCH 087/155] Bump the npm-minor group across 1 directory with 2 updates Bumps the npm-minor group with 2 updates in the / directory: [sinon](https://github.com/sinonjs/sinon) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `sinon` from 22.0.0 to 22.1.0 - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/CHANGES.md) - [Commits](https://github.com/sinonjs/sinon/compare/v22.0.0...v22.1.0) Updates `typescript-eslint` from 8.64.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: sinon dependency-version: 22.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 148 +++++++++++++++++++++++----------------------- package.json | 4 +- 2 files changed, 76 insertions(+), 76 deletions(-) diff --git a/package-lock.json b/package-lock.json index a01b4a12e7..1e395f75fb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -63,9 +63,9 @@ "glob": "^13.0.6", "globals": "^17.7.0", "nock": "^14.0.16", - "sinon": "^22.0.0", + "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.64.0" + "typescript-eslint": "^8.65.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -2591,17 +2591,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.64.0.tgz", - "integrity": "sha512-CGvQPBxN3wZLu6Rz2kFUpZeoCm78xUic92ck39KPePkO1NPOwjCqdQnm5Q87tpWw9vcBvW8XLrDXjH9PWYtJ3Q==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.65.0.tgz", + "integrity": "sha512-IEgob78X12rHpUmtcwFsXhZdVGJtwTVP8FiCLZkR6GlYVrl2PcuB+KhCE5BlVC/eQpQnu8WXRtkHZuPar+gCRA==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.64.0", - "@typescript-eslint/type-utils": "8.64.0", - "@typescript-eslint/utils": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0", + "@typescript-eslint/scope-manager": "8.65.0", + "@typescript-eslint/type-utils": "8.65.0", + "@typescript-eslint/utils": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2614,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.64.0", + "@typescript-eslint/parser": "^8.65.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2630,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.64.0.tgz", - "integrity": "sha512-KA0OshtlcCCXmbfqyZkM5pV3/WNraJf7DkJRLpyrmwPtud57H5BDX7C3k0LPSPxpprfRL+cJDGabF10mvNCoCw==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.65.0.tgz", + "integrity": "sha512-CZ4nMxWwgu1HEEFNkeaCptra9QCtkmKdgf3sWh1rl1trIhmxLilgTV4cwcbQ4wemnT4sWQN8CaKOmdYx+g2gMA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.64.0", - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0", + "@typescript-eslint/scope-manager": "8.65.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2673,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.64.0.tgz", - "integrity": "sha512-tk4WpOJ6IEbGrVHaNmM0YRrwAD3exZlIK3iadQNAxh4YKk6jvUQ4ecq18n+v7+meh+cJ3j+D8nbk8sRKhlwLQg==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.65.0.tgz", + "integrity": "sha512-SxnPhbTsGahizDgbu7oqFH/xVtzIqMd/s+WtnSxNxJZJpLbdT5IPdzg8EZxO3+PoKahXmwJLeNQOpKJb3/bi7Q==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.64.0", - "@typescript-eslint/types": "^8.64.0", + "@typescript-eslint/tsconfig-utils": "^8.65.0", + "@typescript-eslint/types": "^8.65.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2713,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.64.0.tgz", - "integrity": "sha512-CXEaFdYXjSTgKhisNkwCcJwTP8Pl+fmRrEQrri4nm3vU743bALrxzLmq7fHG/7e6a5xO0lDYeURpZmBuhHk54w==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.65.0.tgz", + "integrity": "sha512-Esbl8OSYiVxBokYgWPf7VVWg/BE798wXhimnn9ML9Pt5qoDf8bfQlgjlKXR/k98+AcNzlLKYrpCcrcuZ9DZLgg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0" + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2731,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.64.0.tgz", - "integrity": "sha512-2yo8rRNKuzbVWQp5kslhANqZ2uDAeROQHBRZNPu8JDsHmeFNj/XJJhX/FhNUWmkHHvoNsKa6+tHJiig87EzsQw==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.65.0.tgz", + "integrity": "sha512-j6GzGqCiRdA7Qhur2VVmKZAkBLfnHFQfx4TaJGL9RMveZqCo48jSHHO0DTgizEnGhtWnqmbtCUSrqSkdiY/0Hg==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2748,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.64.0.tgz", - "integrity": "sha512-XWG4Fmmv/6SvyS9nH8jWrKs6terwJvE8cyRt1CzYYqzp9OrPhCT4cMc/f7C6RZCwG+qMmiffJS1/qJP8G1URtg==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.65.0.tgz", + "integrity": "sha512-YjaZ7PRI5qY7ax2L3PbvX0rRyGtipAReCWs0mhhDBHjH/vl0g0BonaGXrKdKpMbIIsMIwDgbk/xzkBTyAltS5g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0", - "@typescript-eslint/utils": "8.64.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0", + "@typescript-eslint/utils": "8.65.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2791,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.64.0.tgz", - "integrity": "sha512-qjhfuTfLXjA4IOzXvz0rTjT01BqEiIgPoUeMwiEjnaHKJMTNo8rH5pYW1a2L/0Dnux2fPC85AeyJoWaGa8WxTA==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz", + "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2805,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.64.0.tgz", - "integrity": "sha512-Pztpsn1aCE1oWDvDEfUk31nngvvF7vUB5SwHFEaZIFpvw7WJtqUHHL4plBZDA9HfWJJjL13BdG0YrJInTUvoVA==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.65.0.tgz", + "integrity": "sha512-JboAE2swaYt4tb1fHhHTABE2K+OLy09XfcTbhnk4Pw96f9dd2e9iYsJ28gBggHlo5z5x1rkyWvcPoTuNTd4oGg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.64.0", - "@typescript-eslint/tsconfig-utils": "8.64.0", - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/visitor-keys": "8.64.0", + "@typescript-eslint/project-service": "8.65.0", + "@typescript-eslint/tsconfig-utils": "8.65.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/visitor-keys": "8.65.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2843,16 +2843,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.8", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", + "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/debug": { @@ -2874,13 +2874,13 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": { - "version": "10.2.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz", - "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==", + "version": "10.2.6", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz", + "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^5.0.5" + "brace-expansion": "^5.0.8" }, "engines": { "node": "18 || 20 || >=22" @@ -2890,16 +2890,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.64.0.tgz", - "integrity": "sha512-aJUGVB3+U0htrrCjoA8qukw8cm8fNCGAxK/tVoS70k8aeb7DETKeFozRiVFIwEeN9WJLsjaP3ph8I60tY2XZoQ==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.65.0.tgz", + "integrity": "sha512-gXiwIHsYreboxeJucHKPvgwl7dXt50mF8s1/c00cP/WoVTyWKFdtfhRWwZiXYFU5H2O8vVoSLNrexFZjYS/SGA==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.64.0", - "@typescript-eslint/types": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0" + "@typescript-eslint/scope-manager": "8.65.0", + "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +2914,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.64.0.tgz", - "integrity": "sha512-mrtuL8Nsn6gi2H4mo5KMTp823M+3Q19Ew/i+Zlikq20tIMm99C3Ez0dCmkWWnxut20esQvTg8aUSEhMcAOXhEw==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.65.0.tgz", + "integrity": "sha512-8C71BQkGjiMmXtop7pHVJu1l2NNShFdkCyD6a2ezzs5vU/L3LRtb69EtcteFwz0mYMPzIgOw0n6OV4VBUWZd7A==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.64.0", + "@typescript-eslint/types": "8.65.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -8556,9 +8556,9 @@ } }, "node_modules/sinon": { - "version": "22.0.0", - "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.0.0.tgz", - "integrity": "sha512-sq/6DpdXOrLyfbKlXLg/Usc7xu8YXPeLkOFZRvA3bNUSA2lhbrZ06yuXbH1fkzBPCbz9O10+7hznzUsjaYNm0Q==", + "version": "22.1.0", + "resolved": "https://registry.npmjs.org/sinon/-/sinon-22.1.0.tgz", + "integrity": "sha512-n1ajF2rBWMTtEwbKcw4UdFg4nCnDdq/U6RDoxtOd7oapOlRoJ5ynwFx60owROyhDpA9QhMZi0pCO/xtmwFjG7w==", "dev": true, "license": "BSD-3-Clause", "dependencies": { @@ -9320,16 +9320,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.64.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.64.0.tgz", - "integrity": "sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==", + "version": "8.65.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.65.0.tgz", + "integrity": "sha512-/ggrHAwyjENDusvyxbuqxAC2dTnZg/Z8F+fgQtYIz+L6n/9HfSlEZcFGV/NsMNa6CkGk0xUjUAFwC0vHOflvIA==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.64.0", - "@typescript-eslint/parser": "8.64.0", - "@typescript-eslint/typescript-estree": "8.64.0", - "@typescript-eslint/utils": "8.64.0" + "@typescript-eslint/eslint-plugin": "8.65.0", + "@typescript-eslint/parser": "8.65.0", + "@typescript-eslint/typescript-estree": "8.65.0", + "@typescript-eslint/utils": "8.65.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" diff --git a/package.json b/package.json index cdd58cd167..ad959a5eee 100644 --- a/package.json +++ b/package.json @@ -71,9 +71,9 @@ "glob": "^13.0.6", "globals": "^17.7.0", "nock": "^14.0.16", - "sinon": "^22.0.0", + "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.64.0" + "typescript-eslint": "^8.65.0" }, "overrides": { "@actions/tool-cache": { From 3502f795752239ff535bbb8c75134dce966e6700 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 17:57:26 +0000 Subject: [PATCH 088/155] Bump ruby/setup-ruby Bumps the actions-minor group with 1 update in the /.github/workflows directory: [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `ruby/setup-ruby` from 1.319.0 to 1.321.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](https://github.com/ruby/setup-ruby/compare/003a5c4d8d6321bd302e38f6f0ec593f77f06600...95ef2b042f9d7a56d8268cba8559e2842e2ad01b) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.321.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/__rubocop-multi-language.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/__rubocop-multi-language.yml b/.github/workflows/__rubocop-multi-language.yml index 4809b680ab..c405b44fed 100644 --- a/.github/workflows/__rubocop-multi-language.yml +++ b/.github/workflows/__rubocop-multi-language.yml @@ -54,7 +54,7 @@ jobs: use-all-platform-bundle: 'false' setup-kotlin: 'true' - name: Set up Ruby - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: 2.6 - name: Install Code Scanning integration From 60a57910be57f97ad7b63038a43680ac716a4039 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 17:59:24 +0000 Subject: [PATCH 089/155] Rebuild --- pr-checks/checks/rubocop-multi-language.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pr-checks/checks/rubocop-multi-language.yml b/pr-checks/checks/rubocop-multi-language.yml index 7879653f38..37c5d36e90 100644 --- a/pr-checks/checks/rubocop-multi-language.yml +++ b/pr-checks/checks/rubocop-multi-language.yml @@ -5,7 +5,7 @@ versions: - default steps: - name: Set up Ruby - uses: ruby/setup-ruby@003a5c4d8d6321bd302e38f6f0ec593f77f06600 # v1.319.0 + uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0 with: ruby-version: 2.6 - name: Install Code Scanning integration From 82f035a50156142187b47d8eb748075dbde92426 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 30 Jul 2026 09:21:21 +0000 Subject: [PATCH 090/155] Update changelog and version after v4.37.4 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 51bb95d5c8..65cd1e1fae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.4 - 29 Jul 2026 - This version of the CodeQL Action adds support for the `tools` input for the `codeql-action/init` step to be specified using a `github-codeql-tools` [repository property](https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization). This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to `toolcache` to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for `tools` in the workflow definition always takes precedence unless the value of the repository property starts with `!`. [#4037](https://github.com/github/codeql-action/pull/4037) diff --git a/package-lock.json b/package-lock.json index a01b4a12e7..b72c91e22b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.4", + "version": "4.37.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.4", + "version": "4.37.5", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index cdd58cd167..8b379f9c9c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.4", + "version": "4.37.5", "private": true, "description": "CodeQL action", "scripts": { From 06f1d4ffed243918940368743ff3fd9147859de6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 30 Jul 2026 09:21:35 +0000 Subject: [PATCH 091/155] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index eb81affd67..17f56246ae 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145404,7 +145404,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.4"; + return "4.37.5"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 2d3b351ea6452a9b21346f8d64567e5b833924de Mon Sep 17 00:00:00 2001 From: sim Date: Thu, 30 Jul 2026 18:47:27 +0100 Subject: [PATCH 092/155] Handle network errors when streaming the CodeQL bundle download A network error such as `ECONNRESET` while streaming the download and extraction of the CodeQL bundle terminated the `init` Action rather than falling back to downloading the bundle before extracting it, since no `error` listener was attached to the request returned by `https.get`. Also pipe the response into `tar` using `stream.pipeline` so that errors on the response itself are surfaced and `tar`'s standard input is closed, and abort the request if it stalls. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- lib/entry-points.js | 360 +++++++++++++++++++------------------ src/tar.test.ts | 33 ++++ src/tar.ts | 13 +- src/tools-download.test.ts | 37 ++++ src/tools-download.ts | 28 ++- 6 files changed, 290 insertions(+), 183 deletions(-) create mode 100644 src/tar.test.ts diff --git a/CHANGELOG.md b/CHANGELOG.md index 65cd1e1fae..c461878c51 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#3367](https://github.com/github/codeql-action/issues/3367) ## 4.37.4 - 29 Jul 2026 diff --git a/lib/entry-points.js b/lib/entry-points.js index 8bea6abaaf..a03519a725 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -7069,7 +7069,7 @@ var require_client_h2 = __commonJS({ "node_modules/undici/lib/dispatcher/client-h2.js"(exports2, module2) { "use strict"; var assert = require("node:assert"); - var { pipeline } = require("node:stream"); + var { pipeline: pipeline2 } = require("node:stream"); var util3 = require_util(); var { RequestContentLengthMismatchError, @@ -7516,7 +7516,7 @@ var require_client_h2 = __commonJS({ } function writeStream(abort, socket, expectsPayload, h2stream, body, client, request3, contentLength) { assert(contentLength !== 0 || client[kRunning] === 0, "stream body cannot be pipelined"); - const pipe = pipeline( + const pipe = pipeline2( body, h2stream, (err) => { @@ -10506,7 +10506,7 @@ var require_api_pipeline = __commonJS({ util3.destroy(ret, err); } }; - function pipeline(opts, handler2) { + function pipeline2(opts, handler2) { try { const pipelineHandler = new PipelineHandler(opts, handler2); this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler); @@ -10515,7 +10515,7 @@ var require_api_pipeline = __commonJS({ return new PassThrough3().destroy(err); } } - module2.exports = pipeline; + module2.exports = pipeline2; } }); @@ -13680,7 +13680,7 @@ var require_fetch = __commonJS({ subresourceSet } = require_constants3(); var EE = require("node:events"); - var { Readable: Readable3, pipeline, finished } = require("node:stream"); + var { Readable: Readable3, pipeline: pipeline2, finished } = require("node:stream"); var { addAbortListener, isErrored, isReadable, bufferToLowerCasedHeaderName } = require_util(); var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url(); var { getGlobalDispatcher } = require_global2(); @@ -14624,7 +14624,7 @@ var require_fetch = __commonJS({ status, statusText, headersList, - body: decoders.length ? pipeline(this.body, ...decoders, (err) => { + body: decoders.length ? pipeline2(this.body, ...decoders, (err) => { if (err) { this.onError(err); } @@ -18604,7 +18604,7 @@ ${value}`; var require_eventsource = __commonJS({ "node_modules/undici/lib/web/eventsource/eventsource.js"(exports2, module2) { "use strict"; - var { pipeline } = require("node:stream"); + var { pipeline: pipeline2 } = require("node:stream"); var { fetching } = require_fetch(); var { makeRequest } = require_request2(); var { webidl } = require_webidl(); @@ -18762,7 +18762,7 @@ var require_eventsource = __commonJS({ )); } }); - pipeline( + pipeline2( response.body.stream, eventSourceStream, (error3) => { @@ -32788,8 +32788,8 @@ var require_internal_hash_files = __commonJS({ continue; } const hash2 = crypto3.createHash("sha256"); - const pipeline = util3.promisify(stream2.pipeline); - yield pipeline(fs31.createReadStream(file), hash2); + const pipeline2 = util3.promisify(stream2.pipeline); + yield pipeline2(fs31.createReadStream(file), hash2); result.write(hash2.digest()); count++; if (!hasMatch) { @@ -35356,12 +35356,12 @@ var require_pipeline = __commonJS({ } sendRequest(httpClient, request3) { const policies = this.getOrderedPolicies(); - const pipeline = policies.reduceRight((next, policy) => { + const pipeline2 = policies.reduceRight((next, policy) => { return (req) => { return policy.sendRequest(req, next); }; }, (req) => httpClient.sendRequest(req)); - return pipeline(request3); + return pipeline2(request3); } getOrderedPolicies() { if (!this._orderedPolicies) { @@ -38488,26 +38488,26 @@ var require_createPipelineFromOptions = __commonJS({ var tlsPolicy_js_1 = require_tlsPolicy(); var multipartPolicy_js_1 = require_multipartPolicy(); function createPipelineFromOptions(options) { - const pipeline = (0, pipeline_js_1.createEmptyPipeline)(); + const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)(); if (checkEnvironment_js_1.isNodeLike) { if (options.agent) { - pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); + pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); } if (options.tlsOptions) { - pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); + pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); } - pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); - pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); + pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); + pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); } - pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); - pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); - pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); - pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); + pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); + pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); + pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); + pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); if (checkEnvironment_js_1.isNodeLike) { - pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); + pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); } - pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); - return pipeline; + pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); + return pipeline2; } } }); @@ -38729,21 +38729,21 @@ var require_clientHelpers = __commonJS({ var oauth2AuthenticationPolicy_js_1 = require_oauth2AuthenticationPolicy(); var cachedHttpClient; function createDefaultPipeline(options = {}) { - const pipeline = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options); - pipeline.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options)); + const pipeline2 = (0, createPipelineFromOptions_js_1.createPipelineFromOptions)(options); + pipeline2.addPolicy((0, apiVersionPolicy_js_1.apiVersionPolicy)(options)); const { credential, authSchemes, allowInsecureConnection } = options; if (credential) { if ((0, credentials_js_1.isApiKeyCredential)(credential)) { - pipeline.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, apiKeyAuthenticationPolicy_js_1.apiKeyAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isBasicCredential)(credential)) { - pipeline.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, basicAuthenticationPolicy_js_1.basicAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isBearerTokenCredential)(credential)) { - pipeline.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, bearerAuthenticationPolicy_js_1.bearerAuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } else if ((0, credentials_js_1.isOAuth2TokenCredential)(credential)) { - pipeline.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); + pipeline2.addPolicy((0, oauth2AuthenticationPolicy_js_1.oauth2AuthenticationPolicy)({ authSchemes, credential, allowInsecureConnection })); } } - return pipeline; + return pipeline2; } function getCachedDefaultHttpsClient() { if (!cachedHttpClient) { @@ -38879,11 +38879,11 @@ var require_sendRequest = __commonJS({ var clientHelpers_js_1 = require_clientHelpers(); var typeGuards_js_1 = require_typeGuards(); var multipart_js_1 = require_multipart(); - async function sendRequest(method, url2, pipeline, options = {}, customHttpClient) { + async function sendRequest(method, url2, pipeline2, options = {}, customHttpClient) { const httpClient = customHttpClient ?? (0, clientHelpers_js_1.getCachedDefaultHttpsClient)(); const request3 = buildPipelineRequest(method, url2, options); try { - const response = await pipeline.sendRequest(httpClient, request3); + const response = await pipeline2.sendRequest(httpClient, request3); const headers = response.headers.toJSON(); const stream2 = response.readableStreamBody ?? response.browserStreamBody; const parsedBody = options.responseAsStream || stream2 !== void 0 ? void 0 : getResponseBody(response); @@ -39146,11 +39146,11 @@ var require_getClient = __commonJS({ var urlHelpers_js_1 = require_urlHelpers(); var checkEnvironment_js_1 = require_checkEnvironment(); function getClient(endpoint2, clientOptions = {}) { - const pipeline = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions); + const pipeline2 = clientOptions.pipeline ?? (0, clientHelpers_js_1.createDefaultPipeline)(clientOptions); if (clientOptions.additionalPolicies?.length) { for (const { policy, position } of clientOptions.additionalPolicies) { const afterPhase = position === "perRetry" ? "Sign" : void 0; - pipeline.addPolicy(policy, { + pipeline2.addPolicy(policy, { afterPhase }); } @@ -39161,53 +39161,53 @@ var require_getClient = __commonJS({ const getUrl = (requestOptions) => (0, urlHelpers_js_1.buildRequestUrl)(endpointUrl, path29, args, { allowInsecureConnection, ...requestOptions }); return { get: (requestOptions = {}) => { - return buildOperation("GET", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("GET", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, post: (requestOptions = {}) => { - return buildOperation("POST", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("POST", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, put: (requestOptions = {}) => { - return buildOperation("PUT", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("PUT", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, patch: (requestOptions = {}) => { - return buildOperation("PATCH", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("PATCH", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, delete: (requestOptions = {}) => { - return buildOperation("DELETE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("DELETE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, head: (requestOptions = {}) => { - return buildOperation("HEAD", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("HEAD", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, options: (requestOptions = {}) => { - return buildOperation("OPTIONS", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("OPTIONS", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); }, trace: (requestOptions = {}) => { - return buildOperation("TRACE", getUrl(requestOptions), pipeline, requestOptions, allowInsecureConnection, httpClient); + return buildOperation("TRACE", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); } }; }; return { path: client, pathUnchecked: client, - pipeline + pipeline: pipeline2 }; } - function buildOperation(method, url2, pipeline, options, allowInsecureConnection, httpClient) { + function buildOperation(method, url2, pipeline2, options, allowInsecureConnection, httpClient) { allowInsecureConnection = options.allowInsecureConnection ?? allowInsecureConnection; return { then: function(onFulfilled, onrejected) { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection }, httpClient).then(onFulfilled, onrejected); }, async asBrowserStream() { if (checkEnvironment_js_1.isNodeLike) { throw new Error("`asBrowserStream` is supported only in the browser environment. Use `asNodeStream` instead to obtain the response body stream. If you require a Web stream of the response in Node, consider using `Readable.toWeb` on the result of `asNodeStream`."); } else { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); } }, async asNodeStream() { if (checkEnvironment_js_1.isNodeLike) { - return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); + return (0, sendRequest_js_1.sendRequest)(method, url2, pipeline2, { ...options, allowInsecureConnection, responseAsStream: true }, httpClient); } else { throw new Error("`isNodeStream` is not supported in the browser environment. Use `asBrowserStream` to obtain the response body stream."); } @@ -40697,31 +40697,31 @@ var require_createPipelineFromOptions2 = __commonJS({ var tracingPolicy_js_1 = require_tracingPolicy(); var wrapAbortSignalLikePolicy_js_1 = require_wrapAbortSignalLikePolicy(); function createPipelineFromOptions(options) { - const pipeline = (0, pipeline_js_1.createEmptyPipeline)(); + const pipeline2 = (0, pipeline_js_1.createEmptyPipeline)(); if (core_util_1.isNodeLike) { if (options.agent) { - pipeline.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); + pipeline2.addPolicy((0, agentPolicy_js_1.agentPolicy)(options.agent)); } if (options.tlsOptions) { - pipeline.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); - } - pipeline.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); - pipeline.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); - } - pipeline.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)()); - pipeline.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); - pipeline.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); - pipeline.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName)); - pipeline.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); - pipeline.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); - pipeline.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), { + pipeline2.addPolicy((0, tlsPolicy_js_1.tlsPolicy)(options.tlsOptions)); + } + pipeline2.addPolicy((0, proxyPolicy_js_1.proxyPolicy)(options.proxyOptions)); + pipeline2.addPolicy((0, decompressResponsePolicy_js_1.decompressResponsePolicy)()); + } + pipeline2.addPolicy((0, wrapAbortSignalLikePolicy_js_1.wrapAbortSignalLikePolicy)()); + pipeline2.addPolicy((0, formDataPolicy_js_1.formDataPolicy)(), { beforePolicies: [multipartPolicy_js_1.multipartPolicyName] }); + pipeline2.addPolicy((0, userAgentPolicy_js_1.userAgentPolicy)(options.userAgentOptions)); + pipeline2.addPolicy((0, setClientRequestIdPolicy_js_1.setClientRequestIdPolicy)(options.telemetryOptions?.clientRequestIdHeaderName)); + pipeline2.addPolicy((0, multipartPolicy_js_1.multipartPolicy)(), { afterPhase: "Deserialize" }); + pipeline2.addPolicy((0, defaultRetryPolicy_js_1.defaultRetryPolicy)(options.retryOptions), { phase: "Retry" }); + pipeline2.addPolicy((0, tracingPolicy_js_1.tracingPolicy)({ ...options.userAgentOptions, ...options.loggingOptions }), { afterPhase: "Retry" }); if (core_util_1.isNodeLike) { - pipeline.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); + pipeline2.addPolicy((0, redirectPolicy_js_1.redirectPolicy)(options.redirectOptions), { afterPhase: "Retry" }); } - pipeline.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); - return pipeline; + pipeline2.addPolicy((0, logPolicy_js_1.logPolicy)(options.loggingOptions), { afterPhase: "Sign" }); + return pipeline2; } } }); @@ -41635,8 +41635,8 @@ var require_disableKeepAlivePolicy = __commonJS({ } }; } - function pipelineContainsDisableKeepAlivePolicy(pipeline) { - return pipeline.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName); + function pipelineContainsDisableKeepAlivePolicy(pipeline2) { + return pipeline2.getOrderedPolicies().some((policy) => policy.name === exports2.disableKeepAlivePolicyName); } } }); @@ -42975,18 +42975,18 @@ var require_pipeline3 = __commonJS({ var core_rest_pipeline_1 = require_commonjs6(); var serializationPolicy_js_1 = require_serializationPolicy(); function createClientPipeline(options = {}) { - const pipeline = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {}); + const pipeline2 = (0, core_rest_pipeline_1.createPipelineFromOptions)(options ?? {}); if (options.credentialOptions) { - pipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ + pipeline2.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ credential: options.credentialOptions.credential, scopes: options.credentialOptions.credentialScopes })); } - pipeline.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" }); - pipeline.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), { + pipeline2.addPolicy((0, serializationPolicy_js_1.serializationPolicy)(options.serializationOptions), { phase: "Serialize" }); + pipeline2.addPolicy((0, deserializationPolicy_js_1.deserializationPolicy)(options.deserializationOptions), { phase: "Deserialize" }); - return pipeline; + return pipeline2; } } }); @@ -50204,11 +50204,11 @@ var require_Pipeline = __commonJS({ var StorageSharedKeyCredentialPolicyV2_js_1 = require_StorageSharedKeyCredentialPolicyV22(); var StorageBrowserPolicyFactory_js_1 = require_StorageBrowserPolicyFactory2(); var StorageCorrectContentLengthPolicy_js_1 = require_StorageCorrectContentLengthPolicy2(); - function isPipelineLike(pipeline) { - if (!pipeline || typeof pipeline !== "object") { + function isPipelineLike(pipeline2) { + if (!pipeline2 || typeof pipeline2 !== "object") { return false; } - const castPipeline = pipeline; + const castPipeline = pipeline2; return Array.isArray(castPipeline.factories) && typeof castPipeline.options === "object" && typeof castPipeline.toServiceClientOptions === "function"; } var Pipeline = class { @@ -50248,11 +50248,11 @@ var require_Pipeline = __commonJS({ if (!credential) { credential = new AnonymousCredential_js_1.AnonymousCredential(); } - const pipeline = new Pipeline([], pipelineOptions); - pipeline._credential = credential; - return pipeline; + const pipeline2 = new Pipeline([], pipelineOptions); + pipeline2._credential = credential; + return pipeline2; } - function processDownlevelPipeline(pipeline) { + function processDownlevelPipeline(pipeline2) { const knownFactoryFunctions = [ isAnonymousCredential, isStorageSharedKeyCredential, @@ -50262,8 +50262,8 @@ var require_Pipeline = __commonJS({ isStorageTelemetryPolicyFactory, isCoreHttpPolicyFactory ]; - if (pipeline.factories.length) { - const novelFactories = pipeline.factories.filter((factory) => { + if (pipeline2.factories.length) { + const novelFactories = pipeline2.factories.filter((factory) => { return !knownFactoryFunctions.some((knownFactory) => knownFactory(factory)); }); if (novelFactories.length) { @@ -50276,14 +50276,14 @@ var require_Pipeline = __commonJS({ } return void 0; } - function getCoreClientOptions(pipeline) { - const { httpClient: v1Client, ...restOptions } = pipeline.options; - let httpClient = pipeline._coreHttpClient; + function getCoreClientOptions(pipeline2) { + const { httpClient: v1Client, ...restOptions } = pipeline2.options; + let httpClient = pipeline2._coreHttpClient; if (!httpClient) { httpClient = v1Client ? (0, core_http_compat_1.convertHttpClient)(v1Client) : (0, storage_common_1.getCachedDefaultHttpClient)(); - pipeline._coreHttpClient = httpClient; + pipeline2._coreHttpClient = httpClient; } - let corePipeline = pipeline._corePipeline; + let corePipeline = pipeline2._corePipeline; if (!corePipeline) { const packageDetails = `azsdk-js-azure-storage-blob/${constants_js_1.SDK_VERSION}`; const userAgentPrefix = restOptions.userAgentOptions && restOptions.userAgentOptions.userAgentPrefix ? `${restOptions.userAgentOptions.userAgentPrefix} ${packageDetails}` : `${packageDetails}`; @@ -50324,11 +50324,11 @@ var require_Pipeline = __commonJS({ corePipeline.addPolicy((0, StorageRetryPolicyV2_js_1.storageRetryPolicy)(restOptions.retryOptions), { phase: "Retry" }); corePipeline.addPolicy((0, storage_common_1.storageRequestFailureDetailsParserPolicy)()); corePipeline.addPolicy((0, StorageBrowserPolicyV2_js_1.storageBrowserPolicy)()); - const downlevelResults = processDownlevelPipeline(pipeline); + const downlevelResults = processDownlevelPipeline(pipeline2); if (downlevelResults) { corePipeline.addPolicy(downlevelResults.wrappedPolicies, downlevelResults.afterRetry ? { afterPhase: "Retry" } : void 0); } - const credential = getCredentialFromPipeline(pipeline); + const credential = getCredentialFromPipeline(pipeline2); if ((0, core_auth_1.isTokenCredential)(credential)) { corePipeline.addPolicy((0, core_rest_pipeline_1.bearerTokenAuthenticationPolicy)({ credential, @@ -50341,7 +50341,7 @@ var require_Pipeline = __commonJS({ accountKey: credential.accountKey }), { phase: "Sign" }); } - pipeline._corePipeline = corePipeline; + pipeline2._corePipeline = corePipeline; } return { ...restOptions, @@ -50350,12 +50350,12 @@ var require_Pipeline = __commonJS({ pipeline: corePipeline }; } - function getCredentialFromPipeline(pipeline) { - if (pipeline._credential) { - return pipeline._credential; + function getCredentialFromPipeline(pipeline2) { + if (pipeline2._credential) { + return pipeline2._credential; } let credential = new AnonymousCredential_js_1.AnonymousCredential(); - for (const factory of pipeline.factories) { + for (const factory of pipeline2.factories) { if ((0, core_auth_1.isTokenCredential)(factory.credential)) { credential = factory.credential; } else if (isStorageSharedKeyCredential(factory)) { @@ -63880,13 +63880,13 @@ var require_StorageClient = __commonJS({ * @param url - url to resource * @param pipeline - request policy pipeline. */ - constructor(url2, pipeline) { + constructor(url2, pipeline2) { this.url = (0, utils_common_js_1.escapeURLPath)(url2); this.accountName = (0, utils_common_js_1.getAccountNameFromUrl)(url2); - this.pipeline = pipeline; - this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline)); + this.pipeline = pipeline2; + this.storageClientContext = new StorageContextClient_js_1.StorageContextClient(this.url, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2)); this.isHttps = (0, utils_common_js_1.iEqual)((0, utils_common_js_1.getURLScheme)(this.url) || "", "https"); - this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline); + this.credential = (0, Pipeline_js_1.getCredentialFromPipeline)(pipeline2); const storageClientContext = this.storageClientContext; storageClientContext.requestContentType = void 0; } @@ -68669,21 +68669,21 @@ var require_Clients = __commonJS({ } constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { options = options || {}; - let pipeline; + let pipeline2; let url2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; if (blobNameOrOptions && typeof blobNameOrOptions !== "string") { options = blobNameOrOptions; } - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -68695,20 +68695,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); ({ blobName: this._name, containerName: this._containerName } = this.getBlobAndContainerNamesFromUrl()); this.blobContext = this.storageClientContext.blob; this._snapshot = (0, utils_common_js_1.getURLParameter)(this.url, constants_js_1.URLConstants.Parameters.SNAPSHOT); @@ -69694,19 +69694,19 @@ var require_Clients = __commonJS({ */ appendBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -69718,20 +69718,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.appendBlobContext = this.storageClientContext.appendBlob; } /** @@ -69967,22 +69967,22 @@ var require_Clients = __commonJS({ */ blockBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; if (blobNameOrOptions && typeof blobNameOrOptions !== "string") { options = blobNameOrOptions; } - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -69994,20 +69994,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.blockBlobContext = this.storageClientContext.blockBlob; this._blobContext = this.storageClientContext.blob; } @@ -70579,19 +70579,19 @@ var require_Clients = __commonJS({ */ pageBlobContext; constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, blobNameOrOptions, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; options = blobNameOrOptions; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string" && blobNameOrOptions && typeof blobNameOrOptions === "string") { const containerName = credentialOrPipelineOrContainerName; const blobName = blobNameOrOptions; @@ -70603,20 +70603,20 @@ var require_Clients = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)((0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)), encodeURIComponent(blobName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName and blobName parameters"); } - super(url2, pipeline); + super(url2, pipeline2); this.pageBlobContext = this.storageClientContext.pageBlob; } /** @@ -71681,10 +71681,10 @@ var require_BlobBatch = __commonJS({ accountKey: credential.accountKey }), { phase: "Sign" }); } - const pipeline = new Pipeline_js_1.Pipeline([]); - pipeline._credential = credential; - pipeline._corePipeline = corePipeline; - return pipeline; + const pipeline2 = new Pipeline_js_1.Pipeline([]); + pipeline2._credential = credential; + pipeline2._corePipeline = corePipeline; + return pipeline2; } appendSubRequestToBody(request3) { this.body += [ @@ -71776,15 +71776,15 @@ var require_BlobBatchClient = __commonJS({ var BlobBatchClient = class { serviceOrContainerContext; constructor(url2, credentialOrPipeline, options) { - let pipeline; + let pipeline2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) { - pipeline = credentialOrPipeline; + pipeline2 = credentialOrPipeline; } else if (!credentialOrPipeline) { - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); } - const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline)); + const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2)); const path29 = (0, utils_common_js_1.getURLPath)(url2); if (path29 && path29 !== "/") { this.serviceOrContainerContext = storageClientContext.container; @@ -71947,18 +71947,18 @@ var require_ContainerClient = __commonJS({ return this._containerName; } constructor(urlOrConnectionString, credentialOrPipelineOrContainerName, options) { - let pipeline; + let pipeline2; let url2; options = options || {}; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = credentialOrPipelineOrContainerName; + pipeline2 = credentialOrPipelineOrContainerName; } else if (core_util_1.isNodeLike && credentialOrPipelineOrContainerName instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipelineOrContainerName instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipelineOrContainerName)) { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipelineOrContainerName, options); } else if (!credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName !== "string") { url2 = urlOrConnectionString; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else if (credentialOrPipelineOrContainerName && typeof credentialOrPipelineOrContainerName === "string") { const containerName = credentialOrPipelineOrContainerName; const extractedCreds = (0, utils_common_js_1.extractConnectionStringParts)(urlOrConnectionString); @@ -71969,20 +71969,20 @@ var require_ContainerClient = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { url2 = (0, utils_common_js_1.appendToURLPath)(extractedCreds.url, encodeURIComponent(containerName)) + "?" + extractedCreds.accountSas; - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } else { throw new Error("Expecting non-empty strings for containerName parameter"); } - super(url2, pipeline); + super(url2, pipeline2); this._containerName = this.getContainerNameFromUrl(); this.containerContext = this.storageClientContext.container; } @@ -73660,28 +73660,28 @@ var require_BlobServiceClient = __commonJS({ if (!options.proxyOptions) { options.proxyOptions = (0, core_rest_pipeline_1.getDefaultProxySettings)(extractedCreds.proxyUri); } - const pipeline = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); - return new _BlobServiceClient(extractedCreds.url, pipeline); + const pipeline2 = (0, Pipeline_js_1.newPipeline)(sharedKeyCredential, options); + return new _BlobServiceClient(extractedCreds.url, pipeline2); } else { throw new Error("Account connection string is only supported in Node.js environment"); } } else if (extractedCreds.kind === "SASConnString") { - const pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); - return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline); + const pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + return new _BlobServiceClient(extractedCreds.url + "?" + extractedCreds.accountSas, pipeline2); } else { throw new Error("Connection string must be either an Account connection string or a SAS connection string"); } } constructor(url2, credentialOrPipeline, options) { - let pipeline; + let pipeline2; if ((0, Pipeline_js_1.isPipelineLike)(credentialOrPipeline)) { - pipeline = credentialOrPipeline; + pipeline2 = credentialOrPipeline; } else if (core_util_1.isNodeLike && credentialOrPipeline instanceof StorageSharedKeyCredential_js_1.StorageSharedKeyCredential || credentialOrPipeline instanceof AnonymousCredential_js_1.AnonymousCredential || (0, core_auth_1.isTokenCredential)(credentialOrPipeline)) { - pipeline = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); } else { - pipeline = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); + pipeline2 = (0, Pipeline_js_1.newPipeline)(new AnonymousCredential_js_1.AnonymousCredential(), options); } - super(url2, pipeline); + super(url2, pipeline2); this.serviceContext = this.storageClientContext.service; } /** @@ -75082,8 +75082,8 @@ var require_downloadUtils = __commonJS({ var abort_controller_1 = require_dist4(); function pipeResponseToStream(response, output) { return __awaiter2(this, void 0, void 0, function* () { - const pipeline = util3.promisify(stream2.pipeline); - yield pipeline(response.message, output); + const pipeline2 = util3.promisify(stream2.pipeline); + yield pipeline2(response.message, output); }); } var DownloadProgress = class { @@ -82212,12 +82212,12 @@ var require_tool_cache = __commonJS({ core31.debug(`Failed to download from "${url2}". Code(${response.message.statusCode}) Message(${response.message.statusMessage})`); throw err; } - const pipeline = util3.promisify(stream2.pipeline); + const pipeline2 = util3.promisify(stream2.pipeline); const responseMessageFactory = _getGlobal("TEST_DOWNLOAD_TOOL_RESPONSE_MESSAGE_FACTORY", () => response.message); const readStream = responseMessageFactory(); let succeeded = false; try { - yield pipeline(readStream, fs31.createWriteStream(dest)); + yield pipeline2(readStream, fs31.createWriteStream(dest)); core31.debug("download complete"); succeeded = true; return dest; @@ -100809,7 +100809,7 @@ var require_pipeline4 = __commonJS({ } } } - function pipeline(...streams) { + function pipeline2(...streams) { return pipelineImpl(streams, once(popCallback(streams))); } function pipelineImpl(streams, callback, opts) { @@ -101075,7 +101075,7 @@ var require_pipeline4 = __commonJS({ } module2.exports = { pipelineImpl, - pipeline + pipeline: pipeline2 }; } }); @@ -101084,7 +101084,7 @@ var require_pipeline4 = __commonJS({ var require_compose = __commonJS({ "node_modules/readable-stream/lib/internal/streams/compose.js"(exports2, module2) { "use strict"; - var { pipeline } = require_pipeline4(); + var { pipeline: pipeline2 } = require_pipeline4(); var Duplex = require_duplex(); var { destroyer } = require_destroy2(); var { @@ -101144,7 +101144,7 @@ var require_compose = __commonJS({ } } const head = streams[0]; - const tail = pipeline(streams, onfinished); + const tail = pipeline2(streams, onfinished); const writable = !!(isWritable(head) || isWritableStream(head) || isTransformStream(head)); const readable = !!(isReadable(tail) || isReadableStream(tail) || isTransformStream(tail)); d = new Duplex({ @@ -101687,7 +101687,7 @@ var require_promises = __commonJS({ var { pipelineImpl: pl } = require_pipeline4(); var { finished } = require_end_of_stream(); require_stream2(); - function pipeline(...streams) { + function pipeline2(...streams) { return new Promise2((resolve14, reject) => { let signal; let end; @@ -101715,7 +101715,7 @@ var require_promises = __commonJS({ } module2.exports = { finished, - pipeline + pipeline: pipeline2 }; } }); @@ -101735,7 +101735,7 @@ var require_stream2 = __commonJS({ } = require_errors4(); var compose = require_compose(); var { setDefaultHighWaterMark, getDefaultHighWaterMark } = require_state3(); - var { pipeline } = require_pipeline4(); + var { pipeline: pipeline2 } = require_pipeline4(); var { destroyer } = require_destroy2(); var eos = require_end_of_stream(); var promises6 = require_promises(); @@ -101799,7 +101799,7 @@ var require_stream2 = __commonJS({ Stream.Duplex = require_duplex(); Stream.Transform = require_transform(); Stream.PassThrough = require_passthrough2(); - Stream.pipeline = pipeline; + Stream.pipeline = pipeline2; var { addAbortSignal } = require_add_abort_signal(); Stream.addAbortSignal = addAbortSignal; Stream.finished = eos; @@ -101815,7 +101815,7 @@ var require_stream2 = __commonJS({ return promises6; } }); - ObjectDefineProperty(pipeline, customPromisify, { + ObjectDefineProperty(pipeline2, customPromisify, { __proto__: null, enumerable: true, get() { @@ -109038,13 +109038,13 @@ var require_streamx = __commonJS({ } function pipelinePromise(...streams) { return new Promise((resolve14, reject) => { - return pipeline(...streams, (err) => { + return pipeline2(...streams, (err) => { if (err) return reject(err); resolve14(); }); }); } - function pipeline(stream2, ...streams) { + function pipeline2(stream2, ...streams) { const all = Array.isArray(stream2) ? [...stream2, ...streams] : [stream2, ...streams]; const done = all.length && typeof all[all.length - 1] === "function" ? all.pop() : null; if (all.length < 2) throw new Error("Pipeline requires at least 2 streams"); @@ -109129,7 +109129,7 @@ var require_streamx = __commonJS({ return s._writev !== Writable.prototype._writev && s._writev !== Duplex.prototype._writev; } module2.exports = { - pipeline, + pipeline: pipeline2, pipelinePromise, isStream: isStream2, isStreamx, @@ -150565,10 +150565,12 @@ async function extractTarZst(tar, dest, tarVersion, logger) { reject(new Error(`Error while extracting tar: ${err}`)); }); if (tar instanceof stream.Readable) { - tar.pipe(tarProcess.stdin).on("error", (err) => { - reject( - new Error(`Error while downloading and extracting tar: ${err}`) - ); + stream.pipeline(tar, tarProcess.stdin, (err) => { + if (err) { + reject( + new Error(`Error while downloading and extracting tar: ${err}`) + ); + } }); } tarProcess.on("exit", (code) => { @@ -150615,6 +150617,7 @@ var toolcache2 = __toESM(require_tool_cache()); var import_follow_redirects = __toESM(require_follow_redirects()); var semver8 = __toESM(require_semver2()); var STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; +var STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1e3; var TOOLCACHE_TOOL_NAME = "CodeQL"; async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorization, headers, tarVersion, logger) { logger.info( @@ -150692,8 +150695,8 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio authorization ? { authorization } : {}, headers ); - const response = await new Promise( - (resolve14) => import_follow_redirects.https.get( + const response = await new Promise((resolve14, reject) => { + const request3 = import_follow_redirects.https.get( codeqlURL, { headers, @@ -150703,9 +150706,18 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio agent }, (r) => resolve14(r) - ) - ); + ); + request3.on("error", reject); + request3.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => { + request3.destroy( + new Error( + `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.` + ) + ); + }); + }); if (response.statusCode !== 200) { + response.resume(); throw new Error( `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.` ); diff --git a/src/tar.test.ts b/src/tar.test.ts new file mode 100644 index 0000000000..48f4e866d3 --- /dev/null +++ b/src/tar.test.ts @@ -0,0 +1,33 @@ +import * as path from "path"; +import * as stream from "stream"; + +import test from "ava"; + +import { getRunnerLogger } from "./logging"; +import { extractTarZst } from "./tar"; +import { setupTests } from "./testing-utils"; +import { withTmpDir } from "./util"; + +setupTests(test); + +test("extractTarZst rejects if the input stream errors", async (t) => { + await withTmpDir(async (tmpDir) => { + const archive = new stream.PassThrough(); + const promise = extractTarZst( + archive, + path.join(tmpDir, "dest"), + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + archive.destroy( + Object.assign(new Error("socket hang up"), { + code: "ECONNRESET", + }), + ); + + await t.throwsAsync(promise, { + message: /Error while downloading and extracting tar/, + }); + }); +}); diff --git a/src/tar.ts b/src/tar.ts index 723716b016..3a0d79cc64 100644 --- a/src/tar.ts +++ b/src/tar.ts @@ -194,10 +194,15 @@ export async function extractTarZst( }); if (tar instanceof stream.Readable) { - tar.pipe(tarProcess.stdin).on("error", (err) => { - reject( - new Error(`Error while downloading and extracting tar: ${err}`), - ); + // Use `pipeline` rather than `pipe` so that an error on either stream is reported here + // rather than being emitted as an unhandled `error` event, and so that `tar`'s standard + // input is closed if the download fails partway through. + stream.pipeline(tar, tarProcess.stdin, (err) => { + if (err) { + reject( + new Error(`Error while downloading and extracting tar: ${err}`), + ); + } }); } diff --git a/src/tools-download.test.ts b/src/tools-download.test.ts index e17d38c5be..66fe0e72e4 100644 --- a/src/tools-download.test.ts +++ b/src/tools-download.test.ts @@ -38,6 +38,43 @@ test.serial( }, ); +test.serial( + "downloadAndExtract falls back to downloading before extracting if streaming fails", + async (t) => { + await withTmpDir(async (tmpDir) => { + sinon.stub(process, "platform").value("linux"); + const archivePath = path.join(tmpDir, "codeql-bundle.tar.zst"); + const destination = path.join(tmpDir, "codeql"); + const downloadTool = sinon + .stub(toolcache, "downloadTool") + .resolves(archivePath); + const extract = sinon.stub(tar, "extract").resolves(destination); + const extractTarZst = sinon.stub(tar, "extractTarZst").resolves(); + const request = nock("https://example.com") + .get("/codeql-bundle.tar.zst") + .replyWithError( + Object.assign(new Error("socket hang up"), { code: "ECONNRESET" }), + ); + + const statusReport = await downloadAndExtract( + "https://example.com/codeql-bundle.tar.zst", + "zstd", + destination, + undefined, + {}, + { type: "gnu", version: "1.34" }, + getRunnerLogger(true), + ); + + t.assert(Number.isInteger(statusReport.downloadDurationMs)); + t.true(request.isDone()); + t.false(extractTarZst.called); + t.true(downloadTool.calledOnce); + t.true(extract.calledOnce); + }); + }, +); + test.serial( "downloadAndExtract omits the download duration when streaming extraction", async (t) => { diff --git a/src/tools-download.ts b/src/tools-download.ts index c19cedb13e..9b2fa8723a 100644 --- a/src/tools-download.ts +++ b/src/tools-download.ts @@ -19,6 +19,12 @@ import { cleanUpPath, getErrorMessage, getRequiredEnvParam } from "./util"; */ const STREAMING_HIGH_WATERMARK_BYTES = 4 * 1024 * 1024; // 4 MiB +/** + * How long the streaming download of the CodeQL tools may stall for before we abort it. This + * applies both to establishing the connection and to gaps between chunks of the response body. + */ +const STREAMING_STALL_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes + /** * The name of the tool cache directory for the CodeQL tools. */ @@ -137,8 +143,8 @@ async function downloadAndExtractZstdWithStreaming( authorization ? { authorization } : {}, headers, ); - const response = await new Promise((resolve) => - https.get( + const response = await new Promise((resolve, reject) => { + const request = https.get( codeqlURL, { headers, @@ -148,10 +154,24 @@ async function downloadAndExtractZstdWithStreaming( agent, } as unknown as RequestOptions, (r) => resolve(r), - ), - ); + ); + // Without this listener, connection failures such as `ECONNRESET` are emitted as unhandled + // `error` events, which terminate the process instead of letting us fall back to downloading + // the bundle before extracting it. This listener stays attached after the response arrives, so + // it also handles errors that occur while the response is being streamed. + request.on("error", reject); + request.setTimeout(STREAMING_STALL_TIMEOUT_MS, () => { + request.destroy( + new Error( + `No data received for ${formatDuration(STREAMING_STALL_TIMEOUT_MS)}.`, + ), + ); + }); + }); if (response.statusCode !== 200) { + // Discard the response body so that the connection can be released. + response.resume(); throw new Error( `Failed to download CodeQL bundle from ${codeqlURL}. HTTP status code: ${response.statusCode}.`, ); From 155e5229973b426bd1ae2f83bb1bf42417fa2a8f Mon Sep 17 00:00:00 2001 From: sim Date: Thu, 30 Jul 2026 18:48:10 +0100 Subject: [PATCH 093/155] Link the PR from the changelog entry Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c461878c51..36092606b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#3367](https://github.com/github/codeql-action/issues/3367) +- Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061) ## 4.37.4 - 29 Jul 2026 From c29563eeaafbc75499c7bb0d74bf77b3506c1cbd Mon Sep 17 00:00:00 2001 From: Sam Robson Date: Fri, 31 Jul 2026 10:10:39 +0100 Subject: [PATCH 094/155] ci: use federated enterprise release PAT --- .../workflows/update-supported-enterprise-server-versions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/update-supported-enterprise-server-versions.yml b/.github/workflows/update-supported-enterprise-server-versions.yml index 01cd6ab8fb..ee2649ad0e 100644 --- a/.github/workflows/update-supported-enterprise-server-versions.yml +++ b/.github/workflows/update-supported-enterprise-server-versions.yml @@ -38,7 +38,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: repository: github/enterprise-releases - token: ${{ secrets.ENTERPRISE_RELEASE_TOKEN }} + token: ${{ secrets.CODEQL_CI_ENTERPRISE_RELEASE_PAT }} path: ${{ github.workspace }}/enterprise-releases/ sparse-checkout: releases.json From daa7fe6fba83d66113fc9990e68503b0e7a44c08 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 14:24:54 +0000 Subject: [PATCH 095/155] Bump js-yaml from 5.2.1 to 5.2.2 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.2.1 to 5.2.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.1...5.2.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 771bf2820e..56e5a48e70 100644 --- a/package-lock.json +++ b/package-lock.json @@ -31,7 +31,7 @@ "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.1", + "js-yaml": "^5.2.2", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", @@ -6981,9 +6981,9 @@ } }, "node_modules/js-yaml": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz", - "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==", + "version": "5.2.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz", + "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 0adeb49ccb..014fb22369 100644 --- a/package.json +++ b/package.json @@ -39,7 +39,7 @@ "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.1", + "js-yaml": "^5.2.2", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", From 266c7bdbd2ad8151d42fd682e28c126c5da068da Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 14:26:29 +0000 Subject: [PATCH 096/155] Rebuild --- lib/entry-points.js | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index b7078c8a5d..08afc4bd04 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -143051,6 +143051,17 @@ function addMappingEvent(state, start, anchorStart, anchorEnd, tagStart, tagEnd, style }); } +function insertFlowPairMappingEvent(state, snapshot) { + state.events.splice(snapshot.eventsLength, 0, { + type: 3, + start: snapshot.position, + anchorStart: NO_RANGE$1, + anchorEnd: NO_RANGE$1, + tagStart: NO_RANGE$1, + tagEnd: NO_RANGE$1, + style: 2 + }); +} function addScalarEvent(state, valueStart, valueEnd, anchorStart, anchorEnd, tagStart, tagEnd, style, chomping = 1, indent = -1, fast = false) { state.events.push({ type: 4, @@ -143494,12 +143505,8 @@ function readFlowCollection(state, nodeIndent, props) { state.position++; skipFlowSeparationSpace(state, nodeIndent); if (!isMapping) { - restoreState(state, entryStart); - addMappingEvent(state, entryStart.position, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, 2); - if (!parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)) addEmptyScalarEvent(state); - skipFlowSeparationSpace(state, nodeIndent); - state.position++; - skipFlowSeparationSpace(state, nodeIndent); + insertFlowPairMappingEvent(state, entryStart); + if (!keyWasRead) addEmptyScalarEvent(state); } else if (!keyWasRead) addEmptyScalarEvent(state); if (!parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)) addEmptyScalarEvent(state); skipFlowSeparationSpace(state, nodeIndent); @@ -143509,9 +143516,8 @@ function readFlowCollection(state, nodeIndent, props) { addEmptyScalarEvent(state); } else if (isMapping) addEmptyScalarEvent(state); else if (isPair) { - restoreState(state, entryStart); - addMappingEvent(state, entryStart.position, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, NO_RANGE$1, 2); - parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true); + insertFlowPairMappingEvent(state, entryStart); + if (!keyWasRead) addEmptyScalarEvent(state); addEmptyScalarEvent(state); addPopEvent(state); } @@ -144148,7 +144154,7 @@ function isNsCharOrWhitespace(c) { function isPlainSafe(c, prev, inblock) { const cIsNsCharOrWhitespace = isNsCharOrWhitespace(c); const cIsNsChar = cIsNsCharOrWhitespace && !isWhitespace(c); - return (inblock ? cIsNsCharOrWhitespace : cIsNsCharOrWhitespace && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET) && c !== CHAR_SHARP && !(prev === CHAR_COLON && !cIsNsChar) || isNsCharOrWhitespace(prev) && !isWhitespace(prev) && c === CHAR_SHARP || prev === CHAR_COLON && cIsNsChar; + return (inblock ? cIsNsCharOrWhitespace : cIsNsCharOrWhitespace && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET) && c !== CHAR_SHARP && !(prev === CHAR_COLON && !cIsNsChar) || isNsCharOrWhitespace(prev) && !isWhitespace(prev) && c === CHAR_SHARP || prev === CHAR_COLON && cIsNsChar && (inblock || c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET); } function isPlainSafeFirst(c) { return isPrintable(c) && c !== CHAR_BOM && !isWhitespace(c) && c !== CHAR_MINUS && c !== CHAR_QUESTION && c !== CHAR_COLON && c !== CHAR_COMMA && c !== CHAR_LEFT_SQUARE_BRACKET && c !== CHAR_RIGHT_SQUARE_BRACKET && c !== CHAR_LEFT_CURLY_BRACKET && c !== CHAR_RIGHT_CURLY_BRACKET && c !== CHAR_SHARP && c !== CHAR_AMPERSAND && c !== CHAR_ASTERISK && c !== CHAR_EXCLAMATION && c !== CHAR_VERTICAL_LINE && c !== CHAR_EQUALS && c !== CHAR_GREATER_THAN && c !== CHAR_SINGLE_QUOTE && c !== CHAR_DOUBLE_QUOTE && c !== CHAR_PERCENT && c !== CHAR_COMMERCIAL_AT && c !== CHAR_GRAVE_ACCENT; @@ -163165,7 +163171,7 @@ tmp/lib/tmp.js: *) js-yaml/dist/js-yaml.mjs: - (*! js-yaml 5.2.1 https://github.com/nodeca/js-yaml @license MIT *) + (*! js-yaml 5.2.2 https://github.com/nodeca/js-yaml @license MIT *) long/index.js: (** From e74600b0d945db9734eb044f95cd43f34b773451 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 09:18:21 +0000 Subject: [PATCH 097/155] Update changelog for v4.37.5 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 36092606b4..0008822f0e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.5 - 03 Aug 2026 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061) From 93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 11:02:52 +0000 Subject: [PATCH 098/155] Update changelog and version after v4.37.5 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0008822f0e..21e812c9f8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.5 - 03 Aug 2026 - Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the `init` Action instead of falling back to downloading the bundle before extracting it. [#4061](https://github.com/github/codeql-action/pull/4061) diff --git a/package-lock.json b/package-lock.json index 771bf2820e..e8ee88ec2b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.5", + "version": "4.37.6", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.5", + "version": "4.37.6", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index 0adeb49ccb..61bcc7b06a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.5", + "version": "4.37.6", "private": true, "description": "CodeQL action", "scripts": { From 3020a2f46286abb1704269b22ada83bd0e81c64f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 3 Aug 2026 11:03:06 +0000 Subject: [PATCH 099/155] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index b7078c8a5d..8a6023ca2f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145420,7 +145420,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.5"; + return "4.37.6"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 065cdc0394d424981db720df63ebc570e41b775f Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Mon, 3 Aug 2026 15:02:48 +0100 Subject: [PATCH 100/155] Change `DEFAULT_CONFIG_FILE_NAME` --- lib/entry-points.js | 2 +- src/config/remote-file.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 4219a7ad8a..cdd0db217d 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -148684,7 +148684,7 @@ function parseUserConfig(logger, pathInput, contents, validateConfig) { } // src/config/remote-file.ts -var DEFAULT_CONFIG_FILE_NAME = ".github/codeql-action.yaml"; +var DEFAULT_CONFIG_FILE_NAME = ".github/codeql-config.yml"; var DEFAULT_CONFIG_FILE_REF = "main"; function getDefaultOwner(env) { const currentRepoNwo = env.getRequired("GITHUB_REPOSITORY" /* GITHUB_REPOSITORY */); diff --git a/src/config/remote-file.ts b/src/config/remote-file.ts index 236e178207..1052072a28 100644 --- a/src/config/remote-file.ts +++ b/src/config/remote-file.ts @@ -16,7 +16,7 @@ export interface RemoteFileAddress { } /** The default file path to use in configuration file shorthands. */ -export const DEFAULT_CONFIG_FILE_NAME = ".github/codeql-action.yaml"; +export const DEFAULT_CONFIG_FILE_NAME = ".github/codeql-config.yml"; /** The default ref to use in configuration file shorthands. */ export const DEFAULT_CONFIG_FILE_REF = "main"; From 45c8742e17cbd668814137f95e605d925b8722a2 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 13:15:26 +0000 Subject: [PATCH 101/155] Update changelog for v4.37.6 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21e812c9f8..298ba90f57 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.6 - 04 Aug 2026 No user facing changes. From ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 4 Aug 2026 14:19:36 +0100 Subject: [PATCH 102/155] Add change note for PR 4070 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 298ba90f57..bbe7e65e68 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## 4.37.6 - 04 Aug 2026 -No user facing changes. +- Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070) ## 4.37.5 - 03 Aug 2026 From 37bdbde05074be171a3a42efabf2928379d28585 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 13:34:41 +0000 Subject: [PATCH 103/155] Update changelog and version after v4.37.6 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bbe7e65e68..bd770ab5f4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.6 - 04 Aug 2026 - Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to `.github/codeql-config.yml` to align it with the suggested path that is used elsewhere. [#4070](https://github.com/github/codeql-action/pull/4070) diff --git a/package-lock.json b/package-lock.json index 212400948a..5f3010a6bd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.6", + "version": "4.37.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.6", + "version": "4.37.7", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index caf12f15c0..23fe11a875 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.6", + "version": "4.37.7", "private": true, "description": "CodeQL action", "scripts": { From 7d82f1132f0de33d07be119009641a28d5110906 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 13:34:54 +0000 Subject: [PATCH 104/155] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index cdd0db217d..836def6b82 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145426,7 +145426,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.6"; + return "4.37.7"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 76c44396d33f17460892166dd0d4ef323ad0c6cc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 14:18:04 +0000 Subject: [PATCH 105/155] Bump brace-expansion from 1.1.16 to 1.1.18 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.18) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5f3010a6bd..58752c7216 100644 --- a/package-lock.json +++ b/package-lock.json @@ -374,9 +374,9 @@ "license": "Apache-2.0" }, "node_modules/@actions/artifact/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -2843,9 +2843,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { @@ -3864,9 +3864,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "1.1.16", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", - "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", @@ -5115,16 +5115,16 @@ } }, "node_modules/eslint-plugin-import-x/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/eslint-plugin-import-x/node_modules/minimatch": { @@ -6111,15 +6111,15 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/glob/node_modules/minimatch": { @@ -8090,15 +8090,15 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/readdir-glob/node_modules/minimatch": { From c5995f544d0a503524a4acfe4c84806a470b5f6c Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 14:19:52 +0000 Subject: [PATCH 106/155] Rebuild --- lib/entry-points.js | 600 +++++++++++++++++++++++++++++--------------- 1 file changed, 402 insertions(+), 198 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 836def6b82..dd77444e02 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -31227,6 +31227,8 @@ var require_brace_expansion = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -31260,11 +31262,12 @@ var require_brace_expansion = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand3(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand3(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -31278,11 +31281,82 @@ var require_brace_expansion = __commonJS({ function gte7(i, y) { return i >= y; } - function expand3(str, max, isTop) { - var expansions = []; + function combine2(acc, base, pre, values, max, maxLength, dropEmpties, outBase) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && expansion.length === base[a]) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + outBase.push(base[a]); + length += expansion.length; + } + } + return out; + } + function expandSequence2(body, isAlphaSequence, max, maxLength) { + var n = body.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; + } + return N; + } + function expand3(str, max, maxLength, isTop) { + var acc = [""]; + var accBase = [0]; + var dropEmpties = false; + var firstGroup = true; + var nextBase; for (; ; ) { var m = balanced2("{", "}", str); - if (!m || /\$$/.test(m.pre)) return [str]; + if (!m) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } + var pre = m.pre; + if (/\$$/.test(pre)) { + return combine2(acc, accBase, str, [""], max, maxLength, dropEmpties, []); + } var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); var isSequence = isNumericSequence || isAlphaSequence; @@ -31291,76 +31365,91 @@ var require_brace_expansion = __commonJS({ if (m.post.match(/,(?!,).*\}/)) { str = m.pre + "{" + m.body + escClose2 + m.post; isTop = true; + firstGroup = true; + dropEmpties = false; + accBase = []; + for (var b = 0; b < acc.length; b++) { + accBase.push(acc[b].length); + } continue; } - return [str]; + return combine2( + acc, + accBase, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties, + [] + ); + } + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; } - var n; + var values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand3(n[0], max, maxLength, false).map(embrace2); if (n.length === 1) { - var post = m.post.length ? expand3(m.post, max, false) : [""]; - return post.map(function(p) { - return m.pre + n[0] + p; - }); + nextBase = []; + acc = combine2( + acc, + accBase, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; + continue; } } - } - var pre = m.pre; - var post = m.post.length ? expand3(m.post, max, false) : [""]; - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d].length !== accBase[d]) { + dropsEmpties = false; } - N.push(c); } - } else { - N = concatMap(n, function(el) { - return expand3(el, max, false); - }); - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand3(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } } } - return expansions; + nextBase = []; + acc = combine2( + acc, + accBase, + pre, + values, + max, + maxLength, + dropEmpties && !m.post.length, + nextBase + ); + accBase = nextBase; + if (!m.post.length) break; + str = m.post; } + return acc; } } }); @@ -89012,6 +89101,8 @@ var require_brace_expansion2 = __commonJS({ var escClose2 = "\0CLOSE" + Math.random() + "\0"; var escComma2 = "\0COMMA" + Math.random() + "\0"; var escPeriod2 = "\0PERIOD" + Math.random() + "\0"; + var EXPANSION_MAX2 = 1e5; + var EXPANSION_MAX_LENGTH2 = 4e6; function numeric2(str) { return parseInt(str, 10) == str ? parseInt(str, 10) : str.charCodeAt(0); } @@ -89045,11 +89136,12 @@ var require_brace_expansion2 = __commonJS({ if (!str) return []; options = options || {}; - var max = options.max == null ? Infinity : options.max; + var max = options.max == null ? EXPANSION_MAX2 : options.max; + var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH2 : options.maxLength; if (str.substr(0, 2) === "{}") { str = "\\{\\}" + str.substr(2); } - return expand3(escapeBraces2(str), max, true).map(unescapeBraces2); + return expand3(escapeBraces2(str), max, maxLength, true).map(unescapeBraces2); } function embrace2(str) { return "{" + str + "}"; @@ -89063,19 +89155,89 @@ var require_brace_expansion2 = __commonJS({ function gte7(i, y) { return i >= y; } - function expand3(str, max, isTop) { - var expansions = []; + function combine2(acc, pre, values, max, maxLength, dropEmpties) { + var out = []; + var length = 0; + for (var a = 0; a < acc.length; a++) { + for (var v = 0; v < values.length; v++) { + if (out.length >= max) return out; + var expansion = acc[a] + pre + values[v]; + if (dropEmpties && !expansion) continue; + if (length + expansion.length > maxLength) return out; + out.push(expansion); + length += expansion.length; + } + } + return out; + } + function expandSequence2(body, isAlphaSequence, max, maxLength) { + var n = body.split(/\.\./); + var N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + var x = numeric2(n[0]); + var y = numeric2(n[1]); + var width = Math.max(n[0].length, n[1].length); + var incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; + var test = lte2; + var reverse = y < x; + if (reverse) { + incr *= -1; + test = gte7; + } + var pad = n.some(isPadded2); + var length = 0; + for (var i = x; test(i, y) && N.length < max; i += incr) { + var c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + var need = width - c.length; + if (need > 0) { + var z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) break; + N.push(c); + length += c.length; + } + return N; + } + function expand3(str, max, maxLength, isTop) { + var acc = [""]; + var dropEmpties = false; + var firstGroup = true; for (; ; ) { const m = balanced2("{", "}", str); - if (!m) return [str]; + if (!m) { + return combine2(acc, str, [""], max, maxLength, dropEmpties); + } const pre = m.pre; - if (/\$$/.test(m.pre)) { - const post2 = m.post.length ? expand3(m.post, max, false) : [""]; - for (let k2 = 0; k2 < post2.length && k2 < max; k2++) { - const expansion2 = pre + "{" + m.body + "}" + post2[k2]; - expansions.push(expansion2); - } - return expansions; + if (/\$$/.test(pre)) { + acc = combine2( + acc, + pre + "{" + m.body + "}", + [""], + max, + maxLength, + dropEmpties && !m.post.length + ); + firstGroup = false; + if (!m.post.length) break; + str = m.post; + continue; } var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); var isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); @@ -89087,73 +89249,66 @@ var require_brace_expansion2 = __commonJS({ isTop = true; continue; } - return [str]; + return combine2( + acc, + pre + "{" + m.body + "}" + m.post, + [""], + max, + maxLength, + dropEmpties + ); } - const post = m.post.length ? expand3(m.post, max, false) : [""]; - var n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + var values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence2(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts2(m.body); - if (n.length === 1) { - n = expand3(n[0], max, false).map(embrace2); + var n = parseCommaParts2(m.body); + if (n.length === 1 && n[0] !== void 0) { + n = expand3(n[0], max, maxLength, false).map(embrace2); if (n.length === 1) { - return post.map(function(p) { - return m.pre + n[0] + p; - }); + acc = combine2( + acc, + pre + n[0], + [""], + max, + maxLength, + dropEmpties && !m.post.length + ); + if (!m.post.length) break; + str = m.post; + continue; } } - } - var N; - if (isSequence) { - var x = numeric2(n[0]); - var y = numeric2(n[1]); - var width = Math.max(n[0].length, n[1].length); - var incr = n.length == 3 ? Math.max(Math.abs(numeric2(n[2])), 1) : 1; - var test = lte2; - var reverse = y < x; - if (reverse) { - incr *= -1; - test = gte7; - } - var pad = n.some(isPadded2); - N = []; - for (var i = x; test(i, y) && N.length < max; i += incr) { - var c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") - c = ""; - } else { - c = String(i); - if (pad) { - var need = width - c.length; - if (need > 0) { - var z = new Array(need + 1).join("0"); - if (i < 0) - c = "-" + z + c.slice(1); - else - c = z + c; - } - } + var dropsEmpties = dropEmpties && !m.post.length && !pre; + for (var d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d]) { + dropsEmpties = false; } - N.push(c); } - } else { - N = []; - for (var j = 0; j < n.length; j++) { - N.push.apply(N, expand3(n[j], max, false)); - } - } - for (var j = 0; j < N.length; j++) { - for (var k = 0; k < post.length && expansions.length < max; k++) { - var expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) - expansions.push(expansion); + values = []; + var valuesLength = 0; + outer: for (var j = 0; j < n.length; j++) { + var expanded = expand3(n[j], max, maxLength, false); + for (var k = 0; k < expanded.length; k++) { + var v = expanded[k]; + if (dropsEmpties && !v) continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; + } } } - return expansions; + acc = combine2(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) break; + str = m.post; } + return acc; } } }); @@ -155679,6 +155834,7 @@ var closePattern = /\\}/g; var commaPattern = /\\,/g; var periodPattern = /\\\./g; var EXPANSION_MAX = 1e5; +var EXPANSION_MAX_LENGTH = 4e6; function numeric(str) { return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0); } @@ -155713,11 +155869,11 @@ function expand2(str, options = {}) { if (!str) { return []; } - const { max = EXPANSION_MAX } = options; + const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options; if (str.slice(0, 2) === "{}") { str = "\\{\\}" + str.slice(2); } - return expand_(escapeBraces(str), max, true).map(unescapeBraces); + return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces); } function embrace(str) { return "{" + str + "}"; @@ -155731,20 +155887,87 @@ function lte(i, y) { function gte6(i, y) { return i >= y; } -function expand_(str, max, isTop) { - const expansions = []; +function combine(acc, pre, values, max, maxLength, dropEmpties) { + const out = []; + let length = 0; + for (let a = 0; a < acc.length; a++) { + for (let v = 0; v < values.length; v++) { + if (out.length >= max) + return out; + const expansion = acc[a] + pre + values[v]; + if (dropEmpties && !expansion) + continue; + if (length + expansion.length > maxLength) + return out; + out.push(expansion); + length += expansion.length; + } + } + return out; +} +function expandSequence(body, isAlphaSequence, max, maxLength) { + const n = body.split(/\.\./); + const N = []; + if (n[0] === void 0 || n[1] === void 0) { + return N; + } + const x = numeric(n[0]); + const y = numeric(n[1]); + const width = Math.max(n[0].length, n[1].length); + let incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; + let test = lte; + const reverse = y < x; + if (reverse) { + incr *= -1; + test = gte6; + } + const pad = n.some(isPadded); + let length = 0; + for (let i = x; test(i, y) && N.length < max; i += incr) { + let c; + if (isAlphaSequence) { + c = String.fromCharCode(i); + if (c === "\\") { + c = ""; + } + } else { + c = String(i); + if (pad) { + const need = width - c.length; + if (need > 0) { + const z = new Array(need + 1).join("0"); + if (i < 0) { + c = "-" + z + c.slice(1); + } else { + c = z + c; + } + } + } + } + if (length + c.length > maxLength) + break; + N.push(c); + length += c.length; + } + return N; +} +function expand_(str, max, maxLength, isTop) { + let acc = [""]; + let dropEmpties = false; + let firstGroup = true; for (; ; ) { const m = balanced("{", "}", str); - if (!m) - return [str]; + if (!m) { + return combine(acc, str, [""], max, maxLength, dropEmpties); + } const pre = m.pre; - if (/\$$/.test(m.pre)) { - const post2 = m.post.length ? expand_(m.post, max, false) : [""]; - for (let k = 0; k < post2.length && k < max; k++) { - const expansion = pre + "{" + m.body + "}" + post2[k]; - expansions.push(expansion); - } - return expansions; + if (/\$$/.test(pre)) { + acc = combine(acc, pre + "{" + m.body + "}", [""], max, maxLength, dropEmpties && !m.post.length); + firstGroup = false; + if (!m.post.length) + break; + str = m.post; + continue; } const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body); const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body); @@ -155756,74 +155979,55 @@ function expand_(str, max, isTop) { isTop = true; continue; } - return [str]; + return combine(acc, pre + "{" + m.body + "}" + m.post, [""], max, maxLength, dropEmpties); } - const post = m.post.length ? expand_(m.post, max, false) : [""]; - let n; + if (firstGroup) { + dropEmpties = isTop && !isSequence; + firstGroup = false; + } + let values; if (isSequence) { - n = m.body.split(/\.\./); + values = expandSequence(m.body, isAlphaSequence, max, maxLength); } else { - n = parseCommaParts(m.body); + let n = parseCommaParts(m.body); if (n.length === 1 && n[0] !== void 0) { - n = expand_(n[0], max, false).map(embrace); + n = expand_(n[0], max, maxLength, false).map(embrace); if (n.length === 1) { - return post.map((p) => m.pre + n[0] + p); + acc = combine(acc, pre + n[0], [""], max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; + continue; } } - } - let N; - if (isSequence && n[0] !== void 0 && n[1] !== void 0) { - const x = numeric(n[0]); - const y = numeric(n[1]); - const width = Math.max(n[0].length, n[1].length); - let incr = n.length === 3 && n[2] !== void 0 ? Math.max(Math.abs(numeric(n[2])), 1) : 1; - let test = lte; - const reverse = y < x; - if (reverse) { - incr *= -1; - test = gte6; - } - const pad = n.some(isPadded); - N = []; - for (let i = x; test(i, y) && N.length < max; i += incr) { - let c; - if (isAlphaSequence) { - c = String.fromCharCode(i); - if (c === "\\") { - c = ""; - } - } else { - c = String(i); - if (pad) { - const need = width - c.length; - if (need > 0) { - const z = new Array(need + 1).join("0"); - if (i < 0) { - c = "-" + z + c.slice(1); - } else { - c = z + c; - } - } - } + let dropsEmpties = dropEmpties && !m.post.length && !pre; + for (let d = 0; dropsEmpties && d < acc.length; d++) { + if (acc[d]) { + dropsEmpties = false; } - N.push(c); - } - } else { - N = []; - for (let j = 0; j < n.length; j++) { - N.push.apply(N, expand_(n[j], max, false)); } - } - for (let j = 0; j < N.length; j++) { - for (let k = 0; k < post.length && expansions.length < max; k++) { - const expansion = pre + N[j] + post[k]; - if (!isTop || isSequence || expansion) { - expansions.push(expansion); + values = []; + let valuesLength = 0; + outer: for (let j = 0; j < n.length; j++) { + const expanded = expand_(n[j], max, maxLength, false); + for (let k = 0; k < expanded.length; k++) { + const v = expanded[k]; + if (dropsEmpties && !v) + continue; + if (values.length >= max || valuesLength + v.length > maxLength) { + break outer; + } + values.push(v); + valuesLength += v.length; } } } - return expansions; + acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length); + if (!m.post.length) + break; + str = m.post; } + return acc; } // node_modules/readdir-glob/node_modules/minimatch/dist/esm/assert-valid-pattern.js From 47a0a833bb564f3d97f560feed33b14037b09885 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 17:54:39 +0000 Subject: [PATCH 107/155] Bump globals in the npm-minor group across 1 directory Bumps the npm-minor group with 1 update in the / directory: [globals](https://github.com/sindresorhus/globals). Updates `globals` from 17.7.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.7.0...v17.8.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 58752c7216..d7e08b9248 100644 --- a/package-lock.json +++ b/package-lock.json @@ -61,7 +61,7 @@ "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.7.0", + "globals": "^17.8.0", "nock": "^14.0.16", "sinon": "^22.1.0", "typescript": "^6.0.3", @@ -6138,9 +6138,9 @@ } }, "node_modules/globals": { - "version": "17.7.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz", - "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==", + "version": "17.8.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz", + "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index 23fe11a875..0924e874c1 100644 --- a/package.json +++ b/package.json @@ -69,7 +69,7 @@ "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.7.0", + "globals": "^17.8.0", "nock": "^14.0.16", "sinon": "^22.1.0", "typescript": "^6.0.3", From 74cfae9be6203473356477ab950b788c8cb4b46a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 17:56:46 +0000 Subject: [PATCH 108/155] Bump actions/setup-java Bumps the actions-minor group with 1 update in the /.github/workflows directory: [actions/setup-java](https://github.com/actions/setup-java). Updates `actions/setup-java` from 5.6.0 to 5.7.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] --- .../workflows/__autobuild-direct-tracing-with-working-dir.yml | 2 +- .github/workflows/__build-mode-autobuild.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml index f3bc58c691..b527638feb 100644 --- a/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml +++ b/.github/workflows/__autobuild-direct-tracing-with-working-dir.yml @@ -63,7 +63,7 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin diff --git a/.github/workflows/__build-mode-autobuild.yml b/.github/workflows/__build-mode-autobuild.yml index 280dbf569c..5043433ee3 100644 --- a/.github/workflows/__build-mode-autobuild.yml +++ b/.github/workflows/__build-mode-autobuild.yml @@ -63,7 +63,7 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Java - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 with: java-version: ${{ inputs.java-version || '17' }} distribution: temurin From bdf39710a2188cdbe1e45fcfd3d2e77a436d6f39 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 17:59:47 +0000 Subject: [PATCH 109/155] Rebuild --- pr-checks/sync.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts index 0517feddbd..9dcce16fe5 100755 --- a/pr-checks/sync.ts +++ b/pr-checks/sync.ts @@ -253,8 +253,8 @@ const languageSetups: LanguageSetups = { name: "Install Java", uses: pinnedUses( "actions/setup-java", - "03ad4de0992f5dab5e18fcb136590ce7c4a0ac95", - "v5.6.0", + "b6effb05e454b25005698d916606bdc6ffcbf961", + "v5.7.0", ), with: { "java-version": `\${{ inputs.java-version || '${defaultLanguageVersions.java}' }}`, From af767ec1f60e6f17d147015c0ec1f8c969172e0f Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 6 Aug 2026 16:38:33 +0100 Subject: [PATCH 110/155] Add overlay_analysis_min_disk_N_gb feature flags Add six feature flags, overlay_analysis_min_disk_8_gb through overlay_analysis_min_disk_13_gb, which will be used to control the amount of available disk space that overlay analysis requires. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 30 ++++++++++++++++++++++++++++++ src/feature-flags.ts | 42 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+) diff --git a/lib/entry-points.js b/lib/entry-points.js index dd77444e02..a4821cbe6e 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147382,6 +147382,36 @@ var featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: void 0 }, + ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_9_gb" /* OverlayAnalysisMinDisk9Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_9_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_10_gb" /* OverlayAnalysisMinDisk10Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_10_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_11_gb" /* OverlayAnalysisMinDisk11Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_11_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_12_gb" /* OverlayAnalysisMinDisk12Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_12_GB", + minimumVersion: void 0 + }, + ["overlay_analysis_min_disk_13_gb" /* OverlayAnalysisMinDisk13Gb */]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_13_GB", + minimumVersion: void 0 + }, ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", diff --git a/src/feature-flags.ts b/src/feature-flags.ts index b3107af962..7316c37f33 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -121,6 +121,18 @@ export enum Feature { * `OverlayAnalysisMatchCodeqlVersion` overrides this flag. */ OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run", + /** + * Feature flags that lower the amount of available disk space that the overlay hardware check + * requires. The lowest threshold that is enabled takes effect; if none are enabled, the default + * threshold applies. These flags have no effect if `OverlayAnalysisSkipResourceChecks` is + * enabled. + */ + OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb", + OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb", + OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb", + OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb", + OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb", + OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb", OverlayAnalysisPython = "overlay_analysis_python", /** * Controls whether lower disk space requirements are used for overlay hardware checks. @@ -354,6 +366,36 @@ export const featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: undefined, }, + [Feature.OverlayAnalysisMinDisk8Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_8_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk9Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_9_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk10Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_10_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk11Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_11_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk12Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_12_GB", + minimumVersion: undefined, + }, + [Feature.OverlayAnalysisMinDisk13Gb]: { + defaultValue: false, + envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_13_GB", + minimumVersion: undefined, + }, [Feature.OverlayAnalysisResourceChecksV2]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", From 6117bb503a0258aa1476e2bd144d82a527ecd739 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 6 Aug 2026 16:38:33 +0100 Subject: [PATCH 111/155] Derive overlay minimum disk space from feature flags Overlay analysis required 20 GB of available disk space, lowered to 14 GB when overlay_analysis_resource_checks_v2 was enabled. That gave us a single step to roll out, and any further reduction needed another flag and another release. Determine the threshold from the new overlay_analysis_min_disk_N_gb flags instead, taking the lowest one that is enabled so that a lower limit can be rolled out to a subset of repositories without first disabling the flag above it. When none are enabled, the 14 GB limit now applies unconditionally, replacing the 20 GB default. Thresholds remain in decimal MB, matching the bytes-per-MB convention the disk check already used, so the effective byte values are unchanged from the previous 14 GB path. Also log the available and required space at debug level when the check passes, so that run logs show which threshold took effect. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 45 ++++++++++++++++--------- src/config-utils.test.ts | 59 ++++++++++++++++++++++++++++----- src/config-utils.ts | 71 +++++++++++++++++++++++++++------------- 3 files changed, 128 insertions(+), 47 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index a4821cbe6e..039e345be2 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -149647,10 +149647,15 @@ async function cachePrefix(codeql, language) { } // src/config-utils.ts -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 2e4; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1e6; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6; +var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14e3; +var OVERLAY_MINIMUM_DISK_SPACE_FEATURES = [ + ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */, 8e3], + ["overlay_analysis_min_disk_9_gb" /* OverlayAnalysisMinDisk9Gb */, 9e3], + ["overlay_analysis_min_disk_10_gb" /* OverlayAnalysisMinDisk10Gb */, 1e4], + ["overlay_analysis_min_disk_11_gb" /* OverlayAnalysisMinDisk11Gb */, 11e3], + ["overlay_analysis_min_disk_12_gb" /* OverlayAnalysisMinDisk12Gb */, 12e3], + ["overlay_analysis_min_disk_13_gb" /* OverlayAnalysisMinDisk13Gb */, 13e3] +]; var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024; var CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE = "2.24.3"; async function getSupportedLanguageMap(codeql, logger) { @@ -149900,16 +149905,26 @@ async function checkOverlayAnalysisFeatureEnabled(features, codeql, languages, c } return new Success(void 0); } -function runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks) { - const minimumDiskSpaceBytes = useV2ResourceChecks ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; - if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { - const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1e6); - const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1e6); +async function getMinimumDiskSpaceMb(features) { + let minimumMb = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB; + for (const [feature, thresholdMb] of OVERLAY_MINIMUM_DISK_SPACE_FEATURES) { + if (await features.getValue(feature)) { + minimumMb = Math.min(minimumMb, thresholdMb); + } + } + return minimumMb; +} +function runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb) { + const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1e6); + if (diskUsage.numAvailableBytes < minimumDiskSpaceMb * 1e6) { logger.info( `Setting overlay database mode to ${"none" /* None */} due to insufficient disk space (${diskSpaceMb} MB, needed ${minimumDiskSpaceMb} MB).` ); return false; } + logger.debug( + `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is above the minimum of ${minimumDiskSpaceMb} MB.` + ); return true; } async function runnerHasSufficientMemory(codeql, ramInput, logger) { @@ -149934,8 +149949,9 @@ async function runnerHasSufficientMemory(codeql, ramInput, logger) { ); return true; } -async function checkRunnerResources(codeql, diskUsage, ramInput, logger, useV2ResourceChecks) { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { +async function checkRunnerResources(codeql, features, diskUsage, ramInput, logger) { + const minimumDiskSpaceMb = await getMinimumDiskSpaceMb(features); + if (!runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb)) { return new Failure("insufficient-disk-space" /* InsufficientDiskSpace */); } if (!await runnerHasSufficientMemory(codeql, ramInput, logger)) { @@ -149983,9 +149999,6 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b "overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */, codeql ); - const useV2ResourceChecks = await features.getValue( - "overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */ - ); const checkOverlayStatus = await features.getValue( "overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */ ); @@ -149999,10 +150012,10 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b } const resourceResult = performResourceChecks && diskUsage !== void 0 ? await checkRunnerResources( codeql, + features, diskUsage, ramInput, - logger, - useV2ResourceChecks + logger ) : new Success(void 0); if (resourceResult.isFailure()) { return resourceResult; diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index 84c709e72a..f4a664c790 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -1295,17 +1295,36 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled", + "Overlay-base database on default branch if runner disk space is above the default limit", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, ], isDefaultBranch: true, diskUsage: { - numAvailableBytes: 5_000_000_000, + numAvailableBytes: 15_000_000_000, + numTotalBytes: 100_000_000_000, + }, + }, + { + overlayDatabaseMode: OverlayDatabaseMode.OverlayBase, + useOverlayDatabaseCaching: true, + }, +); + +checkOverlayEnablementMacro.serial( + "No overlay-base database on default branch if runner disk space is below the default limit", + { + languages: [BuiltInLanguage.javascript], + features: [ + Feature.OverlayAnalysis, + Feature.OverlayAnalysisCodeScanningJavascript, + ], + isDefaultBranch: true, + diskUsage: { + numAvailableBytes: 10_000_000_000, numTotalBytes: 100_000_000_000, }, }, @@ -1315,17 +1334,17 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled", + "Overlay-base database on default branch if runner disk space is above the limit lowered by a feature flag", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, + Feature.OverlayAnalysisMinDisk10Gb, ], isDefaultBranch: true, diskUsage: { - numAvailableBytes: 15_000_000_000, + numAvailableBytes: 11_000_000_000, numTotalBytes: 100_000_000_000, }, }, @@ -1336,16 +1355,40 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled", + "Overlay-base database on default branch if runner disk space is exactly at the lowest limit enabled by a feature flag", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, + Feature.OverlayAnalysisMinDisk9Gb, + Feature.OverlayAnalysisMinDisk12Gb, ], isDefaultBranch: true, diskUsage: { - numAvailableBytes: 15_000_000_000, + numAvailableBytes: 9_000_000_000, + numTotalBytes: 100_000_000_000, + }, + }, + { + overlayDatabaseMode: OverlayDatabaseMode.OverlayBase, + useOverlayDatabaseCaching: true, + }, +); + +checkOverlayEnablementMacro.serial( + "No overlay-base database on default branch if runner disk space is below the lowest limit enabled by a feature flag", + { + languages: [BuiltInLanguage.javascript], + features: [ + Feature.OverlayAnalysis, + Feature.OverlayAnalysisCodeScanningJavascript, + Feature.OverlayAnalysisMinDisk9Gb, + Feature.OverlayAnalysisMinDisk12Gb, + ], + isDefaultBranch: true, + diskUsage: { + numAvailableBytes: 8_500_000_000, numTotalBytes: 100_000_000_000, }, }, diff --git a/src/config-utils.ts b/src/config-utils.ts index b5a880ba7b..dac83aa2c5 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -48,7 +48,7 @@ import { import { prepareDiffInformedAnalysis } from "./diff-informed-analysis-utils"; import { EnvVar } from "./environment"; import * as errorMessages from "./error-messages"; -import { Feature, FeatureEnablement } from "./feature-flags"; +import { Feature, FeatureEnablement, FeatureWithoutCLI } from "./feature-flags"; import { RepositoryProperties, RepositoryPropertyName, @@ -101,19 +101,28 @@ export { type Config } from "./config/action-config"; * whether to perform overlay analysis, then the action will not perform overlay * analysis unless overlay analysis has been explicitly enabled via environment * variable. + * + * This threshold can be lowered by the feature flags in + * `OVERLAY_MINIMUM_DISK_SPACE_FEATURES`. */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 20000; -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = - OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1_000_000; +const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14000; /** - * The v2 minimum available disk space (in MB) required to perform overlay - * analysis. This is a lower threshold than the v1 limit, allowing overlay - * analysis to run on runners with less available disk space. + * Feature flags that lower the minimum available disk space required to perform + * overlay analysis, paired with the threshold (in MB) that each one enables. + * + * If several of these are enabled, the lowest threshold takes effect. */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14000; -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = - OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1_000_000; +const OVERLAY_MINIMUM_DISK_SPACE_FEATURES: ReadonlyArray< + [FeatureWithoutCLI, number] +> = [ + [Feature.OverlayAnalysisMinDisk8Gb, 8000], + [Feature.OverlayAnalysisMinDisk9Gb, 9000], + [Feature.OverlayAnalysisMinDisk10Gb, 10000], + [Feature.OverlayAnalysisMinDisk11Gb, 11000], + [Feature.OverlayAnalysisMinDisk12Gb, 12000], + [Feature.OverlayAnalysisMinDisk13Gb, 13000], +]; /** * The minimum memory (in MB) that must be available for CodeQL to perform overlay analysis. If @@ -588,24 +597,42 @@ async function checkOverlayAnalysisFeatureEnabled( return new Success(undefined); } +/** + * Returns the minimum available disk space (in MB) required to perform overlay + * analysis, which is the lowest threshold enabled by a feature flag, or the + * default threshold if no such feature flag is enabled. + */ +async function getMinimumDiskSpaceMb( + features: FeatureEnablement, +): Promise { + let minimumMb = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB; + for (const [feature, thresholdMb] of OVERLAY_MINIMUM_DISK_SPACE_FEATURES) { + if (await features.getValue(feature)) { + minimumMb = Math.min(minimumMb, thresholdMb); + } + } + return minimumMb; +} + /** Checks if the runner has enough disk space for overlay analysis. */ function runnerHasSufficientDiskSpace( diskUsage: DiskUsage, logger: Logger, - useV2ResourceChecks: boolean, + minimumDiskSpaceMb: number, ): boolean { - const minimumDiskSpaceBytes = useV2ResourceChecks - ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES - : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; - if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { - const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000); - const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1_000_000); + const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000); + if (diskUsage.numAvailableBytes < minimumDiskSpaceMb * 1_000_000) { logger.info( `Setting overlay database mode to ${OverlayDatabaseMode.None} ` + `due to insufficient disk space (${diskSpaceMb} MB, needed ${minimumDiskSpaceMb} MB).`, ); return false; } + + logger.debug( + `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is above the minimum ` + + `of ${minimumDiskSpaceMb} MB.`, + ); return true; } @@ -648,12 +675,13 @@ async function runnerHasSufficientMemory( */ async function checkRunnerResources( codeql: CodeQL, + features: FeatureEnablement, diskUsage: DiskUsage, ramInput: string | undefined, logger: Logger, - useV2ResourceChecks: boolean, ): Promise> { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { + const minimumDiskSpaceMb = await getMinimumDiskSpaceMb(features); + if (!runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb)) { return new Failure(OverlayDisabledReason.InsufficientDiskSpace); } if (!(await runnerHasSufficientMemory(codeql, ramInput, logger))) { @@ -752,9 +780,6 @@ export async function checkOverlayEnablement( Feature.OverlayAnalysisSkipResourceChecks, codeql, )); - const useV2ResourceChecks = await features.getValue( - Feature.OverlayAnalysisResourceChecksV2, - ); const checkOverlayStatus = await features.getValue( Feature.OverlayAnalysisStatusCheck, ); @@ -770,10 +795,10 @@ export async function checkOverlayEnablement( performResourceChecks && diskUsage !== undefined ? await checkRunnerResources( codeql, + features, diskUsage, ramInput, logger, - useV2ResourceChecks, ) : new Success(undefined); if (resourceResult.isFailure()) { From 99caaa8b90b6c06ba323fc5f4c1a097008f2ba31 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 6 Aug 2026 16:38:34 +0100 Subject: [PATCH 112/155] Remove the overlay_analysis_resource_checks_v2 feature flag The flag no longer has any effect now that its 14 GB threshold is the unconditional default, so remove it. Setting CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2 no longer does anything. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 5 ----- src/feature-flags.ts | 10 ---------- 2 files changed, 15 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 039e345be2..9045926098 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147412,11 +147412,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_13_GB", minimumVersion: void 0 }, - ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", - minimumVersion: void 0 - }, ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK", diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 7316c37f33..66532cd850 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -134,11 +134,6 @@ export enum Feature { OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb", OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb", OverlayAnalysisPython = "overlay_analysis_python", - /** - * Controls whether lower disk space requirements are used for overlay hardware checks. - * Has no effect if `OverlayAnalysisSkipResourceChecks` is enabled. - */ - OverlayAnalysisResourceChecksV2 = "overlay_analysis_resource_checks_v2", OverlayAnalysisRuby = "overlay_analysis_ruby", /** Controls whether hardware checks are skipped for overlay analysis. */ OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks", @@ -396,11 +391,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MIN_DISK_13_GB", minimumVersion: undefined, }, - [Feature.OverlayAnalysisResourceChecksV2]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", - minimumVersion: undefined, - }, [Feature.OverlayAnalysisStatusCheck]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK", From 54109818e0b27705cef089f47289f1c93121a4a4 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 6 Aug 2026 16:41:48 +0100 Subject: [PATCH 113/155] Address review feedback on the disk space check Say "at or above" in the debug message logged when the check passes, since the comparison accepts exactly the minimum. Check each feature flag against the threshold its name declares, rather than only exercising a few of them, so that a mistake in one of the mappings cannot go unnoticed. Both sides of the boundary are needed to pin a threshold down: a mapping to a lower value would still pass the case at the limit, and one to a higher value would still fail the case below it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 2 +- src/config-utils.test.ts | 69 +++++++++++++++++++++++++++++----------- src/config-utils.ts | 4 +-- 3 files changed, 53 insertions(+), 22 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 9045926098..18a3387028 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -149918,7 +149918,7 @@ function runnerHasSufficientDiskSpace(diskUsage, logger, minimumDiskSpaceMb) { return false; } logger.debug( - `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is above the minimum of ${minimumDiskSpaceMb} MB.` + `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is at or above the minimum of ${minimumDiskSpaceMb} MB.` ); return true; } diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index f4a664c790..bedf219efd 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -1333,26 +1333,57 @@ checkOverlayEnablementMacro.serial( }, ); -checkOverlayEnablementMacro.serial( - "Overlay-base database on default branch if runner disk space is above the limit lowered by a feature flag", - { - languages: [BuiltInLanguage.javascript], - features: [ - Feature.OverlayAnalysis, - Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisMinDisk10Gb, - ], - isDefaultBranch: true, - diskUsage: { - numAvailableBytes: 11_000_000_000, - numTotalBytes: 100_000_000_000, +// Check that each feature flag lowers the limit to the threshold that its name +// declares. Both sides of the boundary are needed to pin the threshold down: a +// mapping to a lower value would still pass the case at the limit, and one to a +// higher value would still fail the case below it. +for (const [feature, thresholdGb] of [ + [Feature.OverlayAnalysisMinDisk8Gb, 8], + [Feature.OverlayAnalysisMinDisk9Gb, 9], + [Feature.OverlayAnalysisMinDisk10Gb, 10], + [Feature.OverlayAnalysisMinDisk11Gb, 11], + [Feature.OverlayAnalysisMinDisk12Gb, 12], + [Feature.OverlayAnalysisMinDisk13Gb, 13], +] as Array<[Feature, number]>) { + const features = [ + Feature.OverlayAnalysis, + Feature.OverlayAnalysisCodeScanningJavascript, + feature, + ]; + + checkOverlayEnablementMacro.serial( + `Overlay-base database on default branch if ${feature} is enabled and runner disk space is at its limit`, + { + languages: [BuiltInLanguage.javascript], + features, + isDefaultBranch: true, + diskUsage: { + numAvailableBytes: thresholdGb * 1_000_000_000, + numTotalBytes: 100_000_000_000, + }, }, - }, - { - overlayDatabaseMode: OverlayDatabaseMode.OverlayBase, - useOverlayDatabaseCaching: true, - }, -); + { + overlayDatabaseMode: OverlayDatabaseMode.OverlayBase, + useOverlayDatabaseCaching: true, + }, + ); + + checkOverlayEnablementMacro.serial( + `No overlay-base database on default branch if ${feature} is enabled and runner disk space is below its limit`, + { + languages: [BuiltInLanguage.javascript], + features, + isDefaultBranch: true, + diskUsage: { + numAvailableBytes: thresholdGb * 1_000_000_000 - 1_000_000, + numTotalBytes: 100_000_000_000, + }, + }, + { + disabledReason: OverlayDisabledReason.InsufficientDiskSpace, + }, + ); +} checkOverlayEnablementMacro.serial( "Overlay-base database on default branch if runner disk space is exactly at the lowest limit enabled by a feature flag", diff --git a/src/config-utils.ts b/src/config-utils.ts index dac83aa2c5..a0880d14ae 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -630,8 +630,8 @@ function runnerHasSufficientDiskSpace( } logger.debug( - `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is above the minimum ` + - `of ${minimumDiskSpaceMb} MB.`, + `Disk space available for CodeQL analysis is ${diskSpaceMb} MB, which is at or above the ` + + `minimum of ${minimumDiskSpaceMb} MB.`, ); return true; } From 794f5bc38548494f4243638d771a72998c889f3a Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Thu, 6 Aug 2026 16:48:44 +0100 Subject: [PATCH 114/155] Fix the memory check debug message at equality The comparison accepts exactly the minimum, so say "at or above", to match the wording of the disk space check. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 2 +- src/config-utils.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 18a3387028..37cb3b3c8c 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -149940,7 +149940,7 @@ async function runnerHasSufficientMemory(codeql, ramInput, logger) { return false; } logger.debug( - `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.` + `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is at or above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.` ); return true; } diff --git a/src/config-utils.ts b/src/config-utils.ts index a0880d14ae..6b9c41e3b4 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -664,7 +664,7 @@ async function runnerHasSufficientMemory( } logger.debug( - `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.`, + `Memory available for CodeQL analysis is ${memoryFlagValue} MB, which is at or above the minimum of ${OVERLAY_MINIMUM_MEMORY_MB} MB.`, ); return true; } From 5f8c44ba623af0a22379411c415fafdc3937b616 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Fri, 7 Aug 2026 15:11:20 -0500 Subject: [PATCH 115/155] Persist CodeQL version output to file rather than environment --- src/environment.ts | 6 --- src/util.test.ts | 96 ++++++++++++++++++++++++++++++---------------- src/util.ts | 47 ++++++++++++++++++----- 3 files changed, 100 insertions(+), 49 deletions(-) diff --git a/src/environment.ts b/src/environment.ts index d6ff20391a..29665512c2 100644 --- a/src/environment.ts +++ b/src/environment.ts @@ -39,12 +39,6 @@ export enum EnvVar { */ CODE_SCANNING_REF = "CODE_SCANNING_REF", - /** - * `PersistedVersionInfo` for the CodeQL CLI, so later Actions steps can reuse it instead of - * invoking `codeql version` again. - */ - CODEQL_VERSION_INFO = "CODEQL_ACTION_CLI_VERSION_INFO", - /** Whether the CodeQL Action has invoked the Go autobuilder. */ DID_AUTOBUILD_GOLANG = "CODEQL_ACTION_DID_AUTOBUILD_GOLANG", diff --git a/src/util.test.ts b/src/util.test.ts index 3d27e952af..039ee8cce1 100644 --- a/src/util.test.ts +++ b/src/util.test.ts @@ -10,7 +10,7 @@ import * as sinon from "sinon"; import * as api from "./api-client"; import { EnvVar } from "./environment"; import { getRunnerLogger } from "./logging"; -import { setupTests } from "./testing-utils"; +import { getTestEnv, setupTests } from "./testing-utils"; import * as util from "./util"; setupTests(test); @@ -535,55 +535,83 @@ test("Failure.orElse returns the default value for a failure result", (t) => { test.serial( "getCachedCodeQlVersion reuses a version persisted by an earlier step", - (t) => { - process.env[EnvVar.CODEQL_VERSION_INFO] = JSON.stringify({ - cmd: "/path/to/codeql", - version: { version: "2.20.0" }, - }); - t.deepEqual(util.getCachedCodeQlVersion("/path/to/codeql"), { - version: "2.20.0", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + fs.writeFileSync( + cacheFile, + JSON.stringify({ + cmd: "/path/to/codeql", + version: { version: "2.20.0" }, + }), + "utf8", + ); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.deepEqual(util.getCachedCodeQlVersion("/path/to/codeql", env), { + version: "2.20.0", + }); }); }, ); test.serial( "getCachedCodeQlVersion ignores a persisted version from a different CLI", - (t) => { - process.env[EnvVar.CODEQL_VERSION_INFO] = JSON.stringify({ - cmd: "/path/to/other-codeql", - version: { version: "2.20.0" }, + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + fs.writeFileSync( + cacheFile, + JSON.stringify({ + cmd: "/path/to/other-codeql", + version: { version: "2.20.0" }, + }), + "utf8", + ); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is(util.getCachedCodeQlVersion("/path/to/codeql", env), undefined); }); - t.is(util.getCachedCodeQlVersion("/path/to/codeql"), undefined); }, ); test.serial( "getCachedCodeQlVersion ignores a malformed persisted value", - (t) => { - process.env[EnvVar.CODEQL_VERSION_INFO] = "not valid json"; - t.is(util.getCachedCodeQlVersion("/path/to/codeql"), undefined); + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + fs.writeFileSync(cacheFile, "not valid json", "utf8"); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is(util.getCachedCodeQlVersion("/path/to/codeql", env), undefined); + }); }, ); test.serial( "getCachedCodeQlVersion ignores a persisted value with the wrong structure", - (t) => { - for (const value of [ - JSON.stringify({ cmd: "/path/to/codeql" }), - JSON.stringify({ cmd: "/path/to/codeql", version: {} }), - JSON.stringify({ cmd: "/path/to/codeql", version: { version: 2 } }), - JSON.stringify({ version: { version: "2.20.0" } }), - JSON.stringify({ - cmd: "/path/to/codeql", - version: { version: "2.20.0", overlayVersion: "1" }, - }), - JSON.stringify({ - cmd: "/path/to/codeql", - version: { version: "2.20.0", features: "nope" }, - }), - ]) { - process.env[EnvVar.CODEQL_VERSION_INFO] = value; - t.is(util.getCachedCodeQlVersion("/path/to/codeql"), undefined, value); - } + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + for (const value of [ + JSON.stringify({ cmd: "/path/to/codeql" }), + JSON.stringify({ cmd: "/path/to/codeql", version: {} }), + JSON.stringify({ cmd: "/path/to/codeql", version: { version: 2 } }), + JSON.stringify({ version: { version: "2.20.0" } }), + JSON.stringify({ + cmd: "/path/to/codeql", + version: { version: "2.20.0", overlayVersion: "1" }, + }), + JSON.stringify({ + cmd: "/path/to/codeql", + version: { version: "2.20.0", features: "nope" }, + }), + ]) { + fs.writeFileSync(cacheFile, value, "utf8"); + t.is( + util.getCachedCodeQlVersion("/path/to/codeql", env), + undefined, + value, + ); + } + }); }, ); diff --git a/src/util.ts b/src/util.ts index b7d27afae3..315e9ae4e2 100644 --- a/src/util.ts +++ b/src/util.ts @@ -9,11 +9,12 @@ import getFolderSize from "get-folder-size"; import * as yaml from "js-yaml"; import * as semver from "semver"; +import { getTemporaryDirectory } from "./actions-util"; import * as apiCompatibility from "./api-compatibility.json"; import type { CodeQL, VersionInfo } from "./codeql"; import type { Pack } from "./config/db-config"; import type { Config } from "./config-utils"; -import { EnvVar, getRequiredEnvParam } from "./environment"; +import { Env, EnvVar, getEnv, getRequiredEnvParam } from "./environment"; import * as json from "./json"; import { Language } from "./languages"; import { Logger } from "./logging"; @@ -638,7 +639,25 @@ function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { ); } -export function cacheCodeQlVersion(cmd: string, version: VersionInfo): void { +/** + * Returns the file path to the `codeql version` output cache. + * @param env The environment variables to use—only necessary for testing. + */ +function getPathToCodeQLVersionCacheFile(env: Env): string { + return path.join(getTemporaryDirectory(env), "version.json"); +} + +/** + * Caches the CodeQL CLI version both in-memory and on disk. + * @param cmd The path to the CodeQL CLI. + * @param version The version information to cache. + * @param env The environment variables to use—only necessary for testing. + */ +export function cacheCodeQlVersion( + cmd: string, + version: VersionInfo, + env: Env = getEnv(), +): void { if (cachedCodeQlVersion !== undefined) { throw new Error("cacheCodeQlVersion() should be called only once"); } @@ -647,23 +666,33 @@ export function cacheCodeQlVersion(cmd: string, version: VersionInfo): void { // processes, can reuse it rather than invoking `codeql version` again. We // record the CLI path so that a different step using a different CodeQL bundle // doesn't pick up a stale version. - core.exportVariable( - EnvVar.CODEQL_VERSION_INFO, + fs.writeFileSync( + getPathToCodeQLVersionCacheFile(env), JSON.stringify({ cmd, version }), + "utf8", ); } -export function getCachedCodeQlVersion(cmd?: string): undefined | VersionInfo { +/** + * Returns the cached CodeQL CLI version, if any. If not cached, + * attempts to read and parse it from disk. + * @param cmd The path to the CodeQL CLI. + * @param env The environment variables to use—only necessary for testing. + */ +export function getCachedCodeQlVersion( + cmd?: string, + env: Env = getEnv(), +): undefined | VersionInfo { if (cachedCodeQlVersion !== undefined) { return cachedCodeQlVersion; } // Fall back to the value persisted by an earlier Actions step, if any. This is // best-effort: any malformed or mismatched value is ignored so that the caller // invokes `codeql version` instead. - const serialized = process.env[EnvVar.CODEQL_VERSION_INFO]; - if (!serialized) { - return undefined; - } + const serialized = fs.readFileSync( + getPathToCodeQLVersionCacheFile(env), + "utf8", + ); let persisted: unknown; try { persisted = JSON.parse(serialized); From 9183a7b6e152d603c108e9c30411b6e9e4d87d29 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Mon, 10 Aug 2026 10:40:58 -0500 Subject: [PATCH 116/155] Handle file-read errors as cache misses This is particularly important for the first time that `getCachedCodeQlVersion` is invoked, as this cache file will not yet exist. --- lib/entry-points.js | 20 +++++++++++++------- src/util.ts | 10 ++++++---- 2 files changed, 19 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dd77444e02..582aa5a3e3 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145250,22 +145250,28 @@ function isPersistedVersionInfo(x) { const candidate = x; return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && isVersionInfo(candidate.version); } -function cacheCodeQlVersion(cmd, version) { +function getPathToCodeQLVersionCacheFile(env) { + return path.join(getTemporaryDirectory(env), "version.json"); +} +function cacheCodeQlVersion(cmd, version, env = getEnv()) { if (cachedCodeQlVersion !== void 0) { throw new Error("cacheCodeQlVersion() should be called only once"); } cachedCodeQlVersion = version; - core2.exportVariable( - "CODEQL_ACTION_CLI_VERSION_INFO" /* CODEQL_VERSION_INFO */, - JSON.stringify({ cmd, version }) + fs.writeFileSync( + getPathToCodeQLVersionCacheFile(env), + JSON.stringify({ cmd, version }), + "utf8" ); } -function getCachedCodeQlVersion(cmd) { +function getCachedCodeQlVersion(cmd, env = getEnv()) { if (cachedCodeQlVersion !== void 0) { return cachedCodeQlVersion; } - const serialized = process.env["CODEQL_ACTION_CLI_VERSION_INFO" /* CODEQL_VERSION_INFO */]; - if (!serialized) { + let serialized; + try { + serialized = fs.readFileSync(getPathToCodeQLVersionCacheFile(env), "utf8"); + } catch { return void 0; } let persisted; diff --git a/src/util.ts b/src/util.ts index 315e9ae4e2..c926718507 100644 --- a/src/util.ts +++ b/src/util.ts @@ -689,10 +689,12 @@ export function getCachedCodeQlVersion( // Fall back to the value persisted by an earlier Actions step, if any. This is // best-effort: any malformed or mismatched value is ignored so that the caller // invokes `codeql version` instead. - const serialized = fs.readFileSync( - getPathToCodeQLVersionCacheFile(env), - "utf8", - ); + let serialized: string; + try { + serialized = fs.readFileSync(getPathToCodeQLVersionCacheFile(env), "utf8"); + } catch { + return undefined; + } let persisted: unknown; try { persisted = JSON.parse(serialized); From acb38565c9ef611c5c861d009ec0bcbabab5dae8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 23:57:27 +0000 Subject: [PATCH 117/155] Bump js-yaml from 5.2.2 to 5.2.3 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.2.2 to 5.2.3. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/5.2.2...5.2.3) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index d7e08b9248..3ecde2f706 100644 --- a/package-lock.json +++ b/package-lock.json @@ -31,7 +31,7 @@ "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.2", + "js-yaml": "^5.2.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", @@ -6981,9 +6981,9 @@ } }, "node_modules/js-yaml": { - "version": "5.2.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz", - "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==", + "version": "5.2.3", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz", + "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 0924e874c1..4176f5db35 100644 --- a/package.json +++ b/package.json @@ -39,7 +39,7 @@ "follow-redirects": "^1.16.0", "get-folder-size": "^5.0.0", "https-proxy-agent": "^7.0.6", - "js-yaml": "^5.2.2", + "js-yaml": "^5.2.3", "jsonschema": "1.5.0", "long": "^5.3.2", "node-forge": "^1.4.0", From b5225f21c58fd7a6dff7e07e9d80cc804f57fefb Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 23:59:22 +0000 Subject: [PATCH 118/155] Rebuild --- lib/entry-points.js | 56 +++++++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 20 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dd77444e02..f2be624b77 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -142238,6 +142238,11 @@ var binaryTag = defineScalarTag("tag:yaml.org,2002:binary", { }); var YAML_DATE_REGEXP = /* @__PURE__ */ new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9])-([0-9][0-9])$"); var YAML_TIMESTAMP_REGEXP = /* @__PURE__ */ new RegExp("^([0-9][0-9][0-9][0-9])-([0-9][0-9]?)-([0-9][0-9]?)(?:[Tt]|[ \\t]+)([0-9][0-9]?):([0-9][0-9]):([0-9][0-9])(?:\\.([0-9]*))?(?:[ \\t]*(Z|([-+])([0-9][0-9]?)(?::([0-9][0-9]))?))?$"); +function makeUtcDate(year, month, day, hour = 0, minute = 0, second = 0, fraction = 0) { + const date = new Date(Date.UTC(year, month, day, hour, minute, second, fraction)); + date.setUTCFullYear(year, month, day); + return date; +} function resolveYamlTimestamp(source) { let match2 = YAML_DATE_REGEXP.exec(source); if (match2 === null) match2 = YAML_TIMESTAMP_REGEXP.exec(source); @@ -142246,7 +142251,7 @@ function resolveYamlTimestamp(source) { const month = +match2[2] - 1; const day = +match2[3]; if (!match2[4]) { - const date2 = new Date(Date.UTC(year, month, day)); + const date2 = makeUtcDate(year, month, day); if (date2.getUTCFullYear() !== year || date2.getUTCMonth() !== month || date2.getUTCDate() !== day) return NOT_RESOLVED; return date2; } @@ -142260,7 +142265,7 @@ function resolveYamlTimestamp(source) { while (value.length < 3) value += "0"; fraction = +value; } - const date = new Date(Date.UTC(year, month, day, hour, minute, second, fraction)); + const date = makeUtcDate(year, month, day, hour, minute, second, fraction); if (date.getUTCFullYear() !== year || date.getUTCMonth() !== month || date.getUTCDate() !== day) return NOT_RESOLVED; if (match2[9]) { const offsetHour = +match2[10]; @@ -142358,7 +142363,11 @@ var mapTag = defineMappingTag("tag:yaml.org,2002:map", { return Object.prototype.hasOwnProperty.call(container, String(key)); }, keys: (container) => Object.keys(container), - get: (container, key) => container[String(key)] + get: (container, key) => { + const normalizedKey = String(key); + if (!Object.prototype.hasOwnProperty.call(container, normalizedKey)) return null; + return container[normalizedKey]; + } }); var setTag = defineMappingTag("tag:yaml.org,2002:set", { create: () => /* @__PURE__ */ new Set(), @@ -142379,9 +142388,9 @@ var setTag = defineMappingTag("tag:yaml.org,2002:set", { }); function createTagDefinitionMap() { return { - scalar: {}, - sequence: {}, - mapping: {} + scalar: /* @__PURE__ */ Object.create(null), + sequence: /* @__PURE__ */ Object.create(null), + mapping: /* @__PURE__ */ Object.create(null) }; } function createTagDefinitionListMap() { @@ -142551,7 +142560,11 @@ var legacyMapTag = defineMappingTag("tag:yaml.org,2002:map", { return normalizedKey !== null && Object.prototype.hasOwnProperty.call(container, normalizedKey); }, keys: (container) => Object.keys(container), - get: (container, key) => container[String(key)] + get: (container, key) => { + const normalizedKey = String(key); + if (!Object.prototype.hasOwnProperty.call(container, normalizedKey)) return null; + return container[normalizedKey]; + } }); var DEFAULT_SNIPPET_OPTIONS = { maxLength: 79, @@ -142887,10 +142900,10 @@ function getScalarValue(input, scalar) { return getPlainValue(input, valueStart, valueEnd); } } -var DEFAULT_TAG_HANDLERS = { +var DEFAULT_TAG_HANDLERS = Object.assign(/* @__PURE__ */ Object.create(null), { "!": "!", "!!": "tag:yaml.org,2002:" -}; +}); function tagPercentEncode(source) { return encodeURI(source).replace(/!/g, "%21"); } @@ -143143,6 +143156,10 @@ function constructFromEvents(events, options) { } case 6: { const frame = state.frames.pop(); + if (frame.kind === "mapping" && frame.hasKey) { + state.position = frame.keyPosition; + throwError$1(state, "incomplete mapping pair in event stream"); + } if (frame.kind === "document") state.documents.push(frame.value); else { const value = frame.tag.carrierIsResult ? frame.value : finalizeCollection(state, frame.position, frame.tag, frame.value); @@ -143813,10 +143830,6 @@ function parseNode(state, parentIndent, nodeContext, allowToSeek, allowCompact, else if (state.lineIndent === parentIndent) indentStatus = 0; else indentStatus = -1; } - if (state.position === state.lineStart && testDocumentSeparator(state)) { - state.depth--; - return false; - } if (indentStatus === 1) while (true) { const ch = state.input.charCodeAt(state.position); const propertyState = snapshotState(state); @@ -144365,14 +144378,14 @@ function chooseScalarStyle(state, string2, layout, singleLineOnly, forceQuote, i if (char === CHAR_LINE_FEED) { hasLineBreak = true; if (shouldTrackWidth) { - hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && string2[previousLineBreak + 1] !== " "; + hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && !isMoreIndented(string2[previousLineBreak + 1]); previousLineBreak = i; } } else if (!isPrintable(char)) return STYLE_DOUBLE; plain = plain && isPlainSafe(char, prevChar, inblock); prevChar = char; } - hasFoldableLine = hasFoldableLine || shouldTrackWidth && i - previousLineBreak - 1 > lineWidth && string2[previousLineBreak + 1] !== " "; + hasFoldableLine = hasFoldableLine || shouldTrackWidth && i - previousLineBreak - 1 > lineWidth && !isMoreIndented(string2[previousLineBreak + 1]); } if (!hasLineBreak && !hasFoldableLine) { if (plain && !forceQuote) return STYLE_PLAIN; @@ -144437,27 +144450,30 @@ function encodeFlowBreaks(string2, indent) { function dropEndingNewline(string2) { return string2[string2.length - 1] === "\n" ? string2.slice(0, -1) : string2; } +function isMoreIndented(char) { + return char === " " || char === " "; +} function foldBlockScalar(string2, width) { const lineRe = /(\n+)([^\n]*)/g; let nextLF = string2.indexOf("\n"); if (nextLF === -1) nextLF = string2.length; lineRe.lastIndex = nextLF; let result = foldLine(string2.slice(0, nextLF), width); - let prevMoreIndented = string2[0] === "\n" || string2[0] === " "; + let prevMoreIndented = string2[0] === "\n" || isMoreIndented(string2[0]); let moreIndented; let match2; while (match2 = lineRe.exec(string2)) { const prefix = match2[1]; const line = match2[2]; - moreIndented = line[0] === " "; + moreIndented = line !== "" && isMoreIndented(line[0]); result += prefix + (!prevMoreIndented && !moreIndented && line !== "" ? "\n" : "") + foldLine(line, width); prevMoreIndented = moreIndented; } return result; } function foldLine(line, width) { - if (line === "" || line[0] === " ") return line; - const breakRe = / [^ ]/g; + if (line === "" || isMoreIndented(line[0])) return line; + const breakRe = / [^ \t]/g; let match2; let start = 0; let end; @@ -163375,7 +163391,7 @@ tmp/lib/tmp.js: *) js-yaml/dist/js-yaml.mjs: - (*! js-yaml 5.2.2 https://github.com/nodeca/js-yaml @license MIT *) + (*! js-yaml 5.2.3 https://github.com/nodeca/js-yaml @license MIT *) long/index.js: (** From 71311390373a4e40146c33f95fdab34da9c7dd8f Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 11 Aug 2026 13:38:57 +0100 Subject: [PATCH 119/155] Trigger workflows From c205ff6f09225f1b58086f3c7eca4b453ab2e857 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 11 Aug 2026 14:03:49 +0100 Subject: [PATCH 120/155] Promote `OverlayAnalysisResourceChecksV2` This feature has been rolled out to 100% and therefore the default behaviour for some time. --- lib/entry-points.js | 28 ++++++---------------------- src/config-utils.test.ts | 23 +---------------------- src/config-utils.ts | 30 ++++-------------------------- src/feature-flags.ts | 10 ---------- 4 files changed, 11 insertions(+), 80 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index dd77444e02..60e8458e2b 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147382,11 +147382,6 @@ var featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: void 0 }, - ["overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", - minimumVersion: void 0 - }, ["overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK", @@ -149617,10 +149612,8 @@ async function cachePrefix(codeql, language) { } // src/config-utils.ts -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 2e4; +var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14e3; var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1e6; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14e3; -var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1e6; var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024; var CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE = "2.24.3"; async function getSupportedLanguageMap(codeql, logger) { @@ -149870,8 +149863,8 @@ async function checkOverlayAnalysisFeatureEnabled(features, codeql, languages, c } return new Success(void 0); } -function runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks) { - const minimumDiskSpaceBytes = useV2ResourceChecks ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; +function runnerHasSufficientDiskSpace(diskUsage, logger) { + const minimumDiskSpaceBytes = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1e6); const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1e6); @@ -149904,8 +149897,8 @@ async function runnerHasSufficientMemory(codeql, ramInput, logger) { ); return true; } -async function checkRunnerResources(codeql, diskUsage, ramInput, logger, useV2ResourceChecks) { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { +async function checkRunnerResources(codeql, diskUsage, ramInput, logger) { + if (!runnerHasSufficientDiskSpace(diskUsage, logger)) { return new Failure("insufficient-disk-space" /* InsufficientDiskSpace */); } if (!await runnerHasSufficientMemory(codeql, ramInput, logger)) { @@ -149953,9 +149946,6 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b "overlay_analysis_skip_resource_checks" /* OverlayAnalysisSkipResourceChecks */, codeql ); - const useV2ResourceChecks = await features.getValue( - "overlay_analysis_resource_checks_v2" /* OverlayAnalysisResourceChecksV2 */ - ); const checkOverlayStatus = await features.getValue( "overlay_analysis_status_check" /* OverlayAnalysisStatusCheck */ ); @@ -149967,13 +149957,7 @@ async function checkOverlayEnablement(codeql, features, languages, sourceRoot, b ); return new Failure("unable-to-determine-disk-usage" /* UnableToDetermineDiskUsage */); } - const resourceResult = performResourceChecks && diskUsage !== void 0 ? await checkRunnerResources( - codeql, - diskUsage, - ramInput, - logger, - useV2ResourceChecks - ) : new Success(void 0); + const resourceResult = performResourceChecks && diskUsage !== void 0 ? await checkRunnerResources(codeql, diskUsage, ramInput, logger) : new Success(void 0); if (resourceResult.isFailure()) { return resourceResult; } diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index 84c709e72a..10509710af 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -1301,7 +1301,6 @@ checkOverlayEnablementMacro.serial( features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, ], isDefaultBranch: true, diskUsage: { @@ -1315,13 +1314,12 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "Overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks enabled", + "Overlay-base database on default branch if runner disk space is above minimum", { languages: [BuiltInLanguage.javascript], features: [ Feature.OverlayAnalysis, Feature.OverlayAnalysisCodeScanningJavascript, - Feature.OverlayAnalysisResourceChecksV2, ], isDefaultBranch: true, diskUsage: { @@ -1335,25 +1333,6 @@ checkOverlayEnablementMacro.serial( }, ); -checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is between v2 and v1 limits and v2 resource checks not enabled", - { - languages: [BuiltInLanguage.javascript], - features: [ - Feature.OverlayAnalysis, - Feature.OverlayAnalysisCodeScanningJavascript, - ], - isDefaultBranch: true, - diskUsage: { - numAvailableBytes: 15_000_000_000, - numTotalBytes: 100_000_000_000, - }, - }, - { - disabledReason: OverlayDisabledReason.InsufficientDiskSpace, - }, -); - checkOverlayEnablementMacro.serial( "No overlay-base database on default branch if memory flag is too low", { diff --git a/src/config-utils.ts b/src/config-utils.ts index b5a880ba7b..6d1efaa1ba 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -102,19 +102,10 @@ export { type Config } from "./config/action-config"; * analysis unless overlay analysis has been explicitly enabled via environment * variable. */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 20000; +const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14000; const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB * 1_000_000; -/** - * The v2 minimum available disk space (in MB) required to perform overlay - * analysis. This is a lower threshold than the v1 limit, allowing overlay - * analysis to run on runners with less available disk space. - */ -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB = 14000; -const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES = - OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_MB * 1_000_000; - /** * The minimum memory (in MB) that must be available for CodeQL to perform overlay analysis. If * CodeQL will be given less memory than this threshold, then the action will not perform overlay @@ -592,11 +583,8 @@ async function checkOverlayAnalysisFeatureEnabled( function runnerHasSufficientDiskSpace( diskUsage: DiskUsage, logger: Logger, - useV2ResourceChecks: boolean, ): boolean { - const minimumDiskSpaceBytes = useV2ResourceChecks - ? OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_V2_BYTES - : OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; + const minimumDiskSpaceBytes = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_BYTES; if (diskUsage.numAvailableBytes < minimumDiskSpaceBytes) { const diskSpaceMb = Math.round(diskUsage.numAvailableBytes / 1_000_000); const minimumDiskSpaceMb = Math.round(minimumDiskSpaceBytes / 1_000_000); @@ -651,9 +639,8 @@ async function checkRunnerResources( diskUsage: DiskUsage, ramInput: string | undefined, logger: Logger, - useV2ResourceChecks: boolean, ): Promise> { - if (!runnerHasSufficientDiskSpace(diskUsage, logger, useV2ResourceChecks)) { + if (!runnerHasSufficientDiskSpace(diskUsage, logger)) { return new Failure(OverlayDisabledReason.InsufficientDiskSpace); } if (!(await runnerHasSufficientMemory(codeql, ramInput, logger))) { @@ -752,9 +739,6 @@ export async function checkOverlayEnablement( Feature.OverlayAnalysisSkipResourceChecks, codeql, )); - const useV2ResourceChecks = await features.getValue( - Feature.OverlayAnalysisResourceChecksV2, - ); const checkOverlayStatus = await features.getValue( Feature.OverlayAnalysisStatusCheck, ); @@ -768,13 +752,7 @@ export async function checkOverlayEnablement( } const resourceResult = performResourceChecks && diskUsage !== undefined - ? await checkRunnerResources( - codeql, - diskUsage, - ramInput, - logger, - useV2ResourceChecks, - ) + ? await checkRunnerResources(codeql, diskUsage, ramInput, logger) : new Success(undefined); if (resourceResult.isFailure()) { return resourceResult; diff --git a/src/feature-flags.ts b/src/feature-flags.ts index b3107af962..fff7ef0440 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -122,11 +122,6 @@ export enum Feature { */ OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run", OverlayAnalysisPython = "overlay_analysis_python", - /** - * Controls whether lower disk space requirements are used for overlay hardware checks. - * Has no effect if `OverlayAnalysisSkipResourceChecks` is enabled. - */ - OverlayAnalysisResourceChecksV2 = "overlay_analysis_resource_checks_v2", OverlayAnalysisRuby = "overlay_analysis_ruby", /** Controls whether hardware checks are skipped for overlay analysis. */ OverlayAnalysisSkipResourceChecks = "overlay_analysis_skip_resource_checks", @@ -354,11 +349,6 @@ export const featureConfig = { envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_MATCH_CODEQL_VERSION_DRY_RUN", minimumVersion: undefined, }, - [Feature.OverlayAnalysisResourceChecksV2]: { - defaultValue: false, - envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_RESOURCE_CHECKS_V2", - minimumVersion: undefined, - }, [Feature.OverlayAnalysisStatusCheck]: { defaultValue: false, envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS_STATUS_CHECK", From f47bb7b9aa0937411b425809418d83594e9f2eba Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 11 Aug 2026 14:08:57 +0100 Subject: [PATCH 121/155] Remove `v2` from test title --- src/config-utils.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts index 10509710af..aec214cd64 100644 --- a/src/config-utils.test.ts +++ b/src/config-utils.test.ts @@ -1295,7 +1295,7 @@ checkOverlayEnablementMacro.serial( ); checkOverlayEnablementMacro.serial( - "No overlay-base database on default branch if runner disk space is below v2 limit and v2 resource checks enabled", + "No overlay-base database on default branch if runner disk space is below minimum", { languages: [BuiltInLanguage.javascript], features: [ From 208a88adc751d66262eabc084c02422d10db1cc9 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 11:06:17 -0500 Subject: [PATCH 122/155] Simplify JSDoc of `getCachedCodeQlVersion` Co-authored-by: Michael B. Gale --- src/util.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/util.ts b/src/util.ts index c926718507..652ca959e8 100644 --- a/src/util.ts +++ b/src/util.ts @@ -674,8 +674,7 @@ export function cacheCodeQlVersion( } /** - * Returns the cached CodeQL CLI version, if any. If not cached, - * attempts to read and parse it from disk. + * Returns the cached CodeQL CLI version, if any. * @param cmd The path to the CodeQL CLI. * @param env The environment variables to use—only necessary for testing. */ From bfcd769ba12912f8082c11eac8a5d93bbc5eb3dc Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 11:03:56 -0500 Subject: [PATCH 123/155] Fix JSDoc of `env` param --- src/util.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/util.ts b/src/util.ts index 652ca959e8..cffc029dde 100644 --- a/src/util.ts +++ b/src/util.ts @@ -641,7 +641,7 @@ function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { /** * Returns the file path to the `codeql version` output cache. - * @param env The environment variables to use—only necessary for testing. + * @param env The environment variables to use. */ function getPathToCodeQLVersionCacheFile(env: Env): string { return path.join(getTemporaryDirectory(env), "version.json"); @@ -651,7 +651,7 @@ function getPathToCodeQLVersionCacheFile(env: Env): string { * Caches the CodeQL CLI version both in-memory and on disk. * @param cmd The path to the CodeQL CLI. * @param version The version information to cache. - * @param env The environment variables to use—only necessary for testing. + * @param env The environment variables to use. */ export function cacheCodeQlVersion( cmd: string, @@ -676,7 +676,7 @@ export function cacheCodeQlVersion( /** * Returns the cached CodeQL CLI version, if any. * @param cmd The path to the CodeQL CLI. - * @param env The environment variables to use—only necessary for testing. + * @param env The environment variables to use. */ export function getCachedCodeQlVersion( cmd?: string, From 0e85c0e99ce41a638c11f2411c617cbafd9a77ed Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 11:18:04 -0500 Subject: [PATCH 124/155] Refactor unit test to extract testing values --- src/util.test.ts | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/util.test.ts b/src/util.test.ts index 039ee8cce1..367a1ce8f8 100644 --- a/src/util.test.ts +++ b/src/util.test.ts @@ -591,20 +591,23 @@ test.serial( await util.withTmpDir(async (tmpDir: string) => { const cacheFile = path.join(tmpDir, "version.json"); const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - for (const value of [ - JSON.stringify({ cmd: "/path/to/codeql" }), - JSON.stringify({ cmd: "/path/to/codeql", version: {} }), - JSON.stringify({ cmd: "/path/to/codeql", version: { version: 2 } }), - JSON.stringify({ version: { version: "2.20.0" } }), - JSON.stringify({ + + const testValues = [ + { cmd: "/path/to/codeql" }, + { cmd: "/path/to/codeql", version: {} }, + { cmd: "/path/to/codeql", version: { version: 2 } }, + { version: { version: "2.20.0" } }, + { cmd: "/path/to/codeql", version: { version: "2.20.0", overlayVersion: "1" }, - }), - JSON.stringify({ + }, + { cmd: "/path/to/codeql", version: { version: "2.20.0", features: "nope" }, - }), - ]) { + }, + ].map((v) => JSON.stringify(v)); + + for (const value of testValues) { fs.writeFileSync(cacheFile, value, "utf8"); t.is( util.getCachedCodeQlVersion("/path/to/codeql", env), From bb19330c5ee30d87d77211d3d2406dd10786398c Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 11:34:13 -0500 Subject: [PATCH 125/155] Add test of `getCachedCodeQlVersion` with no file --- src/util.test.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/util.test.ts b/src/util.test.ts index 367a1ce8f8..c71a89669b 100644 --- a/src/util.test.ts +++ b/src/util.test.ts @@ -618,3 +618,10 @@ test.serial( }); }, ); + +test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is(util.getCachedCodeQlVersion("/path/to/codeql", env), undefined); + }); +}); From 4dc327a94275ba3874cd4357d25ba3a31ae640c0 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 11:50:11 -0500 Subject: [PATCH 126/155] Introduce basic `cli/output-cache.ts` module --- src/cli/output-cache.ts | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 src/cli/output-cache.ts diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts new file mode 100644 index 0000000000..b6085445e2 --- /dev/null +++ b/src/cli/output-cache.ts @@ -0,0 +1,17 @@ +import path from "path"; + +import { getTemporaryDirectory } from "../actions-util"; + +/** + * The name of the temporary file that backs the on-disk cache of + * CLI responses between workflow steps. + */ +const COMMAND_CACHE_FILENAME = "codeql-action-command-cache.json"; + +/** + * Returns the path to the temporary file that backs the + * on-disk cache of CLI responses between workflow steps. + */ +function getCommandCacheFilePath(): string { + return path.join(getTemporaryDirectory(), COMMAND_CACHE_FILENAME); +} From 1332611f51f117a6c6b7033b4eebf4f73e108235 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 13:39:19 -0500 Subject: [PATCH 127/155] Move cache-related util functions into dedicated module --- lib/entry-points.js | 1803 +++++++++++++++++----------------- src/cli/output-cache.test.ts | 111 +++ src/cli/output-cache.ts | 87 +- src/codeql.ts | 5 +- src/status-report.ts | 2 +- src/testing-utils.ts | 2 +- src/util.test.ts | 95 +- src/util.ts | 88 +- 8 files changed, 1108 insertions(+), 1085 deletions(-) create mode 100644 src/cli/output-cache.test.ts diff --git a/lib/entry-points.js b/lib/entry-points.js index 582aa5a3e3..218f450b1f 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -213,7 +213,7 @@ var require_file_command = __commonJS({ exports2.issueFileCommand = issueFileCommand; exports2.prepareKeyValueMessage = prepareKeyValueMessage; var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var os7 = __importStar2(require("os")); var utils_1 = require_utils(); function issueFileCommand(command, message) { @@ -221,10 +221,10 @@ var require_file_command = __commonJS({ if (!filePath) { throw new Error(`Unable to find environment variable for file command ${command}`); } - if (!fs31.existsSync(filePath)) { + if (!fs32.existsSync(filePath)) { throw new Error(`Missing file at path: ${filePath}`); } - fs31.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { + fs32.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { encoding: "utf8" }); } @@ -1362,14 +1362,14 @@ var require_util = __commonJS({ } const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80; let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`; - let path29 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`; + let path30 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`; if (origin[origin.length - 1] === "/") { origin = origin.slice(0, origin.length - 1); } - if (path29 && path29[0] !== "/") { - path29 = `/${path29}`; + if (path30 && path30[0] !== "/") { + path30 = `/${path30}`; } - return new URL(`${origin}${path29}`); + return new URL(`${origin}${path30}`); } if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) { throw new InvalidArgumentError("Invalid URL protocol: the URL must start with `http:` or `https:`."); @@ -1820,39 +1820,39 @@ var require_diagnostics = __commonJS({ }); diagnosticsChannel.channel("undici:client:sendHeaders").subscribe((evt) => { const { - request: { method, path: path29, origin } + request: { method, path: path30, origin } } = evt; - debuglog("sending request to %s %s/%s", method, origin, path29); + debuglog("sending request to %s %s/%s", method, origin, path30); }); diagnosticsChannel.channel("undici:request:headers").subscribe((evt) => { const { - request: { method, path: path29, origin }, + request: { method, path: path30, origin }, response: { statusCode } } = evt; debuglog( "received response to %s %s/%s - HTTP %d", method, origin, - path29, + path30, statusCode ); }); diagnosticsChannel.channel("undici:request:trailers").subscribe((evt) => { const { - request: { method, path: path29, origin } + request: { method, path: path30, origin } } = evt; - debuglog("trailers received from %s %s/%s", method, origin, path29); + debuglog("trailers received from %s %s/%s", method, origin, path30); }); diagnosticsChannel.channel("undici:request:error").subscribe((evt) => { const { - request: { method, path: path29, origin }, + request: { method, path: path30, origin }, error: error3 } = evt; debuglog( "request to %s %s/%s errored - %s", method, origin, - path29, + path30, error3.message ); }); @@ -1901,9 +1901,9 @@ var require_diagnostics = __commonJS({ }); diagnosticsChannel.channel("undici:client:sendHeaders").subscribe((evt) => { const { - request: { method, path: path29, origin } + request: { method, path: path30, origin } } = evt; - debuglog("sending request to %s %s/%s", method, origin, path29); + debuglog("sending request to %s %s/%s", method, origin, path30); }); } diagnosticsChannel.channel("undici:websocket:open").subscribe((evt) => { @@ -1966,7 +1966,7 @@ var require_request = __commonJS({ var kHandler = /* @__PURE__ */ Symbol("handler"); var Request = class { constructor(origin, { - path: path29, + path: path30, method, body, headers, @@ -1981,11 +1981,11 @@ var require_request = __commonJS({ expectContinue, servername }, handler2) { - if (typeof path29 !== "string") { + if (typeof path30 !== "string") { throw new InvalidArgumentError("path must be a string"); - } else if (path29[0] !== "/" && !(path29.startsWith("http://") || path29.startsWith("https://")) && method !== "CONNECT") { + } else if (path30[0] !== "/" && !(path30.startsWith("http://") || path30.startsWith("https://")) && method !== "CONNECT") { throw new InvalidArgumentError("path must be an absolute URL or start with a slash"); - } else if (invalidPathRegex.test(path29)) { + } else if (invalidPathRegex.test(path30)) { throw new InvalidArgumentError("invalid request path"); } if (typeof method !== "string") { @@ -2051,7 +2051,7 @@ var require_request = __commonJS({ this.completed = false; this.aborted = false; this.upgrade = upgrade || null; - this.path = query ? buildURL(path29, query) : path29; + this.path = query ? buildURL(path30, query) : path30; this.origin = origin; this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent; this.blocking = blocking == null ? false : blocking; @@ -6673,7 +6673,7 @@ var require_client_h1 = __commonJS({ return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT"; } function writeH1(client, request3) { - const { method, path: path29, host, upgrade, blocking, reset } = request3; + const { method, path: path30, host, upgrade, blocking, reset } = request3; let { body, headers, contentLength } = request3; const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH"; if (util3.isFormDataLike(body)) { @@ -6740,7 +6740,7 @@ var require_client_h1 = __commonJS({ if (blocking) { socket[kBlocking] = true; } - let header = `${method} ${path29} HTTP/1.1\r + let header = `${method} ${path30} HTTP/1.1\r `; if (typeof host === "string") { header += `host: ${host}\r @@ -7266,7 +7266,7 @@ var require_client_h2 = __commonJS({ } function writeH2(client, request3) { const session = client[kHTTP2Session]; - const { method, path: path29, host, upgrade, expectContinue, signal, headers: reqHeaders } = request3; + const { method, path: path30, host, upgrade, expectContinue, signal, headers: reqHeaders } = request3; let { body } = request3; if (upgrade) { util3.errorRequest(client, request3, new Error("Upgrade not supported for H2")); @@ -7333,7 +7333,7 @@ var require_client_h2 = __commonJS({ }); return true; } - headers[HTTP2_HEADER_PATH] = path29; + headers[HTTP2_HEADER_PATH] = path30; headers[HTTP2_HEADER_SCHEME] = "https"; const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH"; if (body && typeof body.read === "function") { @@ -7686,9 +7686,9 @@ var require_redirect_handler = __commonJS({ return this.handler.onHeaders(statusCode, headers, resume, statusText); } const { origin, pathname, search } = util3.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin))); - const path29 = search ? `${pathname}${search}` : pathname; + const path30 = search ? `${pathname}${search}` : pathname; this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin); - this.opts.path = path29; + this.opts.path = path30; this.opts.origin = origin; this.opts.maxRedirections = 0; this.opts.query = null; @@ -8923,10 +8923,10 @@ var require_proxy_agent = __commonJS({ }; const { origin, - path: path29 = "/", + path: path30 = "/", headers = {} } = opts; - opts.path = origin + path29; + opts.path = origin + path30; if (!("host" in headers) && !("Host" in headers)) { const { host } = new URL2(origin); headers.host = host; @@ -10847,20 +10847,20 @@ var require_mock_utils = __commonJS({ } return true; } - function safeUrl(path29) { - if (typeof path29 !== "string") { - return path29; + function safeUrl(path30) { + if (typeof path30 !== "string") { + return path30; } - const pathSegments = path29.split("?"); + const pathSegments = path30.split("?"); if (pathSegments.length !== 2) { - return path29; + return path30; } const qp = new URLSearchParams(pathSegments.pop()); qp.sort(); return [...pathSegments, qp.toString()].join("?"); } - function matchKey(mockDispatch2, { path: path29, method, body, headers }) { - const pathMatch = matchValue(mockDispatch2.path, path29); + function matchKey(mockDispatch2, { path: path30, method, body, headers }) { + const pathMatch = matchValue(mockDispatch2.path, path30); const methodMatch = matchValue(mockDispatch2.method, method); const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true; const headersMatch = matchHeaders(mockDispatch2, headers); @@ -10882,7 +10882,7 @@ var require_mock_utils = __commonJS({ function getMockDispatch(mockDispatches, key) { const basePath = key.query ? buildURL(key.path, key.query) : key.path; const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath; - let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path29 }) => matchValue(safeUrl(path29), resolvedPath)); + let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path30 }) => matchValue(safeUrl(path30), resolvedPath)); if (matchedMockDispatches.length === 0) { throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`); } @@ -10920,9 +10920,9 @@ var require_mock_utils = __commonJS({ } } function buildKey(opts) { - const { path: path29, method, body, headers, query } = opts; + const { path: path30, method, body, headers, query } = opts; return { - path: path29, + path: path30, method, body, headers, @@ -11385,10 +11385,10 @@ var require_pending_interceptors_formatter = __commonJS({ } format(pendingInterceptors) { const withPrettyHeaders = pendingInterceptors.map( - ({ method, path: path29, data: { statusCode }, persist, times, timesInvoked, origin }) => ({ + ({ method, path: path30, data: { statusCode }, persist, times, timesInvoked, origin }) => ({ Method: method, Origin: origin, - Path: path29, + Path: path30, "Status code": statusCode, Persistent: persist ? PERSISTENT : NOT_PERSISTENT, Invocations: timesInvoked, @@ -16269,9 +16269,9 @@ var require_util6 = __commonJS({ } } } - function validateCookiePath(path29) { - for (let i = 0; i < path29.length; ++i) { - const code = path29.charCodeAt(i); + function validateCookiePath(path30) { + for (let i = 0; i < path30.length; ++i) { + const code = path30.charCodeAt(i); if (code < 32 || // exclude CTLs (0-31) code === 127 || // DEL code === 59) { @@ -18964,11 +18964,11 @@ var require_undici = __commonJS({ if (typeof opts.path !== "string") { throw new InvalidArgumentError("invalid opts.path"); } - let path29 = opts.path; + let path30 = opts.path; if (!opts.path.startsWith("/")) { - path29 = `/${path29}`; + path30 = `/${path30}`; } - url2 = new URL(util3.parseOrigin(url2).origin + path29); + url2 = new URL(util3.parseOrigin(url2).origin + path30); } else { if (!opts) { opts = typeof url2 === "object" ? url2 : {}; @@ -20271,7 +20271,7 @@ var require_path_utils = __commonJS({ exports2.toPosixPath = toPosixPath; exports2.toWin32Path = toWin32Path; exports2.toPlatformPath = toPlatformPath; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function toPosixPath(pth) { return pth.replace(/[\\]/g, "/"); } @@ -20279,7 +20279,7 @@ var require_path_utils = __commonJS({ return pth.replace(/[/]/g, "\\"); } function toPlatformPath(pth) { - return pth.replace(/[/\\]/g, path29.sep); + return pth.replace(/[/\\]/g, path30.sep); } } }); @@ -20361,13 +20361,13 @@ var require_io_util = __commonJS({ exports2.isRooted = isRooted; exports2.tryGetExecutablePath = tryGetExecutablePath; exports2.getCmdPath = getCmdPath; - var fs31 = __importStar2(require("fs")); - var path29 = __importStar2(require("path")); - _a2 = fs31.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; + var fs32 = __importStar2(require("fs")); + var path30 = __importStar2(require("path")); + _a2 = fs32.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; exports2.IS_WINDOWS = process.platform === "win32"; function readlink(fsPath) { return __awaiter2(this, void 0, void 0, function* () { - const result = yield fs31.promises.readlink(fsPath); + const result = yield fs32.promises.readlink(fsPath); if (exports2.IS_WINDOWS && !result.endsWith("\\")) { return `${result}\\`; } @@ -20375,7 +20375,7 @@ var require_io_util = __commonJS({ }); } exports2.UV_FS_O_EXLOCK = 268435456; - exports2.READONLY = fs31.constants.O_RDONLY; + exports2.READONLY = fs32.constants.O_RDONLY; function exists(fsPath) { return __awaiter2(this, void 0, void 0, function* () { try { @@ -20417,7 +20417,7 @@ var require_io_util = __commonJS({ } if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { - const upperExt = path29.extname(filePath).toUpperCase(); + const upperExt = path30.extname(filePath).toUpperCase(); if (extensions.some((validExt) => validExt.toUpperCase() === upperExt)) { return filePath; } @@ -20441,11 +20441,11 @@ var require_io_util = __commonJS({ if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { try { - const directory = path29.dirname(filePath); - const upperName = path29.basename(filePath).toUpperCase(); + const directory = path30.dirname(filePath); + const upperName = path30.basename(filePath).toUpperCase(); for (const actualName of yield (0, exports2.readdir)(directory)) { if (upperName === actualName.toUpperCase()) { - filePath = path29.join(directory, actualName); + filePath = path30.join(directory, actualName); break; } } @@ -20557,7 +20557,7 @@ var require_io = __commonJS({ exports2.which = which9; exports2.findInPath = findInPath; var assert_1 = require("assert"); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var ioUtil = __importStar2(require_io_util()); function cp(source_1, dest_1) { return __awaiter2(this, arguments, void 0, function* (source, dest, options = {}) { @@ -20566,7 +20566,7 @@ var require_io = __commonJS({ if (destStat && destStat.isFile() && !force) { return; } - const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path29.join(dest, path29.basename(source)) : dest; + const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path30.join(dest, path30.basename(source)) : dest; if (!(yield ioUtil.exists(source))) { throw new Error(`no such file or directory: ${source}`); } @@ -20578,7 +20578,7 @@ var require_io = __commonJS({ yield cpDirRecursive(source, newDest, 0, force); } } else { - if (path29.relative(source, newDest) === "") { + if (path30.relative(source, newDest) === "") { throw new Error(`'${newDest}' and '${source}' are the same file`); } yield copyFile2(source, newDest, force); @@ -20590,7 +20590,7 @@ var require_io = __commonJS({ if (yield ioUtil.exists(dest)) { let destExists = true; if (yield ioUtil.isDirectory(dest)) { - dest = path29.join(dest, path29.basename(source)); + dest = path30.join(dest, path30.basename(source)); destExists = yield ioUtil.exists(dest); } if (destExists) { @@ -20601,7 +20601,7 @@ var require_io = __commonJS({ } } } - yield mkdirP(path29.dirname(dest)); + yield mkdirP(path30.dirname(dest)); yield ioUtil.rename(source, dest); }); } @@ -20660,7 +20660,7 @@ var require_io = __commonJS({ } const extensions = []; if (ioUtil.IS_WINDOWS && process.env["PATHEXT"]) { - for (const extension of process.env["PATHEXT"].split(path29.delimiter)) { + for (const extension of process.env["PATHEXT"].split(path30.delimiter)) { if (extension) { extensions.push(extension); } @@ -20673,12 +20673,12 @@ var require_io = __commonJS({ } return []; } - if (tool.includes(path29.sep)) { + if (tool.includes(path30.sep)) { return []; } const directories = []; if (process.env.PATH) { - for (const p of process.env.PATH.split(path29.delimiter)) { + for (const p of process.env.PATH.split(path30.delimiter)) { if (p) { directories.push(p); } @@ -20686,7 +20686,7 @@ var require_io = __commonJS({ } const matches = []; for (const directory of directories) { - const filePath = yield ioUtil.tryGetExecutablePath(path29.join(directory, tool), extensions); + const filePath = yield ioUtil.tryGetExecutablePath(path30.join(directory, tool), extensions); if (filePath) { matches.push(filePath); } @@ -20816,7 +20816,7 @@ var require_toolrunner = __commonJS({ var os7 = __importStar2(require("os")); var events = __importStar2(require("events")); var child = __importStar2(require("child_process")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var io9 = __importStar2(require_io()); var ioUtil = __importStar2(require_io_util()); var timers_1 = require("timers"); @@ -21031,7 +21031,7 @@ var require_toolrunner = __commonJS({ exec() { return __awaiter2(this, void 0, void 0, function* () { if (!ioUtil.isRooted(this.toolPath) && (this.toolPath.includes("/") || IS_WINDOWS && this.toolPath.includes("\\"))) { - this.toolPath = path29.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); + this.toolPath = path30.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); } this.toolPath = yield io9.which(this.toolPath, true); return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { @@ -21584,7 +21584,7 @@ var require_core = __commonJS({ var file_command_1 = require_file_command(); var utils_1 = require_utils(); var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var oidc_utils_1 = require_oidc_utils(); var ExitCode; (function(ExitCode2) { @@ -21610,7 +21610,7 @@ var require_core = __commonJS({ } else { (0, command_1.issueCommand)("add-path", {}, inputPath); } - process.env["PATH"] = `${inputPath}${path29.delimiter}${process.env["PATH"]}`; + process.env["PATH"] = `${inputPath}${path30.delimiter}${process.env["PATH"]}`; } function getInput2(name, options) { const val = process.env[`INPUT_${name.replace(/ /g, "_").toUpperCase()}`] || ""; @@ -21747,8 +21747,8 @@ var require_context = __commonJS({ if ((0, fs_1.existsSync)(process.env.GITHUB_EVENT_PATH)) { this.payload = JSON.parse((0, fs_1.readFileSync)(process.env.GITHUB_EVENT_PATH, { encoding: "utf8" })); } else { - const path29 = process.env.GITHUB_EVENT_PATH; - process.stdout.write(`GITHUB_EVENT_PATH ${path29} does not exist${os_1.EOL}`); + const path30 = process.env.GITHUB_EVENT_PATH; + process.stdout.write(`GITHUB_EVENT_PATH ${path30} does not exist${os_1.EOL}`); } } this.eventName = process.env.GITHUB_EVENT_NAME; @@ -29356,14 +29356,14 @@ var require_light = __commonJS({ var require_helpers = __commonJS({ "node_modules/jsonschema/lib/helpers.js"(exports2, module2) { "use strict"; - var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema, path29, name, argument) { - if (Array.isArray(path29)) { - this.path = path29; - this.property = path29.reduce(function(sum, item) { + var ValidationError = exports2.ValidationError = function ValidationError2(message, instance, schema, path30, name, argument) { + if (Array.isArray(path30)) { + this.path = path30; + this.property = path30.reduce(function(sum, item) { return sum + makeSuffix(item); }, "instance"); - } else if (path29 !== void 0) { - this.property = path29; + } else if (path30 !== void 0) { + this.property = path30; } if (message) { this.message = message; @@ -29456,16 +29456,16 @@ var require_helpers = __commonJS({ name: { value: "SchemaError", enumerable: false } } ); - var SchemaContext = exports2.SchemaContext = function SchemaContext2(schema, options, path29, base, schemas) { + var SchemaContext = exports2.SchemaContext = function SchemaContext2(schema, options, path30, base, schemas) { this.schema = schema; this.options = options; - if (Array.isArray(path29)) { - this.path = path29; - this.propertyPath = path29.reduce(function(sum, item) { + if (Array.isArray(path30)) { + this.path = path30; + this.propertyPath = path30.reduce(function(sum, item) { return sum + makeSuffix(item); }, "instance"); } else { - this.propertyPath = path29; + this.propertyPath = path30; } this.base = base; this.schemas = schemas; @@ -29474,10 +29474,10 @@ var require_helpers = __commonJS({ return (() => resolveUrl(this.base, target))(); }; SchemaContext.prototype.makeChild = function makeChild(schema, propertyName) { - var path29 = propertyName === void 0 ? this.path : this.path.concat([propertyName]); + var path30 = propertyName === void 0 ? this.path : this.path.concat([propertyName]); var id = schema.$id || schema.id; let base = (() => resolveUrl(this.base, id || ""))(); - var ctx = new SchemaContext(schema, this.options, path29, base, Object.create(this.schemas)); + var ctx = new SchemaContext(schema, this.options, path30, base, Object.create(this.schemas)); if (id && !ctx.schemas[base]) { ctx.schemas[base] = schema; } @@ -30938,7 +30938,7 @@ var require_internal_path_helper = __commonJS({ exports2.hasRoot = hasRoot; exports2.normalizeSeparators = normalizeSeparators; exports2.safeTrimTrailingSeparator = safeTrimTrailingSeparator; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var assert_1 = __importDefault2(require("assert")); var IS_WINDOWS = process.platform === "win32"; function dirname6(p) { @@ -30946,7 +30946,7 @@ var require_internal_path_helper = __commonJS({ if (IS_WINDOWS && /^\\\\[^\\]+(\\[^\\]+)?$/.test(p)) { return p; } - let result = path29.dirname(p); + let result = path30.dirname(p); if (IS_WINDOWS && /^\\\\[^\\]+\\[^\\]+\\$/.test(result)) { result = safeTrimTrailingSeparator(result); } @@ -30983,7 +30983,7 @@ var require_internal_path_helper = __commonJS({ (0, assert_1.default)(hasAbsoluteRoot(root), `ensureAbsoluteRoot parameter 'root' must have an absolute root`); if (root.endsWith("/") || IS_WINDOWS && root.endsWith("\\")) { } else { - root += path29.sep; + root += path30.sep; } return root + itemPath; } @@ -31017,10 +31017,10 @@ var require_internal_path_helper = __commonJS({ return ""; } p = normalizeSeparators(p); - if (!p.endsWith(path29.sep)) { + if (!p.endsWith(path30.sep)) { return p; } - if (p === path29.sep) { + if (p === path30.sep) { return p; } if (IS_WINDOWS && /^[A-Z]:\\$/i.test(p)) { @@ -31459,7 +31459,7 @@ var require_minimatch = __commonJS({ "node_modules/minimatch/minimatch.js"(exports2, module2) { module2.exports = minimatch2; minimatch2.Minimatch = Minimatch2; - var path29 = (function() { + var path30 = (function() { try { return require("path"); } catch (e) { @@ -31467,7 +31467,7 @@ var require_minimatch = __commonJS({ })() || { sep: "/" }; - minimatch2.sep = path29.sep; + minimatch2.sep = path30.sep; var GLOBSTAR2 = minimatch2.GLOBSTAR = Minimatch2.GLOBSTAR = {}; var expand3 = require_brace_expansion(); var plTypes = { @@ -31556,8 +31556,8 @@ var require_minimatch = __commonJS({ assertValidPattern2(pattern); if (!options) options = {}; pattern = pattern.trim(); - if (!options.allowWindowsEscape && path29.sep !== "/") { - pattern = pattern.split(path29.sep).join("/"); + if (!options.allowWindowsEscape && path30.sep !== "/") { + pattern = pattern.split(path30.sep).join("/"); } this.options = options; this.maxGlobstarRecursion = options.maxGlobstarRecursion !== void 0 ? options.maxGlobstarRecursion : 200; @@ -31928,8 +31928,8 @@ var require_minimatch = __commonJS({ if (this.empty) return f === ""; if (f === "/" && partial) return true; var options = this.options; - if (path29.sep !== "/") { - f = f.split(path29.sep).join("/"); + if (path30.sep !== "/") { + f = f.split(path30.sep).join("/"); } f = f.split(slashSplit); this.debug(this.pattern, "split", f); @@ -32172,7 +32172,7 @@ var require_internal_path = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.Path = void 0; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var pathHelper = __importStar2(require_internal_path_helper()); var assert_1 = __importDefault2(require("assert")); var IS_WINDOWS = process.platform === "win32"; @@ -32187,12 +32187,12 @@ var require_internal_path = __commonJS({ (0, assert_1.default)(itemPath, `Parameter 'itemPath' must not be empty`); itemPath = pathHelper.safeTrimTrailingSeparator(itemPath); if (!pathHelper.hasRoot(itemPath)) { - this.segments = itemPath.split(path29.sep); + this.segments = itemPath.split(path30.sep); } else { let remaining = itemPath; let dir = pathHelper.dirname(remaining); while (dir !== remaining) { - const basename2 = path29.basename(remaining); + const basename2 = path30.basename(remaining); this.segments.unshift(basename2); remaining = dir; dir = pathHelper.dirname(remaining); @@ -32210,7 +32210,7 @@ var require_internal_path = __commonJS({ (0, assert_1.default)(segment === pathHelper.dirname(segment), `Parameter 'itemPath' root segment contains information for multiple segments`); this.segments.push(segment); } else { - (0, assert_1.default)(!segment.includes(path29.sep), `Parameter 'itemPath' contains unexpected path separators`); + (0, assert_1.default)(!segment.includes(path30.sep), `Parameter 'itemPath' contains unexpected path separators`); this.segments.push(segment); } } @@ -32221,12 +32221,12 @@ var require_internal_path = __commonJS({ */ toString() { let result = this.segments[0]; - let skipSlash = result.endsWith(path29.sep) || IS_WINDOWS && /^[A-Z]:$/i.test(result); + let skipSlash = result.endsWith(path30.sep) || IS_WINDOWS && /^[A-Z]:$/i.test(result); for (let i = 1; i < this.segments.length; i++) { if (skipSlash) { skipSlash = false; } else { - result += path29.sep; + result += path30.sep; } result += this.segments[i]; } @@ -32284,7 +32284,7 @@ var require_internal_pattern = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.Pattern = void 0; var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var pathHelper = __importStar2(require_internal_path_helper()); var assert_1 = __importDefault2(require("assert")); var minimatch_1 = require_minimatch(); @@ -32313,7 +32313,7 @@ var require_internal_pattern = __commonJS({ } pattern = _Pattern.fixupPattern(pattern, homedir2); this.segments = new internal_path_1.Path(pattern).segments; - this.trailingSeparator = pathHelper.normalizeSeparators(pattern).endsWith(path29.sep); + this.trailingSeparator = pathHelper.normalizeSeparators(pattern).endsWith(path30.sep); pattern = pathHelper.safeTrimTrailingSeparator(pattern); let foundGlob = false; const searchSegments = this.segments.map((x) => _Pattern.getLiteral(x)).filter((x) => !foundGlob && !(foundGlob = x === "")); @@ -32337,8 +32337,8 @@ var require_internal_pattern = __commonJS({ match(itemPath) { if (this.segments[this.segments.length - 1] === "**") { itemPath = pathHelper.normalizeSeparators(itemPath); - if (!itemPath.endsWith(path29.sep) && this.isImplicitPattern === false) { - itemPath = `${itemPath}${path29.sep}`; + if (!itemPath.endsWith(path30.sep) && this.isImplicitPattern === false) { + itemPath = `${itemPath}${path30.sep}`; } } else { itemPath = pathHelper.safeTrimTrailingSeparator(itemPath); @@ -32373,9 +32373,9 @@ var require_internal_pattern = __commonJS({ (0, assert_1.default)(literalSegments.every((x, i) => (x !== "." || i === 0) && x !== ".."), `Invalid pattern '${pattern}'. Relative pathing '.' and '..' is not allowed.`); (0, assert_1.default)(!pathHelper.hasRoot(pattern) || literalSegments[0], `Invalid pattern '${pattern}'. Root segment must not contain globs.`); pattern = pathHelper.normalizeSeparators(pattern); - if (pattern === "." || pattern.startsWith(`.${path29.sep}`)) { + if (pattern === "." || pattern.startsWith(`.${path30.sep}`)) { pattern = _Pattern.globEscape(process.cwd()) + pattern.substr(1); - } else if (pattern === "~" || pattern.startsWith(`~${path29.sep}`)) { + } else if (pattern === "~" || pattern.startsWith(`~${path30.sep}`)) { homedir2 = homedir2 || os7.homedir(); (0, assert_1.default)(homedir2, "Unable to determine HOME directory"); (0, assert_1.default)(pathHelper.hasAbsoluteRoot(homedir2), `Expected HOME directory to be a rooted path. Actual '${homedir2}'`); @@ -32459,8 +32459,8 @@ var require_internal_search_state = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.SearchState = void 0; var SearchState = class { - constructor(path29, level) { - this.path = path29; + constructor(path30, level) { + this.path = path30; this.level = level; } }; @@ -32602,9 +32602,9 @@ var require_internal_globber = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.DefaultGlobber = void 0; var core31 = __importStar2(require_core()); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var globOptionsHelper = __importStar2(require_internal_glob_options_helper()); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var patternHelper = __importStar2(require_internal_pattern_helper()); var internal_match_kind_1 = require_internal_match_kind(); var internal_pattern_1 = require_internal_pattern(); @@ -32656,7 +32656,7 @@ var require_internal_globber = __commonJS({ for (const searchPath of patternHelper.getSearchPaths(patterns)) { core31.debug(`Search path '${searchPath}'`); try { - yield __await2(fs31.promises.lstat(searchPath)); + yield __await2(fs32.promises.lstat(searchPath)); } catch (err) { if (err.code === "ENOENT") { continue; @@ -32680,7 +32680,7 @@ var require_internal_globber = __commonJS({ if (!stats) { continue; } - if (options.excludeHiddenFiles && path29.basename(item.path).match(/^\./)) { + if (options.excludeHiddenFiles && path30.basename(item.path).match(/^\./)) { continue; } if (stats.isDirectory()) { @@ -32690,7 +32690,7 @@ var require_internal_globber = __commonJS({ continue; } const childLevel = item.level + 1; - const childItems = (yield __await2(fs31.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path29.join(item.path, x), childLevel)); + const childItems = (yield __await2(fs32.promises.readdir(item.path))).map((x) => new internal_search_state_1.SearchState(path30.join(item.path, x), childLevel)); stack.push(...childItems.reverse()); } else if (match2 & internal_match_kind_1.MatchKind.File) { yield yield __await2(item.path); @@ -32725,7 +32725,7 @@ var require_internal_globber = __commonJS({ let stats; if (options.followSymbolicLinks) { try { - stats = yield fs31.promises.stat(item.path); + stats = yield fs32.promises.stat(item.path); } catch (err) { if (err.code === "ENOENT") { if (options.omitBrokenSymbolicLinks) { @@ -32737,10 +32737,10 @@ var require_internal_globber = __commonJS({ throw err; } } else { - stats = yield fs31.promises.lstat(item.path); + stats = yield fs32.promises.lstat(item.path); } if (stats.isDirectory() && options.followSymbolicLinks) { - const realPath = yield fs31.promises.realpath(item.path); + const realPath = yield fs32.promises.realpath(item.path); while (traversalChain.length >= item.level) { traversalChain.pop(); } @@ -32849,10 +32849,10 @@ var require_internal_hash_files = __commonJS({ exports2.hashFiles = hashFiles2; var crypto3 = __importStar2(require("crypto")); var core31 = __importStar2(require_core()); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var stream2 = __importStar2(require("stream")); var util3 = __importStar2(require("util")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function hashFiles2(globber_1, currentWorkspace_1) { return __awaiter2(this, arguments, void 0, function* (globber, currentWorkspace, verbose = false) { var _a2, e_1, _b, _c; @@ -32868,17 +32868,17 @@ var require_internal_hash_files = __commonJS({ _e = false; const file = _c; writeDelegate(file); - if (!file.startsWith(`${githubWorkspace}${path29.sep}`)) { + if (!file.startsWith(`${githubWorkspace}${path30.sep}`)) { writeDelegate(`Ignore '${file}' since it is not under GITHUB_WORKSPACE.`); continue; } - if (fs31.statSync(file).isDirectory()) { + if (fs32.statSync(file).isDirectory()) { writeDelegate(`Skip directory '${file}'.`); continue; } const hash2 = crypto3.createHash("sha256"); const pipeline2 = util3.promisify(stream2.pipeline); - yield pipeline2(fs31.createReadStream(file), hash2); + yield pipeline2(fs32.createReadStream(file), hash2); result.write(hash2.digest()); count++; if (!hasMatch) { @@ -34254,8 +34254,8 @@ var require_cacheUtils = __commonJS({ var glob2 = __importStar2(require_glob()); var io9 = __importStar2(require_io()); var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); - var path29 = __importStar2(require("path")); + var fs32 = __importStar2(require("fs")); + var path30 = __importStar2(require("path")); var semver11 = __importStar2(require_semver3()); var util3 = __importStar2(require("util")); var constants_1 = require_constants7(); @@ -34275,15 +34275,15 @@ var require_cacheUtils = __commonJS({ baseLocation = "/home"; } } - tempDirectory = path29.join(baseLocation, "actions", "temp"); + tempDirectory = path30.join(baseLocation, "actions", "temp"); } - const dest = path29.join(tempDirectory, crypto3.randomUUID()); + const dest = path30.join(tempDirectory, crypto3.randomUUID()); yield io9.mkdirP(dest); return dest; }); } function getArchiveFileSizeInBytes(filePath) { - return fs31.statSync(filePath).size; + return fs32.statSync(filePath).size; } function resolvePaths(patterns) { return __awaiter2(this, void 0, void 0, function* () { @@ -34299,7 +34299,7 @@ var require_cacheUtils = __commonJS({ _c = _g.value; _e = false; const file = _c; - const relativeFile = path29.relative(workspace, file).replace(new RegExp(`\\${path29.sep}`, "g"), "/"); + const relativeFile = path30.relative(workspace, file).replace(new RegExp(`\\${path30.sep}`, "g"), "/"); core31.debug(`Matched: ${relativeFile}`); if (relativeFile === "") { paths.push("."); @@ -34321,7 +34321,7 @@ var require_cacheUtils = __commonJS({ } function unlinkFile(filePath) { return __awaiter2(this, void 0, void 0, function* () { - return util3.promisify(fs31.unlink)(filePath); + return util3.promisify(fs32.unlink)(filePath); }); } function getVersion(app_1) { @@ -34363,7 +34363,7 @@ var require_cacheUtils = __commonJS({ } function getGnuTarPathOnWindows() { return __awaiter2(this, void 0, void 0, function* () { - if (fs31.existsSync(constants_1.GnuTarPathOnWindows)) { + if (fs32.existsSync(constants_1.GnuTarPathOnWindows)) { return constants_1.GnuTarPathOnWindows; } const versionOutput = yield getVersion("tar"); @@ -34826,13 +34826,13 @@ function __disposeResources(env) { } return next(); } -function __rewriteRelativeImportExtension(path29, preserveJsx) { - if (typeof path29 === "string" && /^\.\.?\//.test(path29)) { - return path29.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext2, cm) { +function __rewriteRelativeImportExtension(path30, preserveJsx) { + if (typeof path30 === "string" && /^\.\.?\//.test(path30)) { + return path30.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext2, cm) { return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext2 || !cm) ? m : d + ext2 + "." + cm.toLowerCase() + "js"; }); } - return path29; + return path30; } var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default; var init_tslib_es6 = __esm({ @@ -39246,8 +39246,8 @@ var require_getClient = __commonJS({ } const { allowInsecureConnection, httpClient } = clientOptions; const endpointUrl = clientOptions.endpoint ?? endpoint2; - const client = (path29, ...args) => { - const getUrl = (requestOptions) => (0, urlHelpers_js_1.buildRequestUrl)(endpointUrl, path29, args, { allowInsecureConnection, ...requestOptions }); + const client = (path30, ...args) => { + const getUrl = (requestOptions) => (0, urlHelpers_js_1.buildRequestUrl)(endpointUrl, path30, args, { allowInsecureConnection, ...requestOptions }); return { get: (requestOptions = {}) => { return buildOperation("GET", getUrl(requestOptions), pipeline2, requestOptions, allowInsecureConnection, httpClient); @@ -43118,15 +43118,15 @@ var require_urlHelpers2 = __commonJS({ let isAbsolutePath = false; let requestUrl = replaceAll(baseUri, urlReplacements); if (operationSpec.path) { - let path29 = replaceAll(operationSpec.path, urlReplacements); - if (operationSpec.path === "/{nextLink}" && path29.startsWith("/")) { - path29 = path29.substring(1); + let path30 = replaceAll(operationSpec.path, urlReplacements); + if (operationSpec.path === "/{nextLink}" && path30.startsWith("/")) { + path30 = path30.substring(1); } - if (isAbsoluteUrl(path29)) { - requestUrl = path29; + if (isAbsoluteUrl(path30)) { + requestUrl = path30; isAbsolutePath = true; } else { - requestUrl = appendPath(requestUrl, path29); + requestUrl = appendPath(requestUrl, path30); } } const { queryParams, sequenceParams } = calculateQueryParameters(operationSpec, operationArguments, fallbackObject); @@ -43172,9 +43172,9 @@ var require_urlHelpers2 = __commonJS({ } const searchStart = pathToAppend.indexOf("?"); if (searchStart !== -1) { - const path29 = pathToAppend.substring(0, searchStart); + const path30 = pathToAppend.substring(0, searchStart); const search = pathToAppend.substring(searchStart + 1); - newPath = newPath + path29; + newPath = newPath + path30; if (search) { parsedUrl.search = parsedUrl.search ? `${parsedUrl.search}&${search}` : search; } @@ -46090,10 +46090,10 @@ var require_utils_common = __commonJS({ var constants_js_1 = require_constants10(); function escapeURLPath(url2) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 || "/"; - path29 = escape3(path29); - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 || "/"; + path30 = escape3(path30); + urlParsed.pathname = path30; return urlParsed.toString(); } function getProxyUriFromDevConnString(connectionString) { @@ -46178,9 +46178,9 @@ var require_utils_common = __commonJS({ } function appendToURLPath(url2, name) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 ? path29.endsWith("/") ? `${path29}${name}` : `${path29}/${name}` : name; - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 ? path30.endsWith("/") ? `${path30}${name}` : `${path30}/${name}` : name; + urlParsed.pathname = path30; return urlParsed.toString(); } function setURLParameter(url2, name, value) { @@ -47407,9 +47407,9 @@ var require_StorageSharedKeyCredentialPolicy = __commonJS({ * @param request - */ getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${this.factory.accountName}${path29}`; + canonicalizedResourceString += `/${this.factory.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -48148,10 +48148,10 @@ var require_utils_common2 = __commonJS({ var constants_js_1 = require_constants11(); function escapeURLPath(url2) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 || "/"; - path29 = escape3(path29); - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 || "/"; + path30 = escape3(path30); + urlParsed.pathname = path30; return urlParsed.toString(); } function getProxyUriFromDevConnString(connectionString) { @@ -48236,9 +48236,9 @@ var require_utils_common2 = __commonJS({ } function appendToURLPath(url2, name) { const urlParsed = new URL(url2); - let path29 = urlParsed.pathname; - path29 = path29 ? path29.endsWith("/") ? `${path29}${name}` : `${path29}/${name}` : name; - urlParsed.pathname = path29; + let path30 = urlParsed.pathname; + path30 = path30 ? path30.endsWith("/") ? `${path30}${name}` : `${path30}/${name}` : name; + urlParsed.pathname = path30; return urlParsed.toString(); } function setURLParameter(url2, name, value) { @@ -49159,9 +49159,9 @@ var require_StorageSharedKeyCredentialPolicy2 = __commonJS({ * @param request - */ getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${this.factory.accountName}${path29}`; + canonicalizedResourceString += `/${this.factory.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -49791,9 +49791,9 @@ var require_StorageSharedKeyCredentialPolicyV2 = __commonJS({ return canonicalizedHeadersStringToSign; } function getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${options.accountName}${path29}`; + canonicalizedResourceString += `/${options.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -50138,9 +50138,9 @@ var require_StorageSharedKeyCredentialPolicyV22 = __commonJS({ return canonicalizedHeadersStringToSign; } function getCanonicalizedResourceString(request3) { - const path29 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; + const path30 = (0, utils_common_js_1.getURLPath)(request3.url) || "/"; let canonicalizedResourceString = ""; - canonicalizedResourceString += `/${options.accountName}${path29}`; + canonicalizedResourceString += `/${options.accountName}${path30}`; const queries = (0, utils_common_js_1.getURLQueries)(request3.url); const lowercaseQueries = {}; if (queries) { @@ -71795,8 +71795,8 @@ var require_BlobBatch = __commonJS({ if (this.operationCount >= constants_js_1.BATCH_MAX_REQUEST) { throw new RangeError(`Cannot exceed ${constants_js_1.BATCH_MAX_REQUEST} sub requests in a single batch`); } - const path29 = (0, utils_common_js_1.getURLPath)(subRequest.url); - if (!path29 || path29 === "") { + const path30 = (0, utils_common_js_1.getURLPath)(subRequest.url); + if (!path30 || path30 === "") { throw new RangeError(`Invalid url for sub request: '${subRequest.url}'`); } } @@ -71874,8 +71874,8 @@ var require_BlobBatchClient = __commonJS({ pipeline2 = (0, Pipeline_js_1.newPipeline)(credentialOrPipeline, options); } const storageClientContext = new StorageContextClient_js_1.StorageContextClient(url2, (0, Pipeline_js_1.getCoreClientOptions)(pipeline2)); - const path29 = (0, utils_common_js_1.getURLPath)(url2); - if (path29 && path29 !== "/") { + const path30 = (0, utils_common_js_1.getURLPath)(url2); + if (path30 && path30 !== "/") { this.serviceOrContainerContext = storageClientContext.container; } else { this.serviceOrContainerContext = storageClientContext.service; @@ -75162,7 +75162,7 @@ var require_downloadUtils = __commonJS({ var http_client_1 = require_lib(); var storage_blob_1 = require_commonjs15(); var buffer = __importStar2(require("buffer")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var stream2 = __importStar2(require("stream")); var util3 = __importStar2(require("util")); var utils = __importStar2(require_cacheUtils()); @@ -75273,7 +75273,7 @@ var require_downloadUtils = __commonJS({ exports2.DownloadProgress = DownloadProgress; function downloadCacheHttpClient(archiveLocation, archivePath) { return __awaiter2(this, void 0, void 0, function* () { - const writeStream = fs31.createWriteStream(archivePath); + const writeStream = fs32.createWriteStream(archivePath); const httpClient = new http_client_1.HttpClient("actions/cache"); const downloadResponse = yield (0, requestUtils_1.retryHttpClientResponse)("downloadCache", () => __awaiter2(this, void 0, void 0, function* () { return httpClient.get(archiveLocation); @@ -75298,7 +75298,7 @@ var require_downloadUtils = __commonJS({ function downloadCacheHttpClientConcurrent(archiveLocation, archivePath, options) { return __awaiter2(this, void 0, void 0, function* () { var _a2; - const archiveDescriptor = yield fs31.promises.open(archivePath, "w"); + const archiveDescriptor = yield fs32.promises.open(archivePath, "w"); const httpClient = new http_client_1.HttpClient("actions/cache", void 0, { socketTimeout: options.timeoutInMs, keepAlive: true @@ -75414,7 +75414,7 @@ var require_downloadUtils = __commonJS({ } else { const maxSegmentSize = Math.min(134217728, buffer.constants.MAX_LENGTH); const downloadProgress = new DownloadProgress(contentLength); - const fd = fs31.openSync(archivePath, "w"); + const fd = fs32.openSync(archivePath, "w"); try { downloadProgress.startDisplayTimer(); const controller = new abort_controller_1.AbortController(); @@ -75432,12 +75432,12 @@ var require_downloadUtils = __commonJS({ controller.abort(); throw new Error("Aborting cache download as the download time exceeded the timeout."); } else if (Buffer.isBuffer(result)) { - fs31.writeFileSync(fd, result); + fs32.writeFileSync(fd, result); } } } finally { downloadProgress.stopDisplayTimer(); - fs31.closeSync(fd); + fs32.closeSync(fd); } } }); @@ -75776,7 +75776,7 @@ var require_cacheHttpClient = __commonJS({ var core31 = __importStar2(require_core()); var http_client_1 = require_lib(); var auth_1 = require_auth(); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var url_1 = require("url"); var utils = __importStar2(require_cacheUtils()); var uploadUtils_1 = require_uploadUtils(); @@ -75917,7 +75917,7 @@ Other caches with similar key:`); return __awaiter2(this, void 0, void 0, function* () { const fileSize = utils.getArchiveFileSizeInBytes(archivePath); const resourceUrl = getCacheApiUrl(`caches/${cacheId.toString()}`); - const fd = fs31.openSync(archivePath, "r"); + const fd = fs32.openSync(archivePath, "r"); const uploadOptions = (0, options_1.getUploadOptions)(options); const concurrency = utils.assertDefined("uploadConcurrency", uploadOptions.uploadConcurrency); const maxChunkSize = utils.assertDefined("uploadChunkSize", uploadOptions.uploadChunkSize); @@ -75931,7 +75931,7 @@ Other caches with similar key:`); const start = offset; const end = offset + chunkSize - 1; offset += maxChunkSize; - yield uploadChunk(httpClient, resourceUrl, () => fs31.createReadStream(archivePath, { + yield uploadChunk(httpClient, resourceUrl, () => fs32.createReadStream(archivePath, { fd, start, end, @@ -75942,7 +75942,7 @@ Other caches with similar key:`); } }))); } finally { - fs31.closeSync(fd); + fs32.closeSync(fd); } return; }); @@ -81207,7 +81207,7 @@ var require_tar = __commonJS({ var exec_1 = require_exec(); var io9 = __importStar2(require_io()); var fs_1 = require("fs"); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var utils = __importStar2(require_cacheUtils()); var constants_1 = require_constants7(); var IS_WINDOWS = process.platform === "win32"; @@ -81253,13 +81253,13 @@ var require_tar = __commonJS({ const BSD_TAR_ZSTD = tarPath.type === constants_1.ArchiveToolType.BSD && compressionMethod !== constants_1.CompressionMethod.Gzip && IS_WINDOWS; switch (type) { case "create": - args.push("--posix", "-cf", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "--exclude", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "--files-from", constants_1.ManifestFilename); + args.push("--posix", "-cf", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "--exclude", BSD_TAR_ZSTD ? tarFile : cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "--files-from", constants_1.ManifestFilename); break; case "extract": - args.push("-xf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path29.sep}`, "g"), "/")); + args.push("-xf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P", "-C", workingDirectory.replace(new RegExp(`\\${path30.sep}`, "g"), "/")); break; case "list": - args.push("-tf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), "-P"); + args.push("-tf", BSD_TAR_ZSTD ? tarFile : archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), "-P"); break; } if (tarPath.type === constants_1.ArchiveToolType.GNU) { @@ -81305,7 +81305,7 @@ var require_tar = __commonJS({ return BSD_TAR_ZSTD ? [ "zstd -d --long=30 --force -o", constants_1.TarFilename, - archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/") + archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/") ] : [ "--use-compress-program", IS_WINDOWS ? '"zstd -d --long=30"' : "unzstd --long=30" @@ -81314,7 +81314,7 @@ var require_tar = __commonJS({ return BSD_TAR_ZSTD ? [ "zstd -d --force -o", constants_1.TarFilename, - archivePath.replace(new RegExp(`\\${path29.sep}`, "g"), "/") + archivePath.replace(new RegExp(`\\${path30.sep}`, "g"), "/") ] : ["--use-compress-program", IS_WINDOWS ? '"zstd -d"' : "unzstd"]; default: return ["-z"]; @@ -81329,7 +81329,7 @@ var require_tar = __commonJS({ case constants_1.CompressionMethod.Zstd: return BSD_TAR_ZSTD ? [ "zstd -T0 --long=30 --force -o", - cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), + cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), constants_1.TarFilename ] : [ "--use-compress-program", @@ -81338,7 +81338,7 @@ var require_tar = __commonJS({ case constants_1.CompressionMethod.ZstdWithoutLong: return BSD_TAR_ZSTD ? [ "zstd -T0 --force -o", - cacheFileName.replace(new RegExp(`\\${path29.sep}`, "g"), "/"), + cacheFileName.replace(new RegExp(`\\${path30.sep}`, "g"), "/"), constants_1.TarFilename ] : ["--use-compress-program", IS_WINDOWS ? '"zstd -T0"' : "zstdmt"]; default: @@ -81376,7 +81376,7 @@ var require_tar = __commonJS({ } function createTar(archiveFolder, sourceDirectories, compressionMethod) { return __awaiter2(this, void 0, void 0, function* () { - (0, fs_1.writeFileSync)(path29.join(archiveFolder, constants_1.ManifestFilename), sourceDirectories.join("\n")); + (0, fs_1.writeFileSync)(path30.join(archiveFolder, constants_1.ManifestFilename), sourceDirectories.join("\n")); const commands = yield getCommands(compressionMethod, "create"); yield execCommands(commands, archiveFolder); }); @@ -81458,7 +81458,7 @@ var require_cache4 = __commonJS({ exports2.restoreCache = restoreCache5; exports2.saveCache = saveCache5; var core31 = __importStar2(require_core()); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var utils = __importStar2(require_cacheUtils()); var cacheHttpClient = __importStar2(require_cacheHttpClient()); var cacheTwirpClient = __importStar2(require_cacheTwirpClient()); @@ -81588,7 +81588,7 @@ var require_cache4 = __commonJS({ core31.info("Lookup only - skipping download"); return cacheEntry.cacheKey; } - archivePath = path29.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); + archivePath = path30.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); core31.debug(`Archive Path: ${archivePath}`); yield cacheHttpClient.downloadCache(cacheEntry.archiveLocation, archivePath, options); if (core31.isDebug()) { @@ -81667,7 +81667,7 @@ var require_cache4 = __commonJS({ core31.info("Lookup only - skipping download"); return response.matchedKey; } - archivePath = path29.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); + archivePath = path30.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod)); core31.debug(`Archive path: ${archivePath}`); core31.debug(`Starting download of archive to: ${archivePath}`); yield cacheHttpClient.downloadCache(response.signedDownloadUrl, archivePath, options); @@ -81735,7 +81735,7 @@ var require_cache4 = __commonJS({ throw new Error(`Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`); } const archiveFolder = yield utils.createTempDirectory(); - const archivePath = path29.join(archiveFolder, utils.getCacheFileName(compressionMethod)); + const archivePath = path30.join(archiveFolder, utils.getCacheFileName(compressionMethod)); core31.debug(`Archive Path: ${archivePath}`); try { yield (0, tar_1.createTar)(archiveFolder, cachePaths, compressionMethod); @@ -81806,7 +81806,7 @@ var require_cache4 = __commonJS({ throw new Error(`Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`); } const archiveFolder = yield utils.createTempDirectory(); - const archivePath = path29.join(archiveFolder, utils.getCacheFileName(compressionMethod)); + const archivePath = path30.join(archiveFolder, utils.getCacheFileName(compressionMethod)); core31.debug(`Archive Path: ${archivePath}`); try { yield (0, tar_1.createTar)(archiveFolder, cachePaths, compressionMethod); @@ -81962,7 +81962,7 @@ var require_manifest = __commonJS({ var core_1 = require_core(); var os7 = require("os"); var cp = require("child_process"); - var fs31 = require("fs"); + var fs32 = require("fs"); function _findMatch(versionSpec, stable, candidates, archFilter) { return __awaiter2(this, void 0, void 0, function* () { const platFilter = os7.platform(); @@ -82024,10 +82024,10 @@ var require_manifest = __commonJS({ const lsbReleaseFile = "/etc/lsb-release"; const osReleaseFile = "/etc/os-release"; let contents = ""; - if (fs31.existsSync(lsbReleaseFile)) { - contents = fs31.readFileSync(lsbReleaseFile).toString(); - } else if (fs31.existsSync(osReleaseFile)) { - contents = fs31.readFileSync(osReleaseFile).toString(); + if (fs32.existsSync(lsbReleaseFile)) { + contents = fs32.readFileSync(lsbReleaseFile).toString(); + } else if (fs32.existsSync(osReleaseFile)) { + contents = fs32.readFileSync(osReleaseFile).toString(); } return contents; } @@ -82236,10 +82236,10 @@ var require_tool_cache = __commonJS({ var core31 = __importStar2(require_core()); var io9 = __importStar2(require_io()); var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var mm = __importStar2(require_manifest()); var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var httpm = __importStar2(require_lib()); var semver11 = __importStar2(require_semver2()); var stream2 = __importStar2(require("stream")); @@ -82260,8 +82260,8 @@ var require_tool_cache = __commonJS({ var userAgent2 = "actions/tool-cache"; function downloadTool3(url2, dest, auth2, headers) { return __awaiter2(this, void 0, void 0, function* () { - dest = dest || path29.join(_getTempDirectory(), crypto3.randomUUID()); - yield io9.mkdirP(path29.dirname(dest)); + dest = dest || path30.join(_getTempDirectory(), crypto3.randomUUID()); + yield io9.mkdirP(path30.dirname(dest)); core31.debug(`Downloading ${url2}`); core31.debug(`Destination ${dest}`); const maxAttempts = 3; @@ -82282,7 +82282,7 @@ var require_tool_cache = __commonJS({ } function downloadToolAttempt(url2, dest, auth2, headers) { return __awaiter2(this, void 0, void 0, function* () { - if (fs31.existsSync(dest)) { + if (fs32.existsSync(dest)) { throw new Error(`Destination file path ${dest} already exists`); } const http = new httpm.HttpClient(userAgent2, [], { @@ -82306,7 +82306,7 @@ var require_tool_cache = __commonJS({ const readStream = responseMessageFactory(); let succeeded = false; try { - yield pipeline2(readStream, fs31.createWriteStream(dest)); + yield pipeline2(readStream, fs32.createWriteStream(dest)); core31.debug("download complete"); succeeded = true; return dest; @@ -82351,7 +82351,7 @@ var require_tool_cache = __commonJS({ process.chdir(originalCwd); } } else { - const escapedScript = path29.join(__dirname, "..", "scripts", "Invoke-7zdec.ps1").replace(/'/g, "''").replace(/"|\n|\r/g, ""); + const escapedScript = path30.join(__dirname, "..", "scripts", "Invoke-7zdec.ps1").replace(/'/g, "''").replace(/"|\n|\r/g, ""); const escapedFile = file.replace(/'/g, "''").replace(/"|\n|\r/g, ""); const escapedTarget = dest.replace(/'/g, "''").replace(/"|\n|\r/g, ""); const command = `& '${escapedScript}' -Source '${escapedFile}' -Target '${escapedTarget}'`; @@ -82518,12 +82518,12 @@ var require_tool_cache = __commonJS({ arch2 = arch2 || os7.arch(); core31.debug(`Caching tool ${tool} ${version} ${arch2}`); core31.debug(`source dir: ${sourceDir}`); - if (!fs31.statSync(sourceDir).isDirectory()) { + if (!fs32.statSync(sourceDir).isDirectory()) { throw new Error("sourceDir is not a directory"); } const destPath = yield _createToolPath(tool, version, arch2); - for (const itemName of fs31.readdirSync(sourceDir)) { - const s = path29.join(sourceDir, itemName); + for (const itemName of fs32.readdirSync(sourceDir)) { + const s = path30.join(sourceDir, itemName); yield io9.cp(s, destPath, { recursive: true }); } _completeToolPath(tool, version, arch2); @@ -82536,11 +82536,11 @@ var require_tool_cache = __commonJS({ arch2 = arch2 || os7.arch(); core31.debug(`Caching tool ${tool} ${version} ${arch2}`); core31.debug(`source file: ${sourceFile}`); - if (!fs31.statSync(sourceFile).isFile()) { + if (!fs32.statSync(sourceFile).isFile()) { throw new Error("sourceFile is not a file"); } const destFolder = yield _createToolPath(tool, version, arch2); - const destPath = path29.join(destFolder, targetFile); + const destPath = path30.join(destFolder, targetFile); core31.debug(`destination file ${destPath}`); yield io9.cp(sourceFile, destPath); _completeToolPath(tool, version, arch2); @@ -82563,9 +82563,9 @@ var require_tool_cache = __commonJS({ let toolPath = ""; if (versionSpec) { versionSpec = semver11.clean(versionSpec) || ""; - const cachePath = path29.join(_getCacheDirectory(), toolName, versionSpec, arch2); + const cachePath = path30.join(_getCacheDirectory(), toolName, versionSpec, arch2); core31.debug(`checking cache: ${cachePath}`); - if (fs31.existsSync(cachePath) && fs31.existsSync(`${cachePath}.complete`)) { + if (fs32.existsSync(cachePath) && fs32.existsSync(`${cachePath}.complete`)) { core31.debug(`Found tool in cache ${toolName} ${versionSpec} ${arch2}`); toolPath = cachePath; } else { @@ -82577,13 +82577,13 @@ var require_tool_cache = __commonJS({ function findAllVersions2(toolName, arch2) { const versions = []; arch2 = arch2 || os7.arch(); - const toolPath = path29.join(_getCacheDirectory(), toolName); - if (fs31.existsSync(toolPath)) { - const children = fs31.readdirSync(toolPath); + const toolPath = path30.join(_getCacheDirectory(), toolName); + if (fs32.existsSync(toolPath)) { + const children = fs32.readdirSync(toolPath); for (const child of children) { if (isExplicitVersion(child)) { - const fullPath = path29.join(toolPath, child, arch2 || ""); - if (fs31.existsSync(fullPath) && fs31.existsSync(`${fullPath}.complete`)) { + const fullPath = path30.join(toolPath, child, arch2 || ""); + if (fs32.existsSync(fullPath) && fs32.existsSync(`${fullPath}.complete`)) { versions.push(child); } } @@ -82634,7 +82634,7 @@ var require_tool_cache = __commonJS({ function _createExtractFolder(dest) { return __awaiter2(this, void 0, void 0, function* () { if (!dest) { - dest = path29.join(_getTempDirectory(), crypto3.randomUUID()); + dest = path30.join(_getTempDirectory(), crypto3.randomUUID()); } yield io9.mkdirP(dest); return dest; @@ -82642,7 +82642,7 @@ var require_tool_cache = __commonJS({ } function _createToolPath(tool, version, arch2) { return __awaiter2(this, void 0, void 0, function* () { - const folderPath = path29.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); + const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); core31.debug(`destination ${folderPath}`); const markerPath = `${folderPath}.complete`; yield io9.rmRF(folderPath); @@ -82652,9 +82652,9 @@ var require_tool_cache = __commonJS({ }); } function _completeToolPath(tool, version, arch2) { - const folderPath = path29.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); + const folderPath = path30.join(_getCacheDirectory(), tool, semver11.clean(version) || version, arch2 || ""); const markerPath = `${folderPath}.complete`; - fs31.writeFileSync(markerPath, ""); + fs32.writeFileSync(markerPath, ""); core31.debug("finished caching tool"); } function isExplicitVersion(versionSpec) { @@ -88345,13 +88345,13 @@ These characters are not allowed in the artifact name due to limitations with ce (0, core_1.info)(`Artifact name is valid!`); } exports2.validateArtifactName = validateArtifactName; - function validateFilePath(path29) { - if (!path29) { + function validateFilePath(path30) { + if (!path30) { throw new Error(`Provided file path input during validation is empty`); } for (const [invalidCharacterKey, errorMessageForCharacter] of invalidArtifactFilePathCharacters) { - if (path29.includes(invalidCharacterKey)) { - throw new Error(`The path for one of the files in artifact is not valid: ${path29}. Contains the following character: ${errorMessageForCharacter} + if (path30.includes(invalidCharacterKey)) { + throw new Error(`The path for one of the files in artifact is not valid: ${path30}. Contains the following character: ${errorMessageForCharacter} Invalid characters include: ${Array.from(invalidArtifactFilePathCharacters.values()).toString()} @@ -88896,15 +88896,15 @@ var require_upload_zip_specification = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getUploadZipSpecification = exports2.validateRootDirectory = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core_1 = require_core(); var path_1 = require("path"); var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation(); function validateRootDirectory(rootDirectory) { - if (!fs31.existsSync(rootDirectory)) { + if (!fs32.existsSync(rootDirectory)) { throw new Error(`The provided rootDirectory ${rootDirectory} does not exist`); } - if (!fs31.statSync(rootDirectory).isDirectory()) { + if (!fs32.statSync(rootDirectory).isDirectory()) { throw new Error(`The provided rootDirectory ${rootDirectory} is not a valid directory`); } (0, core_1.info)(`Root directory input is valid!`); @@ -88915,7 +88915,7 @@ var require_upload_zip_specification = __commonJS({ rootDirectory = (0, path_1.normalize)(rootDirectory); rootDirectory = (0, path_1.resolve)(rootDirectory); for (let file of filesToZip) { - const stats = fs31.lstatSync(file, { throwIfNoEntry: false }); + const stats = fs32.lstatSync(file, { throwIfNoEntry: false }); if (!stats) { throw new Error(`File ${file} does not exist`); } @@ -89324,8 +89324,8 @@ var require_minimatch2 = __commonJS({ return new Minimatch2(pattern, options).match(p); }; module2.exports = minimatch2; - var path29 = require_path(); - minimatch2.sep = path29.sep; + var path30 = require_path(); + minimatch2.sep = path30.sep; var GLOBSTAR2 = /* @__PURE__ */ Symbol("globstar **"); minimatch2.GLOBSTAR = GLOBSTAR2; var expand3 = require_brace_expansion2(); @@ -89931,8 +89931,8 @@ var require_minimatch2 = __commonJS({ if (this.empty) return f === ""; if (f === "/" && partial) return true; const options = this.options; - if (path29.sep !== "/") { - f = f.split(path29.sep).join("/"); + if (path30.sep !== "/") { + f = f.split(path30.sep).join("/"); } f = f.split(slashSplit); this.debug(this.pattern, "split", f); @@ -89970,13 +89970,13 @@ var require_minimatch2 = __commonJS({ var require_readdir_glob = __commonJS({ "node_modules/@actions/artifact/node_modules/readdir-glob/index.js"(exports2, module2) { module2.exports = readdirGlob2; - var fs31 = require("fs"); + var fs32 = require("fs"); var { EventEmitter: EventEmitter2 } = require("events"); var { Minimatch: Minimatch2 } = require_minimatch2(); var { resolve: resolve14 } = require("path"); function readdir3(dir, strict) { return new Promise((resolve15, reject) => { - fs31.readdir(dir, { withFileTypes: true }, (err, files) => { + fs32.readdir(dir, { withFileTypes: true }, (err, files) => { if (err) { switch (err.code) { case "ENOTDIR": @@ -90009,7 +90009,7 @@ var require_readdir_glob = __commonJS({ } function stat2(file, followSymlinks) { return new Promise((resolve15, reject) => { - const statFunc = followSymlinks ? fs31.stat : fs31.lstat; + const statFunc = followSymlinks ? fs32.stat : fs32.lstat; statFunc(file, (err, stats) => { if (err) { switch (err.code) { @@ -90030,8 +90030,8 @@ var require_readdir_glob = __commonJS({ }); }); } - async function* exploreWalkAsync2(dir, path29, followSymlinks, useStat, shouldSkip, strict) { - let files = await readdir3(path29 + dir, strict); + async function* exploreWalkAsync2(dir, path30, followSymlinks, useStat, shouldSkip, strict) { + let files = await readdir3(path30 + dir, strict); for (const file of files) { let name = file.name; if (name === void 0) { @@ -90040,7 +90040,7 @@ var require_readdir_glob = __commonJS({ } const filename = dir + "/" + name; const relative3 = filename.slice(1); - const absolute = path29 + "/" + relative3; + const absolute = path30 + "/" + relative3; let stats = null; if (useStat || followSymlinks) { stats = await stat2(absolute, followSymlinks); @@ -90054,15 +90054,15 @@ var require_readdir_glob = __commonJS({ if (stats.isDirectory()) { if (!shouldSkip(relative3)) { yield { relative: relative3, absolute, stats }; - yield* exploreWalkAsync2(filename, path29, followSymlinks, useStat, shouldSkip, false); + yield* exploreWalkAsync2(filename, path30, followSymlinks, useStat, shouldSkip, false); } } else { yield { relative: relative3, absolute, stats }; } } } - async function* explore2(path29, followSymlinks, useStat, shouldSkip) { - yield* exploreWalkAsync2("", path29, followSymlinks, useStat, shouldSkip, true); + async function* explore2(path30, followSymlinks, useStat, shouldSkip) { + yield* exploreWalkAsync2("", path30, followSymlinks, useStat, shouldSkip, true); } function readOptions2(options) { return { @@ -92074,54 +92074,54 @@ var require_polyfills = __commonJS({ } var chdir; module2.exports = patch; - function patch(fs31) { + function patch(fs32) { if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) { - patchLchmod(fs31); - } - if (!fs31.lutimes) { - patchLutimes(fs31); - } - fs31.chown = chownFix(fs31.chown); - fs31.fchown = chownFix(fs31.fchown); - fs31.lchown = chownFix(fs31.lchown); - fs31.chmod = chmodFix(fs31.chmod); - fs31.fchmod = chmodFix(fs31.fchmod); - fs31.lchmod = chmodFix(fs31.lchmod); - fs31.chownSync = chownFixSync(fs31.chownSync); - fs31.fchownSync = chownFixSync(fs31.fchownSync); - fs31.lchownSync = chownFixSync(fs31.lchownSync); - fs31.chmodSync = chmodFixSync(fs31.chmodSync); - fs31.fchmodSync = chmodFixSync(fs31.fchmodSync); - fs31.lchmodSync = chmodFixSync(fs31.lchmodSync); - fs31.stat = statFix(fs31.stat); - fs31.fstat = statFix(fs31.fstat); - fs31.lstat = statFix(fs31.lstat); - fs31.statSync = statFixSync(fs31.statSync); - fs31.fstatSync = statFixSync(fs31.fstatSync); - fs31.lstatSync = statFixSync(fs31.lstatSync); - if (fs31.chmod && !fs31.lchmod) { - fs31.lchmod = function(path29, mode, cb) { + patchLchmod(fs32); + } + if (!fs32.lutimes) { + patchLutimes(fs32); + } + fs32.chown = chownFix(fs32.chown); + fs32.fchown = chownFix(fs32.fchown); + fs32.lchown = chownFix(fs32.lchown); + fs32.chmod = chmodFix(fs32.chmod); + fs32.fchmod = chmodFix(fs32.fchmod); + fs32.lchmod = chmodFix(fs32.lchmod); + fs32.chownSync = chownFixSync(fs32.chownSync); + fs32.fchownSync = chownFixSync(fs32.fchownSync); + fs32.lchownSync = chownFixSync(fs32.lchownSync); + fs32.chmodSync = chmodFixSync(fs32.chmodSync); + fs32.fchmodSync = chmodFixSync(fs32.fchmodSync); + fs32.lchmodSync = chmodFixSync(fs32.lchmodSync); + fs32.stat = statFix(fs32.stat); + fs32.fstat = statFix(fs32.fstat); + fs32.lstat = statFix(fs32.lstat); + fs32.statSync = statFixSync(fs32.statSync); + fs32.fstatSync = statFixSync(fs32.fstatSync); + fs32.lstatSync = statFixSync(fs32.lstatSync); + if (fs32.chmod && !fs32.lchmod) { + fs32.lchmod = function(path30, mode, cb) { if (cb) process.nextTick(cb); }; - fs31.lchmodSync = function() { + fs32.lchmodSync = function() { }; } - if (fs31.chown && !fs31.lchown) { - fs31.lchown = function(path29, uid, gid, cb) { + if (fs32.chown && !fs32.lchown) { + fs32.lchown = function(path30, uid, gid, cb) { if (cb) process.nextTick(cb); }; - fs31.lchownSync = function() { + fs32.lchownSync = function() { }; } if (platform2 === "win32") { - fs31.rename = typeof fs31.rename !== "function" ? fs31.rename : (function(fs$rename) { + fs32.rename = typeof fs32.rename !== "function" ? fs32.rename : (function(fs$rename) { function rename(from, to, cb) { var start = Date.now(); var backoff = 0; fs$rename(from, to, function CB(er) { if (er && (er.code === "EACCES" || er.code === "EPERM") && Date.now() - start < 6e4) { setTimeout(function() { - fs31.stat(to, function(stater, st) { + fs32.stat(to, function(stater, st) { if (stater && stater.code === "ENOENT") fs$rename(from, to, CB); else @@ -92137,9 +92137,9 @@ var require_polyfills = __commonJS({ } if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename); return rename; - })(fs31.rename); + })(fs32.rename); } - fs31.read = typeof fs31.read !== "function" ? fs31.read : (function(fs$read) { + fs32.read = typeof fs32.read !== "function" ? fs32.read : (function(fs$read) { function read(fd, buffer, offset, length, position, callback_) { var callback; if (callback_ && typeof callback_ === "function") { @@ -92147,22 +92147,22 @@ var require_polyfills = __commonJS({ callback = function(er, _2, __) { if (er && er.code === "EAGAIN" && eagCounter < 10) { eagCounter++; - return fs$read.call(fs31, fd, buffer, offset, length, position, callback); + return fs$read.call(fs32, fd, buffer, offset, length, position, callback); } callback_.apply(this, arguments); }; } - return fs$read.call(fs31, fd, buffer, offset, length, position, callback); + return fs$read.call(fs32, fd, buffer, offset, length, position, callback); } if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read); return read; - })(fs31.read); - fs31.readSync = typeof fs31.readSync !== "function" ? fs31.readSync : /* @__PURE__ */ (function(fs$readSync) { + })(fs32.read); + fs32.readSync = typeof fs32.readSync !== "function" ? fs32.readSync : /* @__PURE__ */ (function(fs$readSync) { return function(fd, buffer, offset, length, position) { var eagCounter = 0; while (true) { try { - return fs$readSync.call(fs31, fd, buffer, offset, length, position); + return fs$readSync.call(fs32, fd, buffer, offset, length, position); } catch (er) { if (er.code === "EAGAIN" && eagCounter < 10) { eagCounter++; @@ -92172,11 +92172,11 @@ var require_polyfills = __commonJS({ } } }; - })(fs31.readSync); - function patchLchmod(fs32) { - fs32.lchmod = function(path29, mode, callback) { - fs32.open( - path29, + })(fs32.readSync); + function patchLchmod(fs33) { + fs33.lchmod = function(path30, mode, callback) { + fs33.open( + path30, constants.O_WRONLY | constants.O_SYMLINK, mode, function(err, fd) { @@ -92184,80 +92184,80 @@ var require_polyfills = __commonJS({ if (callback) callback(err); return; } - fs32.fchmod(fd, mode, function(err2) { - fs32.close(fd, function(err22) { + fs33.fchmod(fd, mode, function(err2) { + fs33.close(fd, function(err22) { if (callback) callback(err2 || err22); }); }); } ); }; - fs32.lchmodSync = function(path29, mode) { - var fd = fs32.openSync(path29, constants.O_WRONLY | constants.O_SYMLINK, mode); + fs33.lchmodSync = function(path30, mode) { + var fd = fs33.openSync(path30, constants.O_WRONLY | constants.O_SYMLINK, mode); var threw = true; var ret; try { - ret = fs32.fchmodSync(fd, mode); + ret = fs33.fchmodSync(fd, mode); threw = false; } finally { if (threw) { try { - fs32.closeSync(fd); + fs33.closeSync(fd); } catch (er) { } } else { - fs32.closeSync(fd); + fs33.closeSync(fd); } } return ret; }; } - function patchLutimes(fs32) { - if (constants.hasOwnProperty("O_SYMLINK") && fs32.futimes) { - fs32.lutimes = function(path29, at, mt, cb) { - fs32.open(path29, constants.O_SYMLINK, function(er, fd) { + function patchLutimes(fs33) { + if (constants.hasOwnProperty("O_SYMLINK") && fs33.futimes) { + fs33.lutimes = function(path30, at, mt, cb) { + fs33.open(path30, constants.O_SYMLINK, function(er, fd) { if (er) { if (cb) cb(er); return; } - fs32.futimes(fd, at, mt, function(er2) { - fs32.close(fd, function(er22) { + fs33.futimes(fd, at, mt, function(er2) { + fs33.close(fd, function(er22) { if (cb) cb(er2 || er22); }); }); }); }; - fs32.lutimesSync = function(path29, at, mt) { - var fd = fs32.openSync(path29, constants.O_SYMLINK); + fs33.lutimesSync = function(path30, at, mt) { + var fd = fs33.openSync(path30, constants.O_SYMLINK); var ret; var threw = true; try { - ret = fs32.futimesSync(fd, at, mt); + ret = fs33.futimesSync(fd, at, mt); threw = false; } finally { if (threw) { try { - fs32.closeSync(fd); + fs33.closeSync(fd); } catch (er) { } } else { - fs32.closeSync(fd); + fs33.closeSync(fd); } } return ret; }; - } else if (fs32.futimes) { - fs32.lutimes = function(_a2, _b, _c, cb) { + } else if (fs33.futimes) { + fs33.lutimes = function(_a2, _b, _c, cb) { if (cb) process.nextTick(cb); }; - fs32.lutimesSync = function() { + fs33.lutimesSync = function() { }; } } function chmodFix(orig) { if (!orig) return orig; return function(target, mode, cb) { - return orig.call(fs31, target, mode, function(er) { + return orig.call(fs32, target, mode, function(er) { if (chownErOk(er)) er = null; if (cb) cb.apply(this, arguments); }); @@ -92267,7 +92267,7 @@ var require_polyfills = __commonJS({ if (!orig) return orig; return function(target, mode) { try { - return orig.call(fs31, target, mode); + return orig.call(fs32, target, mode); } catch (er) { if (!chownErOk(er)) throw er; } @@ -92276,7 +92276,7 @@ var require_polyfills = __commonJS({ function chownFix(orig) { if (!orig) return orig; return function(target, uid, gid, cb) { - return orig.call(fs31, target, uid, gid, function(er) { + return orig.call(fs32, target, uid, gid, function(er) { if (chownErOk(er)) er = null; if (cb) cb.apply(this, arguments); }); @@ -92286,7 +92286,7 @@ var require_polyfills = __commonJS({ if (!orig) return orig; return function(target, uid, gid) { try { - return orig.call(fs31, target, uid, gid); + return orig.call(fs32, target, uid, gid); } catch (er) { if (!chownErOk(er)) throw er; } @@ -92306,13 +92306,13 @@ var require_polyfills = __commonJS({ } if (cb) cb.apply(this, arguments); } - return options ? orig.call(fs31, target, options, callback) : orig.call(fs31, target, callback); + return options ? orig.call(fs32, target, options, callback) : orig.call(fs32, target, callback); }; } function statFixSync(orig) { if (!orig) return orig; return function(target, options) { - var stats = options ? orig.call(fs31, target, options) : orig.call(fs31, target); + var stats = options ? orig.call(fs32, target, options) : orig.call(fs32, target); if (stats) { if (stats.uid < 0) stats.uid += 4294967296; if (stats.gid < 0) stats.gid += 4294967296; @@ -92341,16 +92341,16 @@ var require_legacy_streams = __commonJS({ "node_modules/graceful-fs/legacy-streams.js"(exports2, module2) { var Stream = require("stream").Stream; module2.exports = legacy; - function legacy(fs31) { + function legacy(fs32) { return { ReadStream, WriteStream }; - function ReadStream(path29, options) { - if (!(this instanceof ReadStream)) return new ReadStream(path29, options); + function ReadStream(path30, options) { + if (!(this instanceof ReadStream)) return new ReadStream(path30, options); Stream.call(this); var self2 = this; - this.path = path29; + this.path = path30; this.fd = null; this.readable = true; this.paused = false; @@ -92384,7 +92384,7 @@ var require_legacy_streams = __commonJS({ }); return; } - fs31.open(this.path, this.flags, this.mode, function(err, fd) { + fs32.open(this.path, this.flags, this.mode, function(err, fd) { if (err) { self2.emit("error", err); self2.readable = false; @@ -92395,10 +92395,10 @@ var require_legacy_streams = __commonJS({ self2._read(); }); } - function WriteStream(path29, options) { - if (!(this instanceof WriteStream)) return new WriteStream(path29, options); + function WriteStream(path30, options) { + if (!(this instanceof WriteStream)) return new WriteStream(path30, options); Stream.call(this); - this.path = path29; + this.path = path30; this.fd = null; this.writable = true; this.flags = "w"; @@ -92423,7 +92423,7 @@ var require_legacy_streams = __commonJS({ this.busy = false; this._queue = []; if (this.fd === null) { - this._open = fs31.open; + this._open = fs32.open; this._queue.push([this._open, this.path, this.flags, this.mode, void 0]); this.flush(); } @@ -92458,7 +92458,7 @@ var require_clone = __commonJS({ // node_modules/graceful-fs/graceful-fs.js var require_graceful_fs = __commonJS({ "node_modules/graceful-fs/graceful-fs.js"(exports2, module2) { - var fs31 = require("fs"); + var fs32 = require("fs"); var polyfills = require_polyfills(); var legacy = require_legacy_streams(); var clone = require_clone(); @@ -92490,12 +92490,12 @@ var require_graceful_fs = __commonJS({ m = "GFS4: " + m.split(/\n/).join("\nGFS4: "); console.error(m); }; - if (!fs31[gracefulQueue]) { + if (!fs32[gracefulQueue]) { queue2 = global[gracefulQueue] || []; - publishQueue(fs31, queue2); - fs31.close = (function(fs$close) { + publishQueue(fs32, queue2); + fs32.close = (function(fs$close) { function close(fd, cb) { - return fs$close.call(fs31, fd, function(err) { + return fs$close.call(fs32, fd, function(err) { if (!err) { resetQueue(); } @@ -92507,48 +92507,48 @@ var require_graceful_fs = __commonJS({ value: fs$close }); return close; - })(fs31.close); - fs31.closeSync = (function(fs$closeSync) { + })(fs32.close); + fs32.closeSync = (function(fs$closeSync) { function closeSync(fd) { - fs$closeSync.apply(fs31, arguments); + fs$closeSync.apply(fs32, arguments); resetQueue(); } Object.defineProperty(closeSync, previousSymbol, { value: fs$closeSync }); return closeSync; - })(fs31.closeSync); + })(fs32.closeSync); if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) { process.on("exit", function() { - debug6(fs31[gracefulQueue]); - require("assert").equal(fs31[gracefulQueue].length, 0); + debug6(fs32[gracefulQueue]); + require("assert").equal(fs32[gracefulQueue].length, 0); }); } } var queue2; if (!global[gracefulQueue]) { - publishQueue(global, fs31[gracefulQueue]); - } - module2.exports = patch(clone(fs31)); - if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs31.__patched) { - module2.exports = patch(fs31); - fs31.__patched = true; - } - function patch(fs32) { - polyfills(fs32); - fs32.gracefulify = patch; - fs32.createReadStream = createReadStream4; - fs32.createWriteStream = createWriteStream3; - var fs$readFile = fs32.readFile; - fs32.readFile = readFile; - function readFile(path29, options, cb) { + publishQueue(global, fs32[gracefulQueue]); + } + module2.exports = patch(clone(fs32)); + if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs32.__patched) { + module2.exports = patch(fs32); + fs32.__patched = true; + } + function patch(fs33) { + polyfills(fs33); + fs33.gracefulify = patch; + fs33.createReadStream = createReadStream4; + fs33.createWriteStream = createWriteStream3; + var fs$readFile = fs33.readFile; + fs33.readFile = readFile; + function readFile(path30, options, cb) { if (typeof options === "function") cb = options, options = null; - return go$readFile(path29, options, cb); - function go$readFile(path30, options2, cb2, startTime) { - return fs$readFile(path30, options2, function(err) { + return go$readFile(path30, options, cb); + function go$readFile(path31, options2, cb2, startTime) { + return fs$readFile(path31, options2, function(err) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$readFile, [path30, options2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$readFile, [path31, options2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92556,16 +92556,16 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$writeFile = fs32.writeFile; - fs32.writeFile = writeFile; - function writeFile(path29, data, options, cb) { + var fs$writeFile = fs33.writeFile; + fs33.writeFile = writeFile; + function writeFile(path30, data, options, cb) { if (typeof options === "function") cb = options, options = null; - return go$writeFile(path29, data, options, cb); - function go$writeFile(path30, data2, options2, cb2, startTime) { - return fs$writeFile(path30, data2, options2, function(err) { + return go$writeFile(path30, data, options, cb); + function go$writeFile(path31, data2, options2, cb2, startTime) { + return fs$writeFile(path31, data2, options2, function(err) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$writeFile, [path30, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$writeFile, [path31, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92573,17 +92573,17 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$appendFile = fs32.appendFile; + var fs$appendFile = fs33.appendFile; if (fs$appendFile) - fs32.appendFile = appendFile; - function appendFile(path29, data, options, cb) { + fs33.appendFile = appendFile; + function appendFile(path30, data, options, cb) { if (typeof options === "function") cb = options, options = null; - return go$appendFile(path29, data, options, cb); - function go$appendFile(path30, data2, options2, cb2, startTime) { - return fs$appendFile(path30, data2, options2, function(err) { + return go$appendFile(path30, data, options, cb); + function go$appendFile(path31, data2, options2, cb2, startTime) { + return fs$appendFile(path31, data2, options2, function(err) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$appendFile, [path30, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$appendFile, [path31, data2, options2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92591,9 +92591,9 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$copyFile = fs32.copyFile; + var fs$copyFile = fs33.copyFile; if (fs$copyFile) - fs32.copyFile = copyFile2; + fs33.copyFile = copyFile2; function copyFile2(src, dest, flags, cb) { if (typeof flags === "function") { cb = flags; @@ -92611,34 +92611,34 @@ var require_graceful_fs = __commonJS({ }); } } - var fs$readdir = fs32.readdir; - fs32.readdir = readdir3; + var fs$readdir = fs33.readdir; + fs33.readdir = readdir3; var noReaddirOptionVersions = /^v[0-5]\./; - function readdir3(path29, options, cb) { + function readdir3(path30, options, cb) { if (typeof options === "function") cb = options, options = null; - var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path30, options2, cb2, startTime) { - return fs$readdir(path30, fs$readdirCallback( - path30, + var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path31, options2, cb2, startTime) { + return fs$readdir(path31, fs$readdirCallback( + path31, options2, cb2, startTime )); - } : function go$readdir2(path30, options2, cb2, startTime) { - return fs$readdir(path30, options2, fs$readdirCallback( - path30, + } : function go$readdir2(path31, options2, cb2, startTime) { + return fs$readdir(path31, options2, fs$readdirCallback( + path31, options2, cb2, startTime )); }; - return go$readdir(path29, options, cb); - function fs$readdirCallback(path30, options2, cb2, startTime) { + return go$readdir(path30, options, cb); + function fs$readdirCallback(path31, options2, cb2, startTime) { return function(err, files) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) enqueue([ go$readdir, - [path30, options2, cb2], + [path31, options2, cb2], err, startTime || Date.now(), Date.now() @@ -92653,21 +92653,21 @@ var require_graceful_fs = __commonJS({ } } if (process.version.substr(0, 4) === "v0.8") { - var legStreams = legacy(fs32); + var legStreams = legacy(fs33); ReadStream = legStreams.ReadStream; WriteStream = legStreams.WriteStream; } - var fs$ReadStream = fs32.ReadStream; + var fs$ReadStream = fs33.ReadStream; if (fs$ReadStream) { ReadStream.prototype = Object.create(fs$ReadStream.prototype); ReadStream.prototype.open = ReadStream$open; } - var fs$WriteStream = fs32.WriteStream; + var fs$WriteStream = fs33.WriteStream; if (fs$WriteStream) { WriteStream.prototype = Object.create(fs$WriteStream.prototype); WriteStream.prototype.open = WriteStream$open; } - Object.defineProperty(fs32, "ReadStream", { + Object.defineProperty(fs33, "ReadStream", { get: function() { return ReadStream; }, @@ -92677,7 +92677,7 @@ var require_graceful_fs = __commonJS({ enumerable: true, configurable: true }); - Object.defineProperty(fs32, "WriteStream", { + Object.defineProperty(fs33, "WriteStream", { get: function() { return WriteStream; }, @@ -92688,7 +92688,7 @@ var require_graceful_fs = __commonJS({ configurable: true }); var FileReadStream = ReadStream; - Object.defineProperty(fs32, "FileReadStream", { + Object.defineProperty(fs33, "FileReadStream", { get: function() { return FileReadStream; }, @@ -92699,7 +92699,7 @@ var require_graceful_fs = __commonJS({ configurable: true }); var FileWriteStream = WriteStream; - Object.defineProperty(fs32, "FileWriteStream", { + Object.defineProperty(fs33, "FileWriteStream", { get: function() { return FileWriteStream; }, @@ -92709,7 +92709,7 @@ var require_graceful_fs = __commonJS({ enumerable: true, configurable: true }); - function ReadStream(path29, options) { + function ReadStream(path30, options) { if (this instanceof ReadStream) return fs$ReadStream.apply(this, arguments), this; else @@ -92729,7 +92729,7 @@ var require_graceful_fs = __commonJS({ } }); } - function WriteStream(path29, options) { + function WriteStream(path30, options) { if (this instanceof WriteStream) return fs$WriteStream.apply(this, arguments), this; else @@ -92747,22 +92747,22 @@ var require_graceful_fs = __commonJS({ } }); } - function createReadStream4(path29, options) { - return new fs32.ReadStream(path29, options); + function createReadStream4(path30, options) { + return new fs33.ReadStream(path30, options); } - function createWriteStream3(path29, options) { - return new fs32.WriteStream(path29, options); + function createWriteStream3(path30, options) { + return new fs33.WriteStream(path30, options); } - var fs$open = fs32.open; - fs32.open = open; - function open(path29, flags, mode, cb) { + var fs$open = fs33.open; + fs33.open = open; + function open(path30, flags, mode, cb) { if (typeof mode === "function") cb = mode, mode = null; - return go$open(path29, flags, mode, cb); - function go$open(path30, flags2, mode2, cb2, startTime) { - return fs$open(path30, flags2, mode2, function(err, fd) { + return go$open(path30, flags, mode, cb); + function go$open(path31, flags2, mode2, cb2, startTime) { + return fs$open(path31, flags2, mode2, function(err, fd) { if (err && (err.code === "EMFILE" || err.code === "ENFILE")) - enqueue([go$open, [path30, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]); + enqueue([go$open, [path31, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]); else { if (typeof cb2 === "function") cb2.apply(this, arguments); @@ -92770,20 +92770,20 @@ var require_graceful_fs = __commonJS({ }); } } - return fs32; + return fs33; } function enqueue(elem) { debug6("ENQUEUE", elem[0].name, elem[1]); - fs31[gracefulQueue].push(elem); + fs32[gracefulQueue].push(elem); retry2(); } var retryTimer; function resetQueue() { var now = Date.now(); - for (var i = 0; i < fs31[gracefulQueue].length; ++i) { - if (fs31[gracefulQueue][i].length > 2) { - fs31[gracefulQueue][i][3] = now; - fs31[gracefulQueue][i][4] = now; + for (var i = 0; i < fs32[gracefulQueue].length; ++i) { + if (fs32[gracefulQueue][i].length > 2) { + fs32[gracefulQueue][i][3] = now; + fs32[gracefulQueue][i][4] = now; } } retry2(); @@ -92791,9 +92791,9 @@ var require_graceful_fs = __commonJS({ function retry2() { clearTimeout(retryTimer); retryTimer = void 0; - if (fs31[gracefulQueue].length === 0) + if (fs32[gracefulQueue].length === 0) return; - var elem = fs31[gracefulQueue].shift(); + var elem = fs32[gracefulQueue].shift(); var fn = elem[0]; var args = elem[1]; var err = elem[2]; @@ -92815,7 +92815,7 @@ var require_graceful_fs = __commonJS({ debug6("RETRY", fn.name, args); fn.apply(null, args.concat([startTime])); } else { - fs31[gracefulQueue].push(elem); + fs32[gracefulQueue].push(elem); } } if (retryTimer === void 0) { @@ -94867,22 +94867,22 @@ var require_lazystream = __commonJS({ // node_modules/normalize-path/index.js var require_normalize_path = __commonJS({ "node_modules/normalize-path/index.js"(exports2, module2) { - module2.exports = function(path29, stripTrailing) { - if (typeof path29 !== "string") { + module2.exports = function(path30, stripTrailing) { + if (typeof path30 !== "string") { throw new TypeError("expected path to be a string"); } - if (path29 === "\\" || path29 === "/") return "/"; - var len = path29.length; - if (len <= 1) return path29; + if (path30 === "\\" || path30 === "/") return "/"; + var len = path30.length; + if (len <= 1) return path30; var prefix = ""; - if (len > 4 && path29[3] === "\\") { - var ch = path29[2]; - if ((ch === "?" || ch === ".") && path29.slice(0, 2) === "\\\\") { - path29 = path29.slice(2); + if (len > 4 && path30[3] === "\\") { + var ch = path30[2]; + if ((ch === "?" || ch === ".") && path30.slice(0, 2) === "\\\\") { + path30 = path30.slice(2); prefix = "//"; } } - var segs = path29.split(/[/\\]+/); + var segs = path30.split(/[/\\]+/); if (stripTrailing !== false && segs[segs.length - 1] === "") { segs.pop(); } @@ -103638,7 +103638,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur g.minimatch.escape = vi.escape; g.minimatch.unescape = Ei.unescape; }); - var fs31 = R((Wt) => { + var fs32 = R((Wt) => { "use strict"; Object.defineProperty(Wt, "__esModule", { value: true }); Wt.LRUCache = void 0; @@ -104507,7 +104507,7 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur }; Object.defineProperty(_2, "__esModule", { value: true }); _2.PathScurry = _2.Path = _2.PathScurryDarwin = _2.PathScurryPosix = _2.PathScurryWin32 = _2.PathScurryBase = _2.PathPosix = _2.PathWin32 = _2.PathBase = _2.ChildrenCache = _2.ResolveCache = void 0; - var Qt = fs31(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => { + var Qt = fs32(), Yt = require("node:path"), yr = require("node:url"), pt = require("fs"), Sr = br(require("node:fs")), vr = pt.realpathSync.native, Ht = require("node:fs/promises"), bs = Oe(), mt = { lstatSync: pt.lstatSync, readdir: pt.readdir, readdirSync: pt.readdirSync, readlinkSync: pt.readlinkSync, realpathSync: vr, promises: { lstat: Ht.lstat, readdir: Ht.readdir, readlink: Ht.readlink, realpath: Ht.realpath } }, _s = (n) => !n || n === mt || n === Sr ? mt : { ...mt, ...n, promises: { ...mt.promises, ...n.promises || {} } }, Os = /^\\\\\?\\([a-z]:)\\?$/i, Er = (n) => n.replace(/\//g, "\\").replace(Os, "$1\\"), _r = /[\\\/]/, N = 0, xs = 1, Ts = 2, G = 4, Cs = 6, Rs = 8, Q = 10, As = 12, j = 15, dt = ~j, xe = 16, ys = 32, gt = 64, W = 128, Vt = 256, Xt = 512, Ss = gt | W | Xt, Or = 1023, Te = (n) => n.isFile() ? Rs : n.isDirectory() ? G : n.isSymbolicLink() ? Q : n.isCharacterDevice() ? Ts : n.isBlockDevice() ? Cs : n.isSocket() ? As : n.isFIFO() ? xs : N, vs = new Qt.LRUCache({ max: 2 ** 12 }), wt = (n) => { let t = vs.get(n); if (t) return t; let e = n.normalize("NFKD"); @@ -105885,8 +105885,8 @@ globstar while`, t, d, e, u, m), this.matchOne(t.slice(d), e.slice(u), s)) retur // node_modules/archiver-utils/file.js var require_file3 = __commonJS({ "node_modules/archiver-utils/file.js"(exports2, module2) { - var fs31 = require_graceful_fs(); - var path29 = require("path"); + var fs32 = require_graceful_fs(); + var path30 = require("path"); var flatten = require_flatten(); var difference = require_difference(); var union = require_union(); @@ -105911,8 +105911,8 @@ var require_file3 = __commonJS({ return result; }; file.exists = function() { - var filepath = path29.join.apply(path29, arguments); - return fs31.existsSync(filepath); + var filepath = path30.join.apply(path30, arguments); + return fs32.existsSync(filepath); }; file.expand = function(...args) { var options = isPlainObject4(args[0]) ? args.shift() : {}; @@ -105925,12 +105925,12 @@ var require_file3 = __commonJS({ }); if (options.filter) { matches = matches.filter(function(filepath) { - filepath = path29.join(options.cwd || "", filepath); + filepath = path30.join(options.cwd || "", filepath); try { if (typeof options.filter === "function") { return options.filter(filepath); } else { - return fs31.statSync(filepath)[options.filter](); + return fs32.statSync(filepath)[options.filter](); } } catch (e) { return false; @@ -105942,7 +105942,7 @@ var require_file3 = __commonJS({ file.expandMapping = function(patterns, destBase, options) { options = Object.assign({ rename: function(destBase2, destPath) { - return path29.join(destBase2 || "", destPath); + return path30.join(destBase2 || "", destPath); } }, options); var files = []; @@ -105950,14 +105950,14 @@ var require_file3 = __commonJS({ file.expand(options, patterns).forEach(function(src) { var destPath = src; if (options.flatten) { - destPath = path29.basename(destPath); + destPath = path30.basename(destPath); } if (options.ext) { destPath = destPath.replace(/(\.[^\/]*)?$/, options.ext); } var dest = options.rename(destBase, destPath, options); if (options.cwd) { - src = path29.join(options.cwd, src); + src = path30.join(options.cwd, src); } dest = dest.replace(pathSeparatorRe, "/"); src = src.replace(pathSeparatorRe, "/"); @@ -106038,8 +106038,8 @@ var require_file3 = __commonJS({ // node_modules/archiver-utils/index.js var require_archiver_utils = __commonJS({ "node_modules/archiver-utils/index.js"(exports2, module2) { - var fs31 = require_graceful_fs(); - var path29 = require("path"); + var fs32 = require_graceful_fs(); + var path30 = require("path"); var isStream2 = require_is_stream(); var lazystream = require_lazystream(); var normalizePath4 = require_normalize_path(); @@ -106087,7 +106087,7 @@ var require_archiver_utils = __commonJS({ }; utils.lazyReadStream = function(filepath) { return new lazystream.Readable(function() { - return fs31.createReadStream(filepath); + return fs32.createReadStream(filepath); }); }; utils.normalizeInputSource = function(source) { @@ -106115,7 +106115,7 @@ var require_archiver_utils = __commonJS({ callback = base; base = dirpath; } - fs31.readdir(dirpath, function(err, list) { + fs32.readdir(dirpath, function(err, list) { var i = 0; var file; var filepath; @@ -106127,11 +106127,11 @@ var require_archiver_utils = __commonJS({ if (!file) { return callback(null, results); } - filepath = path29.join(dirpath, file); - fs31.stat(filepath, function(err2, stats) { + filepath = path30.join(dirpath, file); + fs32.stat(filepath, function(err2, stats) { results.push({ path: filepath, - relative: path29.relative(base, filepath).replace(/\\/g, "/"), + relative: path30.relative(base, filepath).replace(/\\/g, "/"), stats }); if (stats && stats.isDirectory()) { @@ -106190,10 +106190,10 @@ var require_error3 = __commonJS({ // node_modules/@actions/artifact/node_modules/archiver/lib/core.js var require_core2 = __commonJS({ "node_modules/@actions/artifact/node_modules/archiver/lib/core.js"(exports2, module2) { - var fs31 = require("fs"); + var fs32 = require("fs"); var glob2 = require_readdir_glob(); var async = require_async(); - var path29 = require("path"); + var path30 = require("path"); var util3 = require_archiver_utils(); var inherits = require("util").inherits; var ArchiverError2 = require_error3(); @@ -106254,7 +106254,7 @@ var require_core2 = __commonJS({ data.sourcePath = filepath; task.data = data; this._entriesCount++; - if (data.stats && data.stats instanceof fs31.Stats) { + if (data.stats && data.stats instanceof fs32.Stats) { task = this._updateQueueTaskWithStats(task, data.stats); if (task) { if (data.stats.size) { @@ -106425,7 +106425,7 @@ var require_core2 = __commonJS({ callback(); return; } - fs31.lstat(task.filepath, function(err, stats) { + fs32.lstat(task.filepath, function(err, stats) { if (this._state.aborted) { setImmediate(callback); return; @@ -106468,10 +106468,10 @@ var require_core2 = __commonJS({ task.data.sourceType = "buffer"; task.source = Buffer.concat([]); } else if (stats.isSymbolicLink() && this._moduleSupports("symlink")) { - var linkPath = fs31.readlinkSync(task.filepath); - var dirName = path29.dirname(task.filepath); + var linkPath = fs32.readlinkSync(task.filepath); + var dirName = path30.dirname(task.filepath); task.data.type = "symlink"; - task.data.linkname = path29.relative(dirName, path29.resolve(dirName, linkPath)); + task.data.linkname = path30.relative(dirName, path30.resolve(dirName, linkPath)); task.data.sourceType = "buffer"; task.source = Buffer.concat([]); } else { @@ -110921,8 +110921,8 @@ var require_context2 = __commonJS({ if ((0, fs_1.existsSync)(process.env.GITHUB_EVENT_PATH)) { this.payload = JSON.parse((0, fs_1.readFileSync)(process.env.GITHUB_EVENT_PATH, { encoding: "utf8" })); } else { - const path29 = process.env.GITHUB_EVENT_PATH; - process.stdout.write(`GITHUB_EVENT_PATH ${path29} does not exist${os_1.EOL}`); + const path30 = process.env.GITHUB_EVENT_PATH; + process.stdout.write(`GITHUB_EVENT_PATH ${path30} does not exist${os_1.EOL}`); } } this.eventName = process.env.GITHUB_EVENT_NAME; @@ -115818,7 +115818,7 @@ var require_traverse = __commonJS({ })(this.value); }; function walk(root, cb, immutable) { - var path29 = []; + var path30 = []; var parents = []; var alive = true; return (function walker(node_) { @@ -115827,11 +115827,11 @@ var require_traverse = __commonJS({ var state = { node, node_, - path: [].concat(path29), + path: [].concat(path30), parent: parents.slice(-1)[0], - key: path29.slice(-1)[0], - isRoot: path29.length === 0, - level: path29.length, + key: path30.slice(-1)[0], + isRoot: path30.length === 0, + level: path30.length, circular: null, update: function(x) { if (!state.isRoot) { @@ -115886,7 +115886,7 @@ var require_traverse = __commonJS({ parents.push(state); var keys = Object.keys(state.node); keys.forEach(function(key, i2) { - path29.push(key); + path30.push(key); if (modifiers.pre) modifiers.pre.call(state, state.node[key], key); var child = walker(state.node[key]); if (immutable && Object.hasOwnProperty.call(state.node, key)) { @@ -115895,7 +115895,7 @@ var require_traverse = __commonJS({ child.isLast = i2 == keys.length - 1; child.isFirst = i2 == 0; if (modifiers.post) modifiers.post.call(state, child); - path29.pop(); + path30.pop(); }); parents.pop(); } @@ -116916,11 +116916,11 @@ var require_unzip_stream = __commonJS({ return requiredLength; case states.CENTRAL_DIRECTORY_FILE_HEADER_SUFFIX: var isUtf8 = (this.parsedEntity.flags & 2048) !== 0; - var path29 = this._decodeString(chunk.slice(0, this.parsedEntity.fileNameLength), isUtf8); + var path30 = this._decodeString(chunk.slice(0, this.parsedEntity.fileNameLength), isUtf8); var extraDataBuffer = chunk.slice(this.parsedEntity.fileNameLength, this.parsedEntity.fileNameLength + this.parsedEntity.extraFieldLength); var extra = this._readExtraFields(extraDataBuffer); if (extra && extra.parsed && extra.parsed.path && !isUtf8) { - path29 = extra.parsed.path; + path30 = extra.parsed.path; } this.parsedEntity.extra = extra.parsed; var isUnix = (this.parsedEntity.versionMadeBy & 65280) >> 8 === 3; @@ -116932,7 +116932,7 @@ var require_unzip_stream = __commonJS({ } if (this.options.debug) { const debugObj = Object.assign({}, this.parsedEntity, { - path: path29, + path: path30, flags: "0x" + this.parsedEntity.flags.toString(16), unixAttrs: unixAttrs && "0" + unixAttrs.toString(8), isSymlink, @@ -117369,8 +117369,8 @@ var require_parser_stream = __commonJS({ // node_modules/mkdirp/index.js var require_mkdirp = __commonJS({ "node_modules/mkdirp/index.js"(exports2, module2) { - var path29 = require("path"); - var fs31 = require("fs"); + var path30 = require("path"); + var fs32 = require("fs"); var _0777 = parseInt("0777", 8); module2.exports = mkdirP.mkdirp = mkdirP.mkdirP = mkdirP; function mkdirP(p, opts, f, made) { @@ -117381,7 +117381,7 @@ var require_mkdirp = __commonJS({ opts = { mode: opts }; } var mode = opts.mode; - var xfs = opts.fs || fs31; + var xfs = opts.fs || fs32; if (mode === void 0) { mode = _0777; } @@ -117389,7 +117389,7 @@ var require_mkdirp = __commonJS({ var cb = f || /* istanbul ignore next */ function() { }; - p = path29.resolve(p); + p = path30.resolve(p); xfs.mkdir(p, mode, function(er) { if (!er) { made = made || p; @@ -117397,8 +117397,8 @@ var require_mkdirp = __commonJS({ } switch (er.code) { case "ENOENT": - if (path29.dirname(p) === p) return cb(er); - mkdirP(path29.dirname(p), opts, function(er2, made2) { + if (path30.dirname(p) === p) return cb(er); + mkdirP(path30.dirname(p), opts, function(er2, made2) { if (er2) cb(er2, made2); else mkdirP(p, opts, cb, made2); }); @@ -117420,19 +117420,19 @@ var require_mkdirp = __commonJS({ opts = { mode: opts }; } var mode = opts.mode; - var xfs = opts.fs || fs31; + var xfs = opts.fs || fs32; if (mode === void 0) { mode = _0777; } if (!made) made = null; - p = path29.resolve(p); + p = path30.resolve(p); try { xfs.mkdirSync(p, mode); made = made || p; } catch (err0) { switch (err0.code) { case "ENOENT": - made = sync(path29.dirname(p), opts, made); + made = sync(path30.dirname(p), opts, made); sync(p, opts, made); break; // In the case of any other error, just see if there's a dir @@ -117457,8 +117457,8 @@ var require_mkdirp = __commonJS({ // node_modules/unzip-stream/lib/extract.js var require_extract2 = __commonJS({ "node_modules/unzip-stream/lib/extract.js"(exports2, module2) { - var fs31 = require("fs"); - var path29 = require("path"); + var fs32 = require("fs"); + var path30 = require("path"); var util3 = require("util"); var mkdirp = require_mkdirp(); var Transform5 = require("stream").Transform; @@ -117500,11 +117500,11 @@ var require_extract2 = __commonJS({ }; Extract.prototype._processEntry = function(entry) { var self2 = this; - var destPath = path29.join(this.opts.path, entry.path); - var directory = entry.isDirectory ? destPath : path29.dirname(destPath); + var destPath = path30.join(this.opts.path, entry.path); + var directory = entry.isDirectory ? destPath : path30.dirname(destPath); this.unfinishedEntries++; var writeFileFn = function() { - var pipedStream = fs31.createWriteStream(destPath); + var pipedStream = fs32.createWriteStream(destPath); pipedStream.on("close", function() { self2.unfinishedEntries--; self2._notifyAwaiter(); @@ -117628,10 +117628,10 @@ var require_download_artifact = __commonJS({ parsed.search = ""; return parsed.toString(); }; - function exists(path29) { + function exists(path30) { return __awaiter2(this, void 0, void 0, function* () { try { - yield promises_1.default.access(path29); + yield promises_1.default.access(path30); return true; } catch (error3) { if (error3.code === "ENOENT") { @@ -117863,12 +117863,12 @@ var require_dist_node11 = __commonJS({ octokit.log.debug("request", options); const start = Date.now(); const requestOptions = octokit.request.endpoint.parse(options); - const path29 = requestOptions.url.replace(options.baseUrl, ""); + const path30 = requestOptions.url.replace(options.baseUrl, ""); return request3(options).then((response) => { - octokit.log.info(`${requestOptions.method} ${path29} - ${response.status} in ${Date.now() - start}ms`); + octokit.log.info(`${requestOptions.method} ${path30} - ${response.status} in ${Date.now() - start}ms`); return response; }).catch((error3) => { - octokit.log.info(`${requestOptions.method} ${path29} - ${error3.status} in ${Date.now() - start}ms`); + octokit.log.info(`${requestOptions.method} ${path30} - ${error3.status} in ${Date.now() - start}ms`); throw error3; }); }); @@ -118702,7 +118702,7 @@ var require_file_command2 = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.prepareKeyValueMessage = exports2.issueFileCommand = void 0; var crypto3 = __importStar2(require("crypto")); - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var os7 = __importStar2(require("os")); var utils_1 = require_utils10(); function issueFileCommand(command, message) { @@ -118710,10 +118710,10 @@ var require_file_command2 = __commonJS({ if (!filePath) { throw new Error(`Unable to find environment variable for file command ${command}`); } - if (!fs31.existsSync(filePath)) { + if (!fs32.existsSync(filePath)) { throw new Error(`Missing file at path: ${filePath}`); } - fs31.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { + fs32.appendFileSync(filePath, `${(0, utils_1.toCommandValue)(message)}${os7.EOL}`, { encoding: "utf8" }); } @@ -119963,7 +119963,7 @@ var require_path_utils2 = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.toPlatformPath = exports2.toWin32Path = exports2.toPosixPath = void 0; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function toPosixPath(pth) { return pth.replace(/[\\]/g, "/"); } @@ -119973,7 +119973,7 @@ var require_path_utils2 = __commonJS({ } exports2.toWin32Path = toWin32Path; function toPlatformPath(pth) { - return pth.replace(/[/\\]/g, path29.sep); + return pth.replace(/[/\\]/g, path30.sep); } exports2.toPlatformPath = toPlatformPath; } @@ -120036,12 +120036,12 @@ var require_io_util2 = __commonJS({ var _a2; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getCmdPath = exports2.tryGetExecutablePath = exports2.isRooted = exports2.isDirectory = exports2.exists = exports2.READONLY = exports2.UV_FS_O_EXLOCK = exports2.IS_WINDOWS = exports2.unlink = exports2.symlink = exports2.stat = exports2.rmdir = exports2.rm = exports2.rename = exports2.readlink = exports2.readdir = exports2.open = exports2.mkdir = exports2.lstat = exports2.copyFile = exports2.chmod = void 0; - var fs31 = __importStar2(require("fs")); - var path29 = __importStar2(require("path")); - _a2 = fs31.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.readlink = _a2.readlink, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; + var fs32 = __importStar2(require("fs")); + var path30 = __importStar2(require("path")); + _a2 = fs32.promises, exports2.chmod = _a2.chmod, exports2.copyFile = _a2.copyFile, exports2.lstat = _a2.lstat, exports2.mkdir = _a2.mkdir, exports2.open = _a2.open, exports2.readdir = _a2.readdir, exports2.readlink = _a2.readlink, exports2.rename = _a2.rename, exports2.rm = _a2.rm, exports2.rmdir = _a2.rmdir, exports2.stat = _a2.stat, exports2.symlink = _a2.symlink, exports2.unlink = _a2.unlink; exports2.IS_WINDOWS = process.platform === "win32"; exports2.UV_FS_O_EXLOCK = 268435456; - exports2.READONLY = fs31.constants.O_RDONLY; + exports2.READONLY = fs32.constants.O_RDONLY; function exists(fsPath) { return __awaiter2(this, void 0, void 0, function* () { try { @@ -120086,7 +120086,7 @@ var require_io_util2 = __commonJS({ } if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { - const upperExt = path29.extname(filePath).toUpperCase(); + const upperExt = path30.extname(filePath).toUpperCase(); if (extensions.some((validExt) => validExt.toUpperCase() === upperExt)) { return filePath; } @@ -120110,11 +120110,11 @@ var require_io_util2 = __commonJS({ if (stats && stats.isFile()) { if (exports2.IS_WINDOWS) { try { - const directory = path29.dirname(filePath); - const upperName = path29.basename(filePath).toUpperCase(); + const directory = path30.dirname(filePath); + const upperName = path30.basename(filePath).toUpperCase(); for (const actualName of yield exports2.readdir(directory)) { if (upperName === actualName.toUpperCase()) { - filePath = path29.join(directory, actualName); + filePath = path30.join(directory, actualName); break; } } @@ -120209,7 +120209,7 @@ var require_io2 = __commonJS({ Object.defineProperty(exports2, "__esModule", { value: true }); exports2.findInPath = exports2.which = exports2.mkdirP = exports2.rmRF = exports2.mv = exports2.cp = void 0; var assert_1 = require("assert"); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var ioUtil = __importStar2(require_io_util2()); function cp(source, dest, options = {}) { return __awaiter2(this, void 0, void 0, function* () { @@ -120218,7 +120218,7 @@ var require_io2 = __commonJS({ if (destStat && destStat.isFile() && !force) { return; } - const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path29.join(dest, path29.basename(source)) : dest; + const newDest = destStat && destStat.isDirectory() && copySourceDirectory ? path30.join(dest, path30.basename(source)) : dest; if (!(yield ioUtil.exists(source))) { throw new Error(`no such file or directory: ${source}`); } @@ -120230,7 +120230,7 @@ var require_io2 = __commonJS({ yield cpDirRecursive(source, newDest, 0, force); } } else { - if (path29.relative(source, newDest) === "") { + if (path30.relative(source, newDest) === "") { throw new Error(`'${newDest}' and '${source}' are the same file`); } yield copyFile2(source, newDest, force); @@ -120243,7 +120243,7 @@ var require_io2 = __commonJS({ if (yield ioUtil.exists(dest)) { let destExists = true; if (yield ioUtil.isDirectory(dest)) { - dest = path29.join(dest, path29.basename(source)); + dest = path30.join(dest, path30.basename(source)); destExists = yield ioUtil.exists(dest); } if (destExists) { @@ -120254,7 +120254,7 @@ var require_io2 = __commonJS({ } } } - yield mkdirP(path29.dirname(dest)); + yield mkdirP(path30.dirname(dest)); yield ioUtil.rename(source, dest); }); } @@ -120317,7 +120317,7 @@ var require_io2 = __commonJS({ } const extensions = []; if (ioUtil.IS_WINDOWS && process.env["PATHEXT"]) { - for (const extension of process.env["PATHEXT"].split(path29.delimiter)) { + for (const extension of process.env["PATHEXT"].split(path30.delimiter)) { if (extension) { extensions.push(extension); } @@ -120330,12 +120330,12 @@ var require_io2 = __commonJS({ } return []; } - if (tool.includes(path29.sep)) { + if (tool.includes(path30.sep)) { return []; } const directories = []; if (process.env.PATH) { - for (const p of process.env.PATH.split(path29.delimiter)) { + for (const p of process.env.PATH.split(path30.delimiter)) { if (p) { directories.push(p); } @@ -120343,7 +120343,7 @@ var require_io2 = __commonJS({ } const matches = []; for (const directory of directories) { - const filePath = yield ioUtil.tryGetExecutablePath(path29.join(directory, tool), extensions); + const filePath = yield ioUtil.tryGetExecutablePath(path30.join(directory, tool), extensions); if (filePath) { matches.push(filePath); } @@ -120459,7 +120459,7 @@ var require_toolrunner2 = __commonJS({ var os7 = __importStar2(require("os")); var events = __importStar2(require("events")); var child = __importStar2(require("child_process")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var io9 = __importStar2(require_io2()); var ioUtil = __importStar2(require_io_util2()); var timers_1 = require("timers"); @@ -120674,7 +120674,7 @@ var require_toolrunner2 = __commonJS({ exec() { return __awaiter2(this, void 0, void 0, function* () { if (!ioUtil.isRooted(this.toolPath) && (this.toolPath.includes("/") || IS_WINDOWS && this.toolPath.includes("\\"))) { - this.toolPath = path29.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); + this.toolPath = path30.resolve(process.cwd(), this.options.cwd || process.cwd(), this.toolPath); } this.toolPath = yield io9.which(this.toolPath, true); return new Promise((resolve14, reject) => __awaiter2(this, void 0, void 0, function* () { @@ -121174,7 +121174,7 @@ var require_core3 = __commonJS({ var file_command_1 = require_file_command2(); var utils_1 = require_utils10(); var os7 = __importStar2(require("os")); - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); var oidc_utils_1 = require_oidc_utils2(); var ExitCode; (function(ExitCode2) { @@ -121202,7 +121202,7 @@ var require_core3 = __commonJS({ } else { (0, command_1.issueCommand)("add-path", {}, inputPath); } - process.env["PATH"] = `${inputPath}${path29.delimiter}${process.env["PATH"]}`; + process.env["PATH"] = `${inputPath}${path30.delimiter}${process.env["PATH"]}`; } exports2.addPath = addPath2; function getInput2(name, options) { @@ -121378,13 +121378,13 @@ These characters are not allowed in the artifact name due to limitations with ce (0, core_1.info)(`Artifact name is valid!`); } exports2.checkArtifactName = checkArtifactName; - function checkArtifactFilePath(path29) { - if (!path29) { - throw new Error(`Artifact path: ${path29}, is incorrectly provided`); + function checkArtifactFilePath(path30) { + if (!path30) { + throw new Error(`Artifact path: ${path30}, is incorrectly provided`); } for (const [invalidCharacterKey, errorMessageForCharacter] of invalidArtifactFilePathCharacters) { - if (path29.includes(invalidCharacterKey)) { - throw new Error(`Artifact path is not valid: ${path29}. Contains the following character: ${errorMessageForCharacter} + if (path30.includes(invalidCharacterKey)) { + throw new Error(`Artifact path is not valid: ${path30}. Contains the following character: ${errorMessageForCharacter} Invalid characters include: ${Array.from(invalidArtifactFilePathCharacters.values()).toString()} @@ -121430,25 +121430,25 @@ var require_upload_specification = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getUploadSpecification = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core_1 = require_core3(); var path_1 = require("path"); var path_and_artifact_name_validation_1 = require_path_and_artifact_name_validation2(); function getUploadSpecification(artifactName, rootDirectory, artifactFiles) { const specifications = []; - if (!fs31.existsSync(rootDirectory)) { + if (!fs32.existsSync(rootDirectory)) { throw new Error(`Provided rootDirectory ${rootDirectory} does not exist`); } - if (!fs31.statSync(rootDirectory).isDirectory()) { + if (!fs32.statSync(rootDirectory).isDirectory()) { throw new Error(`Provided rootDirectory ${rootDirectory} is not a valid directory`); } rootDirectory = (0, path_1.normalize)(rootDirectory); rootDirectory = (0, path_1.resolve)(rootDirectory); for (let file of artifactFiles) { - if (!fs31.existsSync(file)) { + if (!fs32.existsSync(file)) { throw new Error(`File ${file} does not exist`); } - if (!fs31.statSync(file).isDirectory()) { + if (!fs32.statSync(file).isDirectory()) { file = (0, path_1.normalize)(file); file = (0, path_1.resolve)(file); if (!file.startsWith(rootDirectory)) { @@ -121473,11 +121473,11 @@ var require_upload_specification = __commonJS({ // node_modules/tmp/lib/tmp.js var require_tmp = __commonJS({ "node_modules/tmp/lib/tmp.js"(exports2, module2) { - var fs31 = require("fs"); + var fs32 = require("fs"); var os7 = require("os"); - var path29 = require("path"); + var path30 = require("path"); var crypto3 = require("crypto"); - var _c = { fs: fs31.constants, os: os7.constants }; + var _c = { fs: fs32.constants, os: os7.constants }; var RANDOM_CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; var TEMPLATE_PATTERN = /XXXXXX/; var DEFAULT_TRIES = 3; @@ -121489,13 +121489,13 @@ var require_tmp = __commonJS({ var FILE_MODE = 384; var EXIT = "exit"; var _removeObjects = []; - var FN_RMDIR_SYNC = fs31.rmdirSync.bind(fs31); + var FN_RMDIR_SYNC = fs32.rmdirSync.bind(fs32); var _gracefulCleanup = false; function rimraf(dirPath, callback) { - return fs31.rm(dirPath, { recursive: true }, callback); + return fs32.rm(dirPath, { recursive: true }, callback); } function FN_RIMRAF_SYNC(dirPath) { - return fs31.rmSync(dirPath, { recursive: true }); + return fs32.rmSync(dirPath, { recursive: true }); } function tmpName(options, callback) { const args = _parseArguments(options, callback), opts = args[0], cb = args[1]; @@ -121505,7 +121505,7 @@ var require_tmp = __commonJS({ (function _getUniqueName() { try { const name = _generateTmpName(sanitizedOptions); - fs31.stat(name, function(err2) { + fs32.stat(name, function(err2) { if (!err2) { if (tries-- > 0) return _getUniqueName(); return cb(new Error("Could not get a unique tmp filename, max tries reached " + name)); @@ -121525,7 +121525,7 @@ var require_tmp = __commonJS({ do { const name = _generateTmpName(sanitizedOptions); try { - fs31.statSync(name); + fs32.statSync(name); } catch (e) { return name; } @@ -121536,10 +121536,10 @@ var require_tmp = __commonJS({ const args = _parseArguments(options, callback), opts = args[0], cb = args[1]; tmpName(opts, function _tmpNameCreated(err, name) { if (err) return cb(err); - fs31.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) { + fs32.open(name, CREATE_FLAGS, opts.mode || FILE_MODE, function _fileCreated(err2, fd) { if (err2) return cb(err2); if (opts.discardDescriptor) { - return fs31.close(fd, function _discardCallback(possibleErr) { + return fs32.close(fd, function _discardCallback(possibleErr) { return cb(possibleErr, name, void 0, _prepareTmpFileRemoveCallback(name, -1, opts, false)); }); } else { @@ -121553,9 +121553,9 @@ var require_tmp = __commonJS({ const args = _parseArguments(options), opts = args[0]; const discardOrDetachDescriptor = opts.discardDescriptor || opts.detachDescriptor; const name = tmpNameSync(opts); - let fd = fs31.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE); + let fd = fs32.openSync(name, CREATE_FLAGS, opts.mode || FILE_MODE); if (opts.discardDescriptor) { - fs31.closeSync(fd); + fs32.closeSync(fd); fd = void 0; } return { @@ -121568,7 +121568,7 @@ var require_tmp = __commonJS({ const args = _parseArguments(options, callback), opts = args[0], cb = args[1]; tmpName(opts, function _tmpNameCreated(err, name) { if (err) return cb(err); - fs31.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) { + fs32.mkdir(name, opts.mode || DIR_MODE, function _dirCreated(err2) { if (err2) return cb(err2); cb(null, name, _prepareTmpDirRemoveCallback(name, opts, false)); }); @@ -121577,7 +121577,7 @@ var require_tmp = __commonJS({ function dirSync(options) { const args = _parseArguments(options), opts = args[0]; const name = tmpNameSync(opts); - fs31.mkdirSync(name, opts.mode || DIR_MODE); + fs32.mkdirSync(name, opts.mode || DIR_MODE); return { name, removeCallback: _prepareTmpDirRemoveCallback(name, opts, true) @@ -121591,20 +121591,20 @@ var require_tmp = __commonJS({ next(); }; if (0 <= fdPath[0]) - fs31.close(fdPath[0], function() { - fs31.unlink(fdPath[1], _handler); + fs32.close(fdPath[0], function() { + fs32.unlink(fdPath[1], _handler); }); - else fs31.unlink(fdPath[1], _handler); + else fs32.unlink(fdPath[1], _handler); } function _removeFileSync(fdPath) { let rethrownException = null; try { - if (0 <= fdPath[0]) fs31.closeSync(fdPath[0]); + if (0 <= fdPath[0]) fs32.closeSync(fdPath[0]); } catch (e) { if (!_isEBADF(e) && !_isENOENT(e)) throw e; } finally { try { - fs31.unlinkSync(fdPath[1]); + fs32.unlinkSync(fdPath[1]); } catch (e) { if (!_isENOENT(e)) rethrownException = e; } @@ -121620,7 +121620,7 @@ var require_tmp = __commonJS({ return sync ? removeCallbackSync : removeCallback; } function _prepareTmpDirRemoveCallback(name, opts, sync) { - const removeFunction = opts.unsafeCleanup ? rimraf : fs31.rmdir.bind(fs31); + const removeFunction = opts.unsafeCleanup ? rimraf : fs32.rmdir.bind(fs32); const removeFunctionSync = opts.unsafeCleanup ? FN_RIMRAF_SYNC : FN_RMDIR_SYNC; const removeCallbackSync = _prepareRemoveCallback(removeFunctionSync, name, sync); const removeCallback = _prepareRemoveCallback(removeFunction, name, sync, removeCallbackSync); @@ -121682,35 +121682,35 @@ var require_tmp = __commonJS({ return [actualOptions, callback]; } function _resolvePath(name, tmpDir, cb) { - const pathToResolve = path29.isAbsolute(name) ? name : path29.join(tmpDir, name); - fs31.stat(pathToResolve, function(err) { + const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name); + fs32.stat(pathToResolve, function(err) { if (err) { - fs31.realpath(path29.dirname(pathToResolve), function(err2, parentDir) { + fs32.realpath(path30.dirname(pathToResolve), function(err2, parentDir) { if (err2) return cb(err2); - cb(null, path29.join(parentDir, path29.basename(pathToResolve))); + cb(null, path30.join(parentDir, path30.basename(pathToResolve))); }); } else { - fs31.realpath(pathToResolve, cb); + fs32.realpath(pathToResolve, cb); } }); } function _resolvePathSync(name, tmpDir) { - const pathToResolve = path29.isAbsolute(name) ? name : path29.join(tmpDir, name); + const pathToResolve = path30.isAbsolute(name) ? name : path30.join(tmpDir, name); try { - fs31.statSync(pathToResolve); - return fs31.realpathSync(pathToResolve); + fs32.statSync(pathToResolve); + return fs32.realpathSync(pathToResolve); } catch (_err) { - const parentDir = fs31.realpathSync(path29.dirname(pathToResolve)); - return path29.join(parentDir, path29.basename(pathToResolve)); + const parentDir = fs32.realpathSync(path30.dirname(pathToResolve)); + return path30.join(parentDir, path30.basename(pathToResolve)); } } function _generateTmpName(opts) { const tmpDir = opts.tmpdir; if (!_isUndefined(opts.name)) { - return path29.join(tmpDir, opts.dir, opts.name); + return path30.join(tmpDir, opts.dir, opts.name); } if (!_isUndefined(opts.template)) { - return path29.join(tmpDir, opts.dir, opts.template).replace(TEMPLATE_PATTERN, _randomChars(6)); + return path30.join(tmpDir, opts.dir, opts.template).replace(TEMPLATE_PATTERN, _randomChars(6)); } const name = [ opts.prefix ? opts.prefix : "tmp", @@ -121720,7 +121720,7 @@ var require_tmp = __commonJS({ _randomChars(12), opts.postfix ? "-" + opts.postfix : "" ].join(""); - return path29.join(tmpDir, opts.dir, name); + return path30.join(tmpDir, opts.dir, name); } function _assertPath(option, value) { if (typeof value !== "string") { @@ -121734,8 +121734,8 @@ var require_tmp = __commonJS({ function _assertOptionsBase(options) { if (!_isUndefined(options.name)) { const name = options.name; - if (path29.isAbsolute(name)) throw new Error(`name option must not contain an absolute path, found "${name}".`); - const basename2 = path29.basename(name); + if (path30.isAbsolute(name)) throw new Error(`name option must not contain an absolute path, found "${name}".`); + const basename2 = path30.basename(name); if (basename2 === ".." || basename2 === "." || basename2 !== name) { throw new Error(`name option must not contain a path, found "${name}".`); } @@ -121764,8 +121764,8 @@ var require_tmp = __commonJS({ if (_isUndefined(name)) return cb(null); _resolvePath(name, tmpDir, function(err, resolvedPath) { if (err) return cb(err); - const relativePath2 = path29.relative(tmpDir, resolvedPath); - if (relativePath2.startsWith("..") || path29.isAbsolute(relativePath2)) { + const relativePath2 = path30.relative(tmpDir, resolvedPath); + if (relativePath2.startsWith("..") || path30.isAbsolute(relativePath2)) { return cb(new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath2}".`)); } cb(null, relativePath2); @@ -121774,8 +121774,8 @@ var require_tmp = __commonJS({ function _getRelativePathSync(option, name, tmpDir) { if (_isUndefined(name)) return; const resolvedPath = _resolvePathSync(name, tmpDir); - const relativePath2 = path29.relative(tmpDir, resolvedPath); - if (relativePath2.startsWith("..") || path29.isAbsolute(relativePath2)) { + const relativePath2 = path30.relative(tmpDir, resolvedPath); + if (relativePath2.startsWith("..") || path30.isAbsolute(relativePath2)) { throw new Error(`${option} option must be relative to "${tmpDir}", found "${relativePath2}".`); } return relativePath2; @@ -121821,10 +121821,10 @@ var require_tmp = __commonJS({ _gracefulCleanup = true; } function _getTmpDir(options, cb) { - return fs31.realpath(options && options.tmpdir || os7.tmpdir(), cb); + return fs32.realpath(options && options.tmpdir || os7.tmpdir(), cb); } function _getTmpDirSync(options) { - return fs31.realpathSync(options && options.tmpdir || os7.tmpdir()); + return fs32.realpathSync(options && options.tmpdir || os7.tmpdir()); } process.addListener(EXIT, _garbageCollector); Object.defineProperty(module2.exports, "tmpdir", { @@ -121854,14 +121854,14 @@ var require_tmp_promise = __commonJS({ var fileWithOptions = promisify( (options, cb) => tmp.file( options, - (err, path29, fd, cleanup) => err ? cb(err) : cb(void 0, { path: path29, fd, cleanup: promisify(cleanup) }) + (err, path30, fd, cleanup) => err ? cb(err) : cb(void 0, { path: path30, fd, cleanup: promisify(cleanup) }) ) ); module2.exports.file = async (options) => fileWithOptions(options); module2.exports.withFile = async function withFile(fn, options) { - const { path: path29, fd, cleanup } = await module2.exports.file(options); + const { path: path30, fd, cleanup } = await module2.exports.file(options); try { - return await fn({ path: path29, fd }); + return await fn({ path: path30, fd }); } finally { await cleanup(); } @@ -121870,14 +121870,14 @@ var require_tmp_promise = __commonJS({ var dirWithOptions = promisify( (options, cb) => tmp.dir( options, - (err, path29, cleanup) => err ? cb(err) : cb(void 0, { path: path29, cleanup: promisify(cleanup) }) + (err, path30, cleanup) => err ? cb(err) : cb(void 0, { path: path30, cleanup: promisify(cleanup) }) ) ); module2.exports.dir = async (options) => dirWithOptions(options); module2.exports.withDir = async function withDir(fn, options) { - const { path: path29, cleanup } = await module2.exports.dir(options); + const { path: path30, cleanup } = await module2.exports.dir(options); try { - return await fn({ path: path29 }); + return await fn({ path: path30 }); } finally { await cleanup(); } @@ -122678,10 +122678,10 @@ var require_upload_gzip = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.createGZipFileInBuffer = exports2.createGZipFileOnDisk = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var zlib3 = __importStar2(require("zlib")); var util_1 = require("util"); - var stat2 = (0, util_1.promisify)(fs31.stat); + var stat2 = (0, util_1.promisify)(fs32.stat); var gzipExemptFileExtensions = [ ".gz", ".gzip", @@ -122714,9 +122714,9 @@ var require_upload_gzip = __commonJS({ } } return new Promise((resolve14, reject) => { - const inputStream = fs31.createReadStream(originalFilePath); + const inputStream = fs32.createReadStream(originalFilePath); const gzip = zlib3.createGzip(); - const outputStream = fs31.createWriteStream(tempFilePath); + const outputStream = fs32.createWriteStream(tempFilePath); inputStream.pipe(gzip).pipe(outputStream); outputStream.on("finish", () => __awaiter2(this, void 0, void 0, function* () { const size = (yield stat2(tempFilePath)).size; @@ -122734,7 +122734,7 @@ var require_upload_gzip = __commonJS({ return __awaiter2(this, void 0, void 0, function* () { return new Promise((resolve14) => __awaiter2(this, void 0, void 0, function* () { var _a2, e_1, _b, _c; - const inputStream = fs31.createReadStream(originalFilePath); + const inputStream = fs32.createReadStream(originalFilePath); const gzip = zlib3.createGzip(); inputStream.pipe(gzip); const chunks = []; @@ -122943,7 +122943,7 @@ var require_upload_http_client = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.UploadHttpClient = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core31 = __importStar2(require_core3()); var tmp = __importStar2(require_tmp_promise()); var stream2 = __importStar2(require("stream")); @@ -122957,7 +122957,7 @@ var require_upload_http_client = __commonJS({ var http_manager_1 = require_http_manager(); var upload_gzip_1 = require_upload_gzip(); var requestUtils_1 = require_requestUtils2(); - var stat2 = (0, util_1.promisify)(fs31.stat); + var stat2 = (0, util_1.promisify)(fs32.stat); var UploadHttpClient = class { constructor() { this.uploadHttpManager = new http_manager_1.HttpManager((0, config_variables_1.getUploadFileConcurrency)(), "@actions/artifact-upload"); @@ -123094,7 +123094,7 @@ var require_upload_http_client = __commonJS({ let openUploadStream; if (totalFileSize < buffer.byteLength) { core31.debug(`The gzip file created for ${parameters.file} did not help with reducing the size of the file. The original file will be uploaded as-is`); - openUploadStream = () => fs31.createReadStream(parameters.file); + openUploadStream = () => fs32.createReadStream(parameters.file); isGzip = false; uploadFileSize = totalFileSize; } else { @@ -123140,7 +123140,7 @@ var require_upload_http_client = __commonJS({ failedChunkSizes += chunkSize; continue; } - const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs31.createReadStream(uploadFilePath, { + const result = yield this.uploadChunk(httpClientIndex, parameters.resourceUrl, () => fs32.createReadStream(uploadFilePath, { start: startChunkIndex, end: endChunkIndex, autoClose: false @@ -123335,7 +123335,7 @@ var require_download_http_client = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.DownloadHttpClient = void 0; - var fs31 = __importStar2(require("fs")); + var fs32 = __importStar2(require("fs")); var core31 = __importStar2(require_core3()); var zlib3 = __importStar2(require("zlib")); var utils_1 = require_utils11(); @@ -123426,7 +123426,7 @@ var require_download_http_client = __commonJS({ return __awaiter2(this, void 0, void 0, function* () { let retryCount = 0; const retryLimit = (0, config_variables_1.getRetryLimit)(); - let destinationStream = fs31.createWriteStream(downloadPath); + let destinationStream = fs32.createWriteStream(downloadPath); const headers = (0, utils_1.getDownloadHeaders)("application/json", true, true); const makeDownloadRequest = () => __awaiter2(this, void 0, void 0, function* () { const client = this.downloadHttpManager.getClient(httpClientIndex); @@ -123468,7 +123468,7 @@ var require_download_http_client = __commonJS({ } }); yield (0, utils_1.rmFile)(fileDownloadPath); - destinationStream = fs31.createWriteStream(fileDownloadPath); + destinationStream = fs32.createWriteStream(fileDownloadPath); }); while (retryCount <= retryLimit) { let response; @@ -123585,21 +123585,21 @@ var require_download_specification = __commonJS({ }; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.getDownloadSpecification = void 0; - var path29 = __importStar2(require("path")); + var path30 = __importStar2(require("path")); function getDownloadSpecification(artifactName, artifactEntries, downloadPath, includeRootDirectory) { const directories = /* @__PURE__ */ new Set(); const specifications = { - rootDownloadLocation: includeRootDirectory ? path29.join(downloadPath, artifactName) : downloadPath, + rootDownloadLocation: includeRootDirectory ? path30.join(downloadPath, artifactName) : downloadPath, directoryStructure: [], emptyFilesToCreate: [], filesToDownload: [] }; for (const entry of artifactEntries) { if (entry.path.startsWith(`${artifactName}/`) || entry.path.startsWith(`${artifactName}\\`)) { - const normalizedPathEntry = path29.normalize(entry.path); - const filePath = path29.join(downloadPath, includeRootDirectory ? normalizedPathEntry : normalizedPathEntry.replace(artifactName, "")); + const normalizedPathEntry = path30.normalize(entry.path); + const filePath = path30.join(downloadPath, includeRootDirectory ? normalizedPathEntry : normalizedPathEntry.replace(artifactName, "")); if (entry.itemType === "file") { - directories.add(path29.dirname(filePath)); + directories.add(path30.dirname(filePath)); if (entry.fileLength === 0) { specifications.emptyFilesToCreate.push(filePath); } else { @@ -123741,7 +123741,7 @@ Note: The size of downloaded zips can differ significantly from the reported siz return uploadResponse; }); } - downloadArtifact(name, path29, options) { + downloadArtifact(name, path30, options) { return __awaiter2(this, void 0, void 0, function* () { const downloadHttpClient = new download_http_client_1.DownloadHttpClient(); const artifacts = yield downloadHttpClient.listArtifacts(); @@ -123755,12 +123755,12 @@ Note: The size of downloaded zips can differ significantly from the reported siz throw new Error(`Unable to find an artifact with the name: ${name}`); } const items = yield downloadHttpClient.getContainerItems(artifactToDownload.name, artifactToDownload.fileContainerResourceUrl); - if (!path29) { - path29 = (0, config_variables_1.getWorkSpaceDirectory)(); + if (!path30) { + path30 = (0, config_variables_1.getWorkSpaceDirectory)(); } - path29 = (0, path_1.normalize)(path29); - path29 = (0, path_1.resolve)(path29); - const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(name, items.value, path29, (options === null || options === void 0 ? void 0 : options.createArtifactFolder) || false); + path30 = (0, path_1.normalize)(path30); + path30 = (0, path_1.resolve)(path30); + const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(name, items.value, path30, (options === null || options === void 0 ? void 0 : options.createArtifactFolder) || false); if (downloadSpecification.filesToDownload.length === 0) { core31.info(`No downloadable files were found for the artifact: ${artifactToDownload.name}`); } else { @@ -123775,7 +123775,7 @@ Note: The size of downloaded zips can differ significantly from the reported siz }; }); } - downloadAllArtifacts(path29) { + downloadAllArtifacts(path30) { return __awaiter2(this, void 0, void 0, function* () { const downloadHttpClient = new download_http_client_1.DownloadHttpClient(); const response = []; @@ -123784,18 +123784,18 @@ Note: The size of downloaded zips can differ significantly from the reported siz core31.info("Unable to find any artifacts for the associated workflow"); return response; } - if (!path29) { - path29 = (0, config_variables_1.getWorkSpaceDirectory)(); + if (!path30) { + path30 = (0, config_variables_1.getWorkSpaceDirectory)(); } - path29 = (0, path_1.normalize)(path29); - path29 = (0, path_1.resolve)(path29); + path30 = (0, path_1.normalize)(path30); + path30 = (0, path_1.resolve)(path30); let downloadedArtifacts = 0; while (downloadedArtifacts < artifacts.count) { const currentArtifactToDownload = artifacts.value[downloadedArtifacts]; downloadedArtifacts += 1; core31.info(`starting download of artifact ${currentArtifactToDownload.name} : ${downloadedArtifacts}/${artifacts.count}`); const items = yield downloadHttpClient.getContainerItems(currentArtifactToDownload.name, currentArtifactToDownload.fileContainerResourceUrl); - const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(currentArtifactToDownload.name, items.value, path29, true); + const downloadSpecification = (0, download_specification_1.getDownloadSpecification)(currentArtifactToDownload.name, items.value, path30, true); if (downloadSpecification.filesToDownload.length === 0) { core31.info(`No downloadable files were found for any artifact ${currentArtifactToDownload.name}`); } else { @@ -141674,8 +141674,8 @@ __export(entry_points_exports, { module.exports = __toCommonJS(entry_points_exports); // src/analyze-action.ts -var fs22 = __toESM(require("fs")); -var import_path4 = __toESM(require("path")); +var fs23 = __toESM(require("fs")); +var import_path5 = __toESM(require("path")); var import_perf_hooks4 = require("perf_hooks"); var core16 = __toESM(require_core()); @@ -141769,21 +141769,21 @@ async function getFolderSize(itemPath, options) { getFolderSize.loose = async (itemPath, options) => await core(itemPath, options); getFolderSize.strict = async (itemPath, options) => await core(itemPath, options, { strict: true }); async function core(rootItemPath, options = {}, returnType = {}) { - const fs31 = options.fs || await import("node:fs/promises"); + const fs32 = options.fs || await import("node:fs/promises"); let folderSize = 0n; const foundInos = /* @__PURE__ */ new Set(); const errors = []; await processItem(rootItemPath); async function processItem(itemPath) { if (options.ignore?.test(itemPath)) return; - const stats = returnType.strict ? await fs31.lstat(itemPath, { bigint: true }) : await fs31.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3)); + const stats = returnType.strict ? await fs32.lstat(itemPath, { bigint: true }) : await fs32.lstat(itemPath, { bigint: true }).catch((error3) => errors.push(error3)); if (typeof stats !== "object") return; if (!foundInos.has(stats.ino)) { foundInos.add(stats.ino); folderSize += stats.size; } if (stats.isDirectory()) { - const directoryItems = returnType.strict ? await fs31.readdir(itemPath) : await fs31.readdir(itemPath).catch((error3) => errors.push(error3)); + const directoryItems = returnType.strict ? await fs32.readdir(itemPath) : await fs32.readdir(itemPath).catch((error3) => errors.push(error3)); if (typeof directoryItems !== "object") return; await Promise.all( directoryItems.map( @@ -144782,7 +144782,7 @@ function array(validator) { }; return { validate: validate2, - check: (val, opts, path29) => { + check: (val, opts, path30) => { const result = successfulCheckSchema(); if (!isArray(val)) { result.valid = false; @@ -144790,7 +144790,7 @@ function array(validator) { } let index2 = 0; for (const e of val) { - const elementPath = `${path29}[${index2}]`; + const elementPath = `${path30}[${index2}]`; const eResult = validator.check(e, opts, `${elementPath}`); result.invalidKeys.push(...eResult.invalidKeys); result.unknownKeys.push(...eResult.unknownKeys); @@ -144816,11 +144816,11 @@ function object(schema) { validate: (val) => { return isObject(val) && validateSchema(schema, val); }, - check: (val, opts, path29) => { + check: (val, opts, path30) => { if (!isObject(val)) { return invalidCheckSchema(); } - return checkSchema(schema, val, opts, path29); + return checkSchema(schema, val, opts, path30); }, required: true }; @@ -144830,11 +144830,11 @@ function optionalOrNull(validator) { validate: (val) => { return val === void 0 || val === null || validator.validate(val); }, - check: (val, opts, path29) => { + check: (val, opts, path30) => { if (val === void 0 || val === null) { return successfulCheckSchema(); } - return validator.check(val, opts, path29); + return validator.check(val, opts, path30); }, required: false }; @@ -144844,11 +144844,11 @@ function optional(validator) { validate: (val) => { return val === void 0 || validator.validate(val); }, - check: (val, opts, path29) => { + check: (val, opts, path30) => { if (val === void 0) { return successfulCheckSchema(); } - return validator.check(val, opts, path29); + return validator.check(val, opts, path30); }, required: false }; @@ -144875,7 +144875,7 @@ function invalidCheckSchema() { invalidKeys: [] }; } -function checkSchema(schema, obj, options = {}, path29 = "") { +function checkSchema(schema, obj, options = {}, path30 = "") { const result = successfulCheckSchema(); const inputKeys = new Set(Object.keys(obj)); const invalidKeys = /* @__PURE__ */ new Set(); @@ -144898,7 +144898,7 @@ function checkSchema(schema, obj, options = {}, path29 = "") { continue; } if (hasKey) { - const checkResult = validator.check(obj[key], options, `${path29}.${key}`); + const checkResult = validator.check(obj[key], options, `${path30}.${key}`); result.unknownKeys.push(...checkResult.unknownKeys); result.invalidKeys.push(...checkResult.invalidKeys); if (checkResult.invalidKeys.length > 0) { @@ -144915,10 +144915,10 @@ function checkSchema(schema, obj, options = {}, path29 = "") { invalidKeys.delete(key); } for (const remainingKey of inputKeys) { - result.unknownKeys.push(`${path29}.${remainingKey}`); + result.unknownKeys.push(`${path30}.${remainingKey}`); } for (const invalidKey of invalidKeys) { - result.invalidKeys.push(`${path29}.${invalidKey}`); + result.invalidKeys.push(`${path30}.${invalidKey}`); } return result; } @@ -145241,7 +145241,6 @@ function asHTTPError(arg) { } return void 0; } -var cachedCodeQlVersion = void 0; function isVersionInfo(x) { const candidate = x; return typeof candidate === "object" && candidate !== null && typeof candidate.version === "string" && (candidate.features === void 0 || typeof candidate.features === "object" && candidate.features !== null) && (candidate.overlayVersion === void 0 || typeof candidate.overlayVersion === "number"); @@ -145250,42 +145249,6 @@ function isPersistedVersionInfo(x) { const candidate = x; return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && isVersionInfo(candidate.version); } -function getPathToCodeQLVersionCacheFile(env) { - return path.join(getTemporaryDirectory(env), "version.json"); -} -function cacheCodeQlVersion(cmd, version, env = getEnv()) { - if (cachedCodeQlVersion !== void 0) { - throw new Error("cacheCodeQlVersion() should be called only once"); - } - cachedCodeQlVersion = version; - fs.writeFileSync( - getPathToCodeQLVersionCacheFile(env), - JSON.stringify({ cmd, version }), - "utf8" - ); -} -function getCachedCodeQlVersion(cmd, env = getEnv()) { - if (cachedCodeQlVersion !== void 0) { - return cachedCodeQlVersion; - } - let serialized; - try { - serialized = fs.readFileSync(getPathToCodeQLVersionCacheFile(env), "utf8"); - } catch { - return void 0; - } - let persisted; - try { - persisted = JSON.parse(serialized); - } catch { - return void 0; - } - if (!isPersistedVersionInfo(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { - return void 0; - } - cachedCodeQlVersion = persisted.version; - return cachedCodeQlVersion; -} async function codeQlVersionAtLeast(codeql, requiredVersion) { return semver.gte((await codeql.getVersion()).version, requiredVersion); } @@ -146288,6 +146251,48 @@ function wrapApiConfigurationError(e) { return e; } +// src/cli/output-cache.ts +var fs3 = __toESM(require("fs")); +var import_path = __toESM(require("path")); +var COMMAND_CACHE_FILENAME = "codeql-action-command-cache.json"; +var cachedCodeQlVersion = void 0; +function getCommandCacheFilePath(env) { + return import_path.default.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME); +} +function cacheCodeQlVersion(cmd, version, env = getEnv()) { + if (cachedCodeQlVersion !== void 0) { + throw new Error("cacheCodeQlVersion() should be called only once"); + } + cachedCodeQlVersion = version; + fs3.writeFileSync( + getCommandCacheFilePath(env), + JSON.stringify({ cmd, version }), + "utf8" + ); +} +function getCachedCodeQlVersion(cmd, env = getEnv()) { + if (cachedCodeQlVersion !== void 0) { + return cachedCodeQlVersion; + } + let serialized; + try { + serialized = fs3.readFileSync(getCommandCacheFilePath(env), "utf8"); + } catch { + return void 0; + } + let persisted; + try { + persisted = JSON.parse(serialized); + } catch { + return void 0; + } + if (!isPersistedVersionInfo(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { + return void 0; + } + cachedCodeQlVersion = persisted.version; + return cachedCodeQlVersion; +} + // src/config/pack-registries.ts function parseRegistries(registriesInput) { try { @@ -146306,9 +146311,9 @@ function parseRegistriesWithoutCredentials(registriesInput) { } // src/git-utils.ts -var fs3 = __toESM(require("fs")); +var fs4 = __toESM(require("fs")); var os2 = __toESM(require("os")); -var path3 = __toESM(require("path")); +var path4 = __toESM(require("path")); var core6 = __toESM(require_core()); var toolrunner2 = __toESM(require_toolrunner()); var io3 = __toESM(require_io()); @@ -146457,7 +146462,7 @@ var getGitRoot = async function(sourceRoot) { } }; function hasSubmodules(gitRoot) { - return fs3.existsSync(path3.join(gitRoot, ".gitmodules")); + return fs4.existsSync(path4.join(gitRoot, ".gitmodules")); } var getFileOidsUnderPath = async function(basePath) { const gitRoot = await getGitRoot(basePath); @@ -147070,8 +147075,8 @@ async function runInActions(action) { } // src/feature-flags.ts -var fs5 = __toESM(require("fs")); -var path5 = __toESM(require("path")); +var fs6 = __toESM(require("fs")); +var path6 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json @@ -147079,8 +147084,8 @@ var bundleVersion = "codeql-bundle-v2.26.2"; var cliVersion = "2.26.2"; // src/overlay/index.ts -var fs4 = __toESM(require("fs")); -var path4 = __toESM(require("path")); +var fs5 = __toESM(require("fs")); +var path5 = __toESM(require("path")); var CODEQL_OVERLAY_MINIMUM_VERSION = "2.23.8"; var CODEQL_OVERLAY_MINIMUM_VERSION_CPP = "2.25.0"; var CODEQL_OVERLAY_MINIMUM_VERSION_CSHARP = "2.24.1"; @@ -147093,12 +147098,12 @@ async function writeBaseDatabaseOidsFile(config, sourceRoot) { const gitFileOids = await getFileOidsUnderPath(sourceRoot); const gitFileOidsJson = JSON.stringify(gitFileOids); const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config); - await fs4.promises.writeFile(baseDatabaseOidsFilePath, gitFileOidsJson); + await fs5.promises.writeFile(baseDatabaseOidsFilePath, gitFileOidsJson); } async function readBaseDatabaseOidsFile(config, logger) { const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config); try { - const contents = await fs4.promises.readFile( + const contents = await fs5.promises.readFile( baseDatabaseOidsFilePath, "utf-8" ); @@ -147120,14 +147125,14 @@ async function writeOverlayChangesFile(config, sourceRoot, logger) { const diffRangeFiles = await getDiffRangeFilePaths(sourceRoot, logger); const changedFiles = [.../* @__PURE__ */ new Set([...oidChangedFiles, ...diffRangeFiles])]; const changedFilesJson = JSON.stringify({ changes: changedFiles }); - const overlayChangesFile = path4.join( + const overlayChangesFile = path5.join( getTemporaryDirectory(), "overlay-changes.json" ); logger.debug( `Writing overlay changed files to ${overlayChangesFile}: ${changedFilesJson}` ); - await fs4.promises.writeFile(overlayChangesFile, changedFilesJson); + await fs5.promises.writeFile(overlayChangesFile, changedFilesJson); return overlayChangesFile; } function computeChangedFiles(baseFileOids, overlayFileOids) { @@ -147146,7 +147151,7 @@ function computeChangedFiles(baseFileOids, overlayFileOids) { } async function getDiffRangeFilePaths(sourceRoot, logger) { const jsonFilePath = getDiffRangesJsonFilePath(); - if (!fs4.existsSync(jsonFilePath)) { + if (!fs5.existsSync(jsonFilePath)) { logger.debug( `No diff ranges JSON file found at ${jsonFilePath}; skipping.` ); @@ -147154,7 +147159,7 @@ async function getDiffRangeFilePaths(sourceRoot, logger) { } let contents; try { - contents = await fs4.promises.readFile(jsonFilePath, "utf8"); + contents = await fs5.promises.readFile(jsonFilePath, "utf8"); } catch (e) { logger.warning( `Failed to read diff ranges JSON file at ${jsonFilePath}: ${e}` @@ -147186,7 +147191,7 @@ async function getDiffRangeFilePaths(sourceRoot, logger) { return [...new Set(diffRanges.map((r) => r.path))]; } const relativePaths = diffRanges.map( - (r) => path4.relative(sourceRoot, path4.join(repoRoot, r.path)).replaceAll(path4.sep, "/") + (r) => path5.relative(sourceRoot, path5.join(repoRoot, r.path)).replaceAll(path5.sep, "/") ).filter((rel) => !rel.startsWith("..")); return [...new Set(relativePaths)]; } @@ -147556,7 +147561,7 @@ var Features = class extends OfflineFeatures { super(logger); this.gitHubFeatureFlags = new GitHubFeatureFlags( repositoryNwo, - path5.join(tempDir, FEATURE_FLAGS_FILE_NAME), + path6.join(tempDir, FEATURE_FLAGS_FILE_NAME), logger ); } @@ -147688,12 +147693,12 @@ var GitHubFeatureFlags = class { } async readLocalFlags() { try { - if (fs5.existsSync(this.featureFlagsFile)) { + if (fs6.existsSync(this.featureFlagsFile)) { this.logger.debug( `Loading feature flags from ${this.featureFlagsFile}` ); return JSON.parse( - fs5.readFileSync(this.featureFlagsFile, "utf8") + fs6.readFileSync(this.featureFlagsFile, "utf8") ); } } catch (e) { @@ -147706,7 +147711,7 @@ var GitHubFeatureFlags = class { async writeLocalFlags(flags) { try { this.logger.debug(`Writing feature flags to ${this.featureFlagsFile}`); - fs5.writeFileSync(this.featureFlagsFile, JSON.stringify(flags)); + fs6.writeFileSync(this.featureFlagsFile, JSON.stringify(flags)); } catch (e) { this.logger.warning( `Error writing cached feature flags file ${this.featureFlagsFile}: ${e}.` @@ -147921,8 +147926,8 @@ var SarifScanOrder = [ ]; // src/analyze.ts -var fs16 = __toESM(require("fs")); -var path15 = __toESM(require("path")); +var fs17 = __toESM(require("fs")); +var path16 = __toESM(require("path")); var import_perf_hooks3 = require("perf_hooks"); var io5 = __toESM(require_io()); @@ -147930,8 +147935,8 @@ var io5 = __toESM(require_io()); var core13 = __toESM(require_core()); // src/codeql.ts -var fs15 = __toESM(require("fs")); -var path14 = __toESM(require("path")); +var fs16 = __toESM(require("fs")); +var path15 = __toESM(require("path")); var core12 = __toESM(require_core()); var toolrunner3 = __toESM(require_toolrunner()); @@ -148184,8 +148189,8 @@ function wrapCliConfigurationError(cliError) { } // src/config-utils.ts -var fs9 = __toESM(require("fs")); -var path10 = __toESM(require("path")); +var fs10 = __toESM(require("fs")); +var path11 = __toESM(require("path")); var import_perf_hooks = require("perf_hooks"); var core10 = __toESM(require_core()); @@ -148240,13 +148245,13 @@ function getDependencyCachingEnabled() { } // src/config/db-config.ts -var path7 = __toESM(require("path")); +var path8 = __toESM(require("path")); var jsonschema = __toESM(require_lib2()); var semver5 = __toESM(require_semver2()); // src/diagnostics.ts var import_fs = require("fs"); -var import_path = __toESM(require("path")); +var import_path2 = __toESM(require("path")); var unwrittenDiagnostics = []; var unwrittenDefaultLanguageDiagnostics = []; var diagnosticCounter = 0; @@ -148285,7 +148290,7 @@ function addNoLanguageDiagnostic(config, diagnostic) { function writeDiagnostic(config, language, diagnostic) { const logger = getActionsLogger(); const databasePath = language ? getCodeQLDatabasePath(config, language) : config.dbLocation; - const diagnosticsPath = import_path.default.resolve( + const diagnosticsPath = import_path2.default.resolve( databasePath, "diagnostic", "codeql-action" @@ -148297,7 +148302,7 @@ function writeDiagnostic(config, language, diagnostic) { /[^a-zA-Z0-9.-]/g, "" ); - const jsonPath = import_path.default.resolve( + const jsonPath = import_path2.default.resolve( diagnosticsPath, `codeql-action-${sanitizedTimestamp}-${uniqueSuffix}.json` ); @@ -148645,11 +148650,11 @@ function parsePacksSpecification(packStr) { throw new ConfigurationError(getPacksStrInvalid(packStr)); } } - if (packPath && (path7.isAbsolute(packPath) || // Permit using "/" instead of "\" on Windows + if (packPath && (path8.isAbsolute(packPath) || // Permit using "/" instead of "\" on Windows // Use `x.split(y).join(z)` as a polyfill for `x.replaceAll(y, z)` since // if we used a regex we'd need to escape the path separator on Windows // which seems more awkward. - path7.normalize(packPath).split(path7.sep).join("/") !== packPath.split(path7.sep).join("/"))) { + path8.normalize(packPath).split(path8.sep).join("/") !== packPath.split(path8.sep).join("/"))) { throw new ConfigurationError(getPacksStrInvalid(packStr)); } if (!packPath && pathStart) { @@ -148882,12 +148887,12 @@ function parseNewRemoteFileAddress(env, configFile) { return new Failure(void 0); } const owner = pieces.groups.owner?.trim(); - const path29 = pieces.groups.path?.trim(); + const path30 = pieces.groups.path?.trim(); const ref = pieces.groups.ref?.trim(); return new Success({ owner: owner || getDefaultOwner(env), repo, - path: path29 || DEFAULT_CONFIG_FILE_NAME, + path: path30 || DEFAULT_CONFIG_FILE_NAME, ref: ref || DEFAULT_CONFIG_FILE_REF }); } @@ -148986,7 +148991,7 @@ async function getRemoteConfig(actionState, configFile, apiDetails) { } // src/diff-informed-analysis-utils.ts -var fs6 = __toESM(require("fs")); +var fs7 = __toESM(require("fs")); async function getDiffInformedAnalysisBranches(codeql, features, logger) { if (!await features.getValue("diff_informed_queries" /* DiffInformedQueries */, codeql)) { return void 0; @@ -149028,7 +149033,7 @@ async function prepareDiffInformedAnalysis(codeql, features, logger) { function writeDiffRangesJsonFile(logger, ranges) { const jsonContents = JSON.stringify(ranges, null, 2); const jsonFilePath = getDiffRangesJsonFilePath(); - fs6.writeFileSync(jsonFilePath, jsonContents); + fs7.writeFileSync(jsonFilePath, jsonContents); logger.debug( `Wrote pr-diff-range JSON file to ${jsonFilePath}: ${jsonContents}` @@ -149036,11 +149041,11 @@ ${jsonContents}` } function readDiffRangesJsonFile(logger) { const jsonFilePath = getDiffRangesJsonFilePath(); - if (!fs6.existsSync(jsonFilePath)) { + if (!fs7.existsSync(jsonFilePath)) { logger.debug(`Diff ranges JSON file does not exist at ${jsonFilePath}`); return void 0; } - const jsonContents = fs6.readFileSync(jsonFilePath, "utf8"); + const jsonContents = fs7.readFileSync(jsonFilePath, "utf8"); logger.debug( `Read pr-diff-range JSON file from ${jsonFilePath}: ${jsonContents}` @@ -149291,13 +149296,13 @@ Improved incremental analysis will be automatically retried when the next versio } // src/overlay/status.ts -var fs7 = __toESM(require("fs")); -var path8 = __toESM(require("path")); +var fs8 = __toESM(require("fs")); +var path9 = __toESM(require("path")); var actionsCache = __toESM(require_cache4()); var MAX_CACHE_OPERATION_MS = 3e4; var STATUS_FILE_NAME = "overlay-status.json"; function getStatusFilePath(languages) { - return path8.join( + return path9.join( getTemporaryDirectory(), "overlay-status", [...languages].sort().join("+"), @@ -149336,7 +149341,7 @@ async function getOverlayStatus(codeql, languages, diskUsage, logger) { const cacheKey3 = await getCacheKey(codeql, languages, diskUsage); const statusFile = getStatusFilePath(languages); try { - await fs7.promises.mkdir(path8.dirname(statusFile), { recursive: true }); + await fs8.promises.mkdir(path9.dirname(statusFile), { recursive: true }); const foundKey = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS, actionsCache.restoreCache([statusFile], cacheKey3), @@ -149348,13 +149353,13 @@ async function getOverlayStatus(codeql, languages, diskUsage, logger) { logger.debug("No overlay status found in Actions cache."); return void 0; } - if (!fs7.existsSync(statusFile)) { + if (!fs8.existsSync(statusFile)) { logger.debug( "Overlay status cache entry found but status file is missing." ); return void 0; } - const contents = await fs7.promises.readFile(statusFile, "utf-8"); + const contents = await fs8.promises.readFile(statusFile, "utf-8"); const parsed = JSON.parse(contents); if (!isObject(parsed) || typeof parsed["attemptedToBuildOverlayBaseDatabase"] !== "boolean" || typeof parsed["builtOverlayBaseDatabase"] !== "boolean") { logger.debug( @@ -149374,8 +149379,8 @@ async function saveOverlayStatus(codeql, languages, diskUsage, status, logger) { const cacheKey3 = await getCacheKey(codeql, languages, diskUsage); const statusFile = getStatusFilePath(languages); try { - await fs7.promises.mkdir(path8.dirname(statusFile), { recursive: true }); - await fs7.promises.writeFile(statusFile, JSON.stringify(status)); + await fs8.promises.mkdir(path9.dirname(statusFile), { recursive: true }); + await fs8.promises.writeFile(statusFile, JSON.stringify(status)); const cacheId = await waitForResultWithTimeLimit( MAX_CACHE_OPERATION_MS, actionsCache.saveCache([statusFile], cacheKey3), @@ -149401,8 +149406,8 @@ async function getCacheKey(codeql, languages, diskUsage) { } // src/trap-caching.ts -var fs8 = __toESM(require("fs")); -var path9 = __toESM(require("path")); +var fs9 = __toESM(require("fs")); +var path10 = __toESM(require("path")); var actionsCache2 = __toESM(require_cache4()); var CACHE_VERSION = 1; var CODEQL_TRAP_CACHE_PREFIX = "codeql-trap"; @@ -149419,13 +149424,13 @@ async function downloadTrapCaches(codeql, languages, logger) { `Found ${languagesSupportingCaching.length} languages that support TRAP caching` ); if (languagesSupportingCaching.length === 0) return result; - const cachesDir = path9.join( + const cachesDir = path10.join( getTemporaryDirectory(), "trapCaches" ); for (const language of languagesSupportingCaching) { - const cacheDir2 = path9.join(cachesDir, language); - fs8.mkdirSync(cacheDir2, { recursive: true }); + const cacheDir2 = path10.join(cachesDir, language); + fs9.mkdirSync(cacheDir2, { recursive: true }); result[language] = cacheDir2; } if (await isAnalyzingDefaultBranch()) { @@ -149437,7 +149442,7 @@ async function downloadTrapCaches(codeql, languages, logger) { let baseSha = "unknown"; const eventPath = process.env.GITHUB_EVENT_PATH; if (getWorkflowEventName() === "pull_request" && eventPath !== void 0) { - const event = JSON.parse(fs8.readFileSync(path9.resolve(eventPath), "utf-8")); + const event = JSON.parse(fs9.readFileSync(path10.resolve(eventPath), "utf-8")); baseSha = event.pull_request?.base?.sha || baseSha; } for (const language of languages) { @@ -149656,9 +149661,9 @@ async function getSupportedLanguageMap(codeql, logger) { } var baseWorkflowsPath = ".github/workflows"; function hasActionsWorkflows(sourceRoot) { - const workflowsPath = path10.resolve(sourceRoot, baseWorkflowsPath); - const stats = fs9.lstatSync(workflowsPath, { throwIfNoEntry: false }); - return stats !== void 0 && stats.isDirectory() && fs9.readdirSync(workflowsPath).length > 0; + const workflowsPath = path11.resolve(sourceRoot, baseWorkflowsPath); + const stats = fs10.lstatSync(workflowsPath, { throwIfNoEntry: false }); + return stats !== void 0 && stats.isDirectory() && fs10.readdirSync(workflowsPath).length > 0; } async function getRawLanguagesInRepo(repository, sourceRoot, logger) { logger.debug( @@ -149815,8 +149820,8 @@ async function downloadCacheWithTime(codeQL, languages, logger) { async function loadUserConfig(actionState, configFile, workspacePath, apiDetails, tempDir) { if (isLocal(configFile)) { if (configFile !== userConfigFromActionPath(tempDir)) { - configFile = path10.resolve(workspacePath, configFile); - if (!(configFile + path10.sep).startsWith(workspacePath + path10.sep)) { + configFile = path11.resolve(workspacePath, configFile); + if (!(configFile + path11.sep).startsWith(workspacePath + path11.sep)) { throw new ConfigurationError( getConfigFileOutsideWorkspaceErrorMessage(configFile) ); @@ -150089,10 +150094,10 @@ async function setCppTrapCachingEnvironmentVariables(config, logger) { } } function dbLocationOrDefault(dbLocation, tempDir) { - return dbLocation || path10.resolve(tempDir, "codeql_databases"); + return dbLocation || path11.resolve(tempDir, "codeql_databases"); } function userConfigFromActionPath(tempDir) { - return path10.resolve(tempDir, "user-config-from-action.yml"); + return path11.resolve(tempDir, "user-config-from-action.yml"); } function hasQueryCustomisation(userConfig) { return isDefined2(userConfig["disable-default-queries"]) || isDefined2(userConfig.queries) || isDefined2(userConfig["query-filters"]); @@ -150142,7 +150147,7 @@ async function determineUserConfig(action, tempDir, inputs) { fromConfigInput, fromConfigFile ); - fs9.writeFileSync(computedConfigPath, dump(mergedConfig)); + fs10.writeFileSync(computedConfigPath, dump(mergedConfig)); action.logger.debug( `Using merged configurations from 'config' input with configuration from '${inputs.configFile}': ${computedConfigPath}` ); @@ -150154,7 +150159,7 @@ async function determineUserConfig(action, tempDir, inputs) { `Both a config file and config input were provided. Ignoring config file.` ); } - fs9.writeFileSync(computedConfigPath, inputs.configInput); + fs10.writeFileSync(computedConfigPath, inputs.configInput); inputs.configFile = computedConfigPath; action.logger.debug( `Using config from action input: ${inputs.configFile}` @@ -150307,7 +150312,7 @@ function isLocal(configPath) { return !containsAtRef(configPath); } function getLocalConfig(logger, configFile, validateConfig) { - if (!fs9.existsSync(configFile)) { + if (!fs10.existsSync(configFile)) { throw new ConfigurationError( getConfigFileDoesNotExistErrorMessage(configFile) ); @@ -150315,27 +150320,27 @@ function getLocalConfig(logger, configFile, validateConfig) { return parseUserConfig( logger, configFile, - fs9.readFileSync(configFile, "utf-8"), + fs10.readFileSync(configFile, "utf-8"), validateConfig ); } function getPathToParsedConfigFile(tempDir) { - return path10.join(tempDir, "config"); + return path11.join(tempDir, "config"); } async function saveConfig(config, logger) { const configString = JSON.stringify(config); const configFile = getPathToParsedConfigFile(config.tempDir); - fs9.mkdirSync(path10.dirname(configFile), { recursive: true }); - fs9.writeFileSync(configFile, configString, "utf8"); + fs10.mkdirSync(path11.dirname(configFile), { recursive: true }); + fs10.writeFileSync(configFile, configString, "utf8"); logger.debug("Saved config:"); logger.debug(configString); } async function getConfig(tempDir, logger) { const configFile = getPathToParsedConfigFile(tempDir); - if (!fs9.existsSync(configFile)) { + if (!fs10.existsSync(configFile)) { return void 0; } - const configString = fs9.readFileSync(configFile, "utf8"); + const configString = fs10.readFileSync(configFile, "utf8"); logger.debug("Loaded config:"); logger.debug(configString); const config = JSON.parse(configString); @@ -150357,9 +150362,9 @@ async function generateRegistries(registriesInput, tempDir, logger) { let qlconfigFile; if (registries) { const qlconfig = createRegistriesBlock(registries); - qlconfigFile = path10.join(tempDir, "qlconfig.yml"); + qlconfigFile = path11.join(tempDir, "qlconfig.yml"); const qlconfigContents = dump(qlconfig); - fs9.writeFileSync(qlconfigFile, qlconfigContents, "utf8"); + fs10.writeFileSync(qlconfigFile, qlconfigContents, "utf8"); logger.debug("Generated qlconfig.yml:"); logger.debug(qlconfigContents); registriesAuthTokens = registries.map((registry) => `${registry.url}=${registry.token}`).join(","); @@ -150488,14 +150493,14 @@ async function logGeneratedFilesTelemetry(config, duration, generatedFilesCount) } // src/setup-codeql.ts -var fs13 = __toESM(require("fs")); -var path12 = __toESM(require("path")); +var fs14 = __toESM(require("fs")); +var path13 = __toESM(require("path")); var toolcache3 = __toESM(require_tool_cache()); var import_fast_deep_equal = __toESM(require_fast_deep_equal()); var semver9 = __toESM(require_semver2()); // src/overlay/caching.ts -var fs10 = __toESM(require("fs")); +var fs11 = __toESM(require("fs")); var actionsCache3 = __toESM(require_cache4()); var semver6 = __toESM(require_semver2()); var OVERLAY_BASE_DATABASE_MAX_UPLOAD_SIZE_MB = 7500; @@ -150505,7 +150510,7 @@ var CACHE_PREFIX = "codeql-overlay-base-database"; var MAX_CACHE_OPERATION_MS3 = 6e5; async function checkOverlayBaseDatabase(codeql, config, logger, warningPrefix) { const baseDatabaseOidsFilePath = getBaseDatabaseOidsFilePath(config); - if (!fs10.existsSync(baseDatabaseOidsFilePath)) { + if (!fs11.existsSync(baseDatabaseOidsFilePath)) { logger.warning( `${warningPrefix}: ${baseDatabaseOidsFilePath} does not exist` ); @@ -150794,7 +150799,7 @@ async function getCodeQlVersionsForOverlayBaseDatabases(rawLanguages, logger) { // src/tar.ts var import_child_process = require("child_process"); -var fs11 = __toESM(require("fs")); +var fs12 = __toESM(require("fs")); var stream = __toESM(require("stream")); var import_toolrunner = __toESM(require_toolrunner()); var io4 = __toESM(require_io()); @@ -150867,7 +150872,7 @@ async function isZstdAvailable(logger) { } } async function extract(tarPath, dest, compressionMethod, tarVersion, logger) { - fs11.mkdirSync(dest, { recursive: true }); + fs12.mkdirSync(dest, { recursive: true }); switch (compressionMethod) { case "gzip": return await toolcache.extractTar(tarPath, dest); @@ -150953,9 +150958,9 @@ function inferCompressionMethod(tarPath) { } // src/tools-download.ts -var fs12 = __toESM(require("fs")); +var fs13 = __toESM(require("fs")); var os4 = __toESM(require("os")); -var path11 = __toESM(require("path")); +var path12 = __toESM(require("path")); var import_perf_hooks2 = require("perf_hooks"); var core11 = __toESM(require_core()); var import_http_client = __toESM(require_lib()); @@ -151034,7 +151039,7 @@ async function downloadAndExtract(codeqlURL, compressionMethod, dest, authorizat return { downloadDurationMs }; } async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorization, headers, tarVersion, logger) { - fs12.mkdirSync(dest, { recursive: true }); + fs13.mkdirSync(dest, { recursive: true }); const agent = new import_http_client.HttpClient().getAgent(codeqlURL); headers = Object.assign( { "User-Agent": "CodeQL Action" }, @@ -151071,7 +151076,7 @@ async function downloadAndExtractZstdWithStreaming(codeqlURL, dest, authorizatio await extractTarZst(response, dest, tarVersion, logger); } function getToolcacheDirectory(version) { - return path11.join( + return path12.join( getRequiredEnvParam("RUNNER_TOOL_CACHE"), TOOLCACHE_TOOL_NAME, semver8.clean(version) || version, @@ -151080,7 +151085,7 @@ function getToolcacheDirectory(version) { } function writeToolcacheMarkerFile(extractedPath, logger) { const markerFilePath = `${extractedPath}.complete`; - fs12.writeFileSync(markerFilePath, ""); + fs13.writeFileSync(markerFilePath, ""); logger.info(`Created toolcache marker file ${markerFilePath}`); } @@ -151210,7 +151215,7 @@ async function findOverridingToolsInCache(humanReadableVersion, logger) { const candidates = toolcache3.findAllVersions("CodeQL").filter(isGoodVersion).map((version) => ({ folder: toolcache3.find("CodeQL", version), version - })).filter(({ folder }) => fs13.existsSync(path12.join(folder, "pinned-version"))); + })).filter(({ folder }) => fs14.existsSync(path13.join(folder, "pinned-version"))); if (candidates.length === 1) { const candidate = candidates[0]; logger.debug( @@ -151692,7 +151697,7 @@ async function useZstdBundle(cliVersion2, tarSupportsZstd) { ); } function getTempExtractionDir(tempDir) { - return path12.join(tempDir, v4_default()); + return path13.join(tempDir, v4_default()); } async function getNightlyToolsUrl(logger) { const zstdAvailability = await isZstdAvailable(logger); @@ -151740,8 +151745,8 @@ function isReservedToolsValue(tools) { } // src/tracer-config.ts -var fs14 = __toESM(require("fs")); -var path13 = __toESM(require("path")); +var fs15 = __toESM(require("fs")); +var path14 = __toESM(require("path")); async function shouldEnableIndirectTracing(codeql, config) { if (config.buildMode === "none" /* None */) { return false; @@ -151756,18 +151761,18 @@ async function endTracingForCluster(codeql, config, logger) { logger.info( "Unsetting build tracing environment variables. Subsequent steps of this job will not be traced." ); - const envVariablesFile = path13.resolve( + const envVariablesFile = path14.resolve( config.dbLocation, "temp/tracingEnvironment/end-tracing.json" ); - if (!fs14.existsSync(envVariablesFile)) { + if (!fs15.existsSync(envVariablesFile)) { throw new Error( `Environment file for ending tracing not found: ${envVariablesFile}` ); } try { const endTracingEnvVariables = JSON.parse( - fs14.readFileSync(envVariablesFile, "utf8") + fs15.readFileSync(envVariablesFile, "utf8") ); for (const [key, value] of Object.entries(endTracingEnvVariables)) { if (value !== null) { @@ -151784,8 +151789,8 @@ async function endTracingForCluster(codeql, config, logger) { } async function getTracerConfigForCluster(config) { const tracingEnvVariables = JSON.parse( - fs14.readFileSync( - path13.resolve( + fs15.readFileSync( + path14.resolve( config.dbLocation, "temp/tracingEnvironment/start-tracing.json" ), @@ -151828,7 +151833,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV features, logger ); - let codeqlCmd = path14.join(codeqlFolder, "codeql", "codeql"); + let codeqlCmd = path15.join(codeqlFolder, "codeql", "codeql"); if (process.platform === "win32") { codeqlCmd += ".exe"; } else if (process.platform !== "linux" && process.platform !== "darwin") { @@ -151886,12 +151891,12 @@ async function getCodeQLForCmd(cmd, checkVersion) { }, async isTracedLanguage(language) { const extractorPath = await this.resolveExtractor(language); - const tracingConfigPath = path14.join( + const tracingConfigPath = path15.join( extractorPath, "tools", "tracing-config.lua" ); - return fs15.existsSync(tracingConfigPath); + return fs16.existsSync(tracingConfigPath); }, async isScannedLanguage(language) { return !await this.isTracedLanguage(language); @@ -151971,7 +151976,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { }, async runAutobuild(config, language) { applyAutobuildAzurePipelinesTimeoutFix(); - const autobuildCmd = path14.join( + const autobuildCmd = path15.join( await this.resolveExtractor(language), "tools", process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh" @@ -152341,7 +152346,7 @@ async function writeCodeScanningConfigFile(config, logger) { logger.startGroup("Augmented user configuration file contents"); logger.info(dump(augmentedConfig)); logger.endGroup(); - fs15.writeFileSync(codeScanningConfigFile, dump(augmentedConfig)); + fs16.writeFileSync(codeScanningConfigFile, dump(augmentedConfig)); return codeScanningConfigFile; } var TRAP_CACHE_SIZE_MB = 1024; @@ -152364,7 +152369,7 @@ async function getTrapCachingExtractorConfigArgsForLang(config, language) { ]; } function getGeneratedCodeScanningConfigPath(config) { - return path14.resolve(config.tempDir, "user-config.yaml"); + return path15.resolve(config.tempDir, "user-config.yaml"); } function getExtractionVerbosityArguments(enableDebugLogging) { return enableDebugLogging ? [`--verbosity=${EXTRACTION_DEBUG_MODE_VERBOSITY}`] : []; @@ -152469,31 +152474,31 @@ async function runAutobuild(config, language, logger) { // src/dependency-caching.ts var os5 = __toESM(require("os")); -var import_path2 = require("path"); +var import_path3 = require("path"); var actionsCache4 = __toESM(require_cache4()); var glob = __toESM(require_glob()); var CODEQL_DEPENDENCY_CACHE_PREFIX = "codeql-dependencies"; var CODEQL_DEPENDENCY_CACHE_VERSION = 1; function getJavaTempDependencyDir() { - return (0, import_path2.join)(getTemporaryDirectory(), "codeql_java", "repository"); + return (0, import_path3.join)(getTemporaryDirectory(), "codeql_java", "repository"); } async function getJavaDependencyDirs() { return [ // Maven - (0, import_path2.join)(os5.homedir(), ".m2", "repository"), + (0, import_path3.join)(os5.homedir(), ".m2", "repository"), // Gradle - (0, import_path2.join)(os5.homedir(), ".gradle", "caches"), + (0, import_path3.join)(os5.homedir(), ".gradle", "caches"), // CodeQL Java build-mode: none getJavaTempDependencyDir() ]; } function getCsharpTempDependencyDir() { - return (0, import_path2.join)(getTemporaryDirectory(), "codeql_csharp", "repository"); + return (0, import_path3.join)(getTemporaryDirectory(), "codeql_csharp", "repository"); } async function getCsharpDependencyDirs(codeql, features) { const dirs = [ // Nuget - (0, import_path2.join)(os5.homedir(), ".nuget", "packages") + (0, import_path3.join)(os5.homedir(), ".nuget", "packages") ]; if (await features.getValue("csharp_cache_bmn" /* CsharpCacheBuildModeNone */, codeql)) { dirs.push(getCsharpTempDependencyDir()); @@ -152548,7 +152553,7 @@ var defaultCacheConfigs = { getHashPatterns: getCsharpHashPatterns }, go: { - getDependencyPaths: async () => [(0, import_path2.join)(os5.homedir(), "go", "pkg", "mod")], + getDependencyPaths: async () => [(0, import_path3.join)(os5.homedir(), "go", "pkg", "mod")], getHashPatterns: async () => internal.makePatternCheck(["**/go.sum"]) } }; @@ -152801,7 +152806,7 @@ function dbIsFinalized(config, language, logger) { const dbPath = getCodeQLDatabasePath(config, language); try { const dbInfo = load( - fs16.readFileSync(path15.resolve(dbPath, "codeql-database.yml"), "utf8") + fs17.readFileSync(path16.resolve(dbPath, "codeql-database.yml"), "utf8") ); return !("inProgress" in dbInfo); } catch { @@ -152872,7 +152877,7 @@ extensions: data: `; let data = ranges.map((range2) => { - const filename = path15.join(checkoutPath, range2.path).replaceAll(path15.sep, "/"); + const filename = path16.join(checkoutPath, range2.path).replaceAll(path16.sep, "/"); return ` - [${dump(filename, { forceQuotes: true, quoteStyle: "single" }).trim()}, ${range2.startLine}, ${range2.endLine}] `; }).join(""); @@ -152885,10 +152890,10 @@ function writeDiffRangeDataExtensionPack(logger, ranges, checkoutPath) { if (ranges.length === 0) { ranges = [{ path: "", startLine: 0, endLine: 0 }]; } - const diffRangeDir = path15.join(getTemporaryDirectory(), "pr-diff-range"); - fs16.mkdirSync(diffRangeDir, { recursive: true }); - fs16.writeFileSync( - path15.join(diffRangeDir, "qlpack.yml"), + const diffRangeDir = path16.join(getTemporaryDirectory(), "pr-diff-range"); + fs17.mkdirSync(diffRangeDir, { recursive: true }); + fs17.writeFileSync( + path16.join(diffRangeDir, "qlpack.yml"), ` name: codeql-action/pr-diff-range version: 0.0.0 @@ -152903,8 +152908,8 @@ dataExtensions: ranges, checkoutPath ); - const extensionFilePath = path15.join(diffRangeDir, "pr-diff-range.yml"); - fs16.writeFileSync(extensionFilePath, extensionContents); + const extensionFilePath = path16.join(diffRangeDir, "pr-diff-range.yml"); + fs17.writeFileSync(extensionFilePath, extensionContents); logger.debug( `Wrote pr-diff-range extension pack to ${extensionFilePath}: ${extensionContents}` @@ -153027,7 +153032,7 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir async function runInterpretResultsFor(analysis, language, queries, enableDebugLogging) { logger.info(`Interpreting ${analysis.name} results for ${language}`); const category = analysis.fixCategory(logger, automationDetailsId); - const sarifFile = path15.join( + const sarifFile = path16.join( sarifFolder, addSarifExtension(analysis, language) ); @@ -153056,7 +153061,7 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir } function getPerQueryAlertCounts(sarifPath) { const sarifObject = JSON.parse( - fs16.readFileSync(sarifPath, "utf8") + fs17.readFileSync(sarifPath, "utf8") ); const perQueryAlertCounts = {}; for (const sarifRun of sarifObject.runs) { @@ -153074,13 +153079,13 @@ async function runQueries(sarifFolder, memoryFlag, threadsFlag, diffRangePackDir } async function runFinalize(features, outputDir, threadsFlag, memoryFlag, codeql, config, logger) { try { - await fs16.promises.rm(outputDir, { force: true, recursive: true }); + await fs17.promises.rm(outputDir, { force: true, recursive: true }); } catch (error3) { if (error3?.code !== "ENOENT") { throw error3; } } - await fs16.promises.mkdir(outputDir, { recursive: true }); + await fs17.promises.mkdir(outputDir, { recursive: true }); const timings = await finalizeDatabaseCreation( codeql, features, @@ -153124,7 +153129,7 @@ async function warnIfGoInstalledAfterInit(config, logger) { } // src/database-upload.ts -var fs17 = __toESM(require("fs")); +var fs18 = __toESM(require("fs")); async function cleanupAndUploadDatabases(repositoryNwo, codeql, config, apiDetails, features, logger) { if (getRequiredInput("upload-database") !== "true") { logger.debug("Database upload disabled in workflow. Skipping upload."); @@ -153160,7 +153165,7 @@ async function cleanupAndUploadDatabases(repositoryNwo, codeql, config, apiDetai const bundledDb = await bundleDb(config, language, codeql, language, { includeDiagnostics: false }); - bundledDbSize = fs17.statSync(bundledDb).size; + bundledDbSize = fs18.statSync(bundledDb).size; const commitOid = await getCommitOid( getRequiredInput("checkout_path") ); @@ -153240,7 +153245,7 @@ async function recordClearCleanupSizes(codeql, config, reports, logger) { const bundledDb = await bundleDb(config, language, codeql, language, { includeDiagnostics: false }); - report.clear_cleanup_zipped_size_bytes = fs17.statSync(bundledDb).size; + report.clear_cleanup_zipped_size_bytes = fs18.statSync(bundledDb).size; logger.debug( `Database for ${language} is ${report.clear_cleanup_zipped_size_bytes} bytes zipped at the '${"clear" /* Clear */}' cleanup level (vs. ${report.zipped_upload_size_bytes ?? "unknown"} bytes at the '${"overlay" /* Overlay */}' level).` ); @@ -153263,7 +153268,7 @@ async function uploadBundledDatabase(repositoryNwo, language, commitOid, bundled if (uploadsBaseUrl.endsWith("/")) { uploadsBaseUrl = uploadsBaseUrl.slice(0, -1); } - const bundledDbReadStream = fs17.createReadStream(bundledDb); + const bundledDbReadStream = fs18.createReadStream(bundledDb); try { const startTime = performance.now(); await client.request( @@ -153315,16 +153320,16 @@ __export(upload_lib_exports, { waitForProcessing: () => waitForProcessing, writePostProcessedFiles: () => writePostProcessedFiles }); -var fs21 = __toESM(require("fs")); -var path18 = __toESM(require("path")); +var fs22 = __toESM(require("fs")); +var path19 = __toESM(require("path")); var url = __toESM(require("url")); var import_zlib = __toESM(require("zlib")); var core15 = __toESM(require_core()); var jsonschema2 = __toESM(require_lib2()); // src/fingerprints.ts -var fs18 = __toESM(require("fs")); -var import_path3 = __toESM(require("path")); +var fs19 = __toESM(require("fs")); +var import_path4 = __toESM(require("path")); // node_modules/long/index.js var wasm = null; @@ -154311,7 +154316,7 @@ async function hash(callback, filepath) { } updateHash(current); }; - const readStream = fs18.createReadStream(filepath, "utf8"); + const readStream = fs19.createReadStream(filepath, "utf8"); for await (const data of readStream) { for (let i = 0; i < data.length; ++i) { processCharacter(data.charCodeAt(i)); @@ -154383,14 +154388,14 @@ function resolveUriToFile(location, artifacts, sourceRoot, logger) { ); return void 0; } - if (!import_path3.default.isAbsolute(uri)) { + if (!import_path4.default.isAbsolute(uri)) { uri = srcRootPrefix + uri; } - if (!fs18.existsSync(uri)) { + if (!fs19.existsSync(uri)) { logger.debug(`Unable to compute fingerprint for non-existent file: ${uri}`); return void 0; } - if (fs18.statSync(uri).isDirectory()) { + if (fs19.statSync(uri).isDirectory()) { logger.debug(`Unable to compute fingerprint for directory: ${uri}`); return void 0; } @@ -154445,8 +154450,8 @@ async function addFingerprints(sarifLog, sourceRoot, logger) { } // src/init.ts -var fs19 = __toESM(require("fs")); -var path17 = __toESM(require("path")); +var fs20 = __toESM(require("fs")); +var path18 = __toESM(require("path")); var core14 = __toESM(require_core()); var toolrunner4 = __toESM(require_toolrunner()); var github3 = __toESM(require_github()); @@ -154480,7 +154485,7 @@ async function initConfig2(actionState, inputs) { }); } async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile, logger) { - fs19.mkdirSync(config.dbLocation, { recursive: true }); + fs20.mkdirSync(config.dbLocation, { recursive: true }); await wrapEnvironment( databaseInitEnvironment, async () => await codeql.databaseInitCluster( @@ -154515,25 +154520,25 @@ async function checkPacksForOverlayCompatibility(codeql, config, logger) { } function checkPackForOverlayCompatibility(packDir, codeQlOverlayVersion, logger) { try { - let qlpackPath = path17.join(packDir, "qlpack.yml"); - if (!fs19.existsSync(qlpackPath)) { - qlpackPath = path17.join(packDir, "codeql-pack.yml"); + let qlpackPath = path18.join(packDir, "qlpack.yml"); + if (!fs20.existsSync(qlpackPath)) { + qlpackPath = path18.join(packDir, "codeql-pack.yml"); } const qlpackContents = load( - fs19.readFileSync(qlpackPath, "utf8") + fs20.readFileSync(qlpackPath, "utf8") ); if (!qlpackContents.buildMetadata) { return true; } - const packInfoPath = path17.join(packDir, ".packinfo"); - if (!fs19.existsSync(packInfoPath)) { + const packInfoPath = path18.join(packDir, ".packinfo"); + if (!fs20.existsSync(packInfoPath)) { logger.warning( `The query pack at ${packDir} does not have a .packinfo file, so it cannot support overlay analysis. Recompiling the query pack with the latest CodeQL CLI should solve this problem.` ); return false; } const packInfoFileContents = JSON.parse( - fs19.readFileSync(packInfoPath, "utf8") + fs20.readFileSync(packInfoPath, "utf8") ); const packOverlayVersion = packInfoFileContents.overlayVersion; if (typeof packOverlayVersion !== "number") { @@ -154558,7 +154563,7 @@ function checkPackForOverlayCompatibility(packDir, codeQlOverlayVersion, logger) } async function checkInstallPython311(languages, codeql) { if (languages.includes("python" /* python */) && process.platform === "win32" && !(await codeql.getVersion()).features?.supportsPython312) { - const script = path17.resolve( + const script = path18.resolve( __dirname, "../python-setup", "check_python12.ps1" @@ -154568,8 +154573,8 @@ async function checkInstallPython311(languages, codeql) { ]).exec(); } } -function cleanupDatabaseClusterDirectory(config, logger, options = {}, rmSync5 = fs19.rmSync) { - if (fs19.existsSync(config.dbLocation) && (fs19.statSync(config.dbLocation).isFile() || fs19.readdirSync(config.dbLocation).length > 0)) { +function cleanupDatabaseClusterDirectory(config, logger, options = {}, rmSync5 = fs20.rmSync) { + if (fs20.existsSync(config.dbLocation) && (fs20.statSync(config.dbLocation).isFile() || fs20.readdirSync(config.dbLocation).length > 0)) { if (!options.disableExistingDirectoryWarning) { logger.warning( `The database cluster directory ${config.dbLocation} must be empty. Attempting to clean it up.` @@ -154674,7 +154679,7 @@ To opt out of this change, ${envVarOptOut}`; } // src/sarif/index.ts -var fs20 = __toESM(require("fs")); +var fs21 = __toESM(require("fs")); var InvalidSarifUploadError = class extends Error { }; function getToolNames(sarifFile) { @@ -154689,7 +154694,7 @@ function getToolNames(sarifFile) { return Object.keys(toolNames); } function readSarifFile(sarifFilePath) { - return JSON.parse(fs20.readFileSync(sarifFilePath, "utf8")); + return JSON.parse(fs21.readFileSync(sarifFilePath, "utf8")); } function combineSarifFiles(sarifFiles, logger) { logger.info(`Loading SARIF file(s)`); @@ -154823,10 +154828,10 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo ); codeQL = initCodeQLResult.codeql; } - const baseTempDir = path18.resolve(tempDir, "combined-sarif"); - fs21.mkdirSync(baseTempDir, { recursive: true }); - const outputDirectory = fs21.mkdtempSync(path18.resolve(baseTempDir, "output-")); - const outputFile = path18.resolve(outputDirectory, "combined-sarif.sarif"); + const baseTempDir = path19.resolve(tempDir, "combined-sarif"); + fs22.mkdirSync(baseTempDir, { recursive: true }); + const outputDirectory = fs22.mkdtempSync(path19.resolve(baseTempDir, "output-")); + const outputFile = path19.resolve(outputDirectory, "combined-sarif.sarif"); await codeQL.mergeResults(sarifFiles, outputFile, { mergeRunsFromEqualCategory: true }); @@ -154859,7 +154864,7 @@ function getAutomationID2(category, analysis_key, environment) { async function uploadPayload(payload, repositoryNwo, logger, analysis) { logger.info("Uploading results"); if (shouldSkipSarifUpload()) { - const payloadSaveFile = path18.join( + const payloadSaveFile = path19.join( getTemporaryDirectory(), `payload-${analysis.kind}.json` ); @@ -154867,7 +154872,7 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) { `SARIF upload disabled by an environment variable. Saving to ${payloadSaveFile}` ); logger.info(`Payload: ${JSON.stringify(payload, null, 2)}`); - fs21.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2)); + fs22.writeFileSync(payloadSaveFile, JSON.stringify(payload, null, 2)); return "dummy-sarif-id"; } const client = getApiClient(); @@ -154901,12 +154906,12 @@ async function uploadPayload(payload, repositoryNwo, logger, analysis) { function findSarifFilesInDir(sarifPath, isSarif) { const sarifFiles = []; const walkSarifFiles = (dir) => { - const entries = fs21.readdirSync(dir, { withFileTypes: true }); + const entries = fs22.readdirSync(dir, { withFileTypes: true }); for (const entry of entries) { if (entry.isFile() && isSarif(entry.name)) { - sarifFiles.push(path18.resolve(dir, entry.name)); + sarifFiles.push(path19.resolve(dir, entry.name)); } else if (entry.isDirectory()) { - walkSarifFiles(path18.resolve(dir, entry.name)); + walkSarifFiles(path19.resolve(dir, entry.name)); } } }; @@ -154914,11 +154919,11 @@ function findSarifFilesInDir(sarifPath, isSarif) { return sarifFiles; } function getSarifFilePaths(sarifPath, isSarif) { - if (!fs21.existsSync(sarifPath)) { + if (!fs22.existsSync(sarifPath)) { throw new ConfigurationError(`Path does not exist: ${sarifPath}`); } let sarifFiles; - if (fs21.lstatSync(sarifPath).isDirectory()) { + if (fs22.lstatSync(sarifPath).isDirectory()) { sarifFiles = findSarifFilesInDir(sarifPath, isSarif); if (sarifFiles.length === 0) { throw new ConfigurationError( @@ -154931,7 +154936,7 @@ function getSarifFilePaths(sarifPath, isSarif) { return sarifFiles; } async function getGroupedSarifFilePaths(logger, sarifPath) { - const stats = fs21.statSync(sarifPath, { throwIfNoEntry: false }); + const stats = fs22.statSync(sarifPath, { throwIfNoEntry: false }); if (stats === void 0) { throw new ConfigurationError(`Path does not exist: ${sarifPath}`); } @@ -154939,7 +154944,7 @@ async function getGroupedSarifFilePaths(logger, sarifPath) { if (stats.isDirectory()) { let unassignedSarifFiles = findSarifFilesInDir( sarifPath, - (name) => path18.extname(name) === ".sarif" + (name) => path19.extname(name) === ".sarif" ); logger.debug( `Found the following .sarif files in ${sarifPath}: ${unassignedSarifFiles.join(", ")}` @@ -155066,7 +155071,7 @@ function buildPayload(commitOid, ref, analysisKey, analysisName, zippedSarif, wo payloadObj.base_sha = mergeBaseCommitOid; } else if (process.env.GITHUB_EVENT_PATH) { const githubEvent = JSON.parse( - fs21.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8") + fs22.readFileSync(process.env.GITHUB_EVENT_PATH, "utf8") ); payloadObj.base_ref = `refs/heads/${githubEvent.pull_request.base.ref}`; payloadObj.base_sha = githubEvent.pull_request.base.sha; @@ -155200,19 +155205,19 @@ async function uploadPostProcessedFiles(logger, checkoutPath, uploadTarget, post }; } function dumpSarifFile(sarifPayload, outputDir, logger, uploadTarget) { - if (!fs21.existsSync(outputDir)) { - fs21.mkdirSync(outputDir, { recursive: true }); - } else if (!fs21.lstatSync(outputDir).isDirectory()) { + if (!fs22.existsSync(outputDir)) { + fs22.mkdirSync(outputDir, { recursive: true }); + } else if (!fs22.lstatSync(outputDir).isDirectory()) { throw new ConfigurationError( `The path that processed SARIF files should be written to exists, but is not a directory: ${outputDir}` ); } - const outputFile = path18.resolve( + const outputFile = path19.resolve( outputDir, `upload${uploadTarget.sarifExtension}` ); logger.info(`Writing processed SARIF file to ${outputFile}`); - fs21.writeFileSync(outputFile, sarifPayload); + fs22.writeFileSync(outputFile, sarifPayload); } var STATUS_CHECK_INITIAL_BACKOFF_MILLISECONDS = 5 * 1e3; var STATUS_CHECK_BACKOFF_MULTIPLIER = 2; @@ -155447,12 +155452,12 @@ function doesGoExtractionOutputExist(config) { config, "go" /* go */ ); - const trapDirectory = import_path4.default.join( + const trapDirectory = import_path5.default.join( golangDbDirectory, "trap", "go" /* go */ ); - return fs22.existsSync(trapDirectory) && fs22.readdirSync(trapDirectory).some( + return fs23.existsSync(trapDirectory) && fs23.readdirSync(trapDirectory).some( (fileName) => [ ".trap", ".trap.gz", @@ -155600,7 +155605,7 @@ async function run({ startedAt, logger }) { dbLocations[language] = getCodeQLDatabasePath(config, language); } core16.setOutput("db-locations", dbLocations); - core16.setOutput("sarif-output", import_path4.default.resolve(outputDir)); + core16.setOutput("sarif-output", import_path5.default.resolve(outputDir)); const uploadKind = getUploadValue( getOptionalInput("upload") ); @@ -155748,12 +155753,12 @@ async function runWrapper() { } // src/analyze-action-post.ts -var fs26 = __toESM(require("fs")); +var fs27 = __toESM(require("fs")); var core18 = __toESM(require_core()); // src/debug-artifacts.ts -var fs25 = __toESM(require("fs")); -var path22 = __toESM(require("path")); +var fs26 = __toESM(require("fs")); +var path23 = __toESM(require("path")); var artifact = __toESM(require_artifact2()); var artifactLegacy = __toESM(require_artifact_client2()); var core17 = __toESM(require_core()); @@ -155767,7 +155772,7 @@ function isStream(stream2, { checkOpen = true } = {}) { } // node_modules/readdir-glob/dist/index.mjs -var fs23 = __toESM(require("fs"), 1); +var fs24 = __toESM(require("fs"), 1); var import_events = require("events"); // node_modules/readdir-glob/node_modules/balanced-match/dist/esm/index.js @@ -156875,11 +156880,11 @@ var qmarksTestNoExtDot = ([$0]) => { return (f) => f.length === len && f !== "." && f !== ".."; }; var defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix"; -var path20 = { +var path21 = { win32: { sep: "\\" }, posix: { sep: "/" } }; -var sep6 = defaultPlatform === "win32" ? path20.win32.sep : path20.posix.sep; +var sep6 = defaultPlatform === "win32" ? path21.win32.sep : path21.posix.sep; minimatch.sep = sep6; var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **"); minimatch.GLOBSTAR = GLOBSTAR; @@ -157626,10 +157631,10 @@ minimatch.escape = escape2; minimatch.unescape = unescape2; // node_modules/readdir-glob/dist/index.mjs -var import_path5 = require("path"); +var import_path6 = require("path"); function readdir2(dir, strict) { return new Promise((resolve$1, reject) => { - fs23.readdir(dir, { withFileTypes: true }, (err, files) => { + fs24.readdir(dir, { withFileTypes: true }, (err, files) => { if (err) switch (err.code) { case "ENOTDIR": if (strict) reject(err); @@ -157652,7 +157657,7 @@ function readdir2(dir, strict) { } function getStat(file, followSymlinks) { return new Promise((resolve$1) => { - const statFunc = followSymlinks ? fs23.stat : fs23.lstat; + const statFunc = followSymlinks ? fs24.stat : fs24.lstat; statFunc(file, (err, stats) => { if (err) switch (err.code) { case "ENOENT": @@ -157667,13 +157672,13 @@ function getStat(file, followSymlinks) { }); }); } -async function* exploreWalkAsync(dir, path29, followSymlinks, useStat, shouldSkip, strict) { - let files = await readdir2(path29 + dir, strict); +async function* exploreWalkAsync(dir, path30, followSymlinks, useStat, shouldSkip, strict) { + let files = await readdir2(path30 + dir, strict); for (const file of files) { let name = file.name; const filename = dir + "/" + name; const relative3 = filename.slice(1); - const absolute = path29 + "/" + relative3; + const absolute = path30 + "/" + relative3; let stat2 = file; if (useStat || followSymlinks) stat2 = await getStat(absolute, followSymlinks) ?? stat2; if (stat2.isDirectory()) { @@ -157683,7 +157688,7 @@ async function* exploreWalkAsync(dir, path29, followSymlinks, useStat, shouldSki absolute, stat: stat2 }; - yield* exploreWalkAsync(filename, path29, followSymlinks, useStat, shouldSkip, false); + yield* exploreWalkAsync(filename, path30, followSymlinks, useStat, shouldSkip, false); } } else yield { relative: relative3, @@ -157692,8 +157697,8 @@ async function* exploreWalkAsync(dir, path29, followSymlinks, useStat, shouldSki }; } } -async function* explore(path29, followSymlinks, useStat, shouldSkip) { - yield* exploreWalkAsync("", path29, followSymlinks, useStat, shouldSkip, true); +async function* explore(path30, followSymlinks, useStat, shouldSkip) { + yield* exploreWalkAsync("", path30, followSymlinks, useStat, shouldSkip, true); } function readOptions(options) { return { @@ -157748,7 +157753,7 @@ var ReaddirGlob = class extends import_events.EventEmitter { const skipPatterns = Array.isArray(this.options.skip) ? this.options.skip : [this.options.skip]; this.skipMatchers = skipPatterns.map((skip) => new Minimatch(skip, { dot: true })); } - this.iterator = explore((0, import_path5.resolve)(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this)); + this.iterator = explore((0, import_path6.resolve)(cwd || "."), this.options.follow, this.options.stat, this._shouldSkipDirectory.bind(this)); this.paused = false; this.inactive = false; this.aborted = false; @@ -157819,10 +157824,10 @@ var src_default = readdirGlob; // node_modules/archiver/lib/core.js var import_lazystream = __toESM(require_lazystream(), 1); var import_async = __toESM(require_async(), 1); -var import_path6 = require("path"); +var import_path7 = require("path"); // node_modules/archiver/lib/error.js -var import_util34 = __toESM(require("util"), 1); +var import_util35 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157847,7 +157852,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util34.default.inherits(ArchiverError, Error); +import_util35.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); @@ -158280,11 +158285,11 @@ var Archiver = class extends import_readable_stream2.Transform { task.source = Buffer.concat([]); } else if (stats.isSymbolicLink() && this._supportsSymlink) { const linkPath = (0, import_fs2.readlinkSync)(task.filepath); - const dirName = (0, import_path6.dirname)(task.filepath); + const dirName = (0, import_path7.dirname)(task.filepath); task.data.type = "symlink"; - task.data.linkname = (0, import_path6.relative)( + task.data.linkname = (0, import_path7.relative)( dirName, - (0, import_path6.resolve)(dirName, linkPath) + (0, import_path7.resolve)(dirName, linkPath) ); task.data.sourceType = "buffer"; task.source = Buffer.concat([]); @@ -160122,9 +160127,9 @@ var ZipArchive = class extends Archiver { }; // src/artifact-scanner.ts -var fs24 = __toESM(require("fs")); +var fs25 = __toESM(require("fs")); var os6 = __toESM(require("os")); -var path21 = __toESM(require("path")); +var path22 = __toESM(require("path")); var exec = __toESM(require_exec()); var GITHUB_PAT_CLASSIC_PATTERN = { type: "Personal Access Token (Classic)" /* PersonalAccessClassic */, @@ -160169,7 +160174,7 @@ function isAuthToken(value, patterns = GITHUB_TOKEN_PATTERNS) { function scanFileForTokens(filePath, relativePath2, logger) { const findings = []; try { - const content = fs24.readFileSync(filePath, "utf8"); + const content = fs25.readFileSync(filePath, "utf8"); for (const { type, pattern } of GITHUB_TOKEN_PATTERNS) { const matches = content.match(pattern); if (matches) { @@ -160202,10 +160207,10 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log findings: [] }; try { - const tempExtractDir = fs24.mkdtempSync( - path21.join(extractDir, `extract-${depth}-`) + const tempExtractDir = fs25.mkdtempSync( + path22.join(extractDir, `extract-${depth}-`) ); - const fileName = path21.basename(archivePath).toLowerCase(); + const fileName = path22.basename(archivePath).toLowerCase(); if (fileName.endsWith(".tar.gz") || fileName.endsWith(".tgz")) { logger.debug(`Extracting tar.gz file: ${archivePath}`); await exec.exec("tar", ["-xzf", archivePath, "-C", tempExtractDir], { @@ -160222,21 +160227,21 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log ); } else if (fileName.endsWith(".zst")) { logger.debug(`Extracting zst file: ${archivePath}`); - const outputFile = path21.join( + const outputFile = path22.join( tempExtractDir, - path21.basename(archivePath, ".zst") + path22.basename(archivePath, ".zst") ); await exec.exec("zstd", ["-d", archivePath, "-o", outputFile], { silent: true }); } else if (fileName.endsWith(".gz")) { logger.debug(`Extracting gz file: ${archivePath}`); - const outputFile = path21.join( + const outputFile = path22.join( tempExtractDir, - path21.basename(archivePath, ".gz") + path22.basename(archivePath, ".gz") ); await exec.exec("gunzip", ["-c", archivePath], { - outStream: fs24.createWriteStream(outputFile), + outStream: fs25.createWriteStream(outputFile), silent: true }); } else if (fileName.endsWith(".zip")) { @@ -160257,7 +160262,7 @@ async function scanArchiveFile(archivePath, relativeArchivePath, extractDir, log ); result.scannedFiles += scanResult.scannedFiles; result.findings.push(...scanResult.findings); - fs24.rmSync(tempExtractDir, { recursive: true, force: true }); + fs25.rmSync(tempExtractDir, { recursive: true, force: true }); } catch (e) { logger.debug( `Could not extract or scan archive file ${archivePath}: ${getErrorMessage(e)}` @@ -160270,7 +160275,7 @@ async function scanFile(fullPath, relativePath2, extractDir, logger, depth = 0) scannedFiles: 1, findings: [] }; - const fileName = path21.basename(fullPath).toLowerCase(); + const fileName = path22.basename(fullPath).toLowerCase(); const isArchive = fileName.endsWith(".zip") || fileName.endsWith(".tar.gz") || fileName.endsWith(".tgz") || fileName.endsWith(".tar.zst") || fileName.endsWith(".zst") || fileName.endsWith(".gz"); if (isArchive) { const archiveResult = await scanArchiveFile( @@ -160292,10 +160297,10 @@ async function scanDirectory(dirPath, baseRelativePath, logger, depth = 0) { scannedFiles: 0, findings: [] }; - const entries = fs24.readdirSync(dirPath, { withFileTypes: true }); + const entries = fs25.readdirSync(dirPath, { withFileTypes: true }); for (const entry of entries) { - const fullPath = path21.join(dirPath, entry.name); - const relativePath2 = path21.join(baseRelativePath, entry.name); + const fullPath = path22.join(dirPath, entry.name); + const relativePath2 = path22.join(baseRelativePath, entry.name); if (entry.isDirectory()) { const subResult = await scanDirectory( fullPath, @@ -160309,7 +160314,7 @@ async function scanDirectory(dirPath, baseRelativePath, logger, depth = 0) { const fileResult = await scanFile( fullPath, relativePath2, - path21.dirname(fullPath), + path22.dirname(fullPath), logger, depth ); @@ -160327,11 +160332,11 @@ async function scanArtifactsForTokens(filesToScan, logger) { scannedFiles: 0, findings: [] }; - const tempScanDir = fs24.mkdtempSync(path21.join(os6.tmpdir(), "artifact-scan-")); + const tempScanDir = fs25.mkdtempSync(path22.join(os6.tmpdir(), "artifact-scan-")); try { for (const filePath of filesToScan) { - const stats = fs24.statSync(filePath); - const fileName = path21.basename(filePath); + const stats = fs25.statSync(filePath); + const fileName = path22.basename(filePath); if (stats.isDirectory()) { const dirResult = await scanDirectory(filePath, fileName, logger); result.scannedFiles += dirResult.scannedFiles; @@ -160368,7 +160373,7 @@ async function scanArtifactsForTokens(filesToScan, logger) { } } finally { try { - fs24.rmSync(tempScanDir, { recursive: true, force: true }); + fs25.rmSync(tempScanDir, { recursive: true, force: true }); } catch (e) { logger.debug( `Could not clean up temporary scan directory: ${getErrorMessage(e)}` @@ -160388,14 +160393,14 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion logger.info( "Uploading available combined SARIF files as Actions debugging artifact..." ); - const baseTempDir = path22.resolve(tempDir, "combined-sarif"); + const baseTempDir = path23.resolve(tempDir, "combined-sarif"); const toUpload = []; - if (fs25.existsSync(baseTempDir)) { - const outputDirs = fs25.readdirSync(baseTempDir); + if (fs26.existsSync(baseTempDir)) { + const outputDirs = fs26.readdirSync(baseTempDir); for (const outputDir of outputDirs) { - const sarifFiles = fs25.readdirSync(path22.resolve(baseTempDir, outputDir)).filter((f) => path22.extname(f) === ".sarif"); + const sarifFiles = fs26.readdirSync(path23.resolve(baseTempDir, outputDir)).filter((f) => path23.extname(f) === ".sarif"); for (const sarifFile of sarifFiles) { - toUpload.push(path22.resolve(baseTempDir, outputDir, sarifFile)); + toUpload.push(path23.resolve(baseTempDir, outputDir, sarifFile)); } } } @@ -160421,17 +160426,17 @@ async function uploadCombinedSarifArtifacts(logger, gitHubVariant, codeQlVersion function tryPrepareSarifDebugArtifact(config, language, logger) { try { const analyzeActionOutputDir = process.env["CODEQL_ACTION_SARIF_RESULTS_OUTPUT_DIR" /* SARIF_RESULTS_OUTPUT_DIR */]; - if (analyzeActionOutputDir !== void 0 && fs25.existsSync(analyzeActionOutputDir) && fs25.lstatSync(analyzeActionOutputDir).isDirectory()) { - const sarifFile = path22.resolve( + if (analyzeActionOutputDir !== void 0 && fs26.existsSync(analyzeActionOutputDir) && fs26.lstatSync(analyzeActionOutputDir).isDirectory()) { + const sarifFile = path23.resolve( analyzeActionOutputDir, `${language}.sarif` ); - if (fs25.existsSync(sarifFile)) { - const sarifInDbLocation = path22.resolve( + if (fs26.existsSync(sarifFile)) { + const sarifInDbLocation = path23.resolve( config.dbLocation, `${language}.sarif` ); - fs25.copyFileSync(sarifFile, sarifInDbLocation); + fs26.copyFileSync(sarifFile, sarifInDbLocation); return sarifInDbLocation; } } @@ -160482,13 +160487,13 @@ async function tryUploadAllAvailableDebugArtifacts(codeql, config, logger, codeQ } logger.info("Preparing database logs debug artifact..."); const databaseDirectory = getCodeQLDatabasePath(config, language); - const logsDirectory = path22.resolve(databaseDirectory, "log"); + const logsDirectory = path23.resolve(databaseDirectory, "log"); if (doesDirectoryExist(logsDirectory)) { filesToUpload.push(...listFolder(logsDirectory)); logger.info("Database logs debug artifact ready for upload."); } logger.info("Preparing database cluster logs debug artifact..."); - const multiLanguageTracingLogsDirectory = path22.resolve( + const multiLanguageTracingLogsDirectory = path23.resolve( config.dbLocation, "log" ); @@ -160575,8 +160580,8 @@ async function uploadArtifacts(logger, toUpload, rootDir, artifactName, ghVarian try { await artifactUploader.uploadArtifact( sanitizeArtifactName(`${artifactName}${suffix}`), - toUpload.map((file) => path22.normalize(file)), - path22.normalize(rootDir), + toUpload.map((file) => path23.normalize(file)), + path23.normalize(rootDir), { // ensure we don't keep the debug artifacts around for too long since they can be large. retentionDays: 7 @@ -160603,17 +160608,17 @@ async function getArtifactUploaderClient(logger, ghVariant) { } async function createPartialDatabaseBundle(config, language) { const databasePath = getCodeQLDatabasePath(config, language); - const databaseBundlePath = path22.resolve( + const databaseBundlePath = path23.resolve( config.dbLocation, `${config.debugDatabaseName}-${language}-partial.zip` ); core17.info( `${config.debugDatabaseName}-${language} is not finalized. Uploading partial database bundle at ${databaseBundlePath}...` ); - if (fs25.existsSync(databaseBundlePath)) { - await fs25.promises.rm(databaseBundlePath, { force: true }); + if (fs26.existsSync(databaseBundlePath)) { + await fs26.promises.rm(databaseBundlePath, { force: true }); } - const output = fs25.createWriteStream(databaseBundlePath); + const output = fs26.createWriteStream(databaseBundlePath); const zip = new ZipArchive(); zip.on("error", (err) => { throw err; @@ -160666,9 +160671,9 @@ async function runWrapper2() { getCsharpTempDependencyDir() ]; for (const tempDependencyDir of tempDependencyDirs) { - if (fs26.existsSync(tempDependencyDir)) { + if (fs27.existsSync(tempDependencyDir)) { try { - fs26.rmSync(tempDependencyDir, { recursive: true }); + fs27.rmSync(tempDependencyDir, { recursive: true }); } catch (error3) { logger.info( `Failed to remove temporary dependencies directory: ${getErrorMessage(error3)}` @@ -160775,8 +160780,8 @@ async function runWrapper3() { } // src/init-action.ts -var fs28 = __toESM(require("fs")); -var path24 = __toESM(require("path")); +var fs29 = __toESM(require("fs")); +var path25 = __toESM(require("path")); var core21 = __toESM(require_core()); var io7 = __toESM(require_io()); var semver10 = __toESM(require_semver2()); @@ -160816,8 +160821,8 @@ async function getToolsInput(action, repositoryProperties) { } // src/workflow.ts -var fs27 = __toESM(require("fs")); -var path23 = __toESM(require("path")); +var fs28 = __toESM(require("fs")); +var path24 = __toESM(require("path")); var import_zlib3 = __toESM(require("zlib")); var core20 = __toESM(require_core()); function toCodedErrors(errors) { @@ -160968,15 +160973,15 @@ async function getWorkflow(logger) { ); } const workflowPath = await getWorkflowAbsolutePath(logger); - return load(fs27.readFileSync(workflowPath, "utf-8")); + return load(fs28.readFileSync(workflowPath, "utf-8")); } async function getWorkflowAbsolutePath(logger) { const relativePath2 = await getWorkflowRelativePath(); - const absolutePath = path23.join( + const absolutePath = path24.join( getRequiredEnvParam("GITHUB_WORKSPACE"), relativePath2 ); - if (fs27.existsSync(absolutePath)) { + if (fs28.existsSync(absolutePath)) { logger.debug( `Derived the following absolute path for the currently executing workflow: ${absolutePath}.` ); @@ -161195,7 +161200,7 @@ async function run3(actionState) { ); const repositoryProperties = repositoryPropertiesResult.orElse({}); core21.exportVariable("CODEQL_ACTION_INIT_HAS_RUN" /* INIT_ACTION_HAS_RUN */, "true"); - sourceRoot = path24.resolve( + sourceRoot = path25.resolve( getRequiredEnvParam("GITHUB_WORKSPACE"), getOptionalInput("source-root") || "" ); @@ -161390,21 +161395,21 @@ async function run3(actionState) { )) { try { logger.debug(`Applying static binary workaround for Go`); - const tempBinPath = path24.resolve( + const tempBinPath = path25.resolve( getTemporaryDirectory(), "codeql-action-go-tracing", "bin" ); - fs28.mkdirSync(tempBinPath, { recursive: true }); + fs29.mkdirSync(tempBinPath, { recursive: true }); core21.addPath(tempBinPath); - const goWrapperPath = path24.resolve(tempBinPath, "go"); - fs28.writeFileSync( + const goWrapperPath = path25.resolve(tempBinPath, "go"); + fs29.writeFileSync( goWrapperPath, `#!/bin/bash exec ${goBinaryPath} "$@"` ); - fs28.chmodSync(goWrapperPath, "755"); + fs29.chmodSync(goWrapperPath, "755"); core21.exportVariable("CODEQL_ACTION_GO_BINARY" /* GO_BINARY_LOCATION */, goWrapperPath); } catch (e) { logger.warning( @@ -161589,8 +161594,8 @@ async function runWrapper4() { var core22 = __toESM(require_core()); // src/init-action-post-helper.ts -var fs29 = __toESM(require("fs")); -var import_path7 = __toESM(require("path")); +var fs30 = __toESM(require("fs")); +var import_path8 = __toESM(require("path")); var github4 = __toESM(require_github()); function createFailedUploadFailedSarifResult(error3) { const wrappedError = wrapError(error3); @@ -161701,8 +161706,8 @@ async function maybeUploadFailedSarifArtifact(config, features, logger) { const name = sanitizeArtifactName(`sarif-artifact-${suffix}`); await client.uploadArtifact( name, - [import_path7.default.normalize(failedSarif.sarifFile)], - import_path7.default.normalize("..") + [import_path8.default.normalize(failedSarif.sarifFile)], + import_path8.default.normalize("..") ); return { sarifID: name }; } @@ -161777,7 +161782,7 @@ async function uploadFailureInfo(uploadAllAvailableDebugArtifacts, printDebugLog } if (isSelfHostedRunner()) { try { - fs29.rmSync(config.dbLocation, { + fs30.rmSync(config.dbLocation, { recursive: true, force: true, maxRetries: 3 @@ -162269,11 +162274,11 @@ async function runWrapper7() { // src/start-proxy-action.ts var import_child_process2 = require("child_process"); -var path28 = __toESM(require("path")); +var path29 = __toESM(require("path")); var core27 = __toESM(require_core()); // src/start-proxy.ts -var path26 = __toESM(require("path")); +var path27 = __toESM(require("path")); var core26 = __toESM(require_core()); var toolcache4 = __toESM(require_tool_cache()); @@ -162611,7 +162616,7 @@ async function getProxyBinaryPath(logger, features) { proxyInfo.version ); } - return path26.join(proxyBin, proxyFileName); + return path27.join(proxyBin, proxyFileName); } // src/start-proxy/ca.ts @@ -162676,8 +162681,8 @@ function generateCertificateAuthority() { } // src/start-proxy/environment.ts -var fs30 = __toESM(require("fs")); -var path27 = __toESM(require("path")); +var fs31 = __toESM(require("fs")); +var path28 = __toESM(require("path")); var toolrunner5 = __toESM(require_toolrunner()); var io8 = __toESM(require_io()); function checkEnvVar(logger, name) { @@ -162742,16 +162747,16 @@ function discoverActionsJdks() { function checkJdkSettings(logger, jdkHome) { const filesToCheck = [ // JDK 9+ - path27.join("conf", "net.properties"), + path28.join("conf", "net.properties"), // JDK 8 and below - path27.join("lib", "net.properties") + path28.join("lib", "net.properties") ]; for (const fileToCheck of filesToCheck) { - const file = path27.join(jdkHome, fileToCheck); + const file = path28.join(jdkHome, fileToCheck); try { - if (fs30.existsSync(file)) { + if (fs31.existsSync(file)) { logger.debug(`Found '${file}'.`); - const lines = String(fs30.readFileSync(file)).split("\n"); + const lines = String(fs31.readFileSync(file)).split("\n"); for (const line of lines) { for (const property of javaProperties) { if (line.startsWith(`${property}=`)) { @@ -162933,7 +162938,7 @@ async function run7(action) { try { persistInputs(); const tempDir = getTemporaryDirectory(); - const proxyLogFilePath = path28.resolve(tempDir, "proxy.log"); + const proxyLogFilePath = path29.resolve(tempDir, "proxy.log"); core27.saveState("proxy-log-file", proxyLogFilePath); const repositoryNwo = getRepositoryNwo(); const gitHubVersion = await getGitHubVersion(); diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts new file mode 100644 index 0000000000..e4f7769193 --- /dev/null +++ b/src/cli/output-cache.test.ts @@ -0,0 +1,111 @@ +import * as fs from "fs"; +import path from "path"; + +import test from "ava"; + +import { EnvVar } from "../environment"; +import { getTestEnv, setupTests } from "../testing-utils"; +import * as util from "../util"; + +import * as outputCache from "./output-cache"; + +setupTests(test); + +test.serial( + "getCachedCodeQlVersion reuses a version persisted by an earlier step", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "codeql-action-command-cache.json"); + fs.writeFileSync( + cacheFile, + JSON.stringify({ + cmd: "/path/to/codeql", + version: { version: "2.20.0" }, + }), + "utf8", + ); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.deepEqual(outputCache.getCachedCodeQlVersion("/path/to/codeql", env), { + version: "2.20.0", + }); + }); + }, +); + +test.serial( + "getCachedCodeQlVersion ignores a persisted version from a different CLI", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + fs.writeFileSync( + cacheFile, + JSON.stringify({ + cmd: "/path/to/other-codeql", + version: { version: "2.20.0" }, + }), + "utf8", + ); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is( + outputCache.getCachedCodeQlVersion("/path/to/codeql", env), + undefined, + ); + }); + }, +); + +test.serial( + "getCachedCodeQlVersion ignores a malformed persisted value", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + fs.writeFileSync(cacheFile, "not valid json", "utf8"); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is( + outputCache.getCachedCodeQlVersion("/path/to/codeql", env), + undefined, + ); + }); + }, +); + +test.serial( + "getCachedCodeQlVersion ignores a persisted value with the wrong structure", + async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const cacheFile = path.join(tmpDir, "version.json"); + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + + const testValues = [ + { cmd: "/path/to/codeql" }, + { cmd: "/path/to/codeql", version: {} }, + { cmd: "/path/to/codeql", version: { version: 2 } }, + { version: { version: "2.20.0" } }, + { + cmd: "/path/to/codeql", + version: { version: "2.20.0", overlayVersion: "1" }, + }, + { + cmd: "/path/to/codeql", + version: { version: "2.20.0", features: "nope" }, + }, + ].map((v) => JSON.stringify(v)); + + for (const value of testValues) { + fs.writeFileSync(cacheFile, value, "utf8"); + t.is( + outputCache.getCachedCodeQlVersion("/path/to/codeql", env), + undefined, + value, + ); + } + }); + }, +); + +test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => { + await util.withTmpDir(async (tmpDir: string) => { + const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); + t.is(outputCache.getCachedCodeQlVersion("/path/to/codeql", env), undefined); + }); +}); diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index b6085445e2..e7faa00051 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -1,6 +1,10 @@ +import * as fs from "fs"; import path from "path"; import { getTemporaryDirectory } from "../actions-util"; +import { VersionInfo } from "../codeql"; +import { Env, getEnv } from "../environment"; +import { isPersistedVersionInfo } from "../util"; /** * The name of the temporary file that backs the on-disk cache of @@ -8,10 +12,89 @@ import { getTemporaryDirectory } from "../actions-util"; */ const COMMAND_CACHE_FILENAME = "codeql-action-command-cache.json"; +/** + * The module-global variable that caches the CodeQL CLI version in-memory. + */ +let cachedCodeQlVersion: undefined | VersionInfo = undefined; + +/** + * Resets the in-process cache of the CodeQL CLI version. Only for use in tests, + * which exercise multiple "steps" within a single process. + */ +export function resetCachedCodeQlVersion(): void { + cachedCodeQlVersion = undefined; +} + /** * Returns the path to the temporary file that backs the * on-disk cache of CLI responses between workflow steps. */ -function getCommandCacheFilePath(): string { - return path.join(getTemporaryDirectory(), COMMAND_CACHE_FILENAME); +function getCommandCacheFilePath(env: Env): string { + return path.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME); +} + +/** + * Caches the CodeQL CLI version both in-memory and on disk. + * @param cmd The path to the CodeQL CLI. + * @param version The version information to cache. + * @param env The environment variables to use. + */ +export function cacheCodeQlVersion( + cmd: string, + version: VersionInfo, + env: Env = getEnv(), +): void { + if (cachedCodeQlVersion !== undefined) { + throw new Error("cacheCodeQlVersion() should be called only once"); + } + cachedCodeQlVersion = version; + // Persist the version so that subsequent Actions steps, which run in separate + // processes, can reuse it rather than invoking `codeql version` again. We + // record the CLI path so that a different step using a different CodeQL bundle + // doesn't pick up a stale version. + fs.writeFileSync( + getCommandCacheFilePath(env), + JSON.stringify({ cmd, version }), + "utf8", + ); +} + +/** + * Returns the cached CodeQL CLI version, if any. If not cached, + * attempts to read and parse it from disk. + * @param cmd The path to the CodeQL CLI. + * @param env The environment variables to use. + */ +export function getCachedCodeQlVersion( + cmd?: string, + env: Env = getEnv(), +): undefined | VersionInfo { + if (cachedCodeQlVersion !== undefined) { + return cachedCodeQlVersion; + } + // Fall back to the value persisted by an earlier Actions step, if any. This is + // best-effort: any malformed or mismatched value is ignored so that the caller + // invokes `codeql version` instead. + let serialized: string; + try { + serialized = fs.readFileSync(getCommandCacheFilePath(env), "utf8"); + } catch { + return undefined; + } + let persisted: unknown; + try { + persisted = JSON.parse(serialized); + } catch { + return undefined; + } + if ( + !isPersistedVersionInfo(persisted) || + (cmd !== undefined && persisted.cmd !== cmd) + ) { + return undefined; + } + // Memoize the parsed value so that subsequent calls in this process don't + // re-parse the environment variable. + cachedCodeQlVersion = persisted.version; + return cachedCodeQlVersion; } diff --git a/src/codeql.ts b/src/codeql.ts index a29df90865..db017f1f5f 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -12,6 +12,7 @@ import { runTool, } from "./actions-util"; import * as api from "./api-client"; +import * as outputCache from "./cli/output-cache"; import { CliError, wrapCliConfigurationError } from "./cli-errors"; import { appendExtraQueryExclusions, type Config } from "./config-utils"; import { DocUrl } from "./doc-url"; @@ -502,7 +503,7 @@ async function getCodeQLForCmd( return cmd; }, async getVersion() { - let result = util.getCachedCodeQlVersion(cmd); + let result = outputCache.getCachedCodeQlVersion(cmd); if (result === undefined) { result = await runCliJson( cmd, @@ -511,7 +512,7 @@ async function getCodeQLForCmd( noStreamStdout: true, }, ); - util.cacheCodeQlVersion(cmd, result); + outputCache.cacheCodeQlVersion(cmd, result); } return result; }, diff --git a/src/status-report.ts b/src/status-report.ts index b471bfa971..d2967a86f5 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -14,6 +14,7 @@ import { isSelfHostedRunner, } from "./actions-util"; import { getAnalysisKey, getApiClient } from "./api-client"; +import { getCachedCodeQlVersion } from "./cli/output-cache"; import type { Config } from "./config/action-config"; import type { ComputedInput, InputName } from "./config/inputs"; import { parseRegistriesWithoutCredentials } from "./config/pack-registries"; @@ -30,7 +31,6 @@ import { registryBaseSchema } from "./start-proxy/types"; import { ConfigurationError, getRequiredEnvParam, - getCachedCodeQlVersion, isInTestMode, GITHUB_DOTCOM_URL, DiskUsage, diff --git a/src/testing-utils.ts b/src/testing-utils.ts index 279459275d..f253569235 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -18,6 +18,7 @@ import { AnalysisKind } from "./analyses"; import * as apiClient from "./api-client"; import { GitHubApiDetails } from "./api-client"; import { CachingKind } from "./caching-utils"; +import { resetCachedCodeQlVersion } from "./cli/output-cache"; import * as codeql from "./codeql"; import { Config } from "./config-utils"; import * as defaults from "./defaults.json"; @@ -39,7 +40,6 @@ import { GitHubVariant, GitHubVersion, HTTPError, - resetCachedCodeQlVersion, Result, Success, } from "./util"; diff --git a/src/util.test.ts b/src/util.test.ts index c71a89669b..cca457cbe6 100644 --- a/src/util.test.ts +++ b/src/util.test.ts @@ -10,7 +10,7 @@ import * as sinon from "sinon"; import * as api from "./api-client"; import { EnvVar } from "./environment"; import { getRunnerLogger } from "./logging"; -import { getTestEnv, setupTests } from "./testing-utils"; +import { setupTests } from "./testing-utils"; import * as util from "./util"; setupTests(test); @@ -532,96 +532,3 @@ test("Failure.orElse returns the default value for a failure result", (t) => { const result = new util.Failure(new Error("test error")); t.is(result.orElse("default value"), "default value"); }); - -test.serial( - "getCachedCodeQlVersion reuses a version persisted by an earlier step", - async (t) => { - await util.withTmpDir(async (tmpDir: string) => { - const cacheFile = path.join(tmpDir, "version.json"); - fs.writeFileSync( - cacheFile, - JSON.stringify({ - cmd: "/path/to/codeql", - version: { version: "2.20.0" }, - }), - "utf8", - ); - const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.deepEqual(util.getCachedCodeQlVersion("/path/to/codeql", env), { - version: "2.20.0", - }); - }); - }, -); - -test.serial( - "getCachedCodeQlVersion ignores a persisted version from a different CLI", - async (t) => { - await util.withTmpDir(async (tmpDir: string) => { - const cacheFile = path.join(tmpDir, "version.json"); - fs.writeFileSync( - cacheFile, - JSON.stringify({ - cmd: "/path/to/other-codeql", - version: { version: "2.20.0" }, - }), - "utf8", - ); - const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.is(util.getCachedCodeQlVersion("/path/to/codeql", env), undefined); - }); - }, -); - -test.serial( - "getCachedCodeQlVersion ignores a malformed persisted value", - async (t) => { - await util.withTmpDir(async (tmpDir: string) => { - const cacheFile = path.join(tmpDir, "version.json"); - fs.writeFileSync(cacheFile, "not valid json", "utf8"); - const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.is(util.getCachedCodeQlVersion("/path/to/codeql", env), undefined); - }); - }, -); - -test.serial( - "getCachedCodeQlVersion ignores a persisted value with the wrong structure", - async (t) => { - await util.withTmpDir(async (tmpDir: string) => { - const cacheFile = path.join(tmpDir, "version.json"); - const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - - const testValues = [ - { cmd: "/path/to/codeql" }, - { cmd: "/path/to/codeql", version: {} }, - { cmd: "/path/to/codeql", version: { version: 2 } }, - { version: { version: "2.20.0" } }, - { - cmd: "/path/to/codeql", - version: { version: "2.20.0", overlayVersion: "1" }, - }, - { - cmd: "/path/to/codeql", - version: { version: "2.20.0", features: "nope" }, - }, - ].map((v) => JSON.stringify(v)); - - for (const value of testValues) { - fs.writeFileSync(cacheFile, value, "utf8"); - t.is( - util.getCachedCodeQlVersion("/path/to/codeql", env), - undefined, - value, - ); - } - }); - }, -); - -test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => { - await util.withTmpDir(async (tmpDir: string) => { - const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.is(util.getCachedCodeQlVersion("/path/to/codeql", env), undefined); - }); -}); diff --git a/src/util.ts b/src/util.ts index cffc029dde..572afd6d1e 100644 --- a/src/util.ts +++ b/src/util.ts @@ -9,12 +9,11 @@ import getFolderSize from "get-folder-size"; import * as yaml from "js-yaml"; import * as semver from "semver"; -import { getTemporaryDirectory } from "./actions-util"; import * as apiCompatibility from "./api-compatibility.json"; import type { CodeQL, VersionInfo } from "./codeql"; import type { Pack } from "./config/db-config"; import type { Config } from "./config-utils"; -import { Env, EnvVar, getEnv, getRequiredEnvParam } from "./environment"; +import { EnvVar, getRequiredEnvParam } from "./environment"; import * as json from "./json"; import { Language } from "./languages"; import { Logger } from "./logging"; @@ -599,16 +598,6 @@ export function asHTTPError(arg: any): HTTPError | undefined { return undefined; } -let cachedCodeQlVersion: undefined | VersionInfo = undefined; - -/** - * Resets the in-process cache of the CodeQL CLI version. Only for use in tests, - * which exercise multiple "steps" within a single process. - */ -export function resetCachedCodeQlVersion(): void { - cachedCodeQlVersion = undefined; -} - /** The persisted version together with the CLI path it was obtained from. */ interface PersistedVersionInfo { cmd: string; @@ -629,7 +618,7 @@ function isVersionInfo(x: unknown): x is VersionInfo { ); } -function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { +export function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { const candidate = x as Partial | null; return ( typeof candidate === "object" && @@ -639,79 +628,6 @@ function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { ); } -/** - * Returns the file path to the `codeql version` output cache. - * @param env The environment variables to use. - */ -function getPathToCodeQLVersionCacheFile(env: Env): string { - return path.join(getTemporaryDirectory(env), "version.json"); -} - -/** - * Caches the CodeQL CLI version both in-memory and on disk. - * @param cmd The path to the CodeQL CLI. - * @param version The version information to cache. - * @param env The environment variables to use. - */ -export function cacheCodeQlVersion( - cmd: string, - version: VersionInfo, - env: Env = getEnv(), -): void { - if (cachedCodeQlVersion !== undefined) { - throw new Error("cacheCodeQlVersion() should be called only once"); - } - cachedCodeQlVersion = version; - // Persist the version so that subsequent Actions steps, which run in separate - // processes, can reuse it rather than invoking `codeql version` again. We - // record the CLI path so that a different step using a different CodeQL bundle - // doesn't pick up a stale version. - fs.writeFileSync( - getPathToCodeQLVersionCacheFile(env), - JSON.stringify({ cmd, version }), - "utf8", - ); -} - -/** - * Returns the cached CodeQL CLI version, if any. - * @param cmd The path to the CodeQL CLI. - * @param env The environment variables to use. - */ -export function getCachedCodeQlVersion( - cmd?: string, - env: Env = getEnv(), -): undefined | VersionInfo { - if (cachedCodeQlVersion !== undefined) { - return cachedCodeQlVersion; - } - // Fall back to the value persisted by an earlier Actions step, if any. This is - // best-effort: any malformed or mismatched value is ignored so that the caller - // invokes `codeql version` instead. - let serialized: string; - try { - serialized = fs.readFileSync(getPathToCodeQLVersionCacheFile(env), "utf8"); - } catch { - return undefined; - } - let persisted: unknown; - try { - persisted = JSON.parse(serialized); - } catch { - return undefined; - } - if ( - !isPersistedVersionInfo(persisted) || - (cmd !== undefined && persisted.cmd !== cmd) - ) { - return undefined; - } - // Memoize the parsed value so that subsequent calls in this process don't - // re-parse the environment variable. - cachedCodeQlVersion = persisted.version; - return cachedCodeQlVersion; -} - export async function codeQlVersionAtLeast( codeql: CodeQL, requiredVersion: string, From 246018e04157a8b7531c3d25384b2da6f29083ed Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 15:25:46 -0500 Subject: [PATCH 128/155] Move `VersionInfo` to dedicated module --- src/cli/output-cache.ts | 3 ++- src/cli/types.ts | 13 +++++++++++++ src/codeql.ts | 15 +-------------- src/testing-utils.ts | 3 ++- src/tools-features.ts | 2 +- src/util.ts | 3 ++- 6 files changed, 21 insertions(+), 18 deletions(-) create mode 100644 src/cli/types.ts diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index e7faa00051..957dfd3b4a 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -2,10 +2,11 @@ import * as fs from "fs"; import path from "path"; import { getTemporaryDirectory } from "../actions-util"; -import { VersionInfo } from "../codeql"; import { Env, getEnv } from "../environment"; import { isPersistedVersionInfo } from "../util"; +import type { VersionInfo } from "./types"; + /** * The name of the temporary file that backs the on-disk cache of * CLI responses between workflow steps. diff --git a/src/cli/types.ts b/src/cli/types.ts new file mode 100644 index 0000000000..ad48ff29b4 --- /dev/null +++ b/src/cli/types.ts @@ -0,0 +1,13 @@ +export interface VersionInfo { + version: string; + features?: { [name: string]: boolean }; + /** + * The overlay version helps deal with backward incompatible changes for + * overlay analysis. When a precompiled query pack reports the same overlay + * version as the CodeQL CLI, we can use the CodeQL CLI to perform overlay + * analysis with that pack. Otherwise, if the overlay versions are different, + * or if either the pack or the CLI does not report an overlay version, + * we need to revert to non-overlay analysis. + */ + overlayVersion?: number; +} diff --git a/src/codeql.ts b/src/codeql.ts index db017f1f5f..fecc155bb4 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -13,6 +13,7 @@ import { } from "./actions-util"; import * as api from "./api-client"; import * as outputCache from "./cli/output-cache"; +import type { VersionInfo } from "./cli/types"; import { CliError, wrapCliConfigurationError } from "./cli-errors"; import { appendExtraQueryExclusions, type Config } from "./config-utils"; import { DocUrl } from "./doc-url"; @@ -216,20 +217,6 @@ export interface CodeQL { ): Promise; } -export interface VersionInfo { - version: string; - features?: { [name: string]: boolean }; - /** - * The overlay version helps deal with backward incompatible changes for - * overlay analysis. When a precompiled query pack reports the same overlay - * version as the CodeQL CLI, we can use the CodeQL CLI to perform overlay - * analysis with that pack. Otherwise, if the overlay versions are different, - * or if either the pack or the CLI does not report an overlay version, - * we need to revert to non-overlay analysis. - */ - overlayVersion?: number; -} - export interface ResolveDatabaseOutput { overlayBaseSpecifier?: string; } diff --git a/src/testing-utils.ts b/src/testing-utils.ts index f253569235..e4f26daa0f 100644 --- a/src/testing-utils.ts +++ b/src/testing-utils.ts @@ -19,6 +19,7 @@ import * as apiClient from "./api-client"; import { GitHubApiDetails } from "./api-client"; import { CachingKind } from "./caching-utils"; import { resetCachedCodeQlVersion } from "./cli/output-cache"; +import type { VersionInfo } from "./cli/types"; import * as codeql from "./codeql"; import { Config } from "./config-utils"; import * as defaults from "./defaults.json"; @@ -872,7 +873,7 @@ export const makeVersionInfo = ( version: string, features?: { [name: string]: boolean }, overlayVersion?: number, -): codeql.VersionInfo => ({ +): VersionInfo => ({ version, features, overlayVersion, diff --git a/src/tools-features.ts b/src/tools-features.ts index ff87b754da..4931be65ba 100644 --- a/src/tools-features.ts +++ b/src/tools-features.ts @@ -1,6 +1,6 @@ import * as semver from "semver"; -import type { VersionInfo } from "./codeql"; +import type { VersionInfo } from "./cli/types"; export enum ToolsFeature { BuiltinExtractorsSpecifyDefaultQueries = "builtinExtractorsSpecifyDefaultQueries", diff --git a/src/util.ts b/src/util.ts index 572afd6d1e..e691a7c17f 100644 --- a/src/util.ts +++ b/src/util.ts @@ -10,7 +10,8 @@ import * as yaml from "js-yaml"; import * as semver from "semver"; import * as apiCompatibility from "./api-compatibility.json"; -import type { CodeQL, VersionInfo } from "./codeql"; +import type { VersionInfo } from "./cli/types"; +import type { CodeQL } from "./codeql"; import type { Pack } from "./config/db-config"; import type { Config } from "./config-utils"; import { EnvVar, getRequiredEnvParam } from "./environment"; From 0a99875ae5c8d583ce2d68bfdddbb569ab88c472 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 15:35:03 -0500 Subject: [PATCH 129/155] Move `VersionInfo`-related types to `cli/output-cache.ts` This brings them out of the crowded all-purpose `util.ts` and into `cli/output-cache.ts` where they are exclusively used. --- lib/entry-points.js | 20 ++++++++++---------- src/cli/output-cache.ts | 39 ++++++++++++++++++++++++++++++++++++++- src/util.ts | 31 ------------------------------- 3 files changed, 48 insertions(+), 42 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 218f450b1f..78af796142 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145241,14 +145241,6 @@ function asHTTPError(arg) { } return void 0; } -function isVersionInfo(x) { - const candidate = x; - return typeof candidate === "object" && candidate !== null && typeof candidate.version === "string" && (candidate.features === void 0 || typeof candidate.features === "object" && candidate.features !== null) && (candidate.overlayVersion === void 0 || typeof candidate.overlayVersion === "number"); -} -function isPersistedVersionInfo(x) { - const candidate = x; - return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && isVersionInfo(candidate.version); -} async function codeQlVersionAtLeast(codeql, requiredVersion) { return semver.gte((await codeql.getVersion()).version, requiredVersion); } @@ -146292,6 +146284,14 @@ function getCachedCodeQlVersion(cmd, env = getEnv()) { cachedCodeQlVersion = persisted.version; return cachedCodeQlVersion; } +function isVersionInfo(x) { + const candidate = x; + return typeof candidate === "object" && candidate !== null && typeof candidate.version === "string" && (candidate.features === void 0 || typeof candidate.features === "object" && candidate.features !== null) && (candidate.overlayVersion === void 0 || typeof candidate.overlayVersion === "number"); +} +function isPersistedVersionInfo(x) { + const candidate = x; + return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && isVersionInfo(candidate.version); +} // src/config/pack-registries.ts function parseRegistries(registriesInput) { @@ -157827,7 +157827,7 @@ var import_async = __toESM(require_async(), 1); var import_path7 = require("path"); // node_modules/archiver/lib/error.js -var import_util35 = __toESM(require("util"), 1); +var import_util34 = __toESM(require("util"), 1); var ERROR_CODES = { ABORTED: "archive was aborted", DIRECTORYDIRPATHREQUIRED: "diretory dirpath argument must be a non-empty string value", @@ -157852,7 +157852,7 @@ function ArchiverError(code, data) { this.code = code; this.data = data; } -import_util35.default.inherits(ArchiverError, Error); +import_util34.default.inherits(ArchiverError, Error); // node_modules/archiver/lib/core.js var import_readable_stream2 = __toESM(require_ours(), 1); diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 957dfd3b4a..ccf2666d43 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -3,10 +3,15 @@ import path from "path"; import { getTemporaryDirectory } from "../actions-util"; import { Env, getEnv } from "../environment"; -import { isPersistedVersionInfo } from "../util"; import type { VersionInfo } from "./types"; +/** The persisted version together with the CLI path it was obtained from. */ +interface PersistedVersionInfo { + cmd: string; + version: VersionInfo; +} + /** * The name of the temporary file that backs the on-disk cache of * CLI responses between workflow steps. @@ -99,3 +104,35 @@ export function getCachedCodeQlVersion( cachedCodeQlVersion = persisted.version; return cachedCodeQlVersion; } + +/** + * Determines whether a value is a `VersionInfo` object. + * @param x The value to test + */ +function isVersionInfo(x: unknown): x is VersionInfo { + const candidate = x as Partial | null; + return ( + typeof candidate === "object" && + candidate !== null && + typeof candidate.version === "string" && + (candidate.features === undefined || + (typeof candidate.features === "object" && + candidate.features !== null)) && + (candidate.overlayVersion === undefined || + typeof candidate.overlayVersion === "number") + ); +} + +/** + * Determines whether a value is a `PersistedVersionInfo` object. + * @param x The value to test + */ +function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { + const candidate = x as Partial | null; + return ( + typeof candidate === "object" && + candidate !== null && + typeof candidate.cmd === "string" && + isVersionInfo(candidate.version) + ); +} diff --git a/src/util.ts b/src/util.ts index e691a7c17f..2d910dec3b 100644 --- a/src/util.ts +++ b/src/util.ts @@ -10,7 +10,6 @@ import * as yaml from "js-yaml"; import * as semver from "semver"; import * as apiCompatibility from "./api-compatibility.json"; -import type { VersionInfo } from "./cli/types"; import type { CodeQL } from "./codeql"; import type { Pack } from "./config/db-config"; import type { Config } from "./config-utils"; @@ -599,36 +598,6 @@ export function asHTTPError(arg: any): HTTPError | undefined { return undefined; } -/** The persisted version together with the CLI path it was obtained from. */ -interface PersistedVersionInfo { - cmd: string; - version: VersionInfo; -} - -function isVersionInfo(x: unknown): x is VersionInfo { - const candidate = x as Partial | null; - return ( - typeof candidate === "object" && - candidate !== null && - typeof candidate.version === "string" && - (candidate.features === undefined || - (typeof candidate.features === "object" && - candidate.features !== null)) && - (candidate.overlayVersion === undefined || - typeof candidate.overlayVersion === "number") - ); -} - -export function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { - const candidate = x as Partial | null; - return ( - typeof candidate === "object" && - candidate !== null && - typeof candidate.cmd === "string" && - isVersionInfo(candidate.version) - ); -} - export async function codeQlVersionAtLeast( codeql: CodeQL, requiredVersion: string, From 11569df0a16344bab137c4b7535c8335dc0ffd28 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 15:44:26 -0500 Subject: [PATCH 130/155] Update JSDoc of `getCachedCodeQlVersion` --- src/cli/output-cache.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index ccf2666d43..9616b7ee74 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -66,8 +66,7 @@ export function cacheCodeQlVersion( } /** - * Returns the cached CodeQL CLI version, if any. If not cached, - * attempts to read and parse it from disk. + * Returns the cached CodeQL CLI version, if any. * @param cmd The path to the CodeQL CLI. * @param env The environment variables to use. */ From b222c3aaea90b4a2485a201b23a6a56378e78d7e Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 17:54:08 -0500 Subject: [PATCH 131/155] Generalize file cache data structure --- lib/entry-points.js | 6 +++--- src/cli/output-cache.test.ts | 2 +- src/cli/output-cache.ts | 33 ++++++++++++++++++++++++++------- 3 files changed, 30 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 78af796142..ecd5385df1 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146258,7 +146258,7 @@ function cacheCodeQlVersion(cmd, version, env = getEnv()) { cachedCodeQlVersion = version; fs3.writeFileSync( getCommandCacheFilePath(env), - JSON.stringify({ cmd, version }), + JSON.stringify({ cmd, entries: { ["version" /* Version */]: version } }), "utf8" ); } @@ -146281,7 +146281,7 @@ function getCachedCodeQlVersion(cmd, env = getEnv()) { if (!isPersistedVersionInfo(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { return void 0; } - cachedCodeQlVersion = persisted.version; + cachedCodeQlVersion = persisted.entries["version" /* Version */]; return cachedCodeQlVersion; } function isVersionInfo(x) { @@ -146290,7 +146290,7 @@ function isVersionInfo(x) { } function isPersistedVersionInfo(x) { const candidate = x; - return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && isVersionInfo(candidate.version); + return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && candidate.entries !== void 0 && isVersionInfo(candidate.entries["version" /* Version */]); } // src/config/pack-registries.ts diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts index e4f7769193..83f206e0ef 100644 --- a/src/cli/output-cache.test.ts +++ b/src/cli/output-cache.test.ts @@ -20,7 +20,7 @@ test.serial( cacheFile, JSON.stringify({ cmd: "/path/to/codeql", - version: { version: "2.20.0" }, + entries: { version: { version: "2.20.0" } }, }), "utf8", ); diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 9616b7ee74..5fcca2cd41 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -6,10 +6,24 @@ import { Env, getEnv } from "../environment"; import type { VersionInfo } from "./types"; +/** + * The keys of the command cache. Each key corresponds to a command whose output we cache. + */ +enum CommandCacheKey { + Version = "version", +} + +/** + * The mapping of CLI commands to the types of the output of each command that we cache. + */ +type CommandCacheKeyOutputMap = { + [CommandCacheKey.Version]: VersionInfo; +}; + /** The persisted version together with the CLI path it was obtained from. */ -interface PersistedVersionInfo { +interface PersistedVersionInfo { cmd: string; - version: VersionInfo; + entries: Map; } /** @@ -60,7 +74,7 @@ export function cacheCodeQlVersion( // doesn't pick up a stale version. fs.writeFileSync( getCommandCacheFilePath(env), - JSON.stringify({ cmd, version }), + JSON.stringify({ cmd, entries: { [CommandCacheKey.Version]: version } }), "utf8", ); } @@ -100,7 +114,7 @@ export function getCachedCodeQlVersion( } // Memoize the parsed value so that subsequent calls in this process don't // re-parse the environment variable. - cachedCodeQlVersion = persisted.version; + cachedCodeQlVersion = persisted.entries[CommandCacheKey.Version]; return cachedCodeQlVersion; } @@ -126,12 +140,17 @@ function isVersionInfo(x: unknown): x is VersionInfo { * Determines whether a value is a `PersistedVersionInfo` object. * @param x The value to test */ -function isPersistedVersionInfo(x: unknown): x is PersistedVersionInfo { - const candidate = x as Partial | null; +function isPersistedVersionInfo( + x: unknown, +): x is PersistedVersionInfo { + const candidate = x as Partial< + PersistedVersionInfo + > | null; return ( typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && - isVersionInfo(candidate.version) + candidate.entries !== undefined && + isVersionInfo(candidate.entries[CommandCacheKey.Version]) ); } From 40f80a8df09be2b1e7aed995af3abca5f5ffbce1 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 11 Aug 2026 17:59:08 -0500 Subject: [PATCH 132/155] Rename type to better match generic intention --- lib/entry-points.js | 4 ++-- src/cli/output-cache.ts | 16 +++++++++------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index ecd5385df1..2de9797e9c 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146278,7 +146278,7 @@ function getCachedCodeQlVersion(cmd, env = getEnv()) { } catch { return void 0; } - if (!isPersistedVersionInfo(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { + if (!isCommandCacheRecord(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { return void 0; } cachedCodeQlVersion = persisted.entries["version" /* Version */]; @@ -146288,7 +146288,7 @@ function isVersionInfo(x) { const candidate = x; return typeof candidate === "object" && candidate !== null && typeof candidate.version === "string" && (candidate.features === void 0 || typeof candidate.features === "object" && candidate.features !== null) && (candidate.overlayVersion === void 0 || typeof candidate.overlayVersion === "number"); } -function isPersistedVersionInfo(x) { +function isCommandCacheRecord(x) { const candidate = x; return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && candidate.entries !== void 0 && isVersionInfo(candidate.entries["version" /* Version */]); } diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 5fcca2cd41..e6b665b719 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -20,8 +20,10 @@ type CommandCacheKeyOutputMap = { [CommandCacheKey.Version]: VersionInfo; }; -/** The persisted version together with the CLI path it was obtained from. */ -interface PersistedVersionInfo { +/** + * The type of the command cache that is persisted to disk. + */ +interface CommandCacheRecord { cmd: string; entries: Map; } @@ -107,7 +109,7 @@ export function getCachedCodeQlVersion( return undefined; } if ( - !isPersistedVersionInfo(persisted) || + !isCommandCacheRecord(persisted) || (cmd !== undefined && persisted.cmd !== cmd) ) { return undefined; @@ -137,14 +139,14 @@ function isVersionInfo(x: unknown): x is VersionInfo { } /** - * Determines whether a value is a `PersistedVersionInfo` object. + * Determines whether a value is a `CommandCacheRecord` object. * @param x The value to test */ -function isPersistedVersionInfo( +function isCommandCacheRecord( x: unknown, -): x is PersistedVersionInfo { +): x is CommandCacheRecord { const candidate = x as Partial< - PersistedVersionInfo + CommandCacheRecord > | null; return ( typeof candidate === "object" && From 54a084632e348559349cf916aba71936331974ce Mon Sep 17 00:00:00 2001 From: Mads Navntoft Date: Wed, 12 Aug 2026 11:46:02 +0200 Subject: [PATCH 133/155] Bump undici from ^6.24.0 to ^6.28.0 --- lib/entry-points.js | 94 ++++++++++++++++++++++++++++++++++++++++++--- package-lock.json | 9 +++-- package.json | 4 +- 3 files changed, 95 insertions(+), 12 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 92b1ff3ead..9b8dc585eb 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -2218,7 +2218,11 @@ var require_request = __commonJS({ } else if (typeof val[i] === "object") { throw new InvalidArgumentError(`invalid ${key} header`); } else { - arr.push(`${val[i]}`); + const str = `${val[i]}`; + if (!isValidHeaderValue(str)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } + arr.push(str); } } val = arr; @@ -2230,6 +2234,9 @@ var require_request = __commonJS({ val = ""; } else { val = `${val}`; + if (!isValidHeaderValue(val)) { + throw new InvalidArgumentError(`invalid ${key} header`); + } } if (headerName === "host") { if (request3.host !== null) { @@ -5960,6 +5967,7 @@ var require_client_h1 = __commonJS({ RequestContentLengthMismatchError, ResponseContentLengthMismatchError, RequestAbortedError, + InvalidArgumentError, HeadersTimeoutError, HeadersOverflowError, SocketError, @@ -6686,8 +6694,16 @@ var require_client_h1 = __commonJS({ } body = bodyStream.stream; contentLength = bodyStream.length; - } else if (util3.isBlobLike(body) && request3.contentType == null && body.type) { - headers.push("content-type", body.type); + } else if (util3.isBlobLike(body) && request3.contentType == null) { + const contentType = body.type; + if (contentType) { + const contentTypeValue = `${contentType}`; + if (!util3.isValidHeaderValue(contentTypeValue)) { + util3.errorRequest(client, request3, new InvalidArgumentError("invalid content-type header")); + return false; + } + headers.push("content-type", contentTypeValue); + } } if (body && typeof body.read === "function") { body.read(0); @@ -9239,6 +9255,24 @@ var require_retry_handler = __commonJS({ const current = Date.now(); return new Date(retryAfter).getTime() - current; } + function validatePartialResponseContentLength(headers, range2, statusCode, retryCount) { + const contentLength = headers["content-length"]; + if (contentLength == null) { + return null; + } + if (!Number.isFinite(range2.start) || !Number.isFinite(range2.end)) { + return null; + } + const length = Number(contentLength); + const expectedLength = range2.end - range2.start + 1; + if (!Number.isFinite(length) || length !== expectedLength) { + return new RequestRetryError("Content-Length mismatch", statusCode, { + headers, + data: { count: retryCount } + }); + } + return null; + } var RetryHandler = class _RetryHandler { constructor(opts, handlers) { const { retryOptions, ...dispatchOpts } = opts; @@ -9411,6 +9445,11 @@ var require_retry_handler = __commonJS({ ); return false; } + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = contentRange; assert(this.start === start, "content-range mismatch"); assert(this.end == null || this.end === end, "content-range mismatch"); @@ -9428,6 +9467,11 @@ var require_retry_handler = __commonJS({ statusMessage ); } + const contentLengthError = validatePartialResponseContentLength(headers, range2, statusCode, this.retryCount); + if (contentLengthError != null) { + this.abort(contentLengthError); + return false; + } const { start, size, end = size - 1 } = range2; assert( start != null && Number.isFinite(start), @@ -16273,14 +16317,48 @@ var require_util6 = __commonJS({ for (let i = 0; i < path29.length; ++i) { const code = path29.charCodeAt(i); if (code < 32 || // exclude CTLs (0-31) - code === 127 || // DEL + code > 126 || // exclude DEL and non-ascii code === 59) { throw new Error("Invalid cookie path"); } } } + function isLetterOrDigit(code) { + return code >= 48 && code <= 57 || // 0-9 + code >= 65 && code <= 90 || // A-Z + code >= 97 && code <= 122; + } function validateCookieDomain(domain) { - if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) { + if (domain === " ") { + return; + } + if (domain.length > 255) { + throw new Error("Invalid cookie domain"); + } + let labelLength = 0; + for (let i = 0; i < domain.length; ++i) { + const code = domain.charCodeAt(i); + if (code === 46) { + if (labelLength === 0) { + throw new Error("Invalid cookie domain"); + } + if (domain.charCodeAt(i - 1) === 45) { + throw new Error("Invalid cookie domain"); + } + labelLength = 0; + continue; + } + if (labelLength === 0 && !isLetterOrDigit(code)) { + throw new Error("Invalid cookie domain"); + } + if (!isLetterOrDigit(code) && code !== 45) { + throw new Error("Invalid cookie domain"); + } + if (++labelLength > 63) { + throw new Error("Invalid cookie domain"); + } + } + if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) { throw new Error("Invalid cookie domain"); } } @@ -16363,7 +16441,11 @@ var require_util6 = __commonJS({ throw new Error("Invalid unparsed"); } const [key, ...value] = part.split("="); - out.push(`${key.trim()}=${value.join("=")}`); + const trimmedKey = key.trim(); + const joinedValue = value.join("="); + validateCookieName(trimmedKey); + validateCookieValue(joinedValue); + out.push(`${trimmedKey}=${joinedValue}`); } return out.join("; "); } diff --git a/package-lock.json b/package-lock.json index 3ecde2f706..e9081aee73 100644 --- a/package-lock.json +++ b/package-lock.json @@ -36,7 +36,7 @@ "long": "^5.3.2", "node-forge": "^1.4.0", "semver": "^7.8.5", - "undici": "^6.24.0", + "undici": "^6.28.0", "uuid": "^14.0.1" }, "devDependencies": { @@ -9363,9 +9363,10 @@ } }, "node_modules/undici": { - "version": "6.27.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz", - "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==", + "version": "6.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz", + "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==", + "license": "MIT", "engines": { "node": ">=18.17" } diff --git a/package.json b/package.json index 4176f5db35..0e3d1c7e96 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "node-forge": "^1.4.0", "semver": "^7.8.5", "uuid": "^14.0.1", - "undici": "^6.24.0" + "undici": "^6.28.0" }, "devDependencies": { "@ava/typescript": "6.0.0", @@ -95,6 +95,6 @@ "semver": ">=6.3.1" }, "glob": "^13.0.6", - "undici": "^6.24.0" + "undici": "^6.28.0" } } From 0e8a5d99f8eb4a07306f1ecbdd1fde8793f44f4a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 15:30:15 +0000 Subject: [PATCH 134/155] Update default bundle to codeql-bundle-v2.26.3 --- lib/defaults.json | 8 ++++---- lib/entry-points.js | 4 ++-- src/defaults.json | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/lib/defaults.json b/lib/defaults.json index 558dce6e24..b5d9f13644 100644 --- a/lib/defaults.json +++ b/lib/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.2", - "cliVersion": "2.26.2", - "priorBundleVersion": "codeql-bundle-v2.26.1", - "priorCliVersion": "2.26.1" + "bundleVersion": "codeql-bundle-v2.26.3", + "cliVersion": "2.26.3", + "priorBundleVersion": "codeql-bundle-v2.26.2", + "priorCliVersion": "2.26.2" } diff --git a/lib/entry-points.js b/lib/entry-points.js index 92b1ff3ead..9ae4f875aa 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -147085,8 +147085,8 @@ var path5 = __toESM(require("path")); var semver4 = __toESM(require_semver2()); // src/defaults.json -var bundleVersion = "codeql-bundle-v2.26.2"; -var cliVersion = "2.26.2"; +var bundleVersion = "codeql-bundle-v2.26.3"; +var cliVersion = "2.26.3"; // src/overlay/index.ts var fs4 = __toESM(require("fs")); diff --git a/src/defaults.json b/src/defaults.json index 558dce6e24..b5d9f13644 100644 --- a/src/defaults.json +++ b/src/defaults.json @@ -1,6 +1,6 @@ { - "bundleVersion": "codeql-bundle-v2.26.2", - "cliVersion": "2.26.2", - "priorBundleVersion": "codeql-bundle-v2.26.1", - "priorCliVersion": "2.26.1" + "bundleVersion": "codeql-bundle-v2.26.3", + "cliVersion": "2.26.3", + "priorBundleVersion": "codeql-bundle-v2.26.2", + "priorCliVersion": "2.26.2" } From ca1c97228cf88b7fd58cae44d5f4f8c566f5709a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 15:30:22 +0000 Subject: [PATCH 135/155] Add changelog note --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bd770ab5f4..1ed123883f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th ## [UNRELEASED] -No user facing changes. +- Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085) ## 4.37.6 - 04 Aug 2026 From dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 12 Aug 2026 16:43:22 +0100 Subject: [PATCH 136/155] Make `logger` available to `getCodeQLForCmd` --- lib/entry-points.js | 30 ++++++++++++++++-------------- src/analyze-action-post.ts | 2 +- src/analyze-action.ts | 2 +- src/autobuild-action.ts | 2 +- src/autobuild.ts | 2 +- src/codeql.ts | 13 +++++++------ src/init-action-post-helper.ts | 5 ++++- src/init-action-post.ts | 2 +- src/resolve-environment.ts | 2 +- src/upload-lib.ts | 2 +- 10 files changed, 34 insertions(+), 28 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 92b1ff3ead..c6292e61a1 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -151830,7 +151830,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV `Unsupported platform: ${process.platform}` ); } - cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion); + cachedCodeQL = await getCodeQLForCmd(logger, codeqlCmd, checkVersion); return { codeql: cachedCodeQL, toolsDownloadStatusReport, @@ -151847,13 +151847,13 @@ Details: ${e.stack}` : ""}` ); } } -async function getCodeQL(cmd) { +async function getCodeQL(logger, cmd) { if (cachedCodeQL === void 0) { - cachedCodeQL = await getCodeQLForCmd(cmd, true); + cachedCodeQL = await getCodeQLForCmd(logger, cmd, true); } return cachedCodeQL; } -async function getCodeQLForCmd(cmd, checkVersion) { +async function getCodeQLForCmd(logger, cmd, checkVersion) { const codeql = { getPath() { return cmd; @@ -151890,7 +151890,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { async isScannedLanguage(language) { return !await this.isTracedLanguage(language); }, - async databaseInitCluster(config, sourceRoot, processName, qlconfigFile, logger) { + async databaseInitCluster(config, sourceRoot, processName, qlconfigFile) { const extraArgs = config.languages.map( (language) => `--language=${language}` ); @@ -152446,7 +152446,7 @@ async function setupCppAutobuild(codeql, logger) { } async function runAutobuild(config, language, logger) { logger.startGroup(`Attempting to automatically build ${language} code`); - const codeQL = await getCodeQL(config.codeQLCmd); + const codeQL = await getCodeQL(logger, config.codeQLCmd); if (language === "cpp" /* cpp */) { await setupCppAutobuild(codeQL, logger); } @@ -154786,7 +154786,7 @@ async function combineSarifFilesUsingCLI(sarifFiles, gitHubVersion, features, lo let tempDir = getTemporaryDirectory(); const config = await getConfig(tempDir, logger); if (config !== void 0) { - codeQL = await getCodeQL(config.codeQLCmd); + codeQL = await getCodeQL(logger, config.codeQLCmd); tempDir = config.tempDir; } else { logger.info( @@ -155523,7 +155523,7 @@ async function run({ startedAt, logger }) { "Config file could not be found at expected location. Has the 'init' action been called?" ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (hasBadExpectErrorInput()) { throw new ConfigurationError( "`expect-error` input parameter is for internal use only. It should only be set by codeql-action or a fork." @@ -160646,7 +160646,7 @@ async function runWrapper2() { logger ); if (config !== void 0) { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); const version = await codeql.getVersion(); await uploadCombinedSarifArtifacts( logger, @@ -160726,7 +160726,7 @@ async function run2({ startedAt, logger }) { "Config file could not be found at expected location. Has the 'init' action been called?" ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); languages = await determineAutobuildLanguages(codeql, config, logger); if (languages !== void 0) { const workingDirectory = getOptionalInput("working-directory"); @@ -161616,6 +161616,7 @@ async function prepareFailedSarif(logger, features, config) { const category = `/language:${language}`; const checkoutPath = "."; const result = await generateFailedSarif( + logger, features, config, category, @@ -161636,6 +161637,7 @@ async function prepareFailedSarif(logger, features, config) { const category = getCategoryInputOrThrow(workflow, jobName, matrix); const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); const result = await generateFailedSarif( + logger, features, config, category, @@ -161644,9 +161646,9 @@ async function prepareFailedSarif(logger, features, config) { return new Success(result); } } -async function generateFailedSarif(features, config, category, checkoutPath, sarifFile) { +async function generateFailedSarif(logger, features, config, category, checkoutPath, sarifFile) { const databasePath = config.dbLocation; - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (sarifFile === void 0) { sarifFile = "../codeql-failed-run.sarif"; } @@ -161912,7 +161914,7 @@ async function run4(startedAt) { "Debugging artifacts are unavailable since the 'init' Action failed before it could produce any." ); } else { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); uploadFailedSarifResult = await uploadFailureInfo( tryUploadAllAvailableDebugArtifacts, printDebugLogs, @@ -162015,7 +162017,7 @@ var core23 = __toESM(require_core()); // src/resolve-environment.ts async function runResolveBuildEnvironment(cmd, logger, workingDir, language) { logger.startGroup(`Attempting to resolve build environment for ${language}`); - const codeql = await getCodeQL(cmd); + const codeql = await getCodeQL(logger, cmd); if (workingDir !== void 0) { logger.info(`Using ${workingDir} as the working directory.`); } diff --git a/src/analyze-action-post.ts b/src/analyze-action-post.ts index fe8fbea61c..732b52af19 100644 --- a/src/analyze-action-post.ts +++ b/src/analyze-action-post.ts @@ -38,7 +38,7 @@ export async function runWrapper() { logger, ); if (config !== undefined) { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); const version = await codeql.getVersion(); await debugArtifacts.uploadCombinedSarifArtifacts( logger, diff --git a/src/analyze-action.ts b/src/analyze-action.ts index 5104719bc7..c3c2e40e7f 100644 --- a/src/analyze-action.ts +++ b/src/analyze-action.ts @@ -255,7 +255,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) { ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); if (hasBadExpectErrorInput()) { throw new util.ConfigurationError( diff --git a/src/autobuild-action.ts b/src/autobuild-action.ts index b78bffb9d8..9fa8016578 100644 --- a/src/autobuild-action.ts +++ b/src/autobuild-action.ts @@ -99,7 +99,7 @@ async function run({ startedAt, logger }: ActionState<["Base", "Logger"]>) { ); } - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); languages = await determineAutobuildLanguages(codeql, config, logger); if (languages !== undefined) { diff --git a/src/autobuild.ts b/src/autobuild.ts index 7ec6ba9873..49b790102d 100644 --- a/src/autobuild.ts +++ b/src/autobuild.ts @@ -155,7 +155,7 @@ export async function runAutobuild( logger: Logger, ) { logger.startGroup(`Attempting to automatically build ${language} code`); - const codeQL = await getCodeQL(config.codeQLCmd); + const codeQL = await getCodeQL(logger, config.codeQLCmd); if (language === BuiltInLanguage.cpp) { await setupCppAutobuild(codeQL, logger); } diff --git a/src/codeql.ts b/src/codeql.ts index a29df90865..10e44a5b58 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -23,7 +23,7 @@ import { } from "./feature-flags"; import { isAnalyzingDefaultBranch } from "./git-utils"; import { Language } from "./languages"; -import { Logger } from "./logging"; +import { getRunnerLogger, Logger } from "./logging"; import { writeBaseDatabaseOidsFile, writeOverlayChangesFile } from "./overlay"; import { OverlayDatabaseMode } from "./overlay/overlay-database-mode"; import * as setupCodeql from "./setup-codeql"; @@ -346,7 +346,7 @@ export async function setupCodeQL( ); } - cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion); + cachedCodeQL = await getCodeQLForCmd(logger, codeqlCmd, checkVersion); return { codeql: cachedCodeQL, toolsDownloadStatusReport, @@ -372,9 +372,9 @@ export async function setupCodeQL( /** * Use the CodeQL executable located at the given path. */ -export async function getCodeQL(cmd: string): Promise { +export async function getCodeQL(logger: Logger, cmd: string): Promise { if (cachedCodeQL === undefined) { - cachedCodeQL = await getCodeQLForCmd(cmd, true); + cachedCodeQL = await getCodeQLForCmd(logger, cmd, true); } return cachedCodeQL; } @@ -481,8 +481,9 @@ export function createStubCodeQL(partialCodeql: Partial): CodeQL { */ export async function getCodeQLForTesting( cmd = "codeql-for-testing", + logger: Logger = getRunnerLogger(true), ): Promise { - return getCodeQLForCmd(cmd, false); + return getCodeQLForCmd(logger, cmd, false); } /** @@ -494,6 +495,7 @@ export async function getCodeQLForTesting( * @returns A new CodeQL object */ async function getCodeQLForCmd( + logger: Logger, cmd: string, checkVersion: boolean, ): Promise { @@ -539,7 +541,6 @@ async function getCodeQLForCmd( sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ) { const extraArgs = config.languages.map( (language) => `--language=${language}`, diff --git a/src/init-action-post-helper.ts b/src/init-action-post-helper.ts index 23695b6d1c..7b7b056a1c 100644 --- a/src/init-action-post-helper.ts +++ b/src/init-action-post-helper.ts @@ -123,6 +123,7 @@ async function prepareFailedSarif( const category = `/language:${language}`; const checkoutPath = "."; const result = await generateFailedSarif( + logger, features, config, category, @@ -146,6 +147,7 @@ async function prepareFailedSarif( const checkoutPath = getCheckoutPathInputOrThrow(workflow, jobName, matrix); const result = await generateFailedSarif( + logger, features, config, category, @@ -156,6 +158,7 @@ async function prepareFailedSarif( } async function generateFailedSarif( + logger: Logger, features: FeatureEnablement, config: Config, category: string | undefined, @@ -163,7 +166,7 @@ async function generateFailedSarif( sarifFile?: string, ) { const databasePath = config.dbLocation; - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); // Set the filename for the SARIF file if not already set. if (sarifFile === undefined) { diff --git a/src/init-action-post.ts b/src/init-action-post.ts index b407cfb99e..2261b56ea6 100644 --- a/src/init-action-post.ts +++ b/src/init-action-post.ts @@ -75,7 +75,7 @@ async function run(startedAt: Date) { "Debugging artifacts are unavailable since the 'init' Action failed before it could produce any.", ); } else { - const codeql = await getCodeQL(config.codeQLCmd); + const codeql = await getCodeQL(logger, config.codeQLCmd); uploadFailedSarifResult = await initActionPostHelper.uploadFailureInfo( debugArtifacts.tryUploadAllAvailableDebugArtifacts, diff --git a/src/resolve-environment.ts b/src/resolve-environment.ts index d202efa83e..3a1a6ca6bf 100644 --- a/src/resolve-environment.ts +++ b/src/resolve-environment.ts @@ -9,7 +9,7 @@ export async function runResolveBuildEnvironment( ) { logger.startGroup(`Attempting to resolve build environment for ${language}`); - const codeql = await getCodeQL(cmd); + const codeql = await getCodeQL(logger, cmd); if (workingDir !== undefined) { logger.info(`Using ${workingDir} as the working directory.`); diff --git a/src/upload-lib.ts b/src/upload-lib.ts index 83d1eaffb0..da5552cf24 100644 --- a/src/upload-lib.ts +++ b/src/upload-lib.ts @@ -140,7 +140,7 @@ async function combineSarifFilesUsingCLI( const config = await getConfig(tempDir, logger); if (config !== undefined) { - codeQL = await getCodeQL(config.codeQLCmd); + codeQL = await getCodeQL(logger, config.codeQLCmd); tempDir = config.tempDir; } else { logger.info( From 38055a3c3cf3979323eaf70fc6c73a8690250bde Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 12 Aug 2026 16:49:45 +0100 Subject: [PATCH 137/155] Drop `logger` from `databaseInitCluster` in interface --- lib/entry-points.js | 11 ++++------- src/codeql.test.ts | 4 ---- src/codeql.ts | 1 - src/init-action.ts | 2 -- src/init.ts | 2 -- 5 files changed, 4 insertions(+), 16 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c6292e61a1..841c13bf48 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -154473,7 +154473,7 @@ async function initConfig2(actionState, inputs) { return await initConfig(actionState, inputs); }); } -async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile, logger) { +async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, sourceRoot, processName, qlconfigFile) { fs19.mkdirSync(config.dbLocation, { recursive: true }); await wrapEnvironment( databaseInitEnvironment, @@ -154481,8 +154481,7 @@ async function runDatabaseInitCluster(databaseInitEnvironment, codeql, config, s config, sourceRoot, processName, - qlconfigFile, - logger + qlconfigFile ) ); } @@ -161496,8 +161495,7 @@ exec ${goBinaryPath} "$@"` config, sourceRoot, "Runner.Worker.exe", - qlconfigFile, - logger + qlconfigFile ); if (config.overlayDatabaseMode !== "none" /* None */ && !await checkPacksForOverlayCompatibility(codeql, config, logger)) { logger.info( @@ -161513,8 +161511,7 @@ exec ${goBinaryPath} "$@"` config, sourceRoot, "Runner.Worker.exe", - qlconfigFile, - logger + qlconfigFile ); } const tracerConfig = await getCombinedTracerConfig(codeql, config); diff --git a/src/codeql.test.ts b/src/codeql.test.ts index 84f48b83c9..e8208888e7 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -580,7 +580,6 @@ const injectedConfigMacro = makeMacro({ "", undefined, undefined, - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as string[]; @@ -856,7 +855,6 @@ test.serial( "", undefined, "/path/to/qlconfig.yml", - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as string[]; @@ -887,7 +885,6 @@ test.serial( "", undefined, undefined, // undefined qlconfigFile - getRunnerLogger(true), ); const args = runnerConstructorStub.firstCall.args[1] as any[]; @@ -1066,7 +1063,6 @@ test.serial( "sourceRoot", undefined, undefined, - getRunnerLogger(false), ); t.true(runnerConstructorStub.calledOnce); diff --git a/src/codeql.ts b/src/codeql.ts index 10e44a5b58..9b064620eb 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -91,7 +91,6 @@ export interface CodeQL { sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ): Promise; /** * Runs the autobuilder for the given language. diff --git a/src/init-action.ts b/src/init-action.ts index 00143df427..6b5ed392ef 100644 --- a/src/init-action.ts +++ b/src/init-action.ts @@ -689,7 +689,6 @@ async function run( sourceRoot, "Runner.Worker.exe", qlconfigFile, - logger, ); // To check custom query packs for compatibility with overlay analysis, we @@ -718,7 +717,6 @@ async function run( sourceRoot, "Runner.Worker.exe", qlconfigFile, - logger, ); } diff --git a/src/init.ts b/src/init.ts index dee62913c2..c6a258e58c 100644 --- a/src/init.ts +++ b/src/init.ts @@ -89,7 +89,6 @@ export async function runDatabaseInitCluster( sourceRoot: string, processName: string | undefined, qlconfigFile: string | undefined, - logger: Logger, ): Promise { fs.mkdirSync(config.dbLocation, { recursive: true }); await configUtils.wrapEnvironment( @@ -100,7 +99,6 @@ export async function runDatabaseInitCluster( sourceRoot, processName, qlconfigFile, - logger, ), ); } From 33d70867d5f73bb9c94f2e8543c605628655627b Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Wed, 12 Aug 2026 11:24:37 -0500 Subject: [PATCH 138/155] Pass environment explicitly to CLI caching functions --- lib/entry-points.js | 10 +++++----- src/cli/output-cache.test.ts | 10 +++++----- src/cli/output-cache.ts | 8 ++++---- src/codeql.ts | 6 +++--- src/status-report.ts | 2 +- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 2de9797e9c..c714689f28 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146251,7 +146251,7 @@ var cachedCodeQlVersion = void 0; function getCommandCacheFilePath(env) { return import_path.default.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME); } -function cacheCodeQlVersion(cmd, version, env = getEnv()) { +function cacheCodeQlVersion(cmd, version, env) { if (cachedCodeQlVersion !== void 0) { throw new Error("cacheCodeQlVersion() should be called only once"); } @@ -146262,7 +146262,7 @@ function cacheCodeQlVersion(cmd, version, env = getEnv()) { "utf8" ); } -function getCachedCodeQlVersion(cmd, env = getEnv()) { +function getCachedCodeQlVersion(env, cmd) { if (cachedCodeQlVersion !== void 0) { return cachedCodeQlVersion; } @@ -146834,7 +146834,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi core7.exportVariable("CODEQL_WORKFLOW_STARTED_AT" /* WORKFLOW_STARTED_AT */, workflowStartedAt); } const runnerOs = getRequiredEnvParam("RUNNER_OS"); - const codeQlCliVersion = getCachedCodeQlVersion(); + const codeQlCliVersion = getCachedCodeQlVersion(getEnv()); const actionRef = process.env["GITHUB_ACTION_REF"] || ""; const testingEnvironment = getTestingEnvironment(); if (testingEnvironment) { @@ -151870,7 +151870,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { return cmd; }, async getVersion() { - let result = getCachedCodeQlVersion(cmd); + let result = getCachedCodeQlVersion(getEnv(), cmd); if (result === void 0) { result = await runCliJson( cmd, @@ -151879,7 +151879,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { noStreamStdout: true } ); - cacheCodeQlVersion(cmd, result); + cacheCodeQlVersion(cmd, result, getEnv()); } return result; }, diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts index 83f206e0ef..152f5de5d5 100644 --- a/src/cli/output-cache.test.ts +++ b/src/cli/output-cache.test.ts @@ -25,7 +25,7 @@ test.serial( "utf8", ); const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.deepEqual(outputCache.getCachedCodeQlVersion("/path/to/codeql", env), { + t.deepEqual(outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), { version: "2.20.0", }); }); @@ -47,7 +47,7 @@ test.serial( ); const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); t.is( - outputCache.getCachedCodeQlVersion("/path/to/codeql", env), + outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), undefined, ); }); @@ -62,7 +62,7 @@ test.serial( fs.writeFileSync(cacheFile, "not valid json", "utf8"); const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); t.is( - outputCache.getCachedCodeQlVersion("/path/to/codeql", env), + outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), undefined, ); }); @@ -94,7 +94,7 @@ test.serial( for (const value of testValues) { fs.writeFileSync(cacheFile, value, "utf8"); t.is( - outputCache.getCachedCodeQlVersion("/path/to/codeql", env), + outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), undefined, value, ); @@ -106,6 +106,6 @@ test.serial( test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => { await util.withTmpDir(async (tmpDir: string) => { const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.is(outputCache.getCachedCodeQlVersion("/path/to/codeql", env), undefined); + t.is(outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), undefined); }); }); diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index e6b665b719..81b5084f80 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -2,7 +2,7 @@ import * as fs from "fs"; import path from "path"; import { getTemporaryDirectory } from "../actions-util"; -import { Env, getEnv } from "../environment"; +import { Env } from "../environment"; import type { VersionInfo } from "./types"; @@ -64,7 +64,7 @@ function getCommandCacheFilePath(env: Env): string { export function cacheCodeQlVersion( cmd: string, version: VersionInfo, - env: Env = getEnv(), + env: Env, ): void { if (cachedCodeQlVersion !== undefined) { throw new Error("cacheCodeQlVersion() should be called only once"); @@ -83,12 +83,12 @@ export function cacheCodeQlVersion( /** * Returns the cached CodeQL CLI version, if any. - * @param cmd The path to the CodeQL CLI. * @param env The environment variables to use. + * @param cmd The path to the CodeQL CLI. */ export function getCachedCodeQlVersion( + env: Env, cmd?: string, - env: Env = getEnv(), ): undefined | VersionInfo { if (cachedCodeQlVersion !== undefined) { return cachedCodeQlVersion; diff --git a/src/codeql.ts b/src/codeql.ts index fecc155bb4..bf91df9a8e 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -17,7 +17,7 @@ import type { VersionInfo } from "./cli/types"; import { CliError, wrapCliConfigurationError } from "./cli-errors"; import { appendExtraQueryExclusions, type Config } from "./config-utils"; import { DocUrl } from "./doc-url"; -import { EnvVar } from "./environment"; +import { EnvVar, getEnv } from "./environment"; import { CodeQLDefaultVersionInfo, Feature, @@ -490,7 +490,7 @@ async function getCodeQLForCmd( return cmd; }, async getVersion() { - let result = outputCache.getCachedCodeQlVersion(cmd); + let result = outputCache.getCachedCodeQlVersion(getEnv(), cmd); if (result === undefined) { result = await runCliJson( cmd, @@ -499,7 +499,7 @@ async function getCodeQLForCmd( noStreamStdout: true, }, ); - outputCache.cacheCodeQlVersion(cmd, result); + outputCache.cacheCodeQlVersion(cmd, result, getEnv()); } return result; }, diff --git a/src/status-report.ts b/src/status-report.ts index d2967a86f5..043ff7b3c1 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -376,7 +376,7 @@ export async function createStatusReportBase( core.exportVariable(EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt); } const runnerOs = getRequiredEnvParam("RUNNER_OS"); - const codeQlCliVersion = getCachedCodeQlVersion(); + const codeQlCliVersion = getCachedCodeQlVersion(getEnv()); const actionRef = process.env["GITHUB_ACTION_REF"] || ""; const testingEnvironment = getTestingEnvironment(); // re-export the testing environment variable so that it is available to subsequent steps, From a9baab8deec005d12a5551a30ea44c35f1d9306a Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Wed, 12 Aug 2026 11:26:52 -0500 Subject: [PATCH 139/155] Export CLI cache types --- src/cli/output-cache.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 81b5084f80..5a1d0d697e 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -9,21 +9,21 @@ import type { VersionInfo } from "./types"; /** * The keys of the command cache. Each key corresponds to a command whose output we cache. */ -enum CommandCacheKey { +export enum CommandCacheKey { Version = "version", } /** * The mapping of CLI commands to the types of the output of each command that we cache. */ -type CommandCacheKeyOutputMap = { +export type CommandCacheKeyOutputMap = { [CommandCacheKey.Version]: VersionInfo; }; /** * The type of the command cache that is persisted to disk. */ -interface CommandCacheRecord { +export interface CommandCacheRecord { cmd: string; entries: Map; } From 337136ab8a0472c22e3d139d69f57ee5c92f592b Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Wed, 12 Aug 2026 11:29:11 -0500 Subject: [PATCH 140/155] Rename `CommandCacheRecord` -> `OutputCache` --- lib/entry-points.js | 4 ++-- src/cli/output-cache.ts | 14 +++++--------- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c714689f28..8aa62b9362 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146278,7 +146278,7 @@ function getCachedCodeQlVersion(env, cmd) { } catch { return void 0; } - if (!isCommandCacheRecord(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { + if (!isOutputCache(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { return void 0; } cachedCodeQlVersion = persisted.entries["version" /* Version */]; @@ -146288,7 +146288,7 @@ function isVersionInfo(x) { const candidate = x; return typeof candidate === "object" && candidate !== null && typeof candidate.version === "string" && (candidate.features === void 0 || typeof candidate.features === "object" && candidate.features !== null) && (candidate.overlayVersion === void 0 || typeof candidate.overlayVersion === "number"); } -function isCommandCacheRecord(x) { +function isOutputCache(x) { const candidate = x; return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && candidate.entries !== void 0 && isVersionInfo(candidate.entries["version" /* Version */]); } diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 5a1d0d697e..88fd612b24 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -23,7 +23,7 @@ export type CommandCacheKeyOutputMap = { /** * The type of the command cache that is persisted to disk. */ -export interface CommandCacheRecord { +export interface OutputCache { cmd: string; entries: Map; } @@ -109,7 +109,7 @@ export function getCachedCodeQlVersion( return undefined; } if ( - !isCommandCacheRecord(persisted) || + !isOutputCache(persisted) || (cmd !== undefined && persisted.cmd !== cmd) ) { return undefined; @@ -139,15 +139,11 @@ function isVersionInfo(x: unknown): x is VersionInfo { } /** - * Determines whether a value is a `CommandCacheRecord` object. + * Determines whether a value is a `OutputCache` object. * @param x The value to test */ -function isCommandCacheRecord( - x: unknown, -): x is CommandCacheRecord { - const candidate = x as Partial< - CommandCacheRecord - > | null; +function isOutputCache(x: unknown): x is OutputCache { + const candidate = x as Partial> | null; return ( typeof candidate === "object" && candidate !== null && From bf96b0df935cfe0cd28bdf7d83b4d43fbf05f0d2 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Wed, 12 Aug 2026 11:39:32 -0500 Subject: [PATCH 141/155] Expand test to ensure it does not throw an exception --- src/cli/output-cache.test.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts index 152f5de5d5..b59044febe 100644 --- a/src/cli/output-cache.test.ts +++ b/src/cli/output-cache.test.ts @@ -106,6 +106,11 @@ test.serial( test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => { await util.withTmpDir(async (tmpDir: string) => { const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.is(outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), undefined); + t.notThrows(() => { + t.is( + outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), + undefined, + ); + }); }); }); From 6c0d9018d4ad239d9a787539ba377ed9733678bc Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Wed, 12 Aug 2026 12:01:20 -0500 Subject: [PATCH 142/155] Change `OutputCache` to use object for `entries` This will ensure it works nicely with `JSON.stringify`. And, then we can validate the type before marshaling. --- lib/entry-points.js | 6 +++++- src/cli/output-cache.ts | 10 ++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 8aa62b9362..60227987fd 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146256,9 +146256,13 @@ function cacheCodeQlVersion(cmd, version, env) { throw new Error("cacheCodeQlVersion() should be called only once"); } cachedCodeQlVersion = version; + const outputCache = { + cmd, + entries: { ["version" /* Version */]: version } + }; fs3.writeFileSync( getCommandCacheFilePath(env), - JSON.stringify({ cmd, entries: { ["version" /* Version */]: version } }), + JSON.stringify(outputCache), "utf8" ); } diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 88fd612b24..05889a59ed 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -25,7 +25,9 @@ export type CommandCacheKeyOutputMap = { */ export interface OutputCache { cmd: string; - entries: Map; + entries: { + [P in K]: CommandCacheKeyOutputMap[K]; + }; } /** @@ -70,13 +72,17 @@ export function cacheCodeQlVersion( throw new Error("cacheCodeQlVersion() should be called only once"); } cachedCodeQlVersion = version; + const outputCache = { + cmd, + entries: { [CommandCacheKey.Version]: version }, + } satisfies OutputCache; // Persist the version so that subsequent Actions steps, which run in separate // processes, can reuse it rather than invoking `codeql version` again. We // record the CLI path so that a different step using a different CodeQL bundle // doesn't pick up a stale version. fs.writeFileSync( getCommandCacheFilePath(env), - JSON.stringify({ cmd, entries: { [CommandCacheKey.Version]: version } }), + JSON.stringify(outputCache), "utf8", ); } From ab5db2519c3344f2fa61c711fa2d6ad135829200 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 17:54:58 +0000 Subject: [PATCH 143/155] Bump the npm-minor group across 1 directory with 8 updates Bumps the npm-minor group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@octokit/core](https://github.com/octokit/core.js) | `7.0.6` | `7.0.7` | | [@octokit/plugin-retry](https://github.com/octokit/plugin-retry.js) | `8.1.0` | `8.1.1` | | [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` | | [eslint-plugin-github](https://github.com/github/eslint-plugin-github) | `6.1.1` | `6.1.2` | | [globals](https://github.com/sindresorhus/globals) | `17.8.0` | `17.9.0` | | [nock](https://github.com/nock/nock) | `14.0.16` | `14.0.17` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.66.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.8` | Updates `@octokit/core` from 7.0.6 to 7.0.7 - [Release notes](https://github.com/octokit/core.js/releases) - [Commits](https://github.com/octokit/core.js/compare/v7.0.6...v7.0.7) Updates `@octokit/plugin-retry` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/octokit/plugin-retry.js/releases) - [Commits](https://github.com/octokit/plugin-retry.js/compare/v8.1.0...v8.1.1) Updates `@types/semver` from 7.7.1 to 7.8.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver) Updates `eslint-plugin-github` from 6.1.1 to 6.1.2 - [Release notes](https://github.com/github/eslint-plugin-github/releases) - [Commits](https://github.com/github/eslint-plugin-github/compare/v6.1.1...v6.1.2) Updates `globals` from 17.8.0 to 17.9.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0) Updates `nock` from 14.0.16 to 14.0.17 - [Release notes](https://github.com/nock/nock/releases) - [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md) - [Commits](https://github.com/nock/nock/compare/v14.0.16...v14.0.17) Updates `typescript-eslint` from 8.65.0 to 8.66.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/typescript-eslint) Updates `tsx` from 4.23.1 to 4.23.8 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](https://github.com/privatenumber/tsx/compare/v4.23.1...v4.23.8) --- updated-dependencies: - dependency-name: "@octokit/core" dependency-version: 7.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@octokit/plugin-retry" dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@types/semver" dependency-version: 7.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: eslint-plugin-github dependency-version: 6.1.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: globals dependency-version: 17.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: nock dependency-version: 14.0.17 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: typescript-eslint dependency-version: 8.66.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: tsx dependency-version: 4.23.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] --- package-lock.json | 439 ++++++++++++++++++++++------------------- package.json | 14 +- pr-checks/package.json | 4 +- 3 files changed, 246 insertions(+), 211 deletions(-) diff --git a/package-lock.json b/package-lock.json index e9081aee73..50ebd990cd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -22,10 +22,10 @@ "@actions/http-client": "^3.0.0", "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", - "@octokit/plugin-retry": "^8.1.0", + "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", @@ -50,22 +50,22 @@ "@types/node": "^20.19.43", "@types/node-forge": "^1.3.14", "@types/sarif": "^2.1.7", - "@types/semver": "^7.7.1", + "@types/semver": "^7.8.0", "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.1", + "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.8.0", - "nock": "^14.0.16", + "globals": "^17.9.0", + "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.65.0" + "typescript-eslint": "^8.66.0" } }, "node_modules/@aashutoshrathi/word-wrap": { @@ -1498,9 +1498,9 @@ } }, "node_modules/@eslint/eslintrc": { - "version": "3.3.5", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz", - "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==", + "version": "3.3.6", + "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", + "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", "dev": true, "license": "MIT", "dependencies": { @@ -1510,7 +1510,7 @@ "globals": "^14.0.0", "ignore": "^5.2.0", "import-fresh": "^3.2.1", - "js-yaml": "^4.1.1", + "js-yaml": "^4.3.0", "minimatch": "^3.1.5", "strip-json-comments": "^3.1.1" }, @@ -1526,6 +1526,7 @@ "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", "dev": true, + "license": "MIT", "engines": { "node": ">=18" }, @@ -1534,9 +1535,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { @@ -2086,16 +2087,16 @@ } }, "node_modules/@octokit/core": { - "version": "7.0.6", - "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz", - "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==", + "version": "7.0.7", + "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.7.tgz", + "integrity": "sha512-DcB0M3KFgr9ECI328lhBMVsyFT2DnmNucSBTqEN3exyNKUzkkpUSCHmTRcunF41Eou2TIQKW4seewri8ON9bSA==", "license": "MIT", "dependencies": { "@octokit/auth-token": "^6.0.0", - "@octokit/graphql": "^9.0.3", - "@octokit/request": "^10.0.6", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", + "@octokit/graphql": "^9.0.4", + "@octokit/request": "^10.0.13", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", "before-after-hook": "^4.0.0", "universal-user-agent": "^7.0.0" }, @@ -2103,6 +2104,21 @@ "node": ">= 20" } }, + "node_modules/@octokit/core/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/core/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/core/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2110,18 +2126,33 @@ "license": "ISC" }, "node_modules/@octokit/endpoint": { - "version": "11.0.2", - "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz", - "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==", + "version": "11.0.4", + "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.4.tgz", + "integrity": "sha512-f1cOWoHPmxryJFknxbtDdjODWfV8A9tc8Aae6ermXPNgHFZ/x91AtHIz4gicEjL8hkJiip+u21QHJORfBv/qiA==", "license": "MIT", "dependencies": { - "@octokit/types": "^16.0.0", + "@octokit/types": "^17.0.0", "universal-user-agent": "^7.0.2" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/endpoint/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/endpoint/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2129,19 +2160,34 @@ "license": "ISC" }, "node_modules/@octokit/graphql": { - "version": "9.0.3", - "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz", - "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==", + "version": "9.0.4", + "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.4.tgz", + "integrity": "sha512-5s15CCiY8XXQ+FG+b1YQcl6Z2FA++nwAz/tg2VUrTmnMncP+2nnGUEYANImdnxsA2Fnq+Mbl7hDjUTw7cFAwcg==", "license": "MIT", "dependencies": { - "@octokit/request": "^10.0.6", - "@octokit/types": "^16.0.0", + "@octokit/request": "^10.0.13", + "@octokit/types": "^17.0.0", "universal-user-agent": "^7.0.0" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/graphql/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/graphql/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2194,13 +2240,13 @@ } }, "node_modules/@octokit/plugin-retry": { - "version": "8.1.0", - "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz", - "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==", + "version": "8.1.1", + "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.1.tgz", + "integrity": "sha512-VCVvZ/R1+u3WuiBWpNavZ0mY4aaJNAsENrpBP9aLSR2QyOpQgd7DhM5j4AW7z4MQpnJYgwBPf0XqPQoNBRdQwg==", "license": "MIT", "dependencies": { - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", "bottleneck": "^2.15.3" }, "engines": { @@ -2210,16 +2256,32 @@ "@octokit/core": ">=7" } }, + "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/request": { - "version": "10.0.7", - "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz", - "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==", + "version": "10.0.13", + "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.13.tgz", + "integrity": "sha512-v2269YxL9Yf+x3d+gRI63FP0vFQEiWgLyBzxe/Y+0yFDg2B/Tzf5dhh9VNfccVAQnfcfwQWyk/y6Bn7rUXXs7A==", "license": "MIT", "dependencies": { - "@octokit/endpoint": "^11.0.2", - "@octokit/request-error": "^7.0.2", - "@octokit/types": "^16.0.0", - "fast-content-type-parse": "^3.0.0", + "@octokit/endpoint": "^11.0.3", + "@octokit/request-error": "^7.1.1", + "@octokit/types": "^17.0.0", + "content-type": "^2.0.0", + "json-with-bigint": "^3.5.3", "universal-user-agent": "^7.0.2" }, "engines": { @@ -2227,17 +2289,47 @@ } }, "node_modules/@octokit/request-error": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz", - "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==", + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.1.tgz", + "integrity": "sha512-+eaY7G2VVpSf2pc5Gn1+mph837V/d/TYTJAgWL9Tb0ogGYcpN3IlAVFgjL+Vv93F/sevrxkvsYCedtpLdcFLzA==", "license": "MIT", "dependencies": { - "@octokit/types": "^16.0.0" + "@octokit/types": "^17.0.0" }, "engines": { "node": ">= 20" } }, + "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/request-error/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, + "node_modules/@octokit/request/node_modules/@octokit/openapi-types": { + "version": "28.0.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-28.0.0.tgz", + "integrity": "sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==", + "license": "MIT" + }, + "node_modules/@octokit/request/node_modules/@octokit/types": { + "version": "17.0.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-17.0.0.tgz", + "integrity": "sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==", + "license": "MIT", + "dependencies": { + "@octokit/openapi-types": "^28.0.0" + } + }, "node_modules/@octokit/request/node_modules/universal-user-agent": { "version": "7.0.3", "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz", @@ -2569,9 +2661,9 @@ "license": "MIT" }, "node_modules/@types/semver": { - "version": "7.7.1", - "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz", - "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==", + "version": "7.8.0", + "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.8.0.tgz", + "integrity": "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==", "dev": true, "license": "MIT" }, @@ -2591,17 +2683,17 @@ "license": "MIT" }, "node_modules/@typescript-eslint/eslint-plugin": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.65.0.tgz", - "integrity": "sha512-IEgob78X12rHpUmtcwFsXhZdVGJtwTVP8FiCLZkR6GlYVrl2PcuB+KhCE5BlVC/eQpQnu8WXRtkHZuPar+gCRA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.66.0.tgz", + "integrity": "sha512-p088eaGrzYz1s+7cov0aMOCkNGTJlVxF4jgubf28c8L0Cv9Rloj8YBHnv4hXLq6IIEE1AsjNWavO+k+8kP2Y0A==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/regexpp": "^4.12.2", - "@typescript-eslint/scope-manager": "8.65.0", - "@typescript-eslint/type-utils": "8.65.0", - "@typescript-eslint/utils": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0", + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/type-utils": "8.66.0", + "@typescript-eslint/utils": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "ignore": "^7.0.5", "natural-compare": "^1.4.0", "ts-api-utils": "^2.5.0" @@ -2614,7 +2706,7 @@ "url": "https://opencollective.com/typescript-eslint" }, "peerDependencies": { - "@typescript-eslint/parser": "^8.65.0", + "@typescript-eslint/parser": "^8.66.0", "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0", "typescript": ">=4.8.4 <6.1.0" } @@ -2630,16 +2722,16 @@ } }, "node_modules/@typescript-eslint/parser": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.65.0.tgz", - "integrity": "sha512-CZ4nMxWwgu1HEEFNkeaCptra9QCtkmKdgf3sWh1rl1trIhmxLilgTV4cwcbQ4wemnT4sWQN8CaKOmdYx+g2gMA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.66.0.tgz", + "integrity": "sha512-X6ypGChaWYk6PBtUg2BwuTZEFFcHJAtGTVJ9/lCTOufhZ4i9fNolQNnktq+kkMCwMj7V8Svsq7+TxSDslmhE0g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/scope-manager": "8.65.0", - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0", + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "debug": "^4.4.3" }, "engines": { @@ -2673,14 +2765,14 @@ } }, "node_modules/@typescript-eslint/project-service": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.65.0.tgz", - "integrity": "sha512-SxnPhbTsGahizDgbu7oqFH/xVtzIqMd/s+WtnSxNxJZJpLbdT5IPdzg8EZxO3+PoKahXmwJLeNQOpKJb3/bi7Q==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.66.0.tgz", + "integrity": "sha512-7MthGPTt4BP69lSryqpqq8HQqxuzynssckL/jyDyk3+TNMQ3y2jFWkptCrktWvBrP+EH787Nl5N5Qpw7WZg+5g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/tsconfig-utils": "^8.65.0", - "@typescript-eslint/types": "^8.65.0", + "@typescript-eslint/tsconfig-utils": "^8.66.0", + "@typescript-eslint/types": "^8.66.0", "debug": "^4.4.3" }, "engines": { @@ -2713,14 +2805,14 @@ } }, "node_modules/@typescript-eslint/scope-manager": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.65.0.tgz", - "integrity": "sha512-Esbl8OSYiVxBokYgWPf7VVWg/BE798wXhimnn9ML9Pt5qoDf8bfQlgjlKXR/k98+AcNzlLKYrpCcrcuZ9DZLgg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.66.0.tgz", + "integrity": "sha512-8TGcH25j9zqJ/IULB/ppyhRvxA8QYfFEZ7nfbg6/BN9spDgb8fPWQXlE5l8TWBL50EtUx007uZ1o9VOwrq2/9g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0" + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2731,9 +2823,9 @@ } }, "node_modules/@typescript-eslint/tsconfig-utils": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.65.0.tgz", - "integrity": "sha512-j6GzGqCiRdA7Qhur2VVmKZAkBLfnHFQfx4TaJGL9RMveZqCo48jSHHO0DTgizEnGhtWnqmbtCUSrqSkdiY/0Hg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.66.0.tgz", + "integrity": "sha512-9D5gLYZG4rOjcoag8MQ/fWI8WqA9wcPDyOGyWtWFhvM1lHRbliqUSPIY5J3zqCU1tvSwzXxnnjhQhz5Ne7mJ4g==", "dev": true, "license": "MIT", "engines": { @@ -2748,15 +2840,15 @@ } }, "node_modules/@typescript-eslint/type-utils": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.65.0.tgz", - "integrity": "sha512-YjaZ7PRI5qY7ax2L3PbvX0rRyGtipAReCWs0mhhDBHjH/vl0g0BonaGXrKdKpMbIIsMIwDgbk/xzkBTyAltS5g==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.66.0.tgz", + "integrity": "sha512-LG2dWfjZQQp0ADtAu/EWJVayefGL2UEZ3CDeI44D9v3rXB/WYUqE/jpO28KrEKul5AySrmI+Zh1v6v+xW2U9+g==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0", - "@typescript-eslint/utils": "8.65.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/utils": "8.66.0", "debug": "^4.4.3", "ts-api-utils": "^2.5.0" }, @@ -2791,9 +2883,9 @@ } }, "node_modules/@typescript-eslint/types": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz", - "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.66.0.tgz", + "integrity": "sha512-H6gcYaSDOyvL3AD/jHUtUFo2jqGgn/F6nuyuZSu0QTesxL+cP4dQoIMrODRofuJC09g64+WgZ6tE19Y1N2YIFQ==", "dev": true, "license": "MIT", "engines": { @@ -2805,16 +2897,16 @@ } }, "node_modules/@typescript-eslint/typescript-estree": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.65.0.tgz", - "integrity": "sha512-JboAE2swaYt4tb1fHhHTABE2K+OLy09XfcTbhnk4Pw96f9dd2e9iYsJ28gBggHlo5z5x1rkyWvcPoTuNTd4oGg==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.66.0.tgz", + "integrity": "sha512-8/x4INiiQb10jGgXYD7116/zQ+OL84ZIFn0za68wwFHCanT/VLbBEroWht8RV8fn0/ZCAoazHLQgwUC0UQcDfg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/project-service": "8.65.0", - "@typescript-eslint/tsconfig-utils": "8.65.0", - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/visitor-keys": "8.65.0", + "@typescript-eslint/project-service": "8.66.0", + "@typescript-eslint/tsconfig-utils": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/visitor-keys": "8.66.0", "debug": "^4.4.3", "minimatch": "^10.2.2", "semver": "^7.7.3", @@ -2890,16 +2982,16 @@ } }, "node_modules/@typescript-eslint/utils": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.65.0.tgz", - "integrity": "sha512-gXiwIHsYreboxeJucHKPvgwl7dXt50mF8s1/c00cP/WoVTyWKFdtfhRWwZiXYFU5H2O8vVoSLNrexFZjYS/SGA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.66.0.tgz", + "integrity": "sha512-jasearZPolBw5NJNYGMwxzHMF83niVWmMU1VdHzG1CyfI2VS7f7nZltnKtHcg20hW+7Uo5GfK4MeDPoU3qI8EA==", "dev": true, "license": "MIT", "dependencies": { "@eslint-community/eslint-utils": "^4.9.1", - "@typescript-eslint/scope-manager": "8.65.0", - "@typescript-eslint/types": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0" + "@typescript-eslint/scope-manager": "8.66.0", + "@typescript-eslint/types": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -2914,13 +3006,13 @@ } }, "node_modules/@typescript-eslint/visitor-keys": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.65.0.tgz", - "integrity": "sha512-8C71BQkGjiMmXtop7pHVJu1l2NNShFdkCyD6a2ezzs5vU/L3LRtb69EtcteFwz0mYMPzIgOw0n6OV4VBUWZd7A==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.66.0.tgz", + "integrity": "sha512-dkKR8q+lKciskj1Y3vthHktl+3cMLWGyVUP23bRiPZ5O9BRT++4EqDDV+TVeIKBL1VXVEqrJlz8MYbcnvJcAlg==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/types": "8.65.0", + "@typescript-eslint/types": "8.66.0", "eslint-visitor-keys": "^5.0.0" }, "engines": { @@ -4293,6 +4385,19 @@ "node": "^14.18.0 || >=16.10.0" } }, + "node_modules/content-type": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", + "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "license": "MIT", + "engines": { + "node": ">=18" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" + } + }, "node_modules/convert-to-spaces": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/convert-to-spaces/-/convert-to-spaces-2.0.1.tgz", @@ -4988,15 +5093,15 @@ } }, "node_modules/eslint-plugin-github": { - "version": "6.1.1", - "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.1.tgz", - "integrity": "sha512-xCqu1S/s/CCvoRLafaXNvwiVrxhroNOFLGyG9Dhi4i1PWZgPHlipjXysH6wccPFQyhSKE7gAjSLqdSdM204bZQ==", + "version": "6.1.2", + "resolved": "https://registry.npmjs.org/eslint-plugin-github/-/eslint-plugin-github-6.1.2.tgz", + "integrity": "sha512-XU1fVItfnwYWXG0GqH0MV2VY9EzvgbPxDnUJ9I1915Cpn24z13Vgx1pttrdQy6bhLmDYp+Wl7pX/L1YMKdG+6g==", "dev": true, "license": "MIT", "dependencies": { "@eslint/compat": "^2.0.0", - "@eslint/eslintrc": "^3.1.0", - "@eslint/js": "^9.14.0", + "@eslint/eslintrc": "^3.3.6", + "@eslint/js": "^9.39.5", "@github/browserslist-config": "^1.0.0", "@typescript-eslint/eslint-plugin": "^8.0.0", "@typescript-eslint/parser": "^8.0.0", @@ -5391,30 +5496,6 @@ "node": "^18.18.0 || ^20.9.0 || >=21.1.0" } }, - "node_modules/eslint/node_modules/@eslint/eslintrc": { - "version": "3.3.6", - "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz", - "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==", - "dev": true, - "license": "MIT", - "dependencies": { - "ajv": "^6.14.0", - "debug": "^4.3.2", - "espree": "^10.0.1", - "globals": "^14.0.0", - "ignore": "^5.2.0", - "import-fresh": "^3.2.1", - "js-yaml": "^4.3.0", - "minimatch": "^3.1.5", - "strip-json-comments": "^3.1.1" - }, - "engines": { - "node": "^18.18.0 || ^20.9.0 || >=21.1.0" - }, - "funding": { - "url": "https://opencollective.com/eslint" - } - }, "node_modules/eslint/node_modules/ansi-styles": { "version": "4.2.1", "dev": true, @@ -5480,42 +5561,6 @@ "node": ">=10.13.0" } }, - "node_modules/eslint/node_modules/globals": { - "version": "14.0.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz", - "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - }, - "funding": { - "url": "https://github.com/sponsors/sindresorhus" - } - }, - "node_modules/eslint/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", - "dev": true, - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/puzrin" - }, - { - "type": "github", - "url": "https://github.com/sponsors/nodeca" - } - ], - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/espree": { "version": "10.4.0", "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz", @@ -5650,22 +5695,6 @@ "url": "https://github.com/sindresorhus/execa?sponsor=1" } }, - "node_modules/fast-content-type-parse": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz", - "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/fastify" - }, - { - "type": "opencollective", - "url": "https://opencollective.com/fastify" - } - ], - "license": "MIT" - }, "node_modules/fast-deep-equal": { "version": "3.1.3", "license": "MIT" @@ -6138,9 +6167,9 @@ } }, "node_modules/globals": { - "version": "17.8.0", - "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz", - "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==", + "version": "17.9.0", + "resolved": "https://registry.npmjs.org/globals/-/globals-17.9.0.tgz", + "integrity": "sha512-m/MvAW61QVU5VDNF1Vj8axt016h8w7L5TU1e9zlab7XIttAT2YAlCwl75K1fOqvMM9apmD7lbCIRhpfkhmxhCg==", "dev": true, "license": "MIT", "engines": { @@ -7044,6 +7073,12 @@ "dev": true, "license": "ISC" }, + "node_modules/json-with-bigint": { + "version": "3.5.10", + "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.10.tgz", + "integrity": "sha512-Vcx+JVNEBts/xfcoCS69sKrOhOk/3TVlvlT+XzUOefVKnnrbYSCKpDCm10pohsJFtsJVYnwa/cXRZ4eElzaM6w==", + "license": "MIT" + }, "node_modules/json5": { "version": "1.0.2", "dev": true, @@ -7446,9 +7481,9 @@ "license": "MIT" }, "node_modules/nock": { - "version": "14.0.16", - "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.16.tgz", - "integrity": "sha512-8r4KEc6nT1D/fdLD/R1BO1CPaVEL8o40u/guFRJlXabN7vr3RmMqyjsY5Krt0nMwhsOAwXQ/mtN5vy5Jh3aErg==", + "version": "14.0.17", + "resolved": "https://registry.npmjs.org/nock/-/nock-14.0.17.tgz", + "integrity": "sha512-EjRr1weMa4ALQX35AgZTEnP+weJJjlW1KGDiNM2IQC2069YDHas4f4B4UUYR+TTLyKWxJvOz2wObDKQs/LNreA==", "dev": true, "license": "MIT", "dependencies": { @@ -9168,9 +9203,9 @@ "license": "0BSD" }, "node_modules/tsx": { - "version": "4.23.1", - "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.1.tgz", - "integrity": "sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==", + "version": "4.23.8", + "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.23.8.tgz", + "integrity": "sha512-8W675THjbzfFmLOQzjDBIBna+WjqMGIxmSZ1mMc1+o9qoVsEuAgQu5j5ueLhau8inOkDu9OslVg0FmfBs1RIHw==", "dev": true, "license": "MIT", "dependencies": { @@ -9320,16 +9355,16 @@ } }, "node_modules/typescript-eslint": { - "version": "8.65.0", - "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.65.0.tgz", - "integrity": "sha512-/ggrHAwyjENDusvyxbuqxAC2dTnZg/Z8F+fgQtYIz+L6n/9HfSlEZcFGV/NsMNa6CkGk0xUjUAFwC0vHOflvIA==", + "version": "8.66.0", + "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.66.0.tgz", + "integrity": "sha512-QlEbBPz/RuJ1XUHj29nm3t0F/O/cSlEnntozqPOYHnnTGAXFamnMBu5i9Vn6vhUPHGAjR+Vl+5J8vPN/BMUrJw==", "dev": true, "license": "MIT", "dependencies": { - "@typescript-eslint/eslint-plugin": "8.65.0", - "@typescript-eslint/parser": "8.65.0", - "@typescript-eslint/typescript-estree": "8.65.0", - "@typescript-eslint/utils": "8.65.0" + "@typescript-eslint/eslint-plugin": "8.66.0", + "@typescript-eslint/parser": "8.66.0", + "@typescript-eslint/typescript-estree": "8.66.0", + "@typescript-eslint/utils": "8.66.0" }, "engines": { "node": "^18.18.0 || ^20.9.0 || >=21.1.0" @@ -9810,7 +9845,7 @@ "dependencies": { "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": ">=9.2.2", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "semver": "^7.8.5", @@ -9818,7 +9853,7 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.1" + "tsx": "^4.23.8" } } } diff --git a/package.json b/package.json index 0e3d1c7e96..17229b4b7b 100644 --- a/package.json +++ b/package.json @@ -30,10 +30,10 @@ "@actions/http-client": "^3.0.0", "@actions/io": "^2.0.0", "@actions/tool-cache": "^3.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": "^14.0.0", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", - "@octokit/plugin-retry": "^8.1.0", + "@octokit/plugin-retry": "^8.1.1", "archiver": "^8.0.0", "fast-deep-equal": "^3.1.3", "follow-redirects": "^1.16.0", @@ -58,22 +58,22 @@ "@types/node": "^20.19.43", "@types/node-forge": "^1.3.14", "@types/sarif": "^2.1.7", - "@types/semver": "^7.7.1", + "@types/semver": "^7.8.0", "@types/sinon": "^22.0.0", "ava": "^6.4.1", "esbuild": "^0.28.1", "eslint": "^9.39.5", "eslint-import-resolver-typescript": "^4.4.5", - "eslint-plugin-github": "^6.1.1", + "eslint-plugin-github": "^6.1.2", "eslint-plugin-import-x": "^4.17.1", "eslint-plugin-jsdoc": "^62.9.0", "eslint-plugin-no-async-foreach": "^0.1.1", "glob": "^13.0.6", - "globals": "^17.8.0", - "nock": "^14.0.16", + "globals": "^17.9.0", + "nock": "^14.0.17", "sinon": "^22.1.0", "typescript": "^6.0.3", - "typescript-eslint": "^8.65.0" + "typescript-eslint": "^8.66.0" }, "overrides": { "@actions/tool-cache": { diff --git a/pr-checks/package.json b/pr-checks/package.json index 07d599bb68..6c23d847f2 100644 --- a/pr-checks/package.json +++ b/pr-checks/package.json @@ -4,7 +4,7 @@ "dependencies": { "@actions/core": "^2.0.3", "@actions/github": "^8.0.1", - "@octokit/core": "^7.0.6", + "@octokit/core": "^7.0.7", "@octokit/plugin-paginate-rest": ">=9.2.2", "@octokit/plugin-rest-endpoint-methods": "^17.0.0", "semver": "^7.8.5", @@ -12,6 +12,6 @@ }, "devDependencies": { "@types/node": "^20.19.43", - "tsx": "^4.23.1" + "tsx": "^4.23.8" } } From b4d8a54218a8792de9af2f6f32e33af899ca5212 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 12 Aug 2026 17:57:08 +0000 Subject: [PATCH 144/155] Rebuild --- lib/entry-points.js | 667 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 530 insertions(+), 137 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index bbcd0690a0..c7b8eb6416 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -22251,7 +22251,7 @@ function isKeyOperator(operator) { function getValues(context5, operator, key, modifier) { var value = context5[key], result = []; if (isDefined(value) && value !== "") { - if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") { + if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean") { value = value.toString(); if (modifier && modifier !== "*") { value = value.substring(0, parseInt(modifier, 10)); @@ -22464,99 +22464,474 @@ var init_universal_user_agent3 = __esm({ } }); -// node_modules/fast-content-type-parse/index.js -var require_fast_content_type_parse = __commonJS({ - "node_modules/fast-content-type-parse/index.js"(exports2, module2) { +// node_modules/content-type/dist/index.js +var require_dist = __commonJS({ + "node_modules/content-type/dist/index.js"(exports2) { "use strict"; - var NullObject = function NullObject2() { - }; - NullObject.prototype = /* @__PURE__ */ Object.create(null); - var paramRE = /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\v\u0020-\u00ff])*"|[!#$%&'*+.^\w`|~-]+) */gu; - var quotedPairRE = /\\([\v\u0020-\u00ff])/gu; - var mediaTypeRE = /^[!#$%&'*+.^\w|~-]+\/[!#$%&'*+.^\w|~-]+$/u; - var defaultContentType = { type: "", parameters: new NullObject() }; - Object.freeze(defaultContentType.parameters); - Object.freeze(defaultContentType); - function parse2(header) { - if (typeof header !== "string") { - throw new TypeError("argument header is required and must be a string"); - } - let index2 = header.indexOf(";"); - const type = index2 !== -1 ? header.slice(0, index2).trim() : header.trim(); - if (mediaTypeRE.test(type) === false) { - throw new TypeError("invalid media type"); - } - const result = { - type: type.toLowerCase(), - parameters: new NullObject() - }; - if (index2 === -1) { - return result; + Object.defineProperty(exports2, "__esModule", { value: true }); + exports2.format = format; + exports2.parse = parse3; + var TEXT_REGEXP = /^[\u0009\u0020-\u007e\u0080-\u00ff]*$/; + var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/; + var QUOTE_REGEXP = /[\\"]/g; + var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/; + var NullObject = /* @__PURE__ */ (() => { + const C = function() { + }; + C.prototype = /* @__PURE__ */ Object.create(null); + return C; + })(); + function format(obj) { + const { type, parameters } = obj; + if (!type || !TYPE_REGEXP.test(type)) { + throw new TypeError(`Invalid type: ${type}`); } - let key; - let match2; - let value; - paramRE.lastIndex = index2; - while (match2 = paramRE.exec(header)) { - if (match2.index !== index2) { - throw new TypeError("invalid parameter format"); + let result = type; + if (parameters) { + for (const param of Object.keys(parameters)) { + if (!TOKEN_REGEXP.test(param)) { + throw new TypeError(`Invalid parameter name: ${param}`); + } + result += `; ${param}=${qstring(parameters[param])}`; } - index2 += match2[0].length; - key = match2[1].toLowerCase(); - value = match2[2]; - if (value[0] === '"') { - value = value.slice(1, value.length - 1); - quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1")); + } + return result; + } + function parse3(header, options) { + const len = header.length; + let index2 = skipOWS(header, 0, len); + const valueStart = index2; + index2 = skipValue(header, index2, len); + const valueEnd = trailingOWS(header, valueStart, index2); + const type = header.slice(valueStart, valueEnd).toLowerCase(); + const parameters = options?.parameters === false ? new NullObject() : parseParameters(header, index2, len); + return { type, parameters }; + } + var SP = 32; + var HTAB = 9; + var SEMI = 59; + var EQ = 61; + var DQUOTE = 34; + var BSLASH = 92; + function parseParameters(header, index2, len) { + const parameters = new NullObject(); + parameter: while (index2 < len) { + index2 = skipOWS(header, index2 + 1, len); + const keyStart = index2; + while (index2 < len) { + const code = header.charCodeAt(index2); + if (code === SEMI) + continue parameter; + if (code === EQ) { + const keyEnd = trailingOWS(header, keyStart, index2); + const key = header.slice(keyStart, keyEnd).toLowerCase(); + index2 = skipOWS(header, index2 + 1, len); + if (index2 < len && header.charCodeAt(index2) === DQUOTE) { + index2++; + let value = ""; + while (index2 < len) { + const code2 = header.charCodeAt(index2++); + if (code2 === DQUOTE) { + index2 = skipValue(header, index2, len); + if (parameters[key] === void 0) + parameters[key] = value; + break; + } + if (code2 === BSLASH && index2 < len) { + value += header[index2++]; + continue; + } + value += String.fromCharCode(code2); + } + continue parameter; + } + const valueStart = index2; + index2 = skipValue(header, index2, len); + if (parameters[key] === void 0) { + const valueEnd = trailingOWS(header, valueStart, index2); + parameters[key] = header.slice(valueStart, valueEnd); + } + continue parameter; + } + index2++; } - result.parameters[key] = value; } - if (index2 !== header.length) { - throw new TypeError("invalid parameter format"); + return parameters; + } + function skipValue(str, index2, len) { + while (index2 < len) { + const char = str.charCodeAt(index2); + if (char === SEMI) + break; + index2++; } - return result; + return index2; } - function safeParse2(header) { - if (typeof header !== "string") { - return defaultContentType; + function skipOWS(header, index2, len) { + while (index2 < len) { + const char = header.charCodeAt(index2); + if (char !== SP && char !== HTAB) + break; + index2++; } - let index2 = header.indexOf(";"); - const type = index2 !== -1 ? header.slice(0, index2).trim() : header.trim(); - if (mediaTypeRE.test(type) === false) { - return defaultContentType; + return index2; + } + function trailingOWS(header, start, end) { + while (end > start) { + const char = header.charCodeAt(end - 1); + if (char !== SP && char !== HTAB) + break; + end--; } - const result = { - type: type.toLowerCase(), - parameters: new NullObject() + return end; + } + function qstring(str) { + if (TOKEN_REGEXP.test(str)) + return str; + if (TEXT_REGEXP.test(str)) + return `"${str.replace(QUOTE_REGEXP, "\\$&")}"`; + throw new TypeError(`Invalid parameter value: ${str}`); + } + } +}); + +// node_modules/json-with-bigint/json-with-bigint.js +var intRegex, noiseValue, originalStringify, originalParse, customFormat, bigIntsStringify, noiseStringify, isUnstringifiable, isRawJSON, stringifyIteratively, JSONStringify, featureCache, isContextSourceSupported, convertMarkedBigIntsReviver, JSONParseV2, MAX_INT, MAX_DIGITS, stringsOrLargeNumbers, noiseValueWithQuotes, applyReviverIteratively, serializeBigInts, JSONParse; +var init_json_with_bigint = __esm({ + "node_modules/json-with-bigint/json-with-bigint.js"() { + intRegex = /^-?\d+$/; + noiseValue = /^-?\d+n+$/; + originalStringify = JSON.stringify; + originalParse = JSON.parse; + customFormat = /^-?\d+n$/; + bigIntsStringify = /([\[:])?"(-?\d+)n"($|\s*[,\}\]])/g; + noiseStringify = /([\[:])?("-?\d+n+)n("$|"\s*[,\}\]])/g; + isUnstringifiable = (val) => val === void 0 || typeof val === "function" || typeof val === "symbol"; + isRawJSON = (val) => val !== null && typeof val === "object" && val.constructor && val.constructor.name === "RawJSON"; + stringifyIteratively = (rootValue, replacer, spaceParam) => { + let space2 = ""; + if (typeof spaceParam === "number") { + space2 = " ".repeat(Math.min(10, Math.max(0, Math.floor(spaceParam)))); + } else if (typeof spaceParam === "string") { + space2 = spaceParam.slice(0, 10); + } + const isFunctionReplacer = typeof replacer === "function"; + const propertyList = Array.isArray(replacer) ? new Set(replacer.map(String)) : null; + const prepareVal = (parent, key, val) => { + const isObject2 = val !== null && typeof val === "object"; + const hasToJSON = isObject2 && typeof val.toJSON === "function"; + if (hasToJSON) { + val = val.toJSON(key); + } + const isNoise = typeof val === "string" && noiseValue.test(val); + if (isNoise) return val + "n"; + const isBigInt = typeof val === "bigint"; + if (isBigInt) { + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) return JSON.rawJSON(val.toString()); + return val.toString() + "n"; + } + if (isFunctionReplacer) { + val = replacer.call(parent, key, val); + } + const isPostReplacerObject = val !== null && typeof val === "object"; + if (isPostReplacerObject) { + const isPrimitiveWrapper = val instanceof Number || val instanceof String || val instanceof Boolean; + if (isPrimitiveWrapper) { + val = val.valueOf(); + } + } + return val; }; - if (index2 === -1) { - return result; + const rootProcessed = prepareVal({ "": rootValue }, "", rootValue); + if (isUnstringifiable(rootProcessed)) { + return void 0; } - let key; - let match2; - let value; - paramRE.lastIndex = index2; - while (match2 = paramRE.exec(header)) { - if (match2.index !== index2) { - return defaultContentType; + const isRootPrimitive = rootProcessed === null || typeof rootProcessed !== "object"; + const isRootNativeRawJSON = isRawJSON(rootProcessed); + if (isRootPrimitive || isRootNativeRawJSON) { + return originalStringify(rootProcessed); + } + const chunks = []; + let level = 0; + const stack = [ + { + parent: { "": rootProcessed }, + key: "", + val: rootProcessed, + isArray: Array.isArray(rootProcessed), + keys: Array.isArray(rootProcessed) ? null : Object.keys(rootProcessed), + index: 0, + first: true + } + ]; + const visited = new WeakSet([rootProcessed]); + while (stack.length > 0) { + const node = stack[stack.length - 1]; + if (node.index === 0) { + chunks.push(node.isArray ? "[" : "{"); + level++; + } + let isDone = false; + if (node.isArray) { + if (node.index < node.val.length) { + if (!node.first) chunks.push(","); + if (space2) chunks.push("\n" + space2.repeat(level)); + const childRaw = node.val[node.index]; + const childVal = prepareVal(node.val, String(node.index), childRaw); + if (isUnstringifiable(childVal)) { + chunks.push("null"); + node.first = false; + node.index++; + } else { + const isComplexObject = childVal !== null && typeof childVal === "object"; + const isNativeRaw = isRawJSON(childVal); + if (isComplexObject && !isNativeRaw) { + if (visited.has(childVal)) { + throw new TypeError("Converting circular structure to JSON"); + } + visited.add(childVal); + stack.push({ + parent: node.val, + key: String(node.index), + val: childVal, + isArray: Array.isArray(childVal), + keys: Array.isArray(childVal) ? null : Object.keys(childVal), + index: 0, + first: true + }); + node.first = false; + node.index++; + } else { + chunks.push(originalStringify(childVal)); + node.first = false; + node.index++; + } + } + } else { + isDone = true; + } + } else { + while (node.index < node.keys.length) { + const k = node.keys[node.index++]; + const isFilteredOutByArray = propertyList && !propertyList.has(k); + if (isFilteredOutByArray) continue; + const childRaw = node.val[k]; + const childVal = prepareVal(node.val, k, childRaw); + if (isUnstringifiable(childVal)) continue; + if (!node.first) chunks.push(","); + if (space2) { + chunks.push("\n" + space2.repeat(level) + originalStringify(k) + ": "); + } else { + chunks.push(originalStringify(k) + ":"); + } + const isComplexObject = childVal !== null && typeof childVal === "object"; + const isNativeRaw = isRawJSON(childVal); + if (isComplexObject && !isNativeRaw) { + if (visited.has(childVal)) { + throw new TypeError("Converting circular structure to JSON"); + } + visited.add(childVal); + stack.push({ + parent: node.val, + key: k, + val: childVal, + isArray: Array.isArray(childVal), + keys: Array.isArray(childVal) ? null : Object.keys(childVal), + index: 0, + first: true + }); + node.first = false; + break; + } else { + chunks.push(originalStringify(childVal)); + node.first = false; + } + } + const isNodeFullyProcessed = node.index >= node.keys.length && stack[stack.length - 1] === node; + if (isNodeFullyProcessed) { + isDone = true; + } } - index2 += match2[0].length; - key = match2[1].toLowerCase(); - value = match2[2]; - if (value[0] === '"') { - value = value.slice(1, value.length - 1); - quotedPairRE.test(value) && (value = value.replace(quotedPairRE, "$1")); + if (isDone) { + level--; + if (!node.first && space2) chunks.push("\n" + space2.repeat(level)); + chunks.push(node.isArray ? "]" : "}"); + visited.delete(node.val); + stack.pop(); } - result.parameters[key] = value; } - if (index2 !== header.length) { - return defaultContentType; + return chunks.join(""); + }; + JSONStringify = (value, replacer, space2) => { + try { + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) { + return originalStringify( + value, + (key, val) => { + if (typeof val === "bigint") return JSON.rawJSON(val.toString()); + const hasFunctionReplacer = typeof replacer === "function"; + if (hasFunctionReplacer) return replacer(key, val); + const isKeyInArrayReplacer = Array.isArray(replacer) && replacer.includes(key); + if (isKeyInArrayReplacer) return val; + return val; + }, + space2 + ); + } + if (!value) return originalStringify(value, replacer, space2); + const convertedToCustomJSON = originalStringify( + value, + (key, val) => { + const isNoise = typeof val === "string" && noiseValue.test(val); + if (isNoise) return val.toString() + "n"; + if (typeof val === "bigint") return val.toString() + "n"; + const hasFunctionReplacer = typeof replacer === "function"; + if (hasFunctionReplacer) return replacer(key, val); + const isKeyInArrayReplacer = Array.isArray(replacer) && replacer.includes(key); + if (isKeyInArrayReplacer) return val; + return val; + }, + space2 + ); + const processedJSON = convertedToCustomJSON.replace( + bigIntsStringify, + "$1$2$3" + ); + const denoisedJSON = processedJSON.replace(noiseStringify, "$1$2$3"); + return denoisedJSON; + } catch (error3) { + if (error3 instanceof RangeError) { + const convertedJSON = stringifyIteratively(value, replacer, space2); + if (convertedJSON === void 0) return void 0; + const supportsRawJSON = "rawJSON" in JSON; + if (supportsRawJSON) return convertedJSON; + const processedJSON = convertedJSON.replace(bigIntsStringify, "$1$2$3"); + return processedJSON.replace(noiseStringify, "$1$2$3"); + } + throw error3; } - return result; - } - module2.exports.default = { parse: parse2, safeParse: safeParse2 }; - module2.exports.parse = parse2; - module2.exports.safeParse = safeParse2; - module2.exports.defaultContentType = defaultContentType; + }; + featureCache = /* @__PURE__ */ new Map(); + isContextSourceSupported = () => { + const parseFingerprint = JSON.parse.toString(); + if (featureCache.has(parseFingerprint)) { + return featureCache.get(parseFingerprint); + } + try { + const result = JSON.parse( + "1", + (_2, __, context5) => !!context5?.source && context5.source === "1" + ); + featureCache.set(parseFingerprint, result); + return result; + } catch { + featureCache.set(parseFingerprint, false); + return false; + } + }; + convertMarkedBigIntsReviver = (key, value, context5, userReviver) => { + const isCustomFormatBigInt = typeof value === "string" && customFormat.test(value); + if (isCustomFormatBigInt) return BigInt(value.slice(0, -1)); + const isNoiseValue = typeof value === "string" && noiseValue.test(value); + if (isNoiseValue) return value.slice(0, -1); + const hasUserReviver = typeof userReviver === "function"; + if (!hasUserReviver) return value; + return userReviver(key, value, context5); + }; + JSONParseV2 = (text, reviver) => { + return JSON.parse(text, (key, value, context5) => { + const isNumber2 = typeof value === "number"; + const isOutOfBounds = value > Number.MAX_SAFE_INTEGER || value < Number.MIN_SAFE_INTEGER; + const isBigNumber = isNumber2 && isOutOfBounds; + const isInt = context5 && intRegex.test(context5.source); + const isBigInt = isBigNumber && isInt; + if (isBigInt) return BigInt(context5.source); + const hasCustomReviver = typeof reviver === "function"; + if (!hasCustomReviver) return value; + return reviver(key, value, context5); + }); + }; + MAX_INT = Number.MAX_SAFE_INTEGER.toString(); + MAX_DIGITS = MAX_INT.length; + stringsOrLargeNumbers = /"(?:\\.|[^"])*"|-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/g; + noiseValueWithQuotes = /^"-?\d+n+"$/; + applyReviverIteratively = (parsed, userReviver) => { + const rootHolder = { "": parsed }; + const stack = [{ parent: rootHolder, key: "", visited: false }]; + while (stack.length > 0) { + const node = stack[stack.length - 1]; + if (!node.visited) { + node.visited = true; + const value = node.parent[node.key]; + const isComplexObject = value !== null && typeof value === "object"; + if (isComplexObject) { + const keys = Object.keys(value); + for (let i = keys.length - 1; i >= 0; i--) { + stack.push({ parent: value, key: keys[i], visited: false }); + } + } + } else { + const { parent, key } = node; + let value = parent[key]; + if (typeof value === "string") { + const isCustomFormatBigInt = customFormat.test(value); + if (isCustomFormatBigInt) { + value = BigInt(value.slice(0, -1)); + } else { + const isNoise = noiseValue.test(value); + if (isNoise) value = value.slice(0, -1); + } + } + const hasUserReviver = typeof userReviver === "function"; + if (hasUserReviver) { + value = userReviver.call(parent, key, value); + } + const isDeleted = value === void 0; + if (isDeleted) { + delete parent[key]; + } else { + parent[key] = value; + } + stack.pop(); + } + } + return rootHolder[""]; + }; + serializeBigInts = (text) => { + return text.replace( + stringsOrLargeNumbers, + (match2, digits, fractional, exponential) => { + const isString3 = match2[0] === '"'; + const isNoise = isString3 && noiseValueWithQuotes.test(match2); + if (isNoise) return match2.substring(0, match2.length - 1) + 'n"'; + const hasFractionalOrExponential = fractional || exponential; + const isLessThanMaxSafeInt = digits && (digits.length < MAX_DIGITS || digits.length === MAX_DIGITS && digits <= MAX_INT); + const isStandardValue = isString3 || hasFractionalOrExponential || isLessThanMaxSafeInt; + if (isStandardValue) return match2; + return '"' + match2 + 'n"'; + } + ); + }; + JSONParse = (text, reviver) => { + if (!text) return originalParse(text, reviver); + try { + if (isContextSourceSupported()) return JSONParseV2(text, reviver); + const serializedData = serializeBigInts(text); + return originalParse( + serializedData, + (key, value, context5) => convertMarkedBigIntsReviver(key, value, context5, reviver) + ); + } catch (error3) { + if (error3 instanceof RangeError) { + const serializedData = serializeBigInts(text); + const parsed = originalParse(serializedData); + return applyReviverIteratively(parsed, reviver); + } + throw error3; + } + }; } }); @@ -22622,7 +22997,7 @@ async function fetchWrapper(requestOptions) { } const log = requestOptions.request?.log || console; const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false; - const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSON.stringify(requestOptions.body) : requestOptions.body; + const body = isPlainObject2(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body; const requestHeaders = Object.fromEntries( Object.entries(requestOptions.headers).map(([name, value]) => [ name, @@ -22716,16 +23091,19 @@ async function getResponseData(response) { if (!contentType) { return response.text().catch(noop); } - const mimetype = (0, import_fast_content_type_parse.safeParse)(contentType); + const mimetype = (0, import_content_type.parse)(contentType); if (isJSONResponse(mimetype)) { let text = ""; try { text = await response.text(); - return JSON.parse(text); + return JSONParse(text); } catch (err) { return text; } - } else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8") { + } else if (mimetype.type.startsWith("text/") || // `application/octet-stream` is the canonical "arbitrary binary" type + // (RFC 2046) and must never be decoded as text, even when the response + // carries a (misleading) `charset=utf-8` parameter — see #751. + mimetype.parameters.charset?.toLowerCase() === "utf-8" && mimetype.type !== "application/octet-stream") { return response.text().catch(noop); } else { return response.arrayBuffer().catch( @@ -22744,9 +23122,10 @@ function toErrorMessage(data) { if (data instanceof ArrayBuffer) { return "Unknown error"; } - if ("message" in data) { - const suffix = "documentation_url" in data ? ` - ${data.documentation_url}` : ""; - return Array.isArray(data.errors) ? `${data.message}: ${data.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${data.message}${suffix}`; + if (typeof data === "object" && data !== null && "message" in data) { + const objectData = data; + const suffix = "documentation_url" in objectData ? ` - ${objectData.documentation_url}` : ""; + return Array.isArray(objectData.errors) ? `${objectData.message}: ${objectData.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${objectData.message}${suffix}`; } return `Unknown error: ${JSON.stringify(data)}`; } @@ -22773,14 +23152,15 @@ function withDefaults2(oldEndpoint, newDefaults) { defaults: withDefaults2.bind(null, endpoint2) }); } -var import_fast_content_type_parse, VERSION2, defaults_default, noop, request; +var import_content_type, VERSION2, defaults_default, noop, request; var init_dist_bundle2 = __esm({ "node_modules/@octokit/request/dist-bundle/index.js"() { init_dist_bundle(); init_universal_user_agent3(); - import_fast_content_type_parse = __toESM(require_fast_content_type_parse(), 1); + import_content_type = __toESM(require_dist(), 1); + init_json_with_bigint(); init_dist_src(); - VERSION2 = "10.0.7"; + VERSION2 = "10.0.13"; defaults_default = { headers: { "user-agent": `octokit-request.js/${VERSION2} ${getUserAgent3()}` @@ -22894,6 +23274,9 @@ var init_dist_bundle3 = __esm({ Error.captureStackTrace(this, this.constructor); } } + request; + headers; + response; name = "GraphqlResponseError"; errors; data; @@ -22974,7 +23357,7 @@ var init_dist_bundle4 = __esm({ var VERSION4; var init_version = __esm({ "node_modules/@octokit/core/dist-src/version.js"() { - VERSION4 = "7.0.6"; + VERSION4 = "7.0.7"; } }); @@ -26592,7 +26975,7 @@ var require_parse2 = __commonJS({ "node_modules/semver/functions/parse.js"(exports2, module2) { "use strict"; var SemVer = require_semver(); - var parse2 = (version, options, throwErrors = false) => { + var parse3 = (version, options, throwErrors = false) => { if (version instanceof SemVer) { return version; } @@ -26605,7 +26988,7 @@ var require_parse2 = __commonJS({ throw er; } }; - module2.exports = parse2; + module2.exports = parse3; } }); @@ -26613,9 +26996,9 @@ var require_parse2 = __commonJS({ var require_valid = __commonJS({ "node_modules/semver/functions/valid.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var valid4 = (version, options) => { - const v = parse2(version, options); + const v = parse3(version, options); return v ? v.version : null; }; module2.exports = valid4; @@ -26626,9 +27009,9 @@ var require_valid = __commonJS({ var require_clean = __commonJS({ "node_modules/semver/functions/clean.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var clean3 = (version, options) => { - const s = parse2(version.trim().replace(/^[=v]+/, ""), options); + const s = parse3(version.trim().replace(/^[=v]+/, ""), options); return s ? s.version : null; }; module2.exports = clean3; @@ -26663,10 +27046,10 @@ var require_inc = __commonJS({ var require_diff = __commonJS({ "node_modules/semver/functions/diff.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var diff = (version1, version2) => { - const v1 = parse2(version1, null, true); - const v2 = parse2(version2, null, true); + const v1 = parse3(version1, null, true); + const v2 = parse3(version2, null, true); const comparison = v1.compare(v2); if (comparison === 0) { return null; @@ -26737,9 +27120,9 @@ var require_patch = __commonJS({ var require_prerelease = __commonJS({ "node_modules/semver/functions/prerelease.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var prerelease = (version, options) => { - const parsed = parse2(version, options); + const parsed = parse3(version, options); return parsed && parsed.prerelease.length ? parsed.prerelease : null; }; module2.exports = prerelease; @@ -26925,7 +27308,7 @@ var require_coerce = __commonJS({ "node_modules/semver/functions/coerce.js"(exports2, module2) { "use strict"; var SemVer = require_semver(); - var parse2 = require_parse2(); + var parse3 = require_parse2(); var { safeRe: re, t } = require_re(); var coerce3 = (version, options) => { if (version instanceof SemVer) { @@ -26960,7 +27343,7 @@ var require_coerce = __commonJS({ const patch = match2[4] || "0"; const prerelease = options.includePrerelease && match2[5] ? `-${match2[5]}` : ""; const build2 = options.includePrerelease && match2[6] ? `+${match2[6]}` : ""; - return parse2(`${major}.${minor}.${patch}${prerelease}${build2}`, options); + return parse3(`${major}.${minor}.${patch}${prerelease}${build2}`, options); }; module2.exports = coerce3; } @@ -26970,7 +27353,7 @@ var require_coerce = __commonJS({ var require_truncate = __commonJS({ "node_modules/semver/functions/truncate.js"(exports2, module2) { "use strict"; - var parse2 = require_parse2(); + var parse3 = require_parse2(); var constants = require_constants6(); var SemVer = require_semver(); var truncate = (version, truncation, options) => { @@ -26982,7 +27365,7 @@ var require_truncate = __commonJS({ }; var cloneInputVersion = (version, options) => { const versionStringToParse = version instanceof SemVer ? version.version : version; - return parse2(versionStringToParse, options); + return parse3(versionStringToParse, options); }; var doTruncation = (version, truncation) => { if (isPrerelease(truncation)) { @@ -28026,7 +28409,7 @@ var require_semver2 = __commonJS({ var constants = require_constants6(); var SemVer = require_semver(); var identifiers = require_identifiers(); - var parse2 = require_parse2(); + var parse3 = require_parse2(); var valid4 = require_valid(); var clean3 = require_clean(); var inc = require_inc(); @@ -28065,7 +28448,7 @@ var require_semver2 = __commonJS({ var simplifyRange = require_simplify(); var subset = require_subset(); module2.exports = { - parse: parse2, + parse: parse3, valid: valid4, clean: clean3, inc, @@ -31728,9 +32111,9 @@ var require_minimatch = __commonJS({ throw new TypeError("pattern is too long"); } }; - Minimatch2.prototype.parse = parse2; + Minimatch2.prototype.parse = parse3; var SUBPARSE = {}; - function parse2(pattern, isSub) { + function parse3(pattern, isSub) { assertValidPattern2(pattern); var options = this.options; if (pattern === "**") { @@ -33180,8 +33563,8 @@ var require_semver3 = __commonJS({ } } var i; - exports2.parse = parse2; - function parse2(version, options) { + exports2.parse = parse3; + function parse3(version, options) { if (!options || typeof options !== "object") { options = { loose: !!options, @@ -33209,12 +33592,12 @@ var require_semver3 = __commonJS({ } exports2.valid = valid4; function valid4(version, options) { - var v = parse2(version, options); + var v = parse3(version, options); return v ? v.version : null; } exports2.clean = clean3; function clean3(version, options) { - var s = parse2(version.trim().replace(/^[=v]+/, ""), options); + var s = parse3(version.trim().replace(/^[=v]+/, ""), options); return s ? s.version : null; } exports2.SemVer = SemVer; @@ -33450,8 +33833,8 @@ var require_semver3 = __commonJS({ if (eq(version1, version2)) { return null; } else { - var v1 = parse2(version1); - var v2 = parse2(version2); + var v1 = parse3(version1); + var v2 = parse3(version2); var prefix = ""; if (v1.prerelease.length || v2.prerelease.length) { prefix = "pre"; @@ -34157,7 +34540,7 @@ var require_semver3 = __commonJS({ } exports2.prerelease = prerelease; function prerelease(version, options) { - var parsed = parse2(version, options); + var parsed = parse3(version, options); return parsed && parsed.prerelease.length ? parsed.prerelease : null; } exports2.intersects = intersects; @@ -34194,7 +34577,7 @@ var require_semver3 = __commonJS({ if (match2 === null) { return null; } - return parse2(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options); + return parse3(match2[2] + "." + (match2[3] || "0") + "." + (match2[4] || "0"), options); } } }); @@ -36894,7 +37277,7 @@ var require_ms = __commonJS({ options = options || {}; var type = typeof val; if (type === "string" && val.length > 0) { - return parse2(val); + return parse3(val); } else if (type === "number" && isFinite(val)) { return options.long ? fmtLong(val) : fmtShort(val); } @@ -36902,7 +37285,7 @@ var require_ms = __commonJS({ "val is not a non-empty string or a valid number. val=" + JSON.stringify(val) ); }; - function parse2(str) { + function parse3(str) { str = String(str); if (str.length > 100) { return; @@ -37715,7 +38098,7 @@ var require_helpers3 = __commonJS({ }); // node_modules/agent-base/dist/index.js -var require_dist = __commonJS({ +var require_dist2 = __commonJS({ "node_modules/agent-base/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -37967,7 +38350,7 @@ var require_parse_proxy_response = __commonJS({ }); // node_modules/https-proxy-agent/dist/index.js -var require_dist2 = __commonJS({ +var require_dist3 = __commonJS({ "node_modules/https-proxy-agent/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -38006,7 +38389,7 @@ var require_dist2 = __commonJS({ var tls = __importStar2(require("tls")); var assert_1 = __importDefault2(require("assert")); var debug_1 = __importDefault2(require_src()); - var agent_base_1 = require_dist(); + var agent_base_1 = require_dist2(); var url_1 = require("url"); var parse_proxy_response_1 = require_parse_proxy_response(); var debug6 = (0, debug_1.default)("https-proxy-agent"); @@ -38117,7 +38500,7 @@ var require_dist2 = __commonJS({ }); // node_modules/http-proxy-agent/dist/index.js -var require_dist3 = __commonJS({ +var require_dist4 = __commonJS({ "node_modules/http-proxy-agent/dist/index.js"(exports2) { "use strict"; var __createBinding2 = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) { @@ -38156,7 +38539,7 @@ var require_dist3 = __commonJS({ var tls = __importStar2(require("tls")); var debug_1 = __importDefault2(require_src()); var events_1 = require("events"); - var agent_base_1 = require_dist(); + var agent_base_1 = require_dist2(); var url_1 = require("url"); var debug6 = (0, debug_1.default)("http-proxy-agent"); var HttpProxyAgent = class extends agent_base_1.Agent { @@ -38255,8 +38638,8 @@ var require_proxyPolicy = __commonJS({ exports2.loadNoProxy = loadNoProxy; exports2.getDefaultProxySettings = getDefaultProxySettings; exports2.proxyPolicy = proxyPolicy; - var https_proxy_agent_1 = require_dist2(); - var http_proxy_agent_1 = require_dist3(); + var https_proxy_agent_1 = require_dist3(); + var http_proxy_agent_1 = require_dist4(); var log_js_1 = require_log2(); var HTTPS_PROXY = "HTTPS_PROXY"; var HTTP_PROXY = "HTTP_PROXY"; @@ -42838,7 +43221,7 @@ var require_deserializationPolicy = __commonJS({ return result; } async function deserializeResponseBody(jsonContentTypes, xmlContentTypes, response, options, parseXML) { - const parsedResponse = await parse2(jsonContentTypes, xmlContentTypes, response, options, parseXML); + const parsedResponse = await parse3(jsonContentTypes, xmlContentTypes, response, options, parseXML); if (!shouldDeserializeResponse(parsedResponse)) { return parsedResponse; } @@ -42939,7 +43322,7 @@ var require_deserializationPolicy = __commonJS({ } return { error: error3, shouldReturnResponse: false }; } - async function parse2(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) { + async function parse3(jsonContentTypes, xmlContentTypes, operationResponse, opts, parseXML) { if (!operationResponse.request.streamResponseStatusCodes?.has(operationResponse.status) && operationResponse.bodyAsText) { const text = operationResponse.bodyAsText; const contentType = operationResponse.headers.get("Content-Type") || ""; @@ -75024,7 +75407,7 @@ var require_requestUtils = __commonJS({ }); // node_modules/@azure/abort-controller/dist/index.js -var require_dist4 = __commonJS({ +var require_dist5 = __commonJS({ "node_modules/@azure/abort-controller/dist/index.js"(exports2) { "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); @@ -75250,7 +75633,7 @@ var require_downloadUtils = __commonJS({ var utils = __importStar2(require_cacheUtils()); var constants_1 = require_constants7(); var requestUtils_1 = require_requestUtils(); - var abort_controller_1 = require_dist4(); + var abort_controller_1 = require_dist5(); function pipeResponseToStream(response, output) { return __awaiter2(this, void 0, void 0, function* () { const pipeline2 = util3.promisify(stream2.pipeline); @@ -110320,7 +110703,7 @@ var require_tar2 = __commonJS({ }); // node_modules/buffer-crc32/dist/index.cjs -var require_dist5 = __commonJS({ +var require_dist6 = __commonJS({ "node_modules/buffer-crc32/dist/index.cjs"(exports2, module2) { "use strict"; function getDefaultExportFromCjs(x) { @@ -110632,7 +111015,7 @@ var require_json = __commonJS({ "node_modules/@actions/artifact/node_modules/archiver/lib/plugins/json.js"(exports2, module2) { var inherits = require("util").inherits; var Transform5 = require_ours().Transform; - var crc325 = require_dist5(); + var crc325 = require_dist6(); var util3 = require_archiver_utils(); var Json2 = function(options) { if (!(this instanceof Json2)) { @@ -112267,7 +112650,7 @@ var require_dist_node2 = __commonJS({ return template.replace(/\/$/, ""); } } - function parse2(options) { + function parse3(options) { let method = options.method.toUpperCase(); let url2 = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}"); let headers = Object.assign({}, options.headers); @@ -112331,7 +112714,7 @@ var require_dist_node2 = __commonJS({ ); } function endpointWithDefaults2(defaults3, route, options) { - return parse2(merge2(defaults3, route, options)); + return parse3(merge2(defaults3, route, options)); } function withDefaults4(oldDefaults, newDefaults) { const DEFAULTS22 = merge2(oldDefaults, newDefaults); @@ -112340,7 +112723,7 @@ var require_dist_node2 = __commonJS({ DEFAULTS: DEFAULTS22, defaults: withDefaults4.bind(null, DEFAULTS22), merge: merge2.bind(null, DEFAULTS22), - parse: parse2 + parse: parse3 }); } var endpoint2 = withDefaults4(null, DEFAULTS2); @@ -116572,7 +116955,7 @@ var require_binary = __commonJS({ }); return stream2; }; - exports2.parse = function parse2(buffer) { + exports2.parse = function parse3(buffer) { var self2 = words(function(bytes, cb) { return function(name) { if (offset + bytes <= buffer.length) { @@ -162895,7 +163278,7 @@ async function checkProxyEnvironment(logger, language) { // src/start-proxy/reachability.ts var https2 = __toESM(require("https")); -var import_https_proxy_agent = __toESM(require_dist2()); +var import_https_proxy_agent = __toESM(require_dist3()); var connectionTestConfig = { nuget_feed: { path: "v3/index.json" } }; @@ -163367,6 +163750,13 @@ undici/lib/web/fetch/body.js: undici/lib/web/websocket/frame.js: (*! ws. MIT License. Einar Otto Stangvik *) +content-type/dist/index.js: + (*! + * content-type + * Copyright(c) 2015 Douglas Christopher Wilson + * MIT Licensed + *) + @octokit/request-error/dist-src/index.js: (* v8 ignore else -- @preserve -- Bug with vitest coverage where it sees an else branch that doesn't exist *) @@ -163374,6 +163764,9 @@ undici/lib/web/websocket/frame.js: (* v8 ignore next -- @preserve *) (* v8 ignore else -- @preserve *) +@octokit/graphql/dist-bundle/index.js: + (* v8 ignore if -- @preserve *) + normalize-path/index.js: (*! * normalize-path From 6dc633238e57053487f65e84d69cb5dae36b0cb2 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Wed, 12 Aug 2026 13:45:22 -0500 Subject: [PATCH 145/155] Bolster output-cache unit tests with more test cases --- src/cli/output-cache.test.ts | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts index b59044febe..c0f521556f 100644 --- a/src/cli/output-cache.test.ts +++ b/src/cli/output-cache.test.ts @@ -78,16 +78,21 @@ test.serial( const testValues = [ { cmd: "/path/to/codeql" }, - { cmd: "/path/to/codeql", version: {} }, - { cmd: "/path/to/codeql", version: { version: 2 } }, - { version: { version: "2.20.0" } }, + { entries: { version: { version: "2.20.0" } } }, + { cmd: "/path/to/codeql", entries: {} }, + { cmd: "/path/to/codeql", entries: { version: {} } }, + { cmd: "/path/to/codeql", entries: { version: null } }, + { cmd: "/path/to/codeql", entries: { version: "2.20.0" } }, + { cmd: "/path/to/codeql", entries: { version: { version: null } } }, + { cmd: "/path/to/codeql", entries: { version: { version: 2.2 } } }, + { cmd: "/path/to/codeql", entries: { version: { version: 2 } } }, { cmd: "/path/to/codeql", - version: { version: "2.20.0", overlayVersion: "1" }, + entries: { version: { version: "2.20.0", overlayVersion: "1" } }, }, { cmd: "/path/to/codeql", - version: { version: "2.20.0", features: "nope" }, + entries: { version: { version: "2.20.0", features: "nope" } }, }, ].map((v) => JSON.stringify(v)); From 951a133f96aa2114dd747e9e437305335d0bde16 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 10:59:59 +0000 Subject: [PATCH 146/155] Update changelog for v4.37.7 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1ed123883f..db809345bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.7 - 13 Aug 2026 - Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085) From 2d49edbac6e52dfa9519b8a3733d33c9528172eb Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Thu, 13 Aug 2026 08:12:50 -0500 Subject: [PATCH 147/155] Re-order `env` to be first argument for consistency --- lib/entry-points.js | 4 ++-- src/cli/output-cache.ts | 4 ++-- src/codeql.ts | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 60227987fd..fb7895a395 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146251,7 +146251,7 @@ var cachedCodeQlVersion = void 0; function getCommandCacheFilePath(env) { return import_path.default.join(getTemporaryDirectory(env), COMMAND_CACHE_FILENAME); } -function cacheCodeQlVersion(cmd, version, env) { +function cacheCodeQlVersion(env, cmd, version) { if (cachedCodeQlVersion !== void 0) { throw new Error("cacheCodeQlVersion() should be called only once"); } @@ -151883,7 +151883,7 @@ async function getCodeQLForCmd(cmd, checkVersion) { noStreamStdout: true } ); - cacheCodeQlVersion(cmd, result, getEnv()); + cacheCodeQlVersion(getEnv(), cmd, result); } return result; }, diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 05889a59ed..ec142da026 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -59,14 +59,14 @@ function getCommandCacheFilePath(env: Env): string { /** * Caches the CodeQL CLI version both in-memory and on disk. + * @param env The environment variables to use. * @param cmd The path to the CodeQL CLI. * @param version The version information to cache. - * @param env The environment variables to use. */ export function cacheCodeQlVersion( + env: Env, cmd: string, version: VersionInfo, - env: Env, ): void { if (cachedCodeQlVersion !== undefined) { throw new Error("cacheCodeQlVersion() should be called only once"); diff --git a/src/codeql.ts b/src/codeql.ts index bf91df9a8e..c9b9674bd9 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -499,7 +499,7 @@ async function getCodeQLForCmd( noStreamStdout: true, }, ); - outputCache.cacheCodeQlVersion(cmd, result, getEnv()); + outputCache.cacheCodeQlVersion(getEnv(), cmd, result); } return result; }, From 1158e1c92a62974686b7f0e45894da8082a21ec5 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:30:28 +0000 Subject: [PATCH 148/155] Update changelog and version after v4.37.7 --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index db809345bc..628e41f689 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. +## [UNRELEASED] + +No user facing changes. + ## 4.37.7 - 13 Aug 2026 - Update default CodeQL bundle version to [2.26.3](https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3). [#4085](https://github.com/github/codeql-action/pull/4085) diff --git a/package-lock.json b/package-lock.json index 50ebd990cd..6a74ca0270 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codeql", - "version": "4.37.7", + "version": "4.37.8", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codeql", - "version": "4.37.7", + "version": "4.37.8", "license": "MIT", "workspaces": [ "pr-checks" diff --git a/package.json b/package.json index 17229b4b7b..4e5d1410ce 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codeql", - "version": "4.37.7", + "version": "4.37.8", "private": true, "description": "CodeQL action", "scripts": { From 053d41e61eb7add0b12396d74c99272a5ab512de Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 13:30:41 +0000 Subject: [PATCH 149/155] Rebuild --- lib/entry-points.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index af11ed2bb8..d9c0b0e552 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146062,7 +146062,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) { return path2.join(getTemporaryDirectory(env), PR_DIFF_RANGE_JSON_FILENAME); } function getActionVersion() { - return "4.37.7"; + return "4.37.8"; } function getWorkflowEventName(env = getEnv()) { return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */); From 43250d671a78c42987337835cd6d6f95ac3d98b1 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Thu, 13 Aug 2026 08:59:09 -0500 Subject: [PATCH 150/155] Change cache key to string type to include CLI args --- lib/entry-points.js | 6 +++--- src/cli/output-cache.test.ts | 1 + src/cli/output-cache.ts | 29 +++++++++-------------------- 3 files changed, 13 insertions(+), 23 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index fb7895a395..e40d96fb3e 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146258,7 +146258,7 @@ function cacheCodeQlVersion(env, cmd, version) { cachedCodeQlVersion = version; const outputCache = { cmd, - entries: { ["version" /* Version */]: version } + entries: { version } }; fs3.writeFileSync( getCommandCacheFilePath(env), @@ -146285,7 +146285,7 @@ function getCachedCodeQlVersion(env, cmd) { if (!isOutputCache(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { return void 0; } - cachedCodeQlVersion = persisted.entries["version" /* Version */]; + cachedCodeQlVersion = persisted.entries.version; return cachedCodeQlVersion; } function isVersionInfo(x) { @@ -146294,7 +146294,7 @@ function isVersionInfo(x) { } function isOutputCache(x) { const candidate = x; - return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && candidate.entries !== void 0 && isVersionInfo(candidate.entries["version" /* Version */]); + return typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && candidate.entries !== void 0 && isVersionInfo(candidate.entries.version); } // src/config/pack-registries.ts diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts index c0f521556f..abb6dcf655 100644 --- a/src/cli/output-cache.test.ts +++ b/src/cli/output-cache.test.ts @@ -80,6 +80,7 @@ test.serial( { cmd: "/path/to/codeql" }, { entries: { version: { version: "2.20.0" } } }, { cmd: "/path/to/codeql", entries: {} }, + { cmd: "/path/to/codeql", entries: null }, { cmd: "/path/to/codeql", entries: { version: {} } }, { cmd: "/path/to/codeql", entries: { version: null } }, { cmd: "/path/to/codeql", entries: { version: "2.20.0" } }, diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index ec142da026..231392f7ab 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -9,25 +9,14 @@ import type { VersionInfo } from "./types"; /** * The keys of the command cache. Each key corresponds to a command whose output we cache. */ -export enum CommandCacheKey { - Version = "version", -} - -/** - * The mapping of CLI commands to the types of the output of each command that we cache. - */ -export type CommandCacheKeyOutputMap = { - [CommandCacheKey.Version]: VersionInfo; -}; +export type CommandCacheKey = string; /** * The type of the command cache that is persisted to disk. */ -export interface OutputCache { +export interface OutputCache { cmd: string; - entries: { - [P in K]: CommandCacheKeyOutputMap[K]; - }; + entries: Record; } /** @@ -74,8 +63,8 @@ export function cacheCodeQlVersion( cachedCodeQlVersion = version; const outputCache = { cmd, - entries: { [CommandCacheKey.Version]: version }, - } satisfies OutputCache; + entries: { version }, + } satisfies OutputCache; // Persist the version so that subsequent Actions steps, which run in separate // processes, can reuse it rather than invoking `codeql version` again. We // record the CLI path so that a different step using a different CodeQL bundle @@ -122,7 +111,7 @@ export function getCachedCodeQlVersion( } // Memoize the parsed value so that subsequent calls in this process don't // re-parse the environment variable. - cachedCodeQlVersion = persisted.entries[CommandCacheKey.Version]; + cachedCodeQlVersion = persisted.entries.version as VersionInfo; return cachedCodeQlVersion; } @@ -148,13 +137,13 @@ function isVersionInfo(x: unknown): x is VersionInfo { * Determines whether a value is a `OutputCache` object. * @param x The value to test */ -function isOutputCache(x: unknown): x is OutputCache { - const candidate = x as Partial> | null; +function isOutputCache(x: unknown): x is OutputCache { + const candidate = x as Partial | null; return ( typeof candidate === "object" && candidate !== null && typeof candidate.cmd === "string" && candidate.entries !== undefined && - isVersionInfo(candidate.entries[CommandCacheKey.Version]) + isVersionInfo(candidate.entries.version) ); } From c56f48e9bd458a387eb68a68534459e503e56b17 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Thu, 13 Aug 2026 09:14:00 -0500 Subject: [PATCH 151/155] Log unexpected conditions during caching CLI output --- lib/entry-points.js | 14 +++++++++----- src/cli/output-cache.test.ts | 20 +++++++++++++------- src/cli/output-cache.ts | 11 +++++++++-- src/codeql.ts | 2 +- src/status-report.ts | 2 +- 5 files changed, 33 insertions(+), 16 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 2891a1e18c..87aa76f571 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -146747,20 +146747,24 @@ function cacheCodeQlVersion(env, cmd, version) { "utf8" ); } -function getCachedCodeQlVersion(env, cmd) { +function getCachedCodeQlVersion(logger, env, cmd) { if (cachedCodeQlVersion !== void 0) { return cachedCodeQlVersion; } let serialized; try { serialized = fs3.readFileSync(getCommandCacheFilePath(env), "utf8"); - } catch { + } catch (e) { + logger.debug( + `Cannot read CLI-cache file ${getCommandCacheFilePath(env)}: ${e}` + ); return void 0; } let persisted; try { persisted = JSON.parse(serialized); - } catch { + } catch (e) { + logger.debug(`Cannot parse CLI-cache data as JSON: ${e}`); return void 0; } if (!isOutputCache(persisted) || cmd !== void 0 && persisted.cmd !== cmd) { @@ -147319,7 +147323,7 @@ async function createStatusReportBase(actionName, status, actionStartedAt, confi core7.exportVariable("CODEQL_WORKFLOW_STARTED_AT" /* WORKFLOW_STARTED_AT */, workflowStartedAt); } const runnerOs = getRequiredEnvParam("RUNNER_OS"); - const codeQlCliVersion = getCachedCodeQlVersion(getEnv()); + const codeQlCliVersion = getCachedCodeQlVersion(logger, getEnv()); const actionRef = process.env["GITHUB_ACTION_REF"] || ""; const testingEnvironment = getTestingEnvironment(); if (testingEnvironment) { @@ -152339,7 +152343,7 @@ async function getCodeQLForCmd(logger, cmd, checkVersion) { return cmd; }, async getVersion() { - let result = getCachedCodeQlVersion(getEnv(), cmd); + let result = getCachedCodeQlVersion(logger, getEnv(), cmd); if (result === void 0) { result = await runCliJson( cmd, diff --git a/src/cli/output-cache.test.ts b/src/cli/output-cache.test.ts index abb6dcf655..d8d8629303 100644 --- a/src/cli/output-cache.test.ts +++ b/src/cli/output-cache.test.ts @@ -4,6 +4,7 @@ import path from "path"; import test from "ava"; import { EnvVar } from "../environment"; +import { getRunnerLogger } from "../logging"; import { getTestEnv, setupTests } from "../testing-utils"; import * as util from "../util"; @@ -11,6 +12,8 @@ import * as outputCache from "./output-cache"; setupTests(test); +const logger = getRunnerLogger(true); + test.serial( "getCachedCodeQlVersion reuses a version persisted by an earlier step", async (t) => { @@ -25,9 +28,12 @@ test.serial( "utf8", ); const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); - t.deepEqual(outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), { - version: "2.20.0", - }); + t.deepEqual( + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), + { + version: "2.20.0", + }, + ); }); }, ); @@ -47,7 +53,7 @@ test.serial( ); const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); t.is( - outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), undefined, ); }); @@ -62,7 +68,7 @@ test.serial( fs.writeFileSync(cacheFile, "not valid json", "utf8"); const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); t.is( - outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), undefined, ); }); @@ -100,7 +106,7 @@ test.serial( for (const value of testValues) { fs.writeFileSync(cacheFile, value, "utf8"); t.is( - outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), undefined, value, ); @@ -114,7 +120,7 @@ test.serial("getCachedCodeQlVersion ignores non-existent file", async (t) => { const env = getTestEnv({ [EnvVar.TEMP]: tmpDir }); t.notThrows(() => { t.is( - outputCache.getCachedCodeQlVersion(env, "/path/to/codeql"), + outputCache.getCachedCodeQlVersion(logger, env, "/path/to/codeql"), undefined, ); }); diff --git a/src/cli/output-cache.ts b/src/cli/output-cache.ts index 231392f7ab..8bf8c27abe 100644 --- a/src/cli/output-cache.ts +++ b/src/cli/output-cache.ts @@ -3,6 +3,7 @@ import path from "path"; import { getTemporaryDirectory } from "../actions-util"; import { Env } from "../environment"; +import { Logger } from "../logging"; import type { VersionInfo } from "./types"; @@ -78,10 +79,12 @@ export function cacheCodeQlVersion( /** * Returns the cached CodeQL CLI version, if any. + * @param logger The logger to use for logging messages. * @param env The environment variables to use. * @param cmd The path to the CodeQL CLI. */ export function getCachedCodeQlVersion( + logger: Logger, env: Env, cmd?: string, ): undefined | VersionInfo { @@ -94,13 +97,17 @@ export function getCachedCodeQlVersion( let serialized: string; try { serialized = fs.readFileSync(getCommandCacheFilePath(env), "utf8"); - } catch { + } catch (e) { + logger.debug( + `Cannot read CLI-cache file ${getCommandCacheFilePath(env)}: ${e}`, + ); return undefined; } let persisted: unknown; try { persisted = JSON.parse(serialized); - } catch { + } catch (e) { + logger.debug(`Cannot parse CLI-cache data as JSON: ${e}`); return undefined; } if ( diff --git a/src/codeql.ts b/src/codeql.ts index 299061bd12..8f7e9e7445 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -491,7 +491,7 @@ async function getCodeQLForCmd( return cmd; }, async getVersion() { - let result = outputCache.getCachedCodeQlVersion(getEnv(), cmd); + let result = outputCache.getCachedCodeQlVersion(logger, getEnv(), cmd); if (result === undefined) { result = await runCliJson( cmd, diff --git a/src/status-report.ts b/src/status-report.ts index 043ff7b3c1..e61b04f9dd 100644 --- a/src/status-report.ts +++ b/src/status-report.ts @@ -376,7 +376,7 @@ export async function createStatusReportBase( core.exportVariable(EnvVar.WORKFLOW_STARTED_AT, workflowStartedAt); } const runnerOs = getRequiredEnvParam("RUNNER_OS"); - const codeQlCliVersion = getCachedCodeQlVersion(getEnv()); + const codeQlCliVersion = getCachedCodeQlVersion(logger, getEnv()); const actionRef = process.env["GITHUB_ACTION_REF"] || ""; const testingEnvironment = getTestingEnvironment(); // re-export the testing environment variable so that it is available to subsequent steps, From 45693cc6882bb175b58a06818c91876e201037c7 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 14 Aug 2026 11:53:32 +0100 Subject: [PATCH 152/155] Refactor `ENOSPC` check into `isDiskConfigurationError` function --- lib/entry-points.js | 8 +++++++- src/codeql.test.ts | 18 ++++++++++++++++++ src/codeql.ts | 18 ++++++++++++++++-- 3 files changed, 41 insertions(+), 3 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 56914e8848..c7f68a4b68 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -152288,6 +152288,12 @@ var CODEQL_NEXT_MINIMUM_VERSION = "2.20.7"; var GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.16"; var GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01"; var EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++"; +function isDiskConfigurationError(e) { + if (!(e instanceof Error)) { + return false; + } + return e.message.includes("ENOSPC"); +} async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) { try { const { @@ -152323,7 +152329,7 @@ async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliV }; } catch (rawError) { const e = wrapApiConfigurationError(rawError); - const ErrorClass = e instanceof ConfigurationError || e instanceof Error && e.message.includes("ENOSPC") ? ConfigurationError : Error; + const ErrorClass = e instanceof ConfigurationError || isDiskConfigurationError(e) ? ConfigurationError : Error; throw new ErrorClass( `Unable to download and extract CodeQL CLI: ${getErrorMessage(e)}${e instanceof Error && e.stack ? ` diff --git a/src/codeql.test.ts b/src/codeql.test.ts index e8208888e7..77cf5c35cd 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -51,6 +51,24 @@ test.beforeEach(() => { }); }); +test("isDiskConfigurationError - true for expected errors", async (t) => { + t.true( + codeql.isDiskConfigurationError(new Error("ENOSPC: Out of disk space")), + ); +}); + +test("isDiskConfigurationError - false for other errors", async (t) => { + t.false(codeql.isDiskConfigurationError("Not an Error instance")); + + const otherMessages = [ + "Does not contain an error code we test for", + "ENOSP: Not quite the full error code", + ]; + for (const otherMessage of otherMessages) { + t.false(codeql.isDiskConfigurationError(new Error(otherMessage))); + } +}); + async function installIntoToolcache({ apiDetails = SAMPLE_DOTCOM_API_DETAILS, cliVersion, diff --git a/src/codeql.ts b/src/codeql.ts index 8f7e9e7445..404819fb7f 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -273,6 +273,21 @@ const GHES_MOST_RECENT_DEPRECATION_DATE = "2026-07-01"; /** The CLI verbosity level to use for extraction in debug mode. */ const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++"; +/** + * Decides whether `e` is a disk-related error outside of our control + * that should be classified as a `ConfigurationError`. + * + * @param e The error to check. + * @returns True if the error should be treated as a `ConfigurationError` or false if not. + */ +export function isDiskConfigurationError(e: unknown): boolean { + if (!(e instanceof Error)) { + return false; + } + + return e.message.includes("ENOSPC"); // out of disk space +} + /** * Set up CodeQL CLI access. * @@ -343,8 +358,7 @@ export async function setupCodeQL( } catch (rawError) { const e = api.wrapApiConfigurationError(rawError); const ErrorClass = - e instanceof util.ConfigurationError || - (e instanceof Error && e.message.includes("ENOSPC")) // out of disk space + e instanceof util.ConfigurationError || isDiskConfigurationError(e) ? util.ConfigurationError : Error; From 47fa6222231b12097f83215dd7a6b4a0915841fd Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Fri, 14 Aug 2026 11:56:26 +0100 Subject: [PATCH 153/155] Make `EACCES` a `ConfigurationError` --- lib/entry-points.js | 6 +++++- src/codeql.test.ts | 7 +++++++ src/codeql.ts | 7 ++++++- 3 files changed, 18 insertions(+), 2 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index c7f68a4b68..c10b0ce2ea 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -152292,7 +152292,11 @@ function isDiskConfigurationError(e) { if (!(e instanceof Error)) { return false; } - return e.message.includes("ENOSPC"); + return ( + // out of disk space + e.message.includes("ENOSPC") || // access denied + e.message.includes("EACCES") + ); } async function setupCodeQL(toolsInput, apiDetails, tempDir, variant, defaultCliVersion, rawLanguages, useOverlayAwareDefaultCliVersion, features, logger, checkVersion) { try { diff --git a/src/codeql.test.ts b/src/codeql.test.ts index 77cf5c35cd..df4bafe295 100644 --- a/src/codeql.test.ts +++ b/src/codeql.test.ts @@ -55,6 +55,13 @@ test("isDiskConfigurationError - true for expected errors", async (t) => { t.true( codeql.isDiskConfigurationError(new Error("ENOSPC: Out of disk space")), ); + t.true( + codeql.isDiskConfigurationError( + new Error( + "EACCES: permission denied, mkdir /opt/hostedtoolcache/CodeQL/", + ), + ), + ); }); test("isDiskConfigurationError - false for other errors", async (t) => { diff --git a/src/codeql.ts b/src/codeql.ts index 404819fb7f..117b0d8e65 100644 --- a/src/codeql.ts +++ b/src/codeql.ts @@ -285,7 +285,12 @@ export function isDiskConfigurationError(e: unknown): boolean { return false; } - return e.message.includes("ENOSPC"); // out of disk space + return ( + // out of disk space + e.message.includes("ENOSPC") || + // access denied + e.message.includes("EACCES") + ); } /** From 1aef003397c876c0ab5bd118e1b1f34c175622e9 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Tue, 18 Aug 2026 12:09:33 +0100 Subject: [PATCH 154/155] Address review feedback on overlay disk flags Document each minimum disk feature flag individually and replace the tuple list with an explicit feature-to-threshold mapping. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- lib/entry-points.js | 20 +++++++++++--------- src/config-utils.ts | 31 ++++++++++++++----------------- src/feature-flags.ts | 26 ++++++++++++++++++++++---- 3 files changed, 47 insertions(+), 30 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 095350d51b..12bdf418f8 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -150143,14 +150143,14 @@ async function cachePrefix(codeql, language) { // src/config-utils.ts var OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14e3; -var OVERLAY_MINIMUM_DISK_SPACE_FEATURES = [ - ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */, 8e3], - ["overlay_analysis_min_disk_9_gb" /* OverlayAnalysisMinDisk9Gb */, 9e3], - ["overlay_analysis_min_disk_10_gb" /* OverlayAnalysisMinDisk10Gb */, 1e4], - ["overlay_analysis_min_disk_11_gb" /* OverlayAnalysisMinDisk11Gb */, 11e3], - ["overlay_analysis_min_disk_12_gb" /* OverlayAnalysisMinDisk12Gb */, 12e3], - ["overlay_analysis_min_disk_13_gb" /* OverlayAnalysisMinDisk13Gb */, 13e3] -]; +var OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE = { + ["overlay_analysis_min_disk_8_gb" /* OverlayAnalysisMinDisk8Gb */]: 8e3, + ["overlay_analysis_min_disk_9_gb" /* OverlayAnalysisMinDisk9Gb */]: 9e3, + ["overlay_analysis_min_disk_10_gb" /* OverlayAnalysisMinDisk10Gb */]: 1e4, + ["overlay_analysis_min_disk_11_gb" /* OverlayAnalysisMinDisk11Gb */]: 11e3, + ["overlay_analysis_min_disk_12_gb" /* OverlayAnalysisMinDisk12Gb */]: 12e3, + ["overlay_analysis_min_disk_13_gb" /* OverlayAnalysisMinDisk13Gb */]: 13e3 +}; var OVERLAY_MINIMUM_MEMORY_MB = 5 * 1024; var CODEQL_VERSION_REDUCED_OVERLAY_MEMORY_USAGE = "2.24.3"; async function getSupportedLanguageMap(codeql, logger) { @@ -150402,7 +150402,9 @@ async function checkOverlayAnalysisFeatureEnabled(features, codeql, languages, c } async function getMinimumDiskSpaceMb(features) { let minimumMb = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB; - for (const [feature, thresholdMb] of OVERLAY_MINIMUM_DISK_SPACE_FEATURES) { + for (const [feature, thresholdMb] of Object.entries( + OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE + )) { if (await features.getValue(feature)) { minimumMb = Math.min(minimumMb, thresholdMb); } diff --git a/src/config-utils.ts b/src/config-utils.ts index 6b9c41e3b4..0a6ced00aa 100644 --- a/src/config-utils.ts +++ b/src/config-utils.ts @@ -103,26 +103,21 @@ export { type Config } from "./config/action-config"; * variable. * * This threshold can be lowered by the feature flags in - * `OVERLAY_MINIMUM_DISK_SPACE_FEATURES`. + * `OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE`. */ const OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB = 14000; /** - * Feature flags that lower the minimum available disk space required to perform - * overlay analysis, paired with the threshold (in MB) that each one enables. - * - * If several of these are enabled, the lowest threshold takes effect. + * Minimum available disk space (in MB) enabled by each overlay feature flag. */ -const OVERLAY_MINIMUM_DISK_SPACE_FEATURES: ReadonlyArray< - [FeatureWithoutCLI, number] -> = [ - [Feature.OverlayAnalysisMinDisk8Gb, 8000], - [Feature.OverlayAnalysisMinDisk9Gb, 9000], - [Feature.OverlayAnalysisMinDisk10Gb, 10000], - [Feature.OverlayAnalysisMinDisk11Gb, 11000], - [Feature.OverlayAnalysisMinDisk12Gb, 12000], - [Feature.OverlayAnalysisMinDisk13Gb, 13000], -]; +const OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE = { + [Feature.OverlayAnalysisMinDisk8Gb]: 8000, + [Feature.OverlayAnalysisMinDisk9Gb]: 9000, + [Feature.OverlayAnalysisMinDisk10Gb]: 10000, + [Feature.OverlayAnalysisMinDisk11Gb]: 11000, + [Feature.OverlayAnalysisMinDisk12Gb]: 12000, + [Feature.OverlayAnalysisMinDisk13Gb]: 13000, +} satisfies Partial>; /** * The minimum memory (in MB) that must be available for CodeQL to perform overlay analysis. If @@ -606,8 +601,10 @@ async function getMinimumDiskSpaceMb( features: FeatureEnablement, ): Promise { let minimumMb = OVERLAY_MINIMUM_AVAILABLE_DISK_SPACE_MB; - for (const [feature, thresholdMb] of OVERLAY_MINIMUM_DISK_SPACE_FEATURES) { - if (await features.getValue(feature)) { + for (const [feature, thresholdMb] of Object.entries( + OVERLAY_MINIMUM_DISK_SPACE_MB_BY_FEATURE, + )) { + if (await features.getValue(feature as FeatureWithoutCLI)) { minimumMb = Math.min(minimumMb, thresholdMb); } } diff --git a/src/feature-flags.ts b/src/feature-flags.ts index 66532cd850..7abccf60cb 100644 --- a/src/feature-flags.ts +++ b/src/feature-flags.ts @@ -122,16 +122,34 @@ export enum Feature { */ OverlayAnalysisMatchCodeqlVersionDryRun = "overlay_analysis_match_codeql_version_dry_run", /** - * Feature flags that lower the amount of available disk space that the overlay hardware check - * requires. The lowest threshold that is enabled takes effect; if none are enabled, the default - * threshold applies. These flags have no effect if `OverlayAnalysisSkipResourceChecks` is - * enabled. + * Lowers the overlay minimum available disk space to 8 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. */ OverlayAnalysisMinDisk8Gb = "overlay_analysis_min_disk_8_gb", + /** + * Lowers the overlay minimum available disk space to 9 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ OverlayAnalysisMinDisk9Gb = "overlay_analysis_min_disk_9_gb", + /** + * Lowers the overlay minimum available disk space to 10 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ OverlayAnalysisMinDisk10Gb = "overlay_analysis_min_disk_10_gb", + /** + * Lowers the overlay minimum available disk space to 11 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ OverlayAnalysisMinDisk11Gb = "overlay_analysis_min_disk_11_gb", + /** + * Lowers the overlay minimum available disk space to 12 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ OverlayAnalysisMinDisk12Gb = "overlay_analysis_min_disk_12_gb", + /** + * Lowers the overlay minimum available disk space to 13 GB. The lowest enabled limit wins; if + * none are enabled, the default applies. + */ OverlayAnalysisMinDisk13Gb = "overlay_analysis_min_disk_13_gb", OverlayAnalysisPython = "overlay_analysis_python", OverlayAnalysisRuby = "overlay_analysis_ruby", From 1845f5ba8b4057590f49ee8e246c95ef2ba4b53f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 12:09:34 +0000 Subject: [PATCH 155/155] Update changelog for v4.37.8 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 628e41f689..4234855e52 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs. -## [UNRELEASED] +## 4.37.8 - 21 Aug 2026 No user facing changes.