import * as fs from "fs";

import * as path from "path";

import * as core from "@actions/core";

import * as toolrunner from "@actions/exec/lib/toolrunner";

import * as yaml from "js-yaml";

import {

getActionVersion,

getOptionalInput,

isAnalyzingDefaultBranch,

} from "./actions-util";

import * as api from "./api-client";

import type { Config } from "./config-utils";

import { EnvVar } from "./environment";

import {

CODEQL_VERSION_INTRA_LAYER_PARALLELISM,

CODEQL_VERSION_ANALYSIS_SUMMARY_V2,

CodeQLDefaultVersionInfo,

Feature,

FeatureEnablement,

useCodeScanningConfigInCli,

CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,

} from "./feature-flags";

import { isTracedLanguage, Language } from "./languages";

import { Logger } from "./logging";

import * as setupCodeql from "./setup-codeql";

import * as util from "./util";

import { wrapError } from "./util";

type Options = Array<string | number | boolean>;

/**

* Extra command line options for the codeql commands.

*/

interface ExtraOptions {

"*"?: Options;

database?: {

"*"?: Options;

init?: Options;

"trace-command"?: Options;

analyze?: Options;

finalize?: Options;

};

resolve?: {

"*"?: Options;

extractor?: Options;

queries?: Options;

};

}

export class CommandInvocationError extends Error {

constructor(

cmd: string,

args: string[],

public exitCode: number,

public stderr: string,

public stdout: string,

) {

const prettyCommand = [cmd, ...args]

.map((x) => (x.includes(" ") ? `'${x}'` : x))

.join(" ");

const fatalErrors = extractFatalErrors(stderr);

const lastLine = stderr.trim().split("\n").pop()?.trim();

let error = fatalErrors

? ` and error was: ${fatalErrors.trim()}`

: lastLine

? ` and last log line was: ${lastLine}`

: "";

if (error[error.length - 1] !== ".") {

error += ".";

}

super(

`Encountered a fatal error while running "${prettyCommand}". ` +

`Exit code was ${exitCode}${error} See the logs for more details.`,

);

}

}

export interface CodeQL {

/**

* Get the path of the CodeQL executable.

*/

getPath(): string;

/**

* Get a string containing the semver version of the CodeQL executable.

*/

getVersion(): Promise<VersionInfo>;

/**

* Print version information about CodeQL.

*/

printVersion(): Promise<void>;

/**

* Run 'codeql database init --db-cluster'.

*/

databaseInitCluster(

config: Config,

sourceRoot: string,

processName: string | undefined,

features: FeatureEnablement,

qlconfigFile: string | undefined,

logger: Logger,

): Promise<void>;

/**

* Runs the autobuilder for the given language.

*/

runAutobuild(language: Language): Promise<void>;

/**

* Extract code for a scanned language using 'codeql database trace-command'

* and running the language extractor.

*/

extractScannedLanguage(config: Config, language: Language): Promise<void>;

/**

* Finalize a database using 'codeql database finalize'.

*/

finalizeDatabase(

databasePath: string,

threadsFlag: string,

memoryFlag: string,

): Promise<void>;

/**

* Run 'codeql resolve languages'.

*/

resolveLanguages(): Promise<ResolveLanguagesOutput>;

/**

* Run 'codeql resolve languages' with '--format=betterjson'.

*/

betterResolveLanguages(): Promise<BetterResolveLanguagesOutput>;

/**

* Run 'codeql resolve queries'.

*/

resolveQueries(

queries: string[],

extraSearchPath: string | undefined,

): Promise<ResolveQueriesOutput>;

/**

* Run 'codeql resolve build-environment'

*/

resolveBuildEnvironment(

workingDir: string | undefined,

language: string,

): Promise<ResolveBuildEnvironmentOutput>;

/**

* Run 'codeql pack download'.

*/

packDownload(

packs: string[],

qlconfigFile: string | undefined,

): Promise<PackDownloadOutput>;

/**

* Run 'codeql database cleanup'.

*/

databaseCleanup(databasePath: string, cleanupLevel: string): Promise<void>;

/**

* Run 'codeql database bundle'.

*/

databaseBundle(

databasePath: string,

outputFilePath: string,

dbName: string,

): Promise<void>;

/**

* Run 'codeql database run-queries'.

*

* @param optimizeForLastQueryRun Whether to apply additional optimization for

* the last database query run in the action.

* It is always safe to set it to false.

* It should be set to true only for the very

* last databaseRunQueries() call.

*/

databaseRunQueries(

databasePath: string,

extraSearchPath: string | undefined,

querySuitePath: string | undefined,

flags: string[],

optimizeForLastQueryRun: boolean,

features: FeatureEnablement,

): Promise<void>;

/**

* Run 'codeql database interpret-results'.

*/

databaseInterpretResults(

databasePath: string,

querySuitePaths: string[] | undefined,

sarifFile: string,

addSnippetsFlag: string,

threadsFlag: string,

verbosityFlag: string | undefined,

automationDetailsId: string | undefined,

config: Config,

features: FeatureEnablement,

logger: Logger,

): Promise<string>;

/**

* Run 'codeql database print-baseline'.

*/

databasePrintBaseline(databasePath: string): Promise<string>;

/**

* Run 'codeql database export-diagnostics'

*

* Note that the "--sarif-include-diagnostics" option is always used, as the command should

* only be run if the ExportDiagnosticsEnabled feature flag is on.

*/

databaseExportDiagnostics(

databasePath: string,

sarifFile: string,

automationDetailsId: string | undefined,

tempDir: string,

logger: Logger,

): Promise<void>;

/**

* Run 'codeql diagnostics export'.

*/

diagnosticsExport(

sarifFile: string,

automationDetailsId: string | undefined,

config: Config,

): Promise<void>;

/** Get the location of an extractor for the specified language. */

resolveExtractor(language: Language): Promise<string>;

}

export interface VersionInfo {

version: string;

features?: { [name: string]: boolean };

}

export interface ResolveLanguagesOutput {

[language: string]: [string];

}

export interface BetterResolveLanguagesOutput {

aliases?: {

[alias: string]: string;

};

extractors: {

[language: string]: [

{

extractor_root: string;

extractor_options?: any;

},

];

};

}

export interface ResolveQueriesOutput {

byLanguage: {

[language: string]: {

[queryPath: string]: {};

};

};

noDeclaredLanguage: {

[queryPath: string]: {};

};

multipleDeclaredLanguages: {

[queryPath: string]: {};

};

}

export interface ResolveBuildEnvironmentOutput {

configuration?: {

[language: string]: {

[key: string]: unknown;

};

};

}

export interface PackDownloadOutput {

packs: PackDownloadItem[];

}

interface PackDownloadItem {

name: string;

version: string;

packDir: string;

installResult: string;

}

/**

* Stores the CodeQL object, and is populated by `setupCodeQL` or `getCodeQL`.

* Can be overridden in tests using `setCodeQL`.

*/

let cachedCodeQL: CodeQL | undefined = undefined;

/**

* The oldest version of CodeQL that the Action will run with. This should be

* at least three minor versions behind the current version and must include the

* CLI versions shipped with each supported version of GHES.

*

* The version flags below can be used to conditionally enable certain features

* on versions newer than this.

*/

const CODEQL_MINIMUM_VERSION = "2.10.5";

/**

* This version will shortly become the oldest version of CodeQL that the Action will run with.

*/

const CODEQL_NEXT_MINIMUM_VERSION = "2.10.5";

/**

* This is the version of GHES that was most recently deprecated.

*/

const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.6";

/**

* This is the deprecation date for the version of GHES that was most recently deprecated.

*/

const GHES_MOST_RECENT_DEPRECATION_DATE = "2023-09-12";

/*

* Versions of CodeQL that version-flag certain functionality in the Action.

* For convenience, please keep these in descending order. Once a version

* flag is older than the oldest supported version above, it may be removed.

*/

const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";

/**

* Versions 2.11.1+ of the CodeQL Bundle include a `security-experimental` built-in query suite for

* each language.

*/

export const CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = "2.12.1";

/**

* Versions 2.12.3+ of the CodeQL CLI support exporting configuration information from a code

* scanning config file to SARIF.

*/

export const CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = "2.12.3";

/**

* Versions 2.12.4+ of the CodeQL CLI support the `--qlconfig-file` flag in calls to `database init`.

*/

export const CODEQL_VERSION_INIT_WITH_QLCONFIG = "2.12.4";

/**

* Versions 2.12.4+ of the CodeQL CLI provide a better error message when `database finalize`

* determines that no code has been found.

*/

export const CODEQL_VERSION_BETTER_NO_CODE_ERROR_MESSAGE = "2.12.4";

/**

* Versions 2.13.1+ of the CodeQL CLI fix a bug where diagnostics export could produce invalid SARIF.

*/

export const CODEQL_VERSION_DIAGNOSTICS_EXPORT_FIXED = "2.13.1";

/**

* Versions 2.13.4+ of the CodeQL CLI support the `resolve build-environment` command.

*/

export const CODEQL_VERSION_RESOLVE_ENVIRONMENT = "2.13.4";

/**

* Versions 2.14.2+ of the CodeQL CLI support language-specific baseline configuration.

*/

export const CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG = "2.14.2";

/**

* Versions 2.14.4+ of the CodeQL CLI support language aliasing.

*/

export const CODEQL_VERSION_LANGUAGE_ALIASING = "2.14.4";

/**

* Set up CodeQL CLI access.

*

* @param toolsInput

* @param apiDetails

* @param tempDir

* @param variant

* @param defaultCliVersion

* @param logger

* @param checkVersion Whether to check that CodeQL CLI meets the minimum

* version requirement. Must be set to true outside tests.

* @returns a { CodeQL, toolsVersion } object.

*/

export async function setupCodeQL(

toolsInput: string | undefined,

apiDetails: api.GitHubApiDetails,

tempDir: string,

variant: util.GitHubVariant,

defaultCliVersion: CodeQLDefaultVersionInfo,

logger: Logger,

checkVersion: boolean,

): Promise<{

codeql: CodeQL;

toolsDownloadDurationMs?: number;

toolsSource: setupCodeql.ToolsSource;

toolsVersion: string;

}> {

try {

const { codeqlFolder, toolsDownloadDurationMs, toolsSource, toolsVersion } =

await setupCodeql.setupCodeQLBundle(

toolsInput,

apiDetails,

tempDir,

variant,

defaultCliVersion,

logger,

);

let codeqlCmd = path.join(codeqlFolder, "codeql", "codeql");

if (process.platform === "win32") {

codeqlCmd += ".exe";

} else if (process.platform !== "linux" && process.platform !== "darwin") {

throw new Error(`Unsupported platform: ${process.platform}`);

}

cachedCodeQL = await getCodeQLForCmd(codeqlCmd, checkVersion);

return {

codeql: cachedCodeQL,

toolsDownloadDurationMs,

toolsSource,

toolsVersion,

};

} catch (e) {

throw new Error(

`Unable to download and extract CodeQL CLI: ${wrapError(e).message}`,

);

}

}

/**

* Use the CodeQL executable located at the given path.

*/

export async function getCodeQL(cmd: string): Promise<CodeQL> {

if (cachedCodeQL === undefined) {

cachedCodeQL = await getCodeQLForCmd(cmd, true);

}

return cachedCodeQL;

}

function resolveFunction<T>(

partialCodeql: Partial<CodeQL>,

methodName: string,

defaultImplementation?: T,

): T {

if (typeof partialCodeql[methodName] !== "function") {

if (defaultImplementation !== undefined) {

return defaultImplementation;

}

const dummyMethod = () => {

throw new Error(`CodeQL ${methodName} method not correctly defined`);

};

return dummyMethod as any;

}

return partialCodeql[methodName];

}

/**

* Set the functionality for CodeQL methods. Only for use in tests.

*

* Accepts a partial object and any undefined methods will be implemented

* to immediately throw an exception indicating which method is missing.

*/

export function setCodeQL(partialCodeql: Partial<CodeQL>): CodeQL {

cachedCodeQL = {

getPath: resolveFunction(partialCodeql, "getPath", () => "/tmp/dummy-path"),

getVersion: resolveFunction(

partialCodeql,

"getVersion",

() =>

new Promise((resolve) =>

resolve({

version: "1.0.0",

}),

),

),

printVersion: resolveFunction(partialCodeql, "printVersion"),

databaseInitCluster: resolveFunction(partialCodeql, "databaseInitCluster"),

runAutobuild: resolveFunction(partialCodeql, "runAutobuild"),

extractScannedLanguage: resolveFunction(

partialCodeql,

"extractScannedLanguage",

),

finalizeDatabase: resolveFunction(partialCodeql, "finalizeDatabase"),

resolveLanguages: resolveFunction(partialCodeql, "resolveLanguages"),

betterResolveLanguages: resolveFunction(

partialCodeql,

"betterResolveLanguages",

),

resolveQueries: resolveFunction(partialCodeql, "resolveQueries"),

resolveBuildEnvironment: resolveFunction(

partialCodeql,

"resolveBuildEnvironment",

),

packDownload: resolveFunction(partialCodeql, "packDownload"),

databaseCleanup: resolveFunction(partialCodeql, "databaseCleanup"),

databaseBundle: resolveFunction(partialCodeql, "databaseBundle"),

databaseRunQueries: resolveFunction(partialCodeql, "databaseRunQueries"),

databaseInterpretResults: resolveFunction(

partialCodeql,

"databaseInterpretResults",

),

databasePrintBaseline: resolveFunction(

partialCodeql,

"databasePrintBaseline",

),

databaseExportDiagnostics: resolveFunction(

partialCodeql,

"databaseExportDiagnostics",

),

diagnosticsExport: resolveFunction(partialCodeql, "diagnosticsExport"),

resolveExtractor: resolveFunction(partialCodeql, "resolveExtractor"),

};

return cachedCodeQL;

}

/**

* Get the cached CodeQL object. Should only be used from tests.

*

* TODO: Work out a good way for tests to get this from the test context

* instead of having to have this method.

*/

export function getCachedCodeQL(): CodeQL {

if (cachedCodeQL === undefined) {

// Should never happen as setCodeQL is called by testing-utils.setupTests

throw new Error("cachedCodeQL undefined");

}

return cachedCodeQL;

}

/**

* Get a real, newly created CodeQL instance for testing. The instance refers to

* a non-existent placeholder codeql command, so tests that use this function

* should also stub the toolrunner.ToolRunner constructor.

*/

export async function getCodeQLForTesting(

cmd = "codeql-for-testing",

): Promise<CodeQL> {

return getCodeQLForCmd(cmd, false);

}

/**

* Return a CodeQL object for CodeQL CLI access.

*

* @param cmd Path to CodeQL CLI

* @param checkVersion Whether to check that CodeQL CLI meets the minimum

* version requirement. Must be set to true outside tests.

* @returns A new CodeQL object

*/

export async function getCodeQLForCmd(

cmd: string,

checkVersion: boolean,

): Promise<CodeQL> {

const codeql: CodeQL = {

getPath() {

return cmd;

},

async getVersion() {

let result = util.getCachedCodeQlVersion();

if (result === undefined) {

const output = await runTool(cmd, ["version", "--format=json"]);

try {

result = JSON.parse(output) as VersionInfo;

} catch (err) {

throw Error(

`Invalid JSON output from \`version --format=json\`: ${output}`,

);

}

util.cacheCodeQlVersion(result);

}

return result;

},

async printVersion() {

await runTool(cmd, ["version", "--format=json"]);

},

async databaseInitCluster(

config: Config,

sourceRoot: string,

processName: string | undefined,

features: FeatureEnablement,

qlconfigFile: string | undefined,

logger: Logger,

) {

const extraArgs = config.languages.map(

(language) => `--language=${language}`,

);

if (config.languages.filter((l) => isTracedLanguage(l)).length > 0) {

extraArgs.push("--begin-tracing");

extraArgs.push(...(await getTrapCachingExtractorConfigArgs(config)));

extraArgs.push(`--trace-process-name=${processName}`);

}

// A code scanning config file is only generated if the CliConfigFileEnabled feature flag is enabled.

const codeScanningConfigFile = await generateCodeScanningConfig(

codeql,

config,

features,

logger,

);

// Only pass external repository token if a config file is going to be parsed by the CLI.

let externalRepositoryToken: string | undefined;

if (codeScanningConfigFile) {

externalRepositoryToken = getOptionalInput("external-repository-token");

extraArgs.push(`--codescanning-config=${codeScanningConfigFile}`);

if (externalRepositoryToken) {

extraArgs.push("--external-repository-token-stdin");

}

}

if (

qlconfigFile !== undefined &&

(await util.codeQlVersionAbove(this, CODEQL_VERSION_INIT_WITH_QLCONFIG))

) {

extraArgs.push(`--qlconfig-file=${qlconfigFile}`);

}

if (

await util.codeQlVersionAbove(

this,

CODEQL_VERSION_LANGUAGE_BASELINE_CONFIG,

)

) {

extraArgs.push("--calculate-language-specific-baseline");

}

if (

await features.getValue(Feature.SublanguageFileCoverageEnabled, this)

) {

extraArgs.push("--sublanguage-file-coverage");

} else if (

await util.codeQlVersionAbove(

this,

CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,

)

) {

extraArgs.push("--no-sublanguage-file-coverage");

}

await runTool(

cmd,

[

"database",

"init",

"--db-cluster",

config.dbLocation,

`--source-root=${sourceRoot}`,

...(await getLanguageAliasingArguments(this)),

...extraArgs,

...getExtraOptionsFromEnv(["database", "init"]),

],

{ stdin: externalRepositoryToken },

);

},

async runAutobuild(language: Language) {

const autobuildCmd = path.join(

await this.resolveExtractor(language),

"tools",

process.platform === "win32" ? "autobuild.cmd" : "autobuild.sh",

);

// Update JAVA_TOOL_OPTIONS to contain '-Dhttp.keepAlive=false'

// This is because of an issue with Azure pipelines timing out connections after 4 minutes

// and Maven not properly handling closed connections

// Otherwise long build processes will timeout when pulling down Java packages

// https://developercommunity.visualstudio.com/content/problem/292284/maven-hosted-agent-connection-timeout.html

const javaToolOptions = process.env["JAVA_TOOL_OPTIONS"] || "";

process.env["JAVA_TOOL_OPTIONS"] = [

...javaToolOptions.split(/\s+/),

"-Dhttp.keepAlive=false",

"-Dmaven.wagon.http.pool=false",

].join(" ");

// On macOS, System Integrity Protection (SIP) typically interferes with

// CodeQL build tracing of protected binaries.

// The usual workaround is to prefix `$CODEQL_RUNNER` to build commands:

// `$CODEQL_RUNNER` (not to be confused with the deprecated CodeQL Runner tool)

// points to a simple wrapper binary included with the CLI, and the extra layer of

// process indirection helps the tracer bypass SIP.

// The above SIP workaround is *not* needed here.

// At the `autobuild` step in the Actions workflow, we assume the `init` step

// has successfully run, and will have exported `DYLD_INSERT_LIBRARIES`

// into the environment of subsequent steps, to activate the tracer.

// When `DYLD_INSERT_LIBRARIES` is set in the environment for a step,

// the Actions runtime introduces its own workaround for SIP

// (https://github.com/actions/runner/pull/416).

await runTool(autobuildCmd);

},

async extractScannedLanguage(config: Config, language: Language) {

const databasePath = util.getCodeQLDatabasePath(config, language);

// Set trace command

const ext = process.platform === "win32" ? ".cmd" : ".sh";

const traceCommand = path.resolve(

await this.resolveExtractor(language),

"tools",

`autobuild${ext}`,

);

// Run trace command

await runTool(cmd, [

"database",

"trace-command",

...(await getTrapCachingExtractorConfigArgsForLang(config, language)),

...getExtraOptionsFromEnv(["database", "trace-command"]),

databasePath,

"--",

traceCommand,

]);

},

async finalizeDatabase(

databasePath: string,

threadsFlag: string,

memoryFlag: string,

) {

const args = [

"database",

"finalize",

"--finalize-dataset",

threadsFlag,

memoryFlag,

...getExtraOptionsFromEnv(["database", "finalize"]),

databasePath,

];

try {

await runTool(cmd, args);

} catch (e) {

if (

e instanceof CommandInvocationError &&

!(await util.codeQlVersionAbove(

this,

CODEQL_VERSION_BETTER_NO_CODE_ERROR_MESSAGE,

)) &&

isNoCodeFoundError(e)

) {

throw new util.UserError(

"No code found during the build. Please see: " +

"https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build",

);

}

throw e;

}

},

async resolveLanguages() {

const codeqlArgs = [

"resolve",

"languages",

"--format=json",

...getExtraOptionsFromEnv(["resolve", "languages"]),

];

const output = await runTool(cmd, codeqlArgs);

try {

return JSON.parse(output);

} catch (e) {

throw new Error(

`Unexpected output from codeql resolve languages: ${e}`,

);

}

},

async betterResolveLanguages() {

const codeqlArgs = [

"resolve",

"languages",

"--format=betterjson",

"--extractor-options-verbosity=4",

...(await getLanguageAliasingArguments(this)),

...getExtraOptionsFromEnv(["resolve", "languages"]),

];

const output = await runTool(cmd, codeqlArgs);

try {

return JSON.parse(output);

} catch (e) {

throw new Error(

`Unexpected output from codeql resolve languages with --format=betterjson: ${e}`,

);

}

},

async resolveQueries(

queries: string[],

extraSearchPath: string | undefined,

) {

const codeqlArgs = [

"resolve",

"queries",

...queries,

"--format=bylanguage",

...getExtraOptionsFromEnv(["resolve", "queries"]),

];

if (extraSearchPath !== undefined) {

codeqlArgs.push("--additional-packs", extraSearchPath);

}

const output = await runTool(cmd, codeqlArgs);

try {

return JSON.parse(output);

} catch (e) {

throw new Error(`Unexpected output from codeql resolve queries: ${e}`);

}

},

async resolveBuildEnvironment(

workingDir: string | undefined,

language: string,

) {

const codeqlArgs = [

"resolve",

"build-environment",

`--language=${language}`,

...(await getLanguageAliasingArguments(this)),

...getExtraOptionsFromEnv(["resolve", "build-environment"]),

];

if (workingDir !== undefined) {

codeqlArgs.push("--working-dir", workingDir);

}

const output = await runTool(cmd, codeqlArgs);

try {

return JSON.parse(output);

} catch (e) {

throw new Error(

`Unexpected output from codeql resolve build-environment: ${e} in\n${output}`,

);

}

},

async databaseRunQueries(

databasePath: string,

extraSearchPath: string | undefined,

querySuitePath: string | undefined,

flags: string[],

optimizeForLastQueryRun: boolean,

features: FeatureEnablement,

): Promise<void> {

const codeqlArgs = [

"database",

"run-queries",

...flags,

databasePath,

"--min-disk-free=1024", // Try to leave at least 1GB free

"-v",

...getExtraOptionsFromEnv(["database", "run-queries"]),

];

if (

optimizeForLastQueryRun &&

(await util.supportExpectDiscardedCache(this))

) {

codeqlArgs.push("--expect-discarded-cache");

}

if (extraSearchPath !== undefined) {

codeqlArgs.push("--additional-packs", extraSearchPath);

}

if (querySuitePath) {

codeqlArgs.push(querySuitePath);

}

if (

await features.getValue(

Feature.EvaluatorIntraLayerParallelismEnabled,

this,

)

) {

codeqlArgs.push("--intra-layer-parallelism");

} else if (

await util.codeQlVersionAbove(

this,

CODEQL_VERSION_INTRA_LAYER_PARALLELISM,

)

) {

codeqlArgs.push("--no-intra-layer-parallelism");

}

await runTool(cmd, codeqlArgs);

},

async databaseInterpretResults(

databasePath: string,

querySuitePaths: string[] | undefined,

sarifFile: string,

addSnippetsFlag: string,

threadsFlag: string,

verbosityFlag: string,

automationDetailsId: string | undefined,

config: Config,

features: FeatureEnablement,

logger: Logger,

): Promise<string> {

const shouldExportDiagnostics = await features.getValue(

Feature.ExportDiagnosticsEnabled,

this,

);

const shouldWorkaroundInvalidNotifications =

shouldExportDiagnostics &&

!(await isDiagnosticsExportInvalidSarifFixed(this));

const codeqlOutputFile = shouldWorkaroundInvalidNotifications

? path.join(config.tempDir, "codeql-intermediate-results.sarif")

: sarifFile;

const codeqlArgs = [

"database",

"interpret-results",

threadsFlag,

"--format=sarif-latest",

verbosityFlag,

`--output=${codeqlOutputFile}`,

addSnippetsFlag,

"--print-diagnostics-summary",

"--print-metrics-summary",

"--sarif-add-query-help",

"--sarif-group-rules-by-pack",

...(await getCodeScanningConfigExportArguments(config, this)),

...getExtraOptionsFromEnv(["database", "interpret-results"]),

];

if (automationDetailsId !== undefined) {

codeqlArgs.push("--sarif-category", automationDetailsId);

}

if (

await util.codeQlVersionAbove(

this,

CODEQL_VERSION_FILE_BASELINE_INFORMATION,

)

) {

codeqlArgs.push("--sarif-add-baseline-file-info");

}

if (

await features.getValue(Feature.SublanguageFileCoverageEnabled, this)

) {

codeqlArgs.push("--sublanguage-file-coverage");

} else if (

await util.codeQlVersionAbove(

this,

CODEQL_VERSION_SUBLANGUAGE_FILE_COVERAGE,

)

) {

codeqlArgs.push("--no-sublanguage-file-coverage");

}

if (shouldExportDiagnostics) {

codeqlArgs.push("--sarif-include-diagnostics");

} else if (await util.codeQlVersionAbove(this, "2.12.4")) {

codeqlArgs.push("--no-sarif-include-diagnostics");

}

if (await features.getValue(Feature.AnalysisSummaryV2Enabled, this)) {

codeqlArgs.push("--new-analysis-summary");

} else if (

await util.codeQlVersionAbove(this, CODEQL_VERSION_ANALYSIS_SUMMARY_V2)

) {

codeqlArgs.push("--no-new-analysis-summary");

}

codeqlArgs.push(databasePath);

if (querySuitePaths) {

codeqlArgs.push(...querySuitePaths);

}

// Capture the stdout, which contains the analysis summary. Don't stream it to the Actions

// logs to avoid printing it twice.

const analysisSummary = await runTool(cmd, codeqlArgs, {

noStreamStdout: true,

});

if (shouldWorkaroundInvalidNotifications) {

util.fixInvalidNotificationsInFile(codeqlOutputFile, sarifFile, logger);

}

return analysisSummary;

},

async databasePrintBaseline(databasePath: string): Promise<string> {

const codeqlArgs = [

"database",

"print-baseline",

...getExtraOptionsFromEnv(["database", "print-baseline"]),

databasePath,

];

return await runTool(cmd, codeqlArgs);

},

/**

* Download specified packs into the package cache. If the specified

* package and version already exists (e.g., from a previous analysis run),

* then it is not downloaded again (unless the extra option `--force` is

* specified).

*

* If no version is specified, then the latest version is

* downloaded. The check to determine what the latest version is is done

* each time this package is requested.

*

* Optionally, a `qlconfigFile` is included. If used, then this file

* is used to determine which registry each pack is downloaded from.

*/

async packDownload(

packs: string[],

qlconfigFile: string | undefined,

): Promise<PackDownloadOutput> {

const qlconfigArg = qlconfigFile

? [`--qlconfig-file=${qlconfigFile}`]

: ([] as string[]);

const codeqlArgs = [

"pack",

"download",

...qlconfigArg,

"--format=json",

"--resolve-query-specs",

...getExtraOptionsFromEnv(["pack", "download"]),

...packs,

];

const output = await runTool(cmd, codeqlArgs);

try {

const parsedOutput: PackDownloadOutput = JSON.parse(output);

if (

Array.isArray(parsedOutput.packs) &&

// TODO PackDownloadOutput will not include the version if it is not specified

// in the input. The version is always the latest version available.

// It should be added to the output, but this requires a CLI change