"use strict";

var __importStar = (this && this.__importStar) || function (mod) {

if (mod && mod.__esModule) return mod;

var result = {};

if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];

result["default"] = mod;

return result;

};

Object.defineProperty(exports, "__esModule", { value: true });

const core = __importStar(require("@actions/core"));

const exec = __importStar(require("@actions/exec"));

const fs = __importStar(require("fs"));

const os = __importStar(require("os"));

const path = __importStar(require("path"));

const api = __importStar(require("./api-client"));

const configUtils = __importStar(require("./config-utils"));

const sharedEnv = __importStar(require("./shared-environment"));

/**

* Should the current action be aborted?

*

* This method should be called at the start of all CodeQL actions and they

* should abort cleanly if this returns true without failing the action.

* This method will call `core.setFailed` if necessary.

*/

function should_abort(actionName, requireInitActionHasRun) {

// Check that required aspects of the environment are present

const ref = process.env['GITHUB_REF'];

if (ref === undefined) {

core.setFailed('GITHUB_REF must be set.');

return true;

}

// If the init action is required, then check the it completed successfully.

if (requireInitActionHasRun && process.env[sharedEnv.CODEQL_ACTION_INIT_COMPLETED] === undefined) {

core.setFailed('The CodeQL ' + actionName + ' action cannot be used unless the CodeQL init action is run first. Aborting.');

return true;

}

return false;

}

exports.should_abort = should_abort;

/**

* Get an environment parameter, but throw an error if it is not set.

*/

function getRequiredEnvParam(paramName) {

const value = process.env[paramName];

if (value === undefined || value.length === 0) {

throw new Error(paramName + ' environment variable must be set');

}

core.debug(paramName + '=' + value);

return value;

}

exports.getRequiredEnvParam = getRequiredEnvParam;

/**

* Gets the SHA of the commit that is currently checked out.

*/

async function getCommitOid() {

// Try to use git to get the current commit SHA. If that fails then

// log but otherwise silently fall back to using the SHA from the environment.

// The only time these two values will differ is during analysis of a PR when

// the workflow has changed the current commit to the head commit instead of

// the merge commit, which must mean that git is available.

// Even if this does go wrong, it's not a huge problem for the alerts to

// reported on the merge commit.

try {

let commitOid = '';

await exec.exec('git', ['rev-parse', 'HEAD'], {

silent: true,

listeners: {

stdout: (data) => { commitOid += data.toString(); },

stderr: (data) => { process.stderr.write(data); }

}

});

return commitOid.trim();

}

catch (e) {

core.info("Failed to call git to get current commit. Continuing with data from environment: " + e);

return getRequiredEnvParam('GITHUB_SHA');

}

}

exports.getCommitOid = getCommitOid;

/**

* Get the path of the currently executing workflow.

*/

async function getWorkflowPath() {

const repo_nwo = getRequiredEnvParam('GITHUB_REPOSITORY').split("/");

const owner = repo_nwo[0];

const repo = repo_nwo[1];

const run_id = Number(getRequiredEnvParam('GITHUB_RUN_ID'));

const apiClient = api.getApiClient();

const runsResponse = await apiClient.request('GET /repos/:owner/:repo/actions/runs/:run_id', {

owner,

repo,

run_id

});

const workflowUrl = runsResponse.data.workflow_url;

const workflowResponse = await apiClient.request('GET ' + workflowUrl);

return workflowResponse.data.path;

}

/**

* Get the analysis key paramter for the current job.

*

* This will combine the workflow path and current job name.

* Computing this the first time requires making requests to

* the github API, but after that the result will be cached.

*/

async function getAnalysisKey() {

let analysisKey = process.env[sharedEnv.CODEQL_ACTION_ANALYSIS_KEY];

if (analysisKey !== undefined) {

return analysisKey;

}

const workflowPath = await getWorkflowPath();

const jobName = getRequiredEnvParam('GITHUB_JOB');

analysisKey = workflowPath + ':' + jobName;

core.exportVariable(sharedEnv.CODEQL_ACTION_ANALYSIS_KEY, analysisKey);

return analysisKey;

}

exports.getAnalysisKey = getAnalysisKey;

/**

* Get the ref currently being analyzed.

*/

function getRef() {

// Will be in the form "refs/heads/master" on a push event

// or in the form "refs/pull/N/merge" on a pull_request event

const ref = getRequiredEnvParam('GITHUB_REF');

// For pull request refs we want to convert from the 'merge' ref

// to the 'head' ref, as that is what we want to analyse.

// There should have been some code earlier in the workflow to do

// the checkout, but we have no way of verifying that here.

const pull_ref_regex = /refs\/pull\/(\d+)\/merge/;

if (pull_ref_regex.test(ref)) {

return ref.replace(pull_ref_regex, 'refs/pull/$1/head');

}

else {

return ref;

}

}

exports.getRef = getRef;

/**

* Compose a StatusReport.

*

* @param actionName The name of the action, e.g. 'init', 'finish', 'upload-sarif'

* @param status The status. Must be 'success', 'failure', or 'starting'

* @param cause Cause of failure (only supply if status is 'failure')

* @param exception Exception (only supply if status is 'failure')

*/

async function createStatusReport(actionName, status, cause, exception) {

var _a, _b;

// If this is not the init action starting up or aborting then try to load the config.

// If it fails then carry because it's important to still send the status report.

let config = undefined;

if (actionName !== 'init' || (status !== 'starting' && status !== 'aborted')) {

try {

config = await configUtils.getConfig();

}

catch (e) {

core.error('Unable to load config: ' + e);

}

}

const commitOid = process.env['GITHUB_SHA'] || '';

const ref = getRef();

const workflowRunIDStr = process.env['GITHUB_RUN_ID'];

let workflowRunID = -1;

if (workflowRunIDStr) {

workflowRunID = parseInt(workflowRunIDStr, 10);

}

const workflowName = process.env['GITHUB_WORKFLOW'] || '';

const jobName = process.env['GITHUB_JOB'] || '';

const analysis_key = await getAnalysisKey();

const languages = ((_b = (_a = config) === null || _a === void 0 ? void 0 : _a.languages) === null || _b === void 0 ? void 0 : _b.join(',')) || "";

const startedAt = process.env[sharedEnv.CODEQL_ACTION_STARTED_AT] || new Date().toISOString();

core.exportVariable(sharedEnv.CODEQL_ACTION_STARTED_AT, startedAt);

let statusReport = {

workflow_run_id: workflowRunID,

workflow_name: workflowName,

job_name: jobName,

analysis_key: analysis_key,

languages: languages,

commit_oid: commitOid,

ref: ref,

action_name: actionName,

action_oid: "unknown",

started_at: startedAt,

status: status

};

// Add optional parameters

if (cause) {

statusReport.cause = cause;

}

if (exception) {

statusReport.exception = exception;

}

if (status === 'success' || status === 'failure' || status === 'aborted') {

statusReport.completed_at = new Date().toISOString();

}

let matrix = core.getInput('matrix');

if (matrix) {

statusReport.matrix_vars = matrix;

}

return statusReport;

}

/**

* Send a status report to the code_scanning/analysis/status endpoint.

*

* Returns the status code of the response to the status request.

*/

async function sendStatusReport(statusReport) {

const statusReportJSON = JSON.stringify(statusReport);

core.debug('Sending status report: ' + statusReportJSON);

const nwo = getRequiredEnvParam("GITHUB_REPOSITORY");

const [owner, repo] = nwo.split("/");

const statusResponse = await api.getApiClient().request('PUT /repos/:owner/:repo/code-scanning/analysis/status', {

owner: owner,

repo: repo,

data: statusReportJSON,

});

return statusResponse.status;

}

/**

* Send a status report that an action is starting.

*

* If the action is `init` then this also records the start time in the environment,

* and ensures that the analysed languages are also recorded in the envirenment.

*

* Returns true unless a problem occurred and the action should abort.

*/

async function reportActionStarting(action) {

const statusCode = await sendStatusReport(await createStatusReport(action, 'starting'));

// If the status report request fails with a 403 or a 404, then this is a deliberate

// message from the endpoint that the SARIF upload can be expected to fail too,

// so the action should fail to avoid wasting actions minutes.

//

// Other failure responses (or lack thereof) could be transitory and should not

// cause the action to fail.

if (statusCode === 403) {

core.setFailed('The repo on which this action is running is not opted-in to CodeQL code scanning.');

return false;

}

if (statusCode === 404) {

core.setFailed('Not authorized to used the CodeQL code scanning feature on this repo.');

return false;

}

return true;

}

exports.reportActionStarting = reportActionStarting;

/**

* Report that an action has failed.

*

* Note that the started_at date is always that of the `init` action, since

* this is likely to give a more useful duration when inspecting events.

*/

async function reportActionFailed(action, cause, exception) {

await sendStatusReport(await createStatusReport(action, 'failure', cause, exception));

}

exports.reportActionFailed = reportActionFailed;

/**

* Report that an action has succeeded.

*

* Note that the started_at date is always that of the `init` action, since

* this is likely to give a more useful duration when inspecting events.

*/

async function reportActionSucceeded(action) {

await sendStatusReport(await createStatusReport(action, 'success'));

}

exports.reportActionSucceeded = reportActionSucceeded;

/**

* Report that an action has been aborted.

*

* Note that the started_at date is always that of the `init` action, since

* this is likely to give a more useful duration when inspecting events.

*/

async function reportActionAborted(action, cause) {

await sendStatusReport(await createStatusReport(action, 'aborted', cause));

}

exports.reportActionAborted = reportActionAborted;

/**

* Get the array of all the tool names contained in the given sarif contents.

*

* Returns an array of unique string tool names.

*/

function getToolNames(sarifContents) {

const sarif = JSON.parse(sarifContents);

const toolNames = {};

for (const run of sarif.runs || []) {

const tool = run.tool || {};

const driver = tool.driver || {};

if (typeof driver.name === "string" && driver.name.length > 0) {

toolNames[driver.name] = true;

}

}

return Object.keys(toolNames);

}

exports.getToolNames = getToolNames;

// Creates a random temporary directory, runs the given body, and then deletes the directory.

// Mostly intended for use within tests.

async function withTmpDir(body) {

const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'codeql-action-'));

const realSubdir = path.join(tmpDir, 'real');

fs.mkdirSync(realSubdir);

const symlinkSubdir = path.join(tmpDir, 'symlink');

fs.symlinkSync(realSubdir, symlinkSubdir, 'dir');

const result = await body(symlinkSubdir);

fs.rmdirSync(tmpDir, { recursive: true });

return result;

}

exports.withTmpDir = withTmpDir;

/**

* Get the codeql `--ram` flag as configured by the `ram` input. If no value was

* specified, the total available memory will be used minus 256 MB.

*

* @returns string

*/

function getMemoryFlag() {

let memoryToUseMegaBytes;

const memoryToUseString = core.getInput("ram");

if (memoryToUseString) {

memoryToUseMegaBytes = Number(memoryToUseString);

if (Number.isNaN(memoryToUseMegaBytes) || memoryToUseMegaBytes <= 0) {

throw new Error("Invalid RAM setting \"" + memoryToUseString + "\", specified.");

}

}

else {

const totalMemoryBytes = os.totalmem();

const totalMemoryMegaBytes = totalMemoryBytes / (1024 * 1024);

const systemReservedMemoryMegaBytes = 256;

memoryToUseMegaBytes = totalMemoryMegaBytes - systemReservedMemoryMegaBytes;

}

return "--ram=" + Math.floor(memoryToUseMegaBytes);

}

exports.getMemoryFlag = getMemoryFlag;

/**

* Get the codeql `--threads` value specified for the `threads` input. The value

* defaults to 1. The value will be capped to the number of available CPUs.

*

* @returns string

*/

function getThreadsFlag() {

let numThreads = 1;

const numThreadsString = core.getInput("threads");

if (numThreadsString) {

numThreads = Number(numThreadsString);

if (Number.isNaN(numThreads)) {

throw new Error(`Invalid threads setting "${numThreadsString}", specified.`);

}

const maxThreads = os.cpus().length;

if (numThreads > maxThreads) {

numThreads = maxThreads;

}

const minThreads = -maxThreads;

if (numThreads < minThreads) {

numThreads = minThreads;

}

}

return `--threads=${numThreads}`;

}

exports.getThreadsFlag = getThreadsFlag;

//# sourceMappingURL=util.js.map