Skip to content

Commit

Permalink
Showing 10 changed files with 58 additions and 38 deletions.
6 changes: 6 additions & 0 deletions lib/codeql.test.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion lib/codeql.test.js.map

Large diffs are not rendered by default.

21 changes: 3 additions & 18 deletions lib/runner.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion lib/runner.js.map

Large diffs are not rendered by default.

16 changes: 16 additions & 0 deletions lib/util.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion lib/util.js.map

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion queries/unguarded-action-lib.ql
@@ -65,7 +65,7 @@ class RunnerEntrypoint extends Function {
* Does this runner entry point set the RUNNER_TEMP and
* RUNNER_TOOL_CACHE env vars which make some actions libraries
* safe to use outside of actions.
* See "setupActionsVars" in "runner.ts".
* See "setupActionsVars" in "util.ts".
*/
predicate setsActionsEnvVars() {
// This is matching code of the following format, where "this"
12 changes: 12 additions & 0 deletions src/codeql.test.ts
@@ -24,6 +24,8 @@ const sampleGHAEApiDetails = {

test("download codeql bundle cache", async (t) => {
await util.withTmpDir(async (tmpDir) => {
util.setupActionsVars(tmpDir, tmpDir);

const versions = ["20200601", "20200610"];

for (let i = 0; i < versions.length; i++) {
@@ -56,6 +58,8 @@ test("download codeql bundle cache", async (t) => {

test("download codeql bundle cache explicitly requested with pinned different version cached", async (t) => {
await util.withTmpDir(async (tmpDir) => {
util.setupActionsVars(tmpDir, tmpDir);

nock("https://example.com")
.get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
.replyWithFile(
@@ -96,6 +100,8 @@ test("download codeql bundle cache explicitly requested with pinned different ve

test("don't download codeql bundle cache with pinned different version cached", async (t) => {
await util.withTmpDir(async (tmpDir) => {
util.setupActionsVars(tmpDir, tmpDir);

nock("https://example.com")
.get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
.replyWithFile(
@@ -131,6 +137,8 @@ test("don't download codeql bundle cache with pinned different version cached",

test("download codeql bundle cache with different version cached (not pinned)", async (t) => {
await util.withTmpDir(async (tmpDir) => {
util.setupActionsVars(tmpDir, tmpDir);

nock("https://example.com")
.get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
.replyWithFile(
@@ -181,6 +189,8 @@ test("download codeql bundle cache with different version cached (not pinned)",

test('download codeql bundle cache with pinned different version cached if "latests" tools specified', async (t) => {
await util.withTmpDir(async (tmpDir) => {
util.setupActionsVars(tmpDir, tmpDir);

nock("https://example.com")
.get(`/download/codeql-bundle-20200601/codeql-bundle.tar.gz`)
.replyWithFile(
@@ -232,6 +242,8 @@ test('download codeql bundle cache with pinned different version cached if "late

test("download codeql bundle from github ae endpoint", async (t) => {
await util.withTmpDir(async (tmpDir) => {
util.setupActionsVars(tmpDir, tmpDir);

const bundleAssetID = 10;

const platform =
17 changes: 1 addition & 16 deletions src/runner.ts
@@ -21,6 +21,7 @@ import {
getThreadsFlag,
parseGithubUrl,
getGitHubAuth,
setupActionsVars,
} from "./util";

const program = new Command();
@@ -86,22 +87,6 @@ function parseTraceProcessLevel(): number | undefined {
return undefined;
}

// Sets environment variables that make using some libraries designed for
// use only on actions safe to use outside of actions.
//
// Obviously this is not a tremendously great thing we're doing and it
// would be better to write our own implementation of libraries to use
// outside of actions. For now this works well enough.
//
// Currently this list of libraries that is deemed to now be safe includes:
// - @actions/tool-cache
//
// Also see "queries/unguarded-action-lib.ql".
function setupActionsVars(tempDir: string, toolsDir: string) {
process.env["RUNNER_TEMP"] = tempDir;
process.env["RUNNER_TOOL_CACHE"] = toolsDir;
}

interface InitArgs {
languages: string | undefined;
queries: string | undefined;
16 changes: 16 additions & 0 deletions src/util.ts
@@ -390,3 +390,19 @@ export async function getGitHubAuth(
"No GitHub authentication token was specified. Please provide a token via the GITHUB_TOKEN environment variable, or by adding the `--github-auth-stdin` flag and passing the token via standard input."
);
}

// Sets environment variables that make using some libraries designed for
// use only on actions safe to use outside of actions.
//
// Obviously this is not a tremendously great thing we're doing and it
// would be better to write our own implementation of libraries to use
// outside of actions. For now this works well enough.
//
// Currently this list of libraries that is deemed to now be safe includes:
// - @actions/tool-cache
//
// Also see "queries/unguarded-action-lib.ql".
export function setupActionsVars(tempDir: string, toolsDir: string) {
process.env["RUNNER_TEMP"] = tempDir;
process.env["RUNNER_TOOL_CACHE"] = toolsDir;
}

0 comments on commit 378f30f

Please sign in to comment.