Merge remote-tracking branch 'origin/main' into simon-engledew/fast-fail

package.json

@@ -24,6 +24,7 @@
     "@actions/github": "^4.0.0",
     "@actions/http-client": "^1.0.8",
     "@actions/tool-cache": "^1.5.5",
+    "@chrisgavin/safe-which": "^1.0.2",
     "@octokit/plugin-retry": "^3.0.3",
     "@octokit/types": "^5.5.0",
     "commander": "^6.0.0",

src/actions-util.ts

@@ -2,6 +2,7 @@ import * as path from "path";
 
 import * as core from "@actions/core";
 import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
 
 import * as api from "./api-client";
 import * as sharedEnv from "./shared-environment";
@@ -75,17 +76,21 @@ export const getCommitOid = async function (): Promise<string> {
   // reported on the merge commit.
   try {
     let commitOid = "";
-    await new toolrunnner.ToolRunner("git", ["rev-parse", "HEAD"], {
-      silent: true,
-      listeners: {
-        stdout: (data) => {
-          commitOid += data.toString();
-        },
-        stderr: (data) => {
-          process.stderr.write(data);
+    await new toolrunnner.ToolRunner(
+      await safeWhich.safeWhich("git"),
+      ["rev-parse", "HEAD"],
+      {
+        silent: true,
+        listeners: {
+          stdout: (data) => {
+            commitOid += data.toString();
+          },
+          stderr: (data) => {
+            process.stderr.write(data);
+          },
         },
-      },
-    }).exec();
+      }
+    ).exec();
     return commitOid.trim();
   } catch (e) {
     core.info(

src/external-queries.test.ts

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 
 import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
 import test from "ava";
 
 import * as externalQueries from "./external-queries";
@@ -36,17 +37,21 @@ test("checkoutExternalQueries", async (t) => {
       ];
       console.log(`Running: git ${command.join(" ")}`);
       try {
-        await new toolrunnner.ToolRunner("git", command, {
-          silent: true,
-          listeners: {
-            stdout: (data) => {
-              stdout += data.toString();
+        await new toolrunnner.ToolRunner(
+          await safeWhich.safeWhich("git"),
+          command,
+          {
+            silent: true,
+            listeners: {
+              stdout: (data) => {
+                stdout += data.toString();
+              },
+              stderr: (data) => {
+                stderr += data.toString();
+              },
             },
-            stderr: (data) => {
-              stderr += data.toString();
-            },
-          },
-        }).exec();
+          }
+        ).exec();
       } catch (e) {
         console.log(`Command failed: git ${command.join(" ")}`);
         process.stderr.write(stderr);

src/external-queries.ts

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 
 import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
 
 import { Logger } from "./logging";
 
@@ -28,12 +29,12 @@ export async function checkoutExternalRepository(
 
   if (!fs.existsSync(checkoutLocation)) {
     const repoURL = `${githubUrl}/${repository}`;
-    await new toolrunnner.ToolRunner("git", [
+    await new toolrunnner.ToolRunner(await safeWhich.safeWhich("git"), [
       "clone",
       repoURL,
       checkoutLocation,
     ]).exec();
-    await new toolrunnner.ToolRunner("git", [
+    await new toolrunnner.ToolRunner(await safeWhich.safeWhich("git"), [
       `--work-tree=${checkoutLocation}`,
       `--git-dir=${checkoutLocation}/.git`,
       "checkout",

src/init.ts

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 
 import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
 
 import * as analysisPaths from "./analysis-paths";
 import { CodeQL, setupCodeQL } from "./codeql";
@@ -172,7 +173,7 @@ export async function injectWindowsTracer(
   fs.writeFileSync(injectTracerPath, script);
 
   await new toolrunnner.ToolRunner(
-    "powershell",
+    await safeWhich.safeWhich("powershell"),
     [
       "-ExecutionPolicy",
       "Bypass",
@@ -198,9 +199,10 @@ export async function installPythonDeps(codeql: CodeQL, logger: Logger) {
   if (process.env["ImageOS"] !== undefined) {
     try {
       if (process.platform === "win32") {
-        await new toolrunnner.ToolRunner("powershell", [
-          path.join(scriptsFolder, "install_tools.ps1"),
-        ]).exec();
+        await new toolrunnner.ToolRunner(
+          await safeWhich.safeWhich("powershell"),
+          [path.join(scriptsFolder, "install_tools.ps1")]
+        ).exec();
       } else {
         await new toolrunnner.ToolRunner(
           path.join(scriptsFolder, "install_tools.sh")
@@ -221,7 +223,7 @@ export async function installPythonDeps(codeql: CodeQL, logger: Logger) {
   try {
     const script = "auto_install_packages.py";
     if (process.platform === "win32") {
-      await new toolrunnner.ToolRunner("py", [
+      await new toolrunnner.ToolRunner(await safeWhich.safeWhich("py"), [
         "-3",
         path.join(scriptsFolder, script),
         path.dirname(codeql.getPath()),

src/toolrunner-error-catcher.ts

@@ -1,5 +1,6 @@
 import * as im from "@actions/exec/lib/interfaces";
 import * as toolrunnner from "@actions/exec/lib/toolrunner";
+import * as safeWhich from "@chrisgavin/safe-which";
 
 import { ErrorMatcher } from "./error-matcher";
 
@@ -47,11 +48,15 @@ export async function toolrunnerErrorCatcher(
   // we capture the original return code or error so that if no match is found we can duplicate the behavior
   let returnState: Error | number;
   try {
-    returnState = await new toolrunnner.ToolRunner(commandLine, args, {
-      ...options, // we want to override the original options, so include them first
-      listeners,
-      ignoreReturnCode: true, // so we can check for specific codes using the matchers
-    }).exec();
+    returnState = await new toolrunnner.ToolRunner(
+      await safeWhich.safeWhich(commandLine),
+      args,
+      {
+        ...options, // we want to override the original options, so include them first
+        listeners,
+        ignoreReturnCode: true, // so we can check for specific codes using the matchers
+      }
+    ).exec();
   } catch (e) {
     returnState = e;
   }