Merge remote-tracking branch 'origin/main' into vercel/pkg

the commit.
github · Aug 25, 2020 · c3c86d8 · c3c86d8
2 parents d6daa45 + ab457be
commit c3c86d8
Showing 38 changed files with 37 additions and 187 deletions.
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
@@ -24,6 +24,8 @@ jobs:
           >&2 echo "Failed: Repo should be clean before testing!"
           exit 1
         fi
+        # Wipe the lib directory incase there are extra unnecessary files in there
+        rm -rf lib
         # Generate the JavaScript files
         npm run-script build
         # Check that repo is still clean

diff --git a/analyze/action.yml b/analyze/action.yml
@@ -29,4 +29,4 @@ inputs:
     default: ${{ toJson(matrix) }}
 runs:
   using: 'node12'
-  main: '../lib/finalize-db.js'
+  main: '../lib/analyze-action.js'
diff --git a/autobuild/action.yml b/autobuild/action.yml
@@ -8,4 +8,4 @@ inputs:
     default: ${{ toJson(matrix) }}
 runs:
   using: 'node12'
-  main: '../lib/autobuild.js'
+  main: '../lib/autobuild-action.js'
diff --git a/init/action.yml b/init/action.yml
@@ -18,4 +18,4 @@ inputs:
     required: false
 runs:
   using: 'node12'
-  main: '../lib/setup-tracer.js'
+  main: '../lib/init-action.js'
diff --git a/lib/finalize-db.js → lib/analyze-action.js b/lib/finalize-db.js → lib/analyze-action.js
diff --git a/lib/analyze-action.js.map b/lib/analyze-action.js.map
diff --git a/lib/autobuild.js → lib/autobuild-action.js b/lib/autobuild.js → lib/autobuild-action.js
diff --git a/lib/autobuild-action.js.map b/lib/autobuild-action.js.map
diff --git a/lib/autobuild.js.map b/lib/autobuild.js.map
diff --git a/lib/config-utils.test.js b/lib/config-utils.test.js
diff --git a/lib/config-utils.test.js.map b/lib/config-utils.test.js.map
diff --git a/lib/external-queries.js b/lib/external-queries.js
diff --git a/lib/external-queries.js.map b/lib/external-queries.js.map
diff --git a/lib/external-queries.test.js b/lib/external-queries.test.js
diff --git a/lib/external-queries.test.js.map b/lib/external-queries.test.js.map
diff --git a/lib/finalize-db.js.map b/lib/finalize-db.js.map
diff --git a/lib/finalize-db.test.js b/lib/finalize-db.test.js
diff --git a/lib/finalize-db.test.js.map b/lib/finalize-db.test.js.map
diff --git a/lib/setup-tracer.js → lib/init-action.js b/lib/setup-tracer.js → lib/init-action.js
diff --git a/lib/init-action.js.map b/lib/init-action.js.map
diff --git a/lib/setup-tools.js b/lib/setup-tools.js
diff --git a/lib/setup-tools.js.map b/lib/setup-tools.js.map
diff --git a/lib/setup-tools.test.js b/lib/setup-tools.test.js
diff --git a/lib/setup-tools.test.js.map b/lib/setup-tools.test.js.map
diff --git a/lib/setup-tracer.js.map b/lib/setup-tracer.js.map
diff --git a/lib/test-utils.js b/lib/test-utils.js
diff --git a/lib/test-utils.js.map b/lib/test-utils.js.map
diff --git a/lib/upload-sarif.js → lib/upload-sarif-action.js b/lib/upload-sarif.js → lib/upload-sarif-action.js
diff --git a/lib/upload-sarif-action.js.map b/lib/upload-sarif-action.js.map
diff --git a/lib/upload-sarif.js.map b/lib/upload-sarif.js.map
diff --git a/src/finalize-db.ts → src/analyze-action.ts b/src/finalize-db.ts → src/analyze-action.ts
diff --git a/src/autobuild.ts → src/autobuild-action.ts b/src/autobuild.ts → src/autobuild-action.ts
diff --git a/src/config-utils.test.ts b/src/config-utils.test.ts
@@ -310,7 +310,7 @@ test("API client used when reading remote config", async t => {
     const spyGetContents = mockGetContents(dummyResponse);
 
     // Create checkout directory for remote queries repository
-    fs.mkdirSync(path.join(tmpDir, 'foo/bar'), { recursive: true });
+    fs.mkdirSync(path.join(tmpDir, 'foo/bar/dev'), { recursive: true });
 
     setInput('config-file', 'octo-org/codeql-config/config.yaml@main');
     setInput('languages', 'javascript');

diff --git a/src/external-queries.test.ts b/src/external-queries.test.ts
@@ -10,12 +10,13 @@ setupTests(test);
 
 test("checkoutExternalQueries", async t => {
   await util.withTmpDir(async tmpDir => {
+    const ref = "df4c6869212341b601005567381944ed90906b6b";
     await externalQueries.checkoutExternalRepository(
       "github/codeql-go",
-      "df4c6869212341b601005567381944ed90906b6b",
+      ref,
       tmpDir);
 
     // COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in the default branch
-    t.true(fs.existsSync(path.join(tmpDir, "github", "codeql-go", "COPYRIGHT")));
+    t.true(fs.existsSync(path.join(tmpDir, "github", "codeql-go", ref, "COPYRIGHT")));
   });
 });
diff --git a/src/external-queries.ts b/src/external-queries.ts
@@ -9,7 +9,13 @@ import * as path from 'path';
 export async function checkoutExternalRepository(repository: string, ref: string, tempDir: string): Promise<string> {
   core.info('Checking out ' + repository);
 
-  const checkoutLocation = path.join(tempDir, repository);
+  const checkoutLocation = path.join(tempDir, repository, ref);
+
+  if (!checkoutLocation.startsWith(tempDir)) {
+    // this still permits locations that mess with sibling repositories in `tempDir`, but that is acceptable
+    throw new Error(`'${repository}@${ref}' is not a valid repository and reference.`);
+  }
+
   if (!fs.existsSync(checkoutLocation)) {
     const repoURL = 'https://github.com/' + repository + '.git';
     await exec.exec('git', ['clone', repoURL, checkoutLocation]);

diff --git a/src/setup-tracer.ts → src/init-action.ts b/src/setup-tracer.ts → src/init-action.ts
diff --git a/src/upload-sarif.ts → src/upload-sarif-action.ts b/src/upload-sarif.ts → src/upload-sarif-action.ts
diff --git a/upload-sarif/action.yml b/upload-sarif/action.yml
@@ -16,4 +16,4 @@ inputs:
     default: ${{ toJson(matrix) }}
 runs:
   using: 'node12'
-  main: '../lib/upload-sarif.js'
+  main: '../lib/upload-sarif-action.js'