Merge main into v1 #621
Merged
Merge main into v1 #621
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This input is exposed in the CodeQL CLI as the flag --source-root, allowing
users of the CLI to set --source-root different from --working-dir. However,
in codeql-action, these two paths are conflated and it poses problems for
users with complicated build environments, in which a source root may be
a child of the working directory.
Most users should not notice this, as the default value is
${{ github.workspace }}, as it is implied now (`path.resolve()`).
In the previous commit, the default value of the input is ${{ github.workspace }}
which means that most uses of this input would probably prefix their paths with
${{ github.workspace }}, especially since actions/checkout's 'path' input
must be under ${{ github.workspace }}. Therefore, it doesn't make much sense for
this to be an absolute file path.
Instead, it's more intuitive to make this relative to the repository.
It causes the action to break (or rather that context being unavailable causes it to fail), despite it being in the description field.
Previously, I had tried to refer to '${{ github.workspace }}', but that caused a problem in Actions. Trying to avoid the issue, I changed this to "the workspace," but this gives up quite a bit of specificity.
Co-authored-by: Arthur Baars <[email protected]>
Thanks to @aibaars, `path.resolve()` should will nicely handle more use-cases, namely absolute paths better than `path.join()`. Co-authored-by: Arthur Baars <[email protected]>
This addresses @adityasharad's suggestions in PR #607.
This config file 'ought to have some queries good for testing!
The test is not related to packaging. Co-authored-by: Aditya Sharad <[email protected]>
Moving the files into ../action was causing the job to fail because it couldn't find the test directory anymore. According to @adityasharad, these 'mv's should not be necessary. Removing these means changing the path to the actions. I'm also removing the 'config-file' input to keep the test minimal. I think this will mean that CodeQL will use the default query suite, so I hope that this doesn't change the results.
…tion into source-root-input
As this test is using only JS, it's not necessary to compile or analyze the other languages.
This is for PR #607, 'source-root' input test case.
Co-authored-by: Aditya Sharad <[email protected]>
Mergeback v1.0.5 refs/heads/v1 into main
Add a 'source-root' input to the init Action
Install Python tools on self-hosted runners
Update databases URL
Replace checkoutPath variable with sourceRoot/workspacePath variables
This adds some forced resolutions to ensure that vulnerable versions of packages are not installed.
Fix dependabot vulnerabilities
Minor formatting improvement.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Merging 3c8ba71 into v1
Conductor for this PR is @aeisenberg
Contains the following pull requests:
Please review the following: