CHANGELOG.md

@@ -1,5 +1,9 @@
 # CodeQL Action Changelog
 
+## 1.1.12 - 01 Jun 2022
+
+- Update default CodeQL bundle version to 2.9.3. [#1084](https://github.com/github/codeql-action/pull/1084)
+
 ## 1.1.11 - 17 May 2022
 
 - Update default CodeQL bundle version to 2.9.2. [#1074](https://github.com/github/codeql-action/pull/1074)

README.md

@@ -139,10 +139,3 @@ By default, this will override any queries specified in a config file. If you wi
 
 Read about [troubleshooting code scanning](https://help.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning).
 
-### Note on "missing analysis" message
-
-The very first time code scanning is run and if it is on a pull request, you will probably get a message mentioning a "missing analysis". This is expected.
-
-After code scanning has analyzed the code in a pull request, it needs to compare the analysis of the topic branch (the merge commit of the branch you used to create the pull request) with the analysis of the base branch (the branch into which you want to merge the pull request). This allows code scanning to compute which alerts are newly introduced by the pull request, which alerts were already present in the base branch, and whether any existing alerts are fixed by the changes in the pull request. Initially, if you use a pull request to add code scanning to a repository, the base branch has not yet been analyzed, so it's not possible to compute these details. In this case, when you click through from the results check on the pull request you will see the "Missing analysis for base commit SHA-HASH" message.
-
-For more information and other causes of this message, see [Reasons for the "Analysis not found" message](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository#reasons-for-the-analysis-not-found-message)

lib/defaults.json

@@ -1,3 +1,3 @@
 {
-    "bundleVersion": "codeql-bundle-20220512"
+    "bundleVersion": "codeql-bundle-20220527"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "1.1.11",
+  "version": "1.1.12",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

src/codeql.test.ts

@@ -7,7 +7,10 @@ import nock from "nock";
 import * as sinon from "sinon";
 
 import * as codeql from "./codeql";
+import { Config } from "./config-utils";
 import * as defaults from "./defaults.json";
+import { createFeatureFlags, FeatureFlag } from "./feature-flags";
+import { Language } from "./languages";
 import { getRunnerLogger } from "./logging";
 import { setupTests, setupActionsVars } from "./testing-utils";
 import * as util from "./util";
@@ -425,6 +428,118 @@ test("databaseInterpretResults() sets --sarif-add-query-help for 2.7.1", async (
   );
 });
 
+const stubConfig: Config = {
+  languages: [Language.cpp],
+  queries: {},
+  pathsIgnore: [],
+  paths: [],
+  originalUserInput: {},
+  tempDir: "",
+  toolCacheDir: "",
+  codeQLCmd: "",
+  gitHubVersion: {
+    type: util.GitHubVariant.DOTCOM,
+  } as util.GitHubVersion,
+  dbLocation: "",
+  packs: {},
+  debugMode: false,
+  debugArtifactName: util.DEFAULT_DEBUG_ARTIFACT_NAME,
+  debugDatabaseName: util.DEFAULT_DEBUG_DATABASE_NAME,
+  injectedMlQueries: false,
+};
+
+test("databaseInitCluster() Lua feature flag enabled, but old CLI", async (t) => {
+  const runnerConstructorStub = stubToolRunnerConstructor();
+  const codeqlObject = await codeql.getCodeQLForTesting();
+  sinon.stub(codeqlObject, "getVersion").resolves("2.9.0");
+
+  await codeqlObject.databaseInitCluster(
+    stubConfig,
+    "",
+    undefined,
+    undefined,
+    createFeatureFlags([FeatureFlag.LuaTracerConfigEnabled])
+  );
+  t.false(
+    runnerConstructorStub.firstCall.args[1].includes(
+      "--internal-use-lua-tracing"
+    ),
+    "--internal-use-lua-tracing should be absent, but it is present"
+  );
+  t.false(
+    runnerConstructorStub.firstCall.args[1].includes(
+      "--no-internal-use-lua-tracing"
+    ),
+    "--no-internal-use-lua-tracing should be absent, but it is present"
+  );
+});
+
+test("databaseInitCluster() Lua feature flag disabled, with old CLI", async (t) => {
+  const runnerConstructorStub = stubToolRunnerConstructor();
+  const codeqlObject = await codeql.getCodeQLForTesting();
+  sinon.stub(codeqlObject, "getVersion").resolves("2.9.0");
+
+  await codeqlObject.databaseInitCluster(
+    stubConfig,
+    "",
+    undefined,
+    undefined,
+    createFeatureFlags([])
+  );
+  t.false(
+    runnerConstructorStub.firstCall.args[1].includes(
+      "--internal-use-lua-tracing"
+    ),
+    "--internal-use-lua-tracing should be absent, but it is present"
+  );
+  t.false(
+    runnerConstructorStub.firstCall.args[1].includes(
+      "--no-internal-use-lua-tracing"
+    ),
+    "--no-internal-use-lua-tracing should be absent, but it is present"
+  );
+});
+
+test("databaseInitCluster() Lua feature flag enabled, compatible CLI", async (t) => {
+  const runnerConstructorStub = stubToolRunnerConstructor();
+  const codeqlObject = await codeql.getCodeQLForTesting();
+  sinon.stub(codeqlObject, "getVersion").resolves("2.10.0");
+
+  await codeqlObject.databaseInitCluster(
+    stubConfig,
+    "",
+    undefined,
+    undefined,
+    createFeatureFlags([FeatureFlag.LuaTracerConfigEnabled])
+  );
+  t.true(
+    runnerConstructorStub.firstCall.args[1].includes(
+      "--internal-use-lua-tracing"
+    ),
+    "--internal-use-lua-tracing should be present, but it is absent"
+  );
+});
+
+test("databaseInitCluster() Lua feature flag disabled, compatible CLI", async (t) => {
+  const runnerConstructorStub = stubToolRunnerConstructor();
+  const codeqlObject = await codeql.getCodeQLForTesting();
+  sinon.stub(codeqlObject, "getVersion").resolves("2.10.0");
+
+  await codeqlObject.databaseInitCluster(
+    stubConfig,
+    "",
+    undefined,
+    undefined,
+    createFeatureFlags([])
+  );
+  t.true(
+    runnerConstructorStub.firstCall.args[1].includes(
+      "--no-internal-use-lua-tracing"
+    ),
+    "--no-internal-use-lua-tracing should be present, but it is absent"
+  );
+});
+
 function stubToolRunnerConstructor(): sinon.SinonStub<
   any[],
   toolrunner.ToolRunner

src/codeql.ts

@@ -12,6 +12,7 @@ import * as api from "./api-client";
 import { Config } from "./config-utils";
 import * as defaults from "./defaults.json"; // Referenced from codeql-action-sync-tool!
 import { errorMatchers } from "./error-matcher";
+import { FeatureFlags, FeatureFlag } from "./feature-flags";
 import { isTracedLanguage, Language } from "./languages";
 import { Logger } from "./logging";
 import * as toolcache from "./toolcache";
@@ -83,7 +84,8 @@ export interface CodeQL {
     config: Config,
     sourceRoot: string,
     processName: string | undefined,
-    processLevel: number | undefined
+    processLevel: number | undefined,
+    featureFlags: FeatureFlags
   ): Promise<void>;
   /**
    * Runs the autobuilder for the given language.
@@ -220,6 +222,7 @@ const CODEQL_VERSION_SARIF_GROUP = "2.5.3";
 export const CODEQL_VERSION_COUNTS_LINES = "2.6.2";
 const CODEQL_VERSION_CUSTOM_QUERY_HELP = "2.7.1";
 export const CODEQL_VERSION_ML_POWERED_QUERIES = "2.7.5";
+const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.9.3";
 
 /**
  * This variable controls using the new style of tracing from the CodeQL
@@ -726,7 +729,8 @@ async function getCodeQLForCmd(
       config: Config,
       sourceRoot: string,
       processName: string | undefined,
-      processLevel: number | undefined
+      processLevel: number | undefined,
+      featureFlags: FeatureFlags
     ) {
       const extraArgs = config.languages.map(
         (language) => `--language=${language}`
@@ -741,6 +745,15 @@ async function getCodeQLForCmd(
           // because that always passes in a process name.
           extraArgs.push(`--trace-process-level=${processLevel || 3}`);
         }
+        if (
+          await util.codeQlVersionAbove(this, CODEQL_VERSION_LUA_TRACER_CONFIG)
+        ) {
+          if (await featureFlags.getValue(FeatureFlag.LuaTracerConfigEnabled)) {
+            extraArgs.push("--internal-use-lua-tracing");
+          } else {
+            extraArgs.push("--no-internal-use-lua-tracing");
+          }
+        }
       }
       await runTool(cmd, [
         "database",

src/defaults.json

@@ -1,3 +1,3 @@
 {
-  "bundleVersion": "codeql-bundle-20220512"
+  "bundleVersion": "codeql-bundle-20220527"
 }

src/feature-flags.test.ts

@@ -121,7 +121,10 @@ test("Feature flags exception is propagated if the API request errors", async (t
   });
 });
 
-const FEATURE_FLAGS = ["ml_powered_queries_enabled"];
+const FEATURE_FLAGS = [
+  "ml_powered_queries_enabled",
+  "lua_tracer_config_enabled",
+];
 
 for (const featureFlag of FEATURE_FLAGS) {
   test(`Feature flag '${featureFlag}' is enabled if enabled in the API response`, async (t) => {
@@ -146,6 +149,9 @@ for (const featureFlag of FEATURE_FLAGS) {
         ml_powered_queries_enabled: await featureFlags.getValue(
           FeatureFlag.MlPoweredQueriesEnabled
         ),
+        lua_tracer_config_enabled: await featureFlags.getValue(
+          FeatureFlag.LuaTracerConfigEnabled
+        ),
       };
 
       t.deepEqual(actualFeatureFlags, expectedFeatureFlags);

src/feature-flags.ts

@@ -9,6 +9,7 @@ export interface FeatureFlags {
 
 export enum FeatureFlag {
   MlPoweredQueriesEnabled = "ml_powered_queries_enabled",
+  LuaTracerConfigEnabled = "lua_tracer_config_enabled",
 }
 
 /**

src/init-action.ts

@@ -257,7 +257,8 @@ async function run() {
       config,
       sourceRoot,
       "Runner.Worker.exe",
-      undefined
+      undefined,
+      featureFlags
     );
     if (tracerConfig !== undefined) {
       for (const [key, value] of Object.entries(tracerConfig.env)) {

src/init.ts

@@ -87,7 +87,8 @@ export async function runInit(
   config: configUtils.Config,
   sourceRoot: string,
   processName: string | undefined,
-  processLevel: number | undefined
+  processLevel: number | undefined,
+  featureFlags: FeatureFlags
 ): Promise<TracerConfig | undefined> {
   fs.mkdirSync(config.dbLocation, { recursive: true });
 
@@ -98,7 +99,8 @@ export async function runInit(
         config,
         sourceRoot,
         processName,
-        processLevel
+        processLevel,
+        featureFlags
       );
     } else {
       for (const language of config.languages) {

src/runner.ts

@@ -271,7 +271,8 @@ program
         config,
         sourceRoot,
         parseTraceProcessName(),
-        parseTraceProcessLevel()
+        parseTraceProcessLevel(),
+        createFeatureFlags([])
       );
       if (tracerConfig === undefined) {
         return;