-
Notifications
You must be signed in to change notification settings - Fork 309
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ensure qlconfig file is created when config parsing in cli is on #1527
Conversation
8a54dcb
to
c7ecff7
Compare
I expect that |
b00e4e4
to
328773c
Compare
75fa980
to
826edd9
Compare
Note that even though the PR Check - Packaging: Download using registries jobs are passing, they are not actually testing what they should be. Because we are not using extra private PATs in this repository, we can't test on other registries. I will be creating an internal PR with an integration test. This PR also depends on a change to the CLI where we allow the |
Previously, with the config parsing in the cli feature flag turned on, the CLI was not able to download packs from other registries. This PR adds the codeql-action changes required for this. The CLI changes will be in a separate, internal PR.
826edd9
to
bbe8d37
Compare
This is ready for review, even though it is not complete until the associated change in the codeql cli is available. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks mostly good. Comments are mainly around maintainability and filling a few gaps in my knowledge.
Co-authored-by: Henry Mercer <henry.mercer@me.com>
999f341
to
3c81243
Compare
@henrymercer can you take another look? There is a minor semantic change. If a user explicitly sets a I think this provides a nice back door so that in case there are issues with the action not generating or passing the qlconfig or |
a5f7338
to
60afa75
Compare
60afa75
to
5492b7d
Compare
I'm going to hold off on merging this until the related PR on the CLI side is merged as well. The assumption here is that the feature will be enabled officially for v2.12.3, but we won't be certain until the CLI PR is merged. |
v2.12.3 is now available. I am picking this PR up again. |
@henrymercer, can you take another look? Nothing has changed since your last approval. |
lib/codeql.js
Outdated
@@ -98,6 +98,10 @@ exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = "2.10.3"; | |||
* Versions 2.11.1+ of the CodeQL Bundle include a `security-experimental` built-in query suite for each language. | |||
*/ | |||
exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = "2.12.1"; | |||
/** | |||
* Versions 2.12.3+ of the CodeQL CLI support the `--qlconfig` flag in calls to `database init`. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
* Versions 2.12.3+ of the CodeQL CLI support the `--qlconfig` flag in calls to `database init`. | |
* Versions 2.12.4+ of the CodeQL CLI support the `--qlconfig` flag in calls to `database init`. |
Thanks for the review. Addressed your comments and need another approvel. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Previously, with the config parsing in the cli feature flag turned on, the CLI was not able to download packs from other registries. This PR adds the codeql-action changes required for this. The CLI changes will be in a separate, internal PR.
This is a fix for a potential bug that has not yet been raised, so no changelog post is necessary.
Merge / deployment checklist