Merge branch 'main' into update-bundle/codeql-bundle-v2.17.0

Author: cklin

CHANGELOG.md

@@ -7,6 +7,9 @@ Note that the only difference between `v2` and `v3` of the CodeQL Action is the
 ## [UNRELEASED]
 
 - Update default CodeQL bundle version to 2.17.0. [#2219](https://github.com/github/codeql-action/pull/2219)
+- Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. [#2220](https://github.com/github/codeql-action/pull/2220)
+  - If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
+  - Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace `github/codeql-action/*@v3` by `github/codeql-action/*@v3.24.10` and `github/codeql-action/*@v2` by `github/codeql-action/*@v2.24.10` in your code scanning workflow to ensure you continue using this version of the CodeQL Action.
 
 ## 3.24.9 - 22 Mar 2024
 

lib/api-compatibility.json

@@ -1 +1 @@
-{ "maximumVersion": "3.13", "minimumVersion": "3.8" }
+{ "maximumVersion": "3.13", "minimumVersion": "3.9" }

lib/codeql.js

@@ -1 +1 @@
-{"maximumVersion": "3.13", "minimumVersion": "3.8"}
+{"maximumVersion": "3.13", "minimumVersion": "3.9"}

lib/codeql.js.map

@@ -29,6 +29,7 @@ import {
   makeVersionInfo,
   createTestConfig,
 } from "./testing-utils";
+import { ToolsFeature } from "./tools-features";
 import * as util from "./util";
 import { initializeEnvironment } from "./util";
 
@@ -772,33 +773,34 @@ test("does not pass a qlconfig to the CLI when it is undefined", async (t: Execu
 
 const NEW_ANALYSIS_SUMMARY_TEST_CASES = [
   {
-    codeqlVersion: "2.15.0",
+    codeqlVersion: makeVersionInfo("2.15.0", {
+      [ToolsFeature.AnalysisSummaryV2IsDefault]: true,
+    }),
     githubVersion: {
       type: util.GitHubVariant.DOTCOM,
     },
-    flagPassed: true,
+    flagPassed: false,
     negativeFlagPassed: false,
   },
   {
-    codeqlVersion: "2.15.0",
+    codeqlVersion: makeVersionInfo("2.15.0"),
     githubVersion: {
-      type: util.GitHubVariant.GHES,
-      version: "3.9.0",
+      type: util.GitHubVariant.DOTCOM,
     },
     flagPassed: true,
     negativeFlagPassed: false,
   },
   {
-    codeqlVersion: "2.15.0",
+    codeqlVersion: makeVersionInfo("2.15.0"),
     githubVersion: {
       type: util.GitHubVariant.GHES,
-      version: "3.8.6",
+      version: "3.9.0",
     },
-    flagPassed: false,
-    negativeFlagPassed: true,
+    flagPassed: true,
+    negativeFlagPassed: false,
   },
   {
-    codeqlVersion: "2.14.6",
+    codeqlVersion: makeVersionInfo("2.14.6"),
     githubVersion: {
       type: util.GitHubVariant.DOTCOM,
     },
@@ -819,14 +821,12 @@ for (const {
       : negativeFlagPassed
       ? "--no-new-analysis-summary"
       : "nothing"
-  } for CodeQL CLI v${codeqlVersion} and ${
+  } for CodeQL version ${JSON.stringify(codeqlVersion)} and ${
     util.GitHubVariant[githubVersion.type]
   } ${githubVersion.version ? ` ${githubVersion.version}` : ""}`, async (t) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon
-      .stub(codeqlObject, "getVersion")
-      .resolves(makeVersionInfo(codeqlVersion));
+    sinon.stub(codeqlObject, "getVersion").resolves(codeqlVersion);
     // safeWhich throws because of the test CodeQL object.
     sinon.stub(safeWhich, "safeWhich").resolves("");
     await codeqlObject.databaseInterpretResults(

lib/codeql.test.js

@@ -280,17 +280,17 @@ const CODEQL_MINIMUM_VERSION = "2.11.6";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
-const CODEQL_NEXT_MINIMUM_VERSION = "2.11.6";
+const CODEQL_NEXT_MINIMUM_VERSION = "2.12.6";
 
 /**
  * This is the version of GHES that was most recently deprecated.
  */
-const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.7";
+const GHES_VERSION_MOST_RECENTLY_DEPRECATED = "3.8";
 
 /**
  * This is the deprecation date for the version of GHES that was most recently deprecated.
  */
-const GHES_MOST_RECENT_DEPRECATION_DATE = "2023-11-08";
+const GHES_MOST_RECENT_DEPRECATION_DATE = "2024-03-26";
 
 /** The CLI verbosity level to use for extraction in debug mode. */
 const EXTRACTION_DEBUG_MODE_VERBOSITY = "progress++";
@@ -890,20 +890,16 @@ export async function getCodeQLForCmd(
         codeqlArgs.push("--no-sarif-include-diagnostics");
       }
       if (
-        // Analysis summary v2 links to the status page, so check the GHES version we're running on
-        // supports the status page.
-        (config.gitHubVersion.type !== util.GitHubVariant.GHES ||
-          semver.gte(config.gitHubVersion.version, "3.9.0")) &&
         (await util.codeQlVersionAbove(
           this,
           CODEQL_VERSION_ANALYSIS_SUMMARY_V2,
-        ))
+        )) &&
+        !isSupportedToolsFeature(
+          await this.getVersion(),
+          ToolsFeature.AnalysisSummaryV2IsDefault,
+        )
       ) {
         codeqlArgs.push("--new-analysis-summary");
-      } else if (
-        await util.codeQlVersionAbove(this, CODEQL_VERSION_ANALYSIS_SUMMARY_V2)
-      ) {
-        codeqlArgs.push("--no-new-analysis-summary");
       }
       codeqlArgs.push(databasePath);
       if (querySuitePaths) {
@@ -1148,8 +1144,9 @@ export async function getCodeQLForCmd(
         "version of the CLI using the 'tools' input to the 'init' Action, you can remove this " +
         "input to use the default version.\n\n" +
         "Alternatively, if you want to continue using CodeQL CLI version " +
-        `${result.version}, you can replace 'github/codeql-action/*@v3' by ` +
-        `'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
+        `${result.version}, you can replace 'github/codeql-action/*@v${
+          getActionVersion().split(".")[0]
+        }' by 'github/codeql-action/*@v${getActionVersion()}' in your code scanning workflow to ` +
         "continue using this version of the CodeQL Action.",
     );
     core.exportVariable(EnvVar.SUPPRESS_DEPRECATED_SOON_WARNING, "true");

lib/codeql.test.js.map

@@ -1,6 +1,7 @@
 import type { VersionInfo } from "./codeql";
 
 export enum ToolsFeature {
+  AnalysisSummaryV2IsDefault = "analysisSummaryV2Default",
   BuildModeOption = "buildModeOption",
   IndirectTracingSupportsStaticBinaries = "indirectTracingSupportsStaticBinaries",
   InformsAboutUnsupportedPathFilters = "informsAboutUnsupportedPathFilters",