8000 Log a warning if SIP is disabled and CLI is < 2.15.1 · github/codeql-action@ab00339 · GitHub
[go: up one dir, main page]
Skip to content

Commit ab00339

Browse files
angelapwenangelapwen
committed
Log a warning if SIP is disabled and CLI is < 2.15.1
1 parent 366c5f9 commit ab00339

File tree

6 files changed

+82
-4
lines changed

6 files changed

+82
-4
lines changed

‎lib/init-action.js

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/init-action.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/init.js

Lines changed: 23 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/init.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/init-action.ts

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,13 @@ import {
2424
} from "./diagnostics";
2525
import { EnvVar } from "./environment";
2626
import { Feature, Features } from "./feature-flags";
27-
import { checkInstallPython311, initCodeQL, initConfig, runInit } from "./init";
27+
import {
28+
checkInstallPython311,
29+
initCodeQL,
30+
initConfig,
31+
isSipEnabled,
32+
runInit,
33+
} from "./init";
2834
import { Language } from "./languages";
2935
import { getActionsLogger, Logger } from "./logging";
3036
import { parseRepositoryNwo } from "./repository";
@@ -467,6 +473,18 @@ async function run() {
467473
}
468474
}
469475

476+
// For CLI versions <2.15.1, build tracing caused errors in MacOS ARM machines with
477+
// System Integrity Protection (SIP) disabled.
478+
if (
479+
!(await codeQlVersionAbove(codeql, "2.15.1")) &&
480+
process.platform === "darwin" &&
481+
!(await isSipEnabled(logger))
482+
) {
483+
logger.warning(
484+
"CodeQL versions 2.15.0 and lower are not supported on MacOS ARM machines with System Integrity Protection (SIP) disabled.",
485+
);
486+
}
487+
470488
// From 2.16.0 the default for the python extractor is to not perform any
471489
// dependency extraction. For versions before that, you needed to set this flag to
472490
// enable this behavior (supported since 2.13.1).

‎src/init.ts

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
import * as fs from "fs";
22
import * as path from "path";
33

4+
import * as exec from "@actions/exec/lib/exec";
45
import * as toolrunner from "@actions/exec/lib/toolrunner";
56
import * as safeWhich from "@chrisgavin/safe-which";
67

@@ -140,3 +141,33 @@ export async function checkInstallPython311(
140141
]).exec();
141142
}
142143
}
144+
145+
// For MacOS runners: runs `csrutil status` to determine whether System
146+
// Integrity Protection is enabled.
147+
export async function isSipEnabled(logger): Promise<boolean | undefined> {
148+
try {
149+
const sipStatusOutput = await exec.getExecOutput("csrutil status");
150+
if (sipStatusOutput.exitCode === 0) {
151+
if (
152+
sipStatusOutput.stdout.includes(
153+
"System Integrity Protection status: enabled.",
154+
)
155+
) {
156+
return true;
157+
}
158+
if (
159+
sipStatusOutput.stdout.includes(
160+
"System Integrity Protection status: disabled.",
161+
)
162+
) {
163+
return false;
164+
}
165+
}
166+
return undefined;
167+
} catch (e) {
168+
logger.warning(
169+
`Failed to determine if System Integrity Protection was enabled: ${e}`,
170+
);
171+
return undefined;
172+
}
173+
}

0 commit comments

Comments
 (0)
0