Move check-codescanning-config/index.ts to pr-checks and add tests

Author: mbg

.github/actions/check-codescanning-config/action.yml

@@ -54,16 +54,15 @@ runs:
       env:
         CODEQL_ACTION_TEST_MODE: 'true'
 
-    - name: Install dependencies
-      shell: bash
-      run: npm install --location=global ts-node js-yaml
-
     - name: Check config
-      working-directory: ${{ github.action_path }}
       shell: bash
       env:
         EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
-      run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
+      run: |
+        npx tsx ts-node ../action/pr-checks/check-cs-config.ts \
+          --file "$RUNNER_TEMP/user-config.yaml" \
+          --expected-contents "$EXPECTED_CONFIG_FILE_CONTENTS"
+
     - name: Clean up
       shell: bash
       if: always()

.github/actions/check-codescanning-config/index.ts

@@ -0,0 +1,68 @@
+/**
+ * Tests for `check-cs-config.ts`.
+ */
+
+import * as assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import type { UserConfig } from "../src/config/db-config";
+
+import { checkConfiguration } from "./check-cs-config";
+
+describe("checkConfiguration", async () => {
+  await it("passes when actual and expected configs match", () => {
+    const actual: UserConfig = { name: "test-config", paths: ["src"] };
+    const expected = JSON.stringify(actual);
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("passes when queries arrays match after sorting", () => {
+    const actual: UserConfig = { paths: ["b", "a", "c"] };
+    const expected = JSON.stringify(actual);
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("throws when actual config does not match expected", () => {
+    const actual: UserConfig = { name: "actual-name" };
+    const expected = JSON.stringify({
+      name: "expected-name",
+    } satisfies UserConfig);
+    assert.throws(() => checkConfiguration(actual, expected), {
+      message: /Expected configuration does not match actual configuration/,
+    });
+  });
+
+  await it("throws when expected contents are empty", () => {
+    assert.throws(() => checkConfiguration({}, ""), {
+      message: /No expected configuration provided/,
+    });
+  });
+
+  await it("throws when expected contents are only whitespace", () => {
+    assert.throws(() => checkConfiguration({}, "   "), {
+      message: /No expected configuration provided/,
+    });
+  });
+
+  await it("passes with complex config", () => {
+    const actual: UserConfig = {
+      name: "complex",
+      "disable-default-queries": true,
+      paths: ["src", "lib"],
+      "paths-ignore": ["test"],
+      "threat-models": ["remote"],
+    };
+    const expected = JSON.stringify(actual);
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("trims whitespace from expected contents before parsing", () => {
+    const actual: UserConfig = { name: "trimmed" };
+    const expected = `  ${JSON.stringify(actual)}  `;
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("passes when both configs are empty objects", () => {
+    assert.doesNotThrow(() => checkConfiguration({}, "{}"));
+  });
+});

pr-checks/check-cs-config.test.ts

@@ -0,0 +1,100 @@
+#!/usr/bin/env npx tsx
+
+/**
+ * Checks the code scanning configuration file generated by the
+ * action to ensure it contains the expected contents
+ */
+
+import * as assert from "node:assert";
+import * as fs from "node:fs";
+import { parseArgs } from "node:util";
+
+import * as core from "@actions/core";
+import * as yaml from "js-yaml";
+
+import type { UserConfig } from "../src/config/db-config";
+
+import { getErrorMessage } from "./util";
+
+function sortConfigArrays(config: UserConfig) {
+  for (const key of Object.keys(config)) {
+    const value = config[key];
+    if (key === "queries" && Array.isArray(value)) {
+      config[key] = value.sort();
+    }
+  }
+  return config;
+}
+
+function loadActualConfig(configPath: string) {
+  if (!fs.existsSync(configPath)) {
+    throw new Error("No configuration file found");
+  } else {
+    const rawActualConfig = fs.readFileSync(configPath, "utf8");
+    core.startGroup("Actual generated user config");
+    core.info(rawActualConfig);
+    core.endGroup();
+
+    return yaml.load(rawActualConfig) as UserConfig;
+  }
+}
+
+export function checkConfiguration(
+  actualConfig: UserConfig,
+  expectedContents: string,
+) {
+  const rawExpectedConfig = expectedContents.trim();
+  if (!rawExpectedConfig) {
+    throw new Error("No expected configuration provided");
+  }
+
+  const expectedConfig = JSON.parse(rawExpectedConfig) as UserConfig;
+
+  core.startGroup("Expected generated user config");
+  core.info(yaml.dump(expectedConfig));
+  core.endGroup();
+
+  assert.deepStrictEqual(
+    sortConfigArrays(actualConfig),
+    sortConfigArrays(expectedConfig),
+    "Expected configuration does not match actual configuration",
+  );
+}
+
+function main() {
+  const { values } = parseArgs({
+    options: {
+      // The path of the configuration file to check.
+      file: {
+        type: "string",
+      },
+      // The expected contents of the file.
+      "expected-contents": {
+        type: "string",
+      },
+    },
+    strict: true,
+  });
+
+  if (values.file === undefined) {
+    throw new Error("The '--file' input is required.");
+  }
+  if (values["expected-contents"] === undefined) {
+    throw new Error("The '--expected-contents' input is required.");
+  }
+
+  const actualConfig = loadActualConfig(values.file);
+
+  try {
+    checkConfiguration(actualConfig, values["expected-contents"]);
+  } catch (err) {
+    core.error(getErrorMessage(err));
+    return -1;
+  }
+
+  return 0;
+}
+
+if (require.main === module) {
+  process.exit(main());
+}