Trying these additional files
ADD
action.yml
+name: 'code-analysis'
+description: 'Run .NET code quality analysis and code style analysis shipping with the .NET SDK'
+author: 'GitHub'
+inputs:
+ build-breaking:
+ description: 'Boolean value indicating if code analysis violations should break the build'
+ required: true
+ solution:
+ description: 'Solution to analyze'
+ required: false
+ solutions:
+ description: 'Semi-colon separated list of solutions to analyze'
+ required: false
+ project:
+ description: 'Project to analyze'
+ required: false
+ projects:
+ description: 'Semi-colon separated list of projects to analyze'
+ required: false
+ all-categories: # AnalysisLevel: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Default analysis level and analysis mode for all rules'
+ required: false
+ default: 'latest-minimum'
+ style: # AnalysisLevelStyle: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for code style rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/style-rules/'
+ required: false
+ default: ''
+ design: # AnalysisLevelDesign: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for design rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/design-warnings'
+ required: false
+ default: ''
+ documentation: # AnalysisLevelDocumentation: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for documentation rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/documentation-warnings'
+ required: false
+ default: ''
+ globalization: # AnalysisLevelGlobalization: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for globalization rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/globalization-warnings'
+ required: false
+ default: ''
+ interoperability: # AnalysisLevelInteroperability: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for portability and interoperability rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/interoperability-warnings'
+ required: false
+ default: ''
+ maintainability: # AnalysisLevelMaintainability: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for maintainability rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/maintainability-warnings'
+ required: false
+ default: ''
+ naming: # AnalysisLevelNaming: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for naming rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/naming-warnings'
+ required: false
+ default: ''
+ performance: # AnalysisLevelPerformance: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for performance rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/performance-warnings'
+ required: false
+ default: ''
+ reliability: # AnalysisLevelReliability: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for reliability rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/reliability-warnings'
+ required: false
+ default: ''
+ security: # AnalysisLevelSecurity: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for security rules https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/security-warnings'
+ required: false
+ default: ''
+ usage: # AnalysisLevelPerformance: https://docs.microsoft.com/dotnet/core/project-sdk/msbuild-props#analysislevel
+ description: 'Overridden analysis level and analysis mode for usage rules: https://docs.microsoft.com/dotnet/fundamentals/code-analysis/quality-rules/usage-warnings'
+ required: false
+ default: ''
+outputs:
+ sarifFile:
+ description: A file path to a '.sarif' file with analysis results.
+runs:
+ using: 'node12'
+ main: 'lib/action.js'
\ No newline at end of file

ADD
lib/action.js
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+ if (k2 === undefined) k2 = k;
+ Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+ if (k2 === undefined) k2 = k;
+ o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+ o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+ if (mod && mod.__esModule) return mod;
+ var result = {};
+ if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+ __setModuleDefault(result, mod);
+ return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core = __importStar(require("@actions/core"));
+const msca_toolkit_1 = require("./msca-toolkit/msca-toolkit");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+function getAnalysisLevelArgumentFromInput(analysisLevelName) {
+ let analysisLevelInput = core.getInput(analysisLevelName.toLowerCase());
+ if (action.isNullOrWhiteSpace(analysisLevelInput)) {
+ return '';
+ }
+ let analysisLevel;
+ let analysisMode;
+ let separator = analysisLevelInput.lastIndexOf('-');
+ if (separator > 0) {
+ analysisLevel = analysisLevelInput.substring(0, separator);
+ analysisMode = analysisLevelInput.substring(separator + 1);
+ }
+ else {
+ switch (analysisLevelInput.toLowerCase()) {
+ case 'none':
+ case 'default':
+ case 'minimum':
+ case 'recommended':
+ case 'all':
+ case 'allenabledbydefault':
+ case 'alldisabledbydefault':
+ analysisMode = analysisLevelInput;
+ analysisLevel = 'latest';
+ break;
+ default:
+ analysisLevel = analysisLevelInput;
+ analysisMode = 'minimum';
+ break;
+ }
+ }
+ let newArg;
+ if (analysisLevelName == 'all-categories') {
+ newArg = `/p:AnalysisLevel=${analysisLevel} /p:AnalysisMode=${analysisMode} `;
+ }
+ else {
+ newArg = `/p:AnalysisLevel${analysisLevelName}=${analysisLevel} /p:AnalysisMode${analysisLevelName}=${analysisMode} `;
+ }
+ return newArg;
+}
+function appendToProjectsOrSolutions(inputVariableName, projectsOrSolutions) {
+ let input = core.getInput(inputVariableName);
+ if (!action.isNullOrWhiteSpace(input)) {
+ if (!action.isNullOrWhiteSpace(projectsOrSolutions)) {
+ projectsOrSolutions += ';';
+ }
+ projectsOrSolutions += input;
+ }
+ return projectsOrSolutions;
+}
+let action = new msca_toolkit_1.MscaAction();
+// Process core analysis-level
+let analysisArgs = getAnalysisLevelArgumentFromInput('all-categories');
+// Process category specific analysis levels
+analysisArgs += getAnalysisLevelArgumentFromInput('Style');
+analysisArgs += getAnalysisLevelArgumentFromInput('Design');
+analysisArgs += getAnalysisLevelArgumentFromInput('Documentation');
+analysisArgs += getAnalysisLevelArgumentFromInput('Globalization');
+analysisArgs += getAnalysisLevelArgumentFromInput('Interoperability');
+analysisArgs += getAnalysisLevelArgumentFromInput('Maintainability');
+analysisArgs += getAnalysisLevelArgumentFromInput('Naming');
+analysisArgs += getAnalysisLevelArgumentFromInput('Performance');
+analysisArgs += getAnalysisLevelArgumentFromInput('Reliability');
+analysisArgs += getAnalysisLevelArgumentFromInput('Security');
+analysisArgs += getAnalysisLevelArgumentFromInput('Usage');
+let buildBreakingArg = core.getInput('build-breaking');
+let warnAsError = action.isNullOrWhiteSpace(buildBreakingArg) || buildBreakingArg.toLowerCase() != 'false';
+let projectsOrSolutions = '';
+projectsOrSolutions = appendToProjectsOrSolutions('solution', projectsOrSolutions);
+projectsOrSolutions = appendToProjectsOrSolutions('solutions', projectsOrSolutions);
+projectsOrSolutions = appendToProjectsOrSolutions('project', projectsOrSolutions);
+projectsOrSolutions = appendToProjectsOrSolutions('projects', projectsOrSolutions);
+var buildCommandLines = "";
+var first = true;
+if (action.isNullOrWhiteSpace(projectsOrSolutions)) {
+ buildCommandLines += `msbuild.exe ${analysisArgs}`;
+}
+else {
+ projectsOrSolutions.split(";").forEach(function (project) {
+ if (!first) {
+ buildCommandLines += " ; ";
+ first = false;
+ }
+ buildCommandLines += `msbuild.exe ${analysisArgs}${project}`;
+ });
+}
+var configContent = {
+ "fileVersion": "1.12.0",
+ "tools": [
+ {
+ "fileVersion": "1.12.0",
+ "tool": {
+ "name": "RoslynAnalyzers",
+ "version": "1.12.0"
+ },
+ "arguments": {
+ "CopyLogsOnly": false,
+ "SourcesDirectory": "$(Folders.SourceRepo)",
+ "MSBuildVersion": "16.0",
+ "CodeAnalysisAssemblyVersion": "3.8.0",
+ "SetupCommandlines": "\\\"$(VisualStudioInstallDirectory)\\Common7\\Tools\\VsMSBuildCmd.bat\\\"",
+ "BuildArchitecture": "amd64",
+ "BuildCommandlines": buildCommandLines,
+ "NetAnalyzersRootDirectory": "$(Packages.Microsoft.CodeAnalysis.NetAnalyzers)",
+ "CSharpCodeStyleAnalyzersRootDirectory": "$(Packages.Microsoft.CodeAnalysis.CSharp.CodeStyle)",
+ "FxCopAnalyzersRootDirectory": "",
+ "RulesetPath": "",
+ "SdlRulesetVersion": "",
+ "TreatWarningsAsErrors": warnAsError,
+ "LoggerLevel": "Warning",
+ "ForceSuccess": true // Pass force success flag so MSBuild exit code 1 on analyzer errors does not lead to non-graceful failure.
+ },
+ "outputExtension": "sarif",
+ "successfulExitCodes": [
+ 0
+ ]
+ }
+ ]
+};
+const actionDirectory = path.resolve(__dirname);
+core.debug(`actionDirectory = ${actionDirectory}`);
+let data = JSON.stringify(configContent);
+let gdnConfigFilePath = path.join(actionDirectory, '../', 'roslynanalyzers.gdnconfig');
+core.debug(`gdnConfigFilePath = ${gdnConfigFilePath}`);
+try {
+ fs.writeFileSync(gdnConfigFilePath, data);
+ data = fs.readFileSync(gdnConfigFilePath, "utf8");
+ core.info(data);
+}
+catch (err) {
+ throw Error(err);
+}
+let args = [];
+args.push('-c');
+args.push(gdnConfigFilePath);
+args.push('--no-policy');
+// Set logger level to only display warnings and errors
+args.push('--logger-level');
+args.push('Warning');
+if (!warnAsError) {
+ args.push('--not-break-on-detections');
+}
+core.info("------------------------------------------------------------------------------");
+core.info("Installing and running analyzers...");
+core.info("Warnings and errors will be displayed once the analysis completes.");
+action.run(args);

ADD
lib/msca-toolkit/msca-installer.js
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+ if (k2 === undefined) k2 = k;
+ Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+ if (k2 === undefined) k2 = k;
+ o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+ o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+ if (mod && mod.__esModule) return mod;
+ var result = {};
+ if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+ __setModuleDefault(result, mod);
+ return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+ function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+ return new (P || (P = Promise))(function (resolve, reject) {
+ function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+ function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+ function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+ step((generator = generator.apply(thisArg, _arguments || [])).next());
+ });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MscaInstaller = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const process = __importStar(require("process"));
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+class MscaInstaller {
+ install(cliVersion) {
+ return __awaiter(this, void 0, void 0, function* () {
+ console.log('Installing Microsoft Security Code Analysis Cli...');
+ if (process.env.MSCA_FILEPATH) {
+ console.log(`MSCA Cli File Path overriden by %MSCA_FILEPATH%: ${process.env.MSCA_FILEPATH}`);
+ return;
+ }
+ if (process.env.MSCA_DIRECTORY) {
+ console.log(`MSCA Cli Directory overriden by %MSCA_DIRECTORY%: ${process.env.MSCA_DIRECTORY}`);
+ // Set the mscai file path
+ let mscaFilePath = path.join(process.env.MSCA_DIRECTORY, 'guardian');
+ core.debug(`mscaFilePath = ${mscaFilePath}`);
+ process.env.MSCA_FILEPATH = mscaFilePath;
+ return;
+ }
+ // initialize the _msca directory
+ let mscaDirectory = path.resolve(path.join(process.env.GITHUB_WORKSPACE, '../../_msca'));
+ core.debug(`mscaDirectory = ${mscaDirectory}`);
+ this.ensureDirectory(mscaDirectory);
+ let mscaPackagesDirectory = path.join(mscaDirectory, 'versions');
+ core.debug(`mscaPackagesDirectory = ${mscaPackagesDirectory}`);
+ this.ensureDirectory(mscaPackagesDirectory);
+ let mscaVersionsDirectory = path.join(mscaPackagesDirectory, 'microsoft.security.codeanalysis.cli');
+ core.debug(`mscaVersionsDirectory = ${mscaVersionsDirectory}`);
+ if (this.isInstalled(mscaVersionsDirectory, cliVersion)) {
+ return;
+ }
+ let failed = false;
+ let attempts = 0;
+ let maxAttempts = 2;
+ do {
+ failed = false;
+ const mscaToolkitDirectory = path.resolve(__dirname);
+ core.debug(`mscaToolkitDirectory = ${mscaToolkitDirectory}`);
+ const mscaProjectFile = path.join(mscaToolkitDirectory, 'msca-toolkit.proj');
+ core.debug(`mscaProjectFile = ${mscaProjectFile}`);
+ let args = [
+ 'restore',
+ mscaProjectFile,
+ `/p:MscaPackageVersion=${cliVersion}`,
+ '--packages',
+ mscaPackagesDirectory,
+ '--source',
+ 'https://api.nuget.org/v3/index.json'
+ ];
+ try {
+ yield exec.exec('dotnet', args);
+ }
+ catch (error) {
+ core.debug(error);
+ failed = true;
+ attempts += 1;
+ if (attempts > maxAttempts) {
+ break;
+ }
+ }
+ } while (failed);
+ this.resolvePackageDirectory(mscaVersionsDirectory, cliVersion);
+ });
+ }
+ ensureDirectory(directory) {
+ if (!fs.existsSync(directory)) {
+ fs.mkdirSync(directory);
+ }
+ }
+ isInstalled(mscaVersionsDirectory, cliVersion) {
+ let installed = false;
+ if (cliVersion.includes("*")) {
+ core.debug(`MSCA Cli version contains a latest quantifier: ${cliVersion}. Continuing with install...`);
+ return installed;
+ }
+ this.setMscaiVariablesWithVersion(mscaVersionsDirectory, cliVersion);
+ if (fs.existsSync(process.env.MSCA_DIRECTORY)) {
+ console.log(`MSCA Cli v${cliVersion} already installed.`);
+ installed = true;
+ }
+ return installed;
+ }
+ resolvePackageDirectory(mscaVersionsDirectory, cliVersion) {
+ if (cliVersion.includes("*")) {
+ // find the latest directory
+ let mscaPackageDirectory = this.findLatestVersionDirectory(mscaVersionsDirectory);
+ this.setMscaiVariables(mscaPackageDirectory);
+ }
+ else {
+ this.setMscaiVariablesWithVersion(mscaVersionsDirectory, cliVersion);
+ }
+ if (!fs.existsSync(process.env.MSCA_DIRECTORY)) {
+ throw `Microsoft Security Code Analysis Cli v${cliVersion} was not found after installation.`;
+ }
+ }
+ findLatestVersionDirectory(mscaVersionsDirectory, isPreRelease = false) {
+ let latestDirectory = null;
+ let latestVersionParts = null;
+ let latestIsPreRelease = false;
+ let latestPreReleaseFlag = null;
+ // Get all of the directories in the versions directory
+ core.debug(`Searching for all version folders in: ${mscaVersionsDirectory}`);
+ let dirs = this.getDirectories(mscaVersionsDirectory);
+ // Evaluate each directory
+ for (let dirIndex = 0; dirIndex < dirs.length; dirIndex++) {
+ let dir = dirs[dirIndex];
+ if (dir == null || dir == "") {
+ core.debug(`Skipping null or empty directory: ${dir}`);
+ continue;
+ }
+ core.debug(`Evaluating mscai directory: ${dir}`);
+ // If we reuse the same RegExp object, it will return null every other call
+ const dirRegex = new RegExp(/^(\d+\.?){1,6}(\-\w+)?$/g);
+ if (dirRegex.exec(dir) == null) {
+ core.debug(`Skipping invalid version directory: ${dir}`);
+ continue;
+ }
+ let fullVersionParts = dir.split("-");
+ if (fullVersionParts == null || fullVersionParts.length < 0 || fullVersionParts.length > 2) {
+ core.debug(`Skipping invalid version directory: ${dir}`);
+ }
+ let dirIsPreRelease = fullVersionParts.length > 1;
+ if (!isPreRelease && dirIsPreRelease) {
+ core.debug(`Skipping pre-release version directory: ${dir}`);
+ continue;
+ }
+ let dirPreReleaseFlag = null;
+ if (dirIsPreRelease) {
+ dirPreReleaseFlag = fullVersionParts[1];
+ }
+ let versionNumbersString = fullVersionParts[0];
+ let versionParts = dir.split(".");
+ // If the latestDirectory isn't set yet, the folder is the latest directory
+ let isLatest = latestDirectory == null || latestVersionParts == null;
+ if (!isLatest) {
+ // Evaluate the directory's version against the latest directory
+ // Handle comparisions of separate level versions
+ // Some packages exclude Patch or include Revisions up to two levels (Rev1 and Rev2)
+ let maxVersionParts = versionParts.length;
+ if (latestVersionParts.length > maxVersionParts) {
+ maxVersionParts = latestVersionParts.length;
+ }
+ for (let versionPartIndex = 0; versionPartIndex < versionParts.length; versionPartIndex++) {
+ let versionPart = 0;
+ let latestVersionPart = 0;
+ let isLastVersionPart = versionPartIndex == (maxVersionParts - 1);
+ if (versionPartIndex < versionParts.length) {
+ versionPart = parseInt(versionParts[versionPartIndex]);
+ }
+ if (versionPartIndex < latestVersionParts.length) {
+ latestVersionPart = parseInt(latestVersionParts[versionPartIndex]);
+ }
+ if (versionPart > latestVersionPart) {
+ isLatest = true;
+ }
+ else if (versionPart == latestVersionPart) {
+ isLatest = isLastVersionPart
+ &&
+ ((isPreRelease && latestIsPreRelease && dirPreReleaseFlag > latestPreReleaseFlag)
+ ||
+ (!isPreRelease && latestIsPreRelease));
+ }
+ else {
+ // Current version is less than latest found
+ break;
+ }
+ if (isLatest) {
+ break;
+ }
+ }
+ }
+ if (isLatest) {
+ core.debug(`Setting latest version directory: ${dir}`);
+ latestDirectory = path.join(mscaVersionsDirectory, dir);
+ latestVersionParts = versionParts;
+ latestIsPreRelease = dirIsPreRelease;
+ latestPreReleaseFlag = dirPreReleaseFlag;
+ }
+ }
+ core.debug(`latestDirectory = ${latestDirectory}`);
+ return latestDirectory;
+ }
+ getDirectories(directory) {
+ // read the directory for all paths
+ // filter for directories
+ return fs.readdirSync(directory).filter(p => this.isDirectory(directory, p));
+ }
+ isDirectory(directory, p) {
+ // statSync follows symlinks
+ return fs.statSync(path.join(directory, p)).isDirectory();
+ }
+ setMscaiVariablesWithVersion(mscaVersionsDirectory, cliVersion) {
+ let mscaPackageDirectory = path.join(mscaVersionsDirectory, cliVersion);
+ core.debug(`mscaPackageDirectory = ${mscaPackageDirectory}`);
+ this.setMscaiVariables(mscaPackageDirectory);
+ }
+ setMscaiVariables(mscaPackageDirectory) {
+ let mscaDirectory = path.join(mscaPackageDirectory, 'tools');
+ core.debug(`mscaDirectory = ${mscaDirectory}`);
+ let mscaFilePath = path.join(mscaDirectory, 'guardian');
+ core.debug(`mscaFilePath = ${mscaFilePath}`);
+ process.env.MSCA_DIRECTORY = mscaDirectory;
+ process.env.MSCA_FILEPATH = mscaFilePath;
+ }
+}
+exports.MscaInstaller = MscaInstaller;

ADD
lib/msca-toolkit/msca-toolkit.js
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+ if (k2 === undefined) k2 = k;
+ Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+ if (k2 === undefined) k2 = k;
+ o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+ o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+ if (mod && mod.__esModule) return mod;
+ var result = {};
+ if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+ __setModuleDefault(result, mod);
+ return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+ function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+ return new (P || (P = Promise))(function (resolve, reject) {
+ function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+ function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+ function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+ step((generator = generator.apply(thisArg, _arguments || [])).next());
+ });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MscaAction = void 0;
+const path = __importStar(require("path"));
+const process = __importStar(require("process"));
+const core = __importStar(require("@actions/core"));
+const exec = __importStar(require("@actions/exec"));
+const msca_installer_1 = require("./msca-installer");
+class MscaAction {
+ constructor() {
+ this.cliVersion = '0.*';
+ }
+ setupEnvironment() {
+ return __awaiter(this, void 0, void 0, function* () {
+ console.log('------------------------------------------------------------------------------');
+ if (!process.env.MSCA_FILEPATH) {
+ let cliVersion = this.resolveCliVersion();
+ let mscaInstaller = new msca_installer_1.MscaInstaller();
+ yield mscaInstaller.install(cliVersion);
+ }
+ console.log('------------------------------------------------------------------------------');
+ });
+ }
+ resolveCliVersion() {
+ let cliVersion = this.cliVersion;
+ if (process.env.MSCA_VERSION) {
+ cliVersion = process.env.MSCA_VERSION;
+ }
+ return cliVersion;
+ }
+ isNullOrWhiteSpace(value) {
+ return !value || !value.trim();
+ }
+ init() {
+ return __awaiter(this, void 0, void 0, function* () {
+ let cliFilePath = process.env.MSCA_FILEPATH;
+ core.debug(`cliFilePath = ${cliFilePath}`);
+ try {
+ yield exec.exec(cliFilePath, ['init', '--force']);
+ }
+ catch (error) {
+ core.debug(error.Message);
+ }
+ });
+ }
+ run(inputArgs) {
+ return __awaiter(this, void 0, void 0, function* () {
+ yield this.setupEnvironment();
+ yield this.init();
+ let cliFilePath = process.env.MSCA_FILEPATH;
+ core.debug(`cliFilePath = ${cliFilePath}`);
+ let args = ['run'];
+ if (inputArgs != null) {
+ for (let i = 0; i < inputArgs.length; i++) {
+ args.push(inputArgs[i]);
+ }
+ }
+ if (core.isDebug()) {
+ args.push('--logger-level');
+ args.push('trace');
+ }
+ let sarifFile = path.join(process.env.GITHUB_WORKSPACE, '.gdn', 'analysis_results.sarif');
+ core.debug(`sarifFile = ${sarifFile}`);
+ // Write it as a GitHub Action variable for follow up tasks to consume
+ core.exportVariable('ANALYSIS_RESULTS_SARIF_FILE', sarifFile);
+ core.setOutput('sarifFile', sarifFile);
+ args.push('--export-breaking-results-to-file');
+ args.push(`${sarifFile}`);
+ core.debug('Running Microsoft Security Code Analysis...');
+ try {
+ yield exec.exec(cliFilePath, args);
+ }
+ catch (error) {
+ core.setFailed(error.Message);
+ }
+ });
+ }
+}
+exports.MscaAction = MscaAction;

ADD
lib/msca-toolkit/msca-toolkit.proj
+<Project Sdk="Microsoft.NET.Sdk">
+
+ <PropertyGroup>
+ <TargetFramework Condition=" '$(TargetFramework)' == '' ">netcoreapp3.1</TargetFramework>
+ <MscaPackageName Condition=" '$(MscaPackageName)' == '' ">Microsoft.Security.CodeAnalysis.Cli</MscaPackageName>
+ <MscaPackageVersion Condition=" '$(MscaPackageVersion)' == '' ">0.*</MscaPackageVersion>
+ </PropertyGroup>
+
+ <ItemGroup>
+ <PackageReference Include="$(MscaPackageName)" Version="$(MscaPackageVersion)" />
+ </ItemGroup>
+
+</Project>
\ No newline at end of file

Trying these additional files