Add new parameter downloadUrl

Author: adangel

README.md

@@ -78,6 +78,7 @@ See also [Uploading a SARIF file to GitHub](https://docs.github.com/en/code-secu
 |------------|---|--------|---------------|
 |`token`     |no |"github.token"|Personal access token (PAT) used to query the latest PMD release via api.github.com and to determine the modified files of a push/pull request (see option "analyzeModifiedFilesOnly").<br>By default the automatic token for GitHub Actions is used.<br>If this action is used in GHES environment (e.g. the baseUrl is not "api.github.com"), then the token is only used for querying the modified files of a push/pull request. The token won't be used to query the latest PMD release.<br>[Learn more about automatic token authentication](https://docs.github.com/en/actions/security-guides/automatic-token-authentication)<br>[Learn more about creating and using encrypted secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets)|
 |`version`   |no |"latest"|PMD version to use. Using "latest" automatically downloads the latest version.<br>Available versions: <https://github.com/pmd/pmd/releases><br>Note: Only PMD 6.31.0 and later is supported due to required support for [Sarif report format](https://pmd.github.io/latest/pmd_userdocs_report_formats.html#sarif).|
+|`downloadUrl`|no|""      |Manually specify the download URL from where the PMD binary distribution will be downloaded. By default, this parameter is empty and the download URL is automatically determined by querying the PMD releases at <https://github.com/pmd/pmd/releases>.<br>This can be used to test PMD versions that are not official releases.<br>If a downloadUrl is specified, then the version must not be "latest". You need to specify a concrete version. The downloaded PMD won't be cached and will always be downloaded again.|
 |`sourcePath`|no |"."     |Root directory for sources. Uses by default the current directory|
 |`rulesets`  |yes|        |Comma separated list of ruleset names to use.|
 |`analyzeModifiedFilesOnly`|no|"true"|Instead of analyze all files under "sourcePath", only the files that have been touched in a pull request or push will be analyzed. This makes the analysis faster and helps especially bigger projects which gradually want to introduce PMD. This helps in enforcing that no new code violation is introduced.<br>Depending on the analyzed language, the results might be less accurate results. At the moment, this is not a problem, as PMD mostly analyzes each file individually, but that might change in the future.<br>If the change is very big, not all files might be analyzed. Currently the maximum number of modified files is 300.<br>Note: When using PMD as a code scanner in order to create "Code scanning alerts" on GitHub, all files should be analyzed in order to produce a complete picture of the project. Otherwise alerts might get closed too soon.|

action.yml

@@ -3,11 +3,18 @@ description: Execute PMD static code analysis.
 inputs:
   token:
     description: >-
-      Personal access token (PAT) used to query the latest PMD release and the
-      download URL for PMD.
+      Personal access token (PAT) used to query the latest PMD release via
+      api.github.com and to determine the modified files of a push/pull request
+      (see option "analyzeModifiedFilesOnly").
 
-      By default the automatic token for GitHub Actions is used. [Learn more
-      about automatic token
+      By default the automatic token for GitHub Actions is used.
+
+      If this action is used in GHES environment (e.g. the baseUrl is not
+      "api.github.com"), then the token is only used for querying the modified
+      files of a push/pull request. The token won't be used to query the latest
+      PMD release.
+
+      [Learn more about automatic token
       authentication](https://docs.github.com/en/actions/security-guides/automatic-token-authentication)
 
       [Learn more about creating and using encrypted
@@ -26,6 +33,20 @@ inputs:
       format](https://pmd.github.io/latest/pmd_userdocs_report_formats.html#sarif).
     required: false
     default: latest
+  downloadUrl:
+    description: >-
+      Manually specify the download URL from where the PMD binary distribution
+      will be downloaded. By default, this parameter is empty and the download
+      URL is automatically determined by querying the PMD releases at
+      <https://github.com/pmd/pmd/releases>.
+
+      This can be used to test PMD versions that are not official releases.
+
+      If a downloadUrl is specified, then the version must not be "latest". You
+      need to specify a concrete version. The downloaded PMD won't be cached and
+      will always be downloaded again.
+    required: false
+    default: ''
   sourcePath:
     description: Root directory for sources
     required: false

dist/index.js

@@ -15,7 +15,8 @@ async function main() {
   try {
     pmdInfo = await util.downloadPmd(
       validator.validateVersion(core.getInput('version'), { required: true }),
-      token
+      token,
+      validator.validateDownloadUrl(core.getInput('downloadUrl'), { required: true })
     );
 
     if (core.getInput('analyzeModifiedFilesOnly', { required: true }) === 'true') {

lib/index.js

@@ -14,7 +14,7 @@ const { Octokit } = require('@octokit/rest');
 // repos/compareCommits API calls.
 const MAX_PAGE = 10;
 
-const downloadPmd = async function(version, token) {
+async function downloadPmdRelease(version, token) {
     let pmdVersion = version;
     let cachedPmdPath = tc.find('pmd', version);
     core.debug(`cached path result: ${cachedPmdPath}`);
@@ -33,6 +33,32 @@ const downloadPmd = async function(version, token) {
     }
 }
 
+async function downloadPmdUrl(version, downloadUrl) {
+    let pmdVersion = version;
+    const pathToZipDistribution = await tc.downloadTool(downloadUrl);
+    const pmdExtractedFolder = await tc.extractZip(pathToZipDistribution);
+    core.info(`Downloaded PMD ${pmdVersion} from ${downloadUrl} to ${pmdExtractedFolder}`);
+    const files = await fs.readdir(pmdExtractedFolder);
+    core.debug(`ZIP archive content: ${files}`);
+    let subpath = files[0];
+    core.debug(`Using the first entry as basepath for PMD: ${subpath}`)
+    return {
+        version: pmdVersion,
+        path: path.join(pmdExtractedFolder, subpath)
+    }
+}
+
+const downloadPmd = async function(version, token, downloadUrl) {
+    if (version === 'latest' && downloadUrl !== undefined && downloadUrl !== '')
+        throw `Can't combine version=${version} with custom downloadUrl=${downloadUrl}`
+
+    if (downloadUrl === undefined || downloadUrl === '') {
+        return downloadPmdRelease(version, token);
+    } else {
+        return downloadPmdUrl(version, downloadUrl);
+    }
+}
+
 const executePmd = async function(pmdInfo, fileListOrSourcePath, ruleset, reportFormat, reportFile) {
     let pmdExecutable = '/bin/run.sh pmd';
     if (isPmd7Cli(pmdInfo.version)) {
@@ -77,7 +103,7 @@ function useNewArgsFormat(pmdVersion) {
 }
 
 function isPmd7Cli(pmdVersion) {
-    return semver.gte(pmdVersion, '7.0.0-rc1');
+    return semver.major(pmdVersion) >= 7;
 }
 
 async function determinePmdRelease(pmdVersion, token) {

lib/util.js

@@ -28,7 +28,15 @@ const validateRulesets = function(rulesets) {
     return normalized;
 }
 
+const validateDownloadUrl = function(url) {
+    if (typeof(url) === 'string' && (url === '' || url.match(/^https?:\/\//)))
+        // valid
+        return url;
+
+    throw 'Invalid downloadUrl';
+}
+
 module.exports.validateVersion = validateVersion;
 module.exports.validateSourcePath = validateSourcePath;
 module.exports.validateRulesets = validateRulesets;
-
+module.exports.validateDownloadUrl = validateDownloadUrl;

lib/validator.js

@@ -4,3 +4,4 @@ zip -r pmd-bin-6.39.0.zip pmd-bin-6.39.0
 zip -r pmd-bin-6.40.0.zip pmd-bin-6.40.0
 zip -r pmd-bin-6.41.0.zip pmd-bin-6.41.0
 zip -r pmd-bin-7.0.0-rc1.zip pmd-bin-7.0.0-rc1
+zip -r pmd-bin-7.0.0-SNAPSHOT.zip pmd-bin-7.0.0-SNAPSHOT

tests/data/create-zips.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+echo "Running PMD 7.0.0-SNAPSHOT with: $@"
+
+echo '{
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "PMD",
+          "version": "7.0.0-SNAPSHOT"
+        }
+      }
+    }
+  ]
+}' > pmd-report.sarif
+

tests/data/pmd-bin-7.0.0-SNAPSHOT.zip

@@ -0,0 +1,17 @@
+@echo off
+echo Running PMD 7.0.0-SNAPSHOT with: %*
+
+(
+    echo {
+    echo   "runs": [
+    echo     {
+    echo       "tool": {
+    echo         "driver": {
+    echo           "name": "PMD",
+    echo           "version": "7.0.0-SNAPSHOT"
+    echo         }
+    echo       }
+    echo     }
+    echo   ]
+    echo }
+)>"pmd-report.sarif"