fix: persist inputs between the upload action and its post step

CHANGELOG.md

@@ -7,6 +7,7 @@ Note that the only difference between `v2` and `v3` of the CodeQL Action is the
 ## [UNRELEASED]
 
 - Bump the minimum CodeQL bundle version to 2.14.6. [#2549](https://github.com/github/codeql-action/pull/2549)
+- The upload-sarif action should not break composite actions that have a different set of inputs than the ones expected by upload-sarif. Failure used to appear in the form of: `upload-sarif post-action step failed: Input required and not supplied: token`.
 
 ## 3.26.13 - 14 Oct 2024
 

src/actions-util.ts

@@ -559,3 +559,29 @@ export async function runTool(
   }
   return stdout;
 }
+
+const persistedInputsKey = "persisted_inputs";
+
+/**
+ * Persists all inputs to the action as state that can be retrieved later in the post-action.
+ * This is need due to a runner bug that can cause inputs to be lost in the post-action.
+ * https://github.com/actions/runner/issues/3514
+ */
+export const persistInputs = function () {
+  const inputEnvironmentVariables = Object.entries(process.env).filter(
+    ([name]) => name.startsWith("INPUT_"),
+  );
+  core.saveState(persistedInputsKey, JSON.stringify(inputEnvironmentVariables));
+};
+
+/**
+ * Restores all inputs to the action from the persisted state.
+ */
+export const restoreInputs = function () {
+  const persistedInputs = core.getState(persistedInputsKey);
+  if (persistedInputs) {
+    for (const [name, value] of JSON.parse(persistedInputs)) {
+      process.env[name] = value;
+    }
+  }
+};

src/upload-sarif-action-post.ts

@@ -5,6 +5,7 @@
  */
 import * as core from "@actions/core";
 
+import * as actionsUtil from "./actions-util";
 import { getTemporaryDirectory } from "./actions-util";
 import { getGitHubVersion } from "./api-client";
 import * as debugArtifacts from "./debug-artifacts";
@@ -20,6 +21,7 @@ import {
 
 async function runWrapper() {
   try {
+    actionsUtil.restoreInputs();
     const logger = getActionsLogger();
     const gitHubVersion = await getGitHubVersion();
     checkGitHubVersionInRange(gitHubVersion, logger);

src/upload-sarif-action.ts

@@ -60,6 +60,8 @@ async function run() {
   const gitHubVersion = await getGitHubVersion();
   checkActionVersion(getActionVersion(), gitHubVersion);
 
+  actionsUtil.persistInputs();
+
   const repositoryNwo = parseRepositoryNwo(
     getRequiredEnvParam("GITHUB_REPOSITORY"),
   );