Add remaining CI scripts to pr-checks

.github/actions/check-codescanning-config/action.yml

@@ -54,16 +54,15 @@ runs:
       env:
         CODEQL_ACTION_TEST_MODE: 'true'
 
-    - name: Install dependencies
-      shell: bash
-      run: npm install --location=global ts-node js-yaml
-
     - name: Check config
-      working-directory: ${{ github.action_path }}
       shell: bash
       env:
         EXPECTED_CONFIG_FILE_CONTENTS: '${{ inputs.expected-config-file-contents }}'
-      run: ts-node ./index.ts "$RUNNER_TEMP/user-config.yaml" "$EXPECTED_CONFIG_FILE_CONTENTS"
+      run: |
+        npx tsx ../action/pr-checks/check-cs-config.ts \
+          --file "$RUNNER_TEMP/user-config.yaml" \
+          --expected-contents "$EXPECTED_CONFIG_FILE_CONTENTS"
+
     - name: Clean up
       shell: bash
       if: always()

.github/actions/check-sarif/action.yml

@@ -16,5 +16,23 @@ inputs:
       Comma separated list of query ids that should NOT be included in this SARIF file.
 
 runs:
-  using: node24
-  main: index.js
+  using: "composite"
+  steps:
+    - name: Run `check-sarif.ts`
+      shell: bash
+      env:
+        SARIF_FILE: ${{ inputs.sarif-file }}
+        QUERIES_RUN: ${{ inputs.queries-run }}
+        QUERIES_NOT_RUN: ${{ inputs.queries-not-run }}
+      run: |
+        if [[ -d pr-checks ]]; then
+          npx tsx ./pr-checks/check-sarif.ts \
+            --sarif-file "$SARIF_FILE" \
+            --queries-run "$QUERIES_RUN" \
+            --queries-not-run "$QUERIES_NOT_RUN"
+        else
+          npx tsx ../action/pr-checks/check-sarif.ts \
+            --sarif-file "$SARIF_FILE" \
+            --queries-run "$QUERIES_RUN" \
+            --queries-not-run "$QUERIES_NOT_RUN"
+        fi

.github/workflows/pr-checks.yml

@@ -55,7 +55,7 @@ jobs:
           npm ci
 
       - name: Verify compiled JS up to date
-        run: .github/workflows/script/check-js.sh
+        run: npx tsx pr-checks/check-js.ts
 
       - name: Run unit tests
         if: always()

.github/workflows/update-bundle.yml

@@ -50,7 +50,7 @@ jobs:
         run: npm ci
 
       - name: Update bundle
-        uses: ./.github/actions/update-bundle
+        run: npx tsx pr-checks/update-bundle.ts
 
       - name: Set up CodeQL CLI from new bundle
         id: setup-codeql

pr-checks/check-cs-config.test.ts

@@ -0,0 +1,68 @@
+/**
+ * Tests for `check-cs-config.ts`.
+ */
+
+import * as assert from "node:assert/strict";
+import { describe, it } from "node:test";
+
+import type { UserConfig } from "../src/config/db-config";
+
+import { checkConfiguration } from "./check-cs-config";
+
+describe("checkConfiguration", async () => {
+  await it("passes when actual and expected configs match", () => {
+    const actual: UserConfig = { name: "test-config", paths: ["src"] };
+    const expected = JSON.stringify(actual);
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("passes when queries arrays match after sorting", () => {
+    const actual: UserConfig = { paths: ["b", "a", "c"] };
+    const expected = JSON.stringify(actual);
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("throws when actual config does not match expected", () => {
+    const actual: UserConfig = { name: "actual-name" };
+    const expected = JSON.stringify({
+      name: "expected-name",
+    } satisfies UserConfig);
+    assert.throws(() => checkConfiguration(actual, expected), {
+      message: /Expected configuration does not match actual configuration/,
+    });
+  });
+
+  await it("throws when expected contents are empty", () => {
+    assert.throws(() => checkConfiguration({}, ""), {
+      message: /No expected configuration provided/,
+    });
+  });
+
+  await it("throws when expected contents are only whitespace", () => {
+    assert.throws(() => checkConfiguration({}, "   "), {
+      message: /No expected configuration provided/,
+    });
+  });
+
+  await it("passes with complex config", () => {
+    const actual: UserConfig = {
+      name: "complex",
+      "disable-default-queries": true,
+      paths: ["src", "lib"],
+      "paths-ignore": ["test"],
+      "threat-models": ["remote"],
+    };
+    const expected = JSON.stringify(actual);
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("trims whitespace from expected contents before parsing", () => {
+    const actual: UserConfig = { name: "trimmed" };
+    const expected = `  ${JSON.stringify(actual)}  `;
+    assert.doesNotThrow(() => checkConfiguration(actual, expected));
+  });
+
+  await it("passes when both configs are empty objects", () => {
+    assert.doesNotThrow(() => checkConfiguration({}, "{}"));
+  });
+});