Attempted fix for missing CDS SARIF results

Avoids changing directory when running the `cds` compiler, which
ensures that paths generated in .cds.json files are relative to the
"source root" directory. This replicates the behavior of the original
index-files.sh (shell) script, which works but is probably not correct.

Author: data-douser

extractors/cds/tools/index-files.js

@@ -1,7 +1,7 @@
 const { execFileSync, spawnSync } = require('child_process');
 const { existsSync, readFileSync, statSync, writeFileSync } = require('fs');
 const { arch, platform } = require('os');
-const { basename, dirname, join, resolve } = require('path');
+const { dirname, join, resolve } = require('path');
 const { quote } = require('shell-quote');
 
 // Terminate early if this script is not invoked with the required arguments.
@@ -161,16 +161,19 @@ try {
     }
 
     packageJsonDirs.forEach((dir) => {
-        console.log(`Installing '@sap/cds-dk' into ${dir} to enable CDS compilation ...`);
+        console.log(`Installing node dependencies from ${dir}/package.json ...`);
         execFileSync(
             'npm',
-            ['install', '--quiet', '--no-audit', '--no-fund', '--no-save', '@sap/cds-dk'],
+            ['install', '--quiet', '--no-audit', '--no-fund'],
             { cwd: dir, stdio: 'inherit' }
         );
-        console.log(`Installing node packages into ${dir} to enable CDS compilation ...`);
+        // Order is important here. Install dependencies from package.json in the directory,
+        // then install the CDS development kit (`@sap/cds-dk`) in the directory. Reversing
+        // this order causes cyclic install-remove behavior.
+        console.log(`Installing '@sap/cds-dk' into ${dir} to enable CDS compilation ...`);
         execFileSync(
             'npm',
-            ['install', '--quiet', '--no-audit', '--no-fund'],
+            ['install', '--quiet', '--no-audit', '--no-fund', '--no-save', '@sap/cds-dk'],
             { cwd: dir, stdio: 'inherit' }
         );
     });
@@ -201,7 +204,7 @@ responseFiles.forEach(rawCdsFilePath => {
             '--locations',
             '--log-level', 'warn'
         ],
-        { cwd: dirname(cdsFilePath), shell: true, stdio: 'pipe' }
+        { shell: true, stdio: 'pipe' }
     );
     if (result.error || result.status !== 0 || !result.stdout) {
         const errorMessage = `Could not compile the file ${cdsFilePath}.\nReported error(s):\n\`\`\`\n${result.stderr.toString()}\n\`\`\``;

scripts/compile-cds.cmd

@@ -0,0 +1,14 @@
+@echo off
+
+if not defined CODEQL_EXTRACTOR_CDS_SKIP_EXTRACTION (
+    type NUL && "%CODEQL_DIST%\codeql.exe" database index-files ^
+        --include-extension=.cds ^
+        --language cds ^
+        --prune **\node_modules\**\* ^
+        --prune **\.eslint\**\* ^
+        --total-size-limit=10m ^
+        -- ^
+        "%CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE%"
+)
+
+exit /b %ERRORLEVEL%

scripts/compile-cds.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # To use this script with the CodeQL CLI:
 # 1. Set the `codeql database create` `--search-path`` argument to the `extractors/` directory in this repository, e.g.:
@@ -32,14 +32,16 @@ set -eu
 #  - extractors/javascript/tools/pre-finalize.sh
 # Any changes should be synchronized between these three places.
 
-# Do not extract CDS files if the CODEQL_EXTRACTOR_CDS_SKIP_EXTRACTION environment variable is set
+# Do not extract CDS files if the CODEQL_EXTRACTOR_CDS_SKIP_EXTRACTION
+# environment variable is set.
 if [ -z "${CODEQL_EXTRACTOR_CDS_SKIP_EXTRACTION:-}" ]; then
     # Call the index-files command with the CDS extractor
-    "$CODEQL_DIST/codeql" database index-files \
-        --language cds \
-        --total-size-limit 10m \
+    "${CODEQL_DIST}/codeql" database index-files \
         --include-extension=.cds \
+        --language cds \
         --prune **/node_modules/**/* \
         --prune **/.eslint/**/* \
+        --total-size-limit=10m \
+        -- \
         "$CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE"
 fi