Don't crash if we are unable to get a response from the feature-flag endpoint.

src/feature-flags.test.ts

@@ -31,12 +31,12 @@ const ALL_FEATURE_FLAGS_DISABLED_VARIANTS: Array<{
   description: string;
   gitHubVersion: util.GitHubVersion;
 }> = [
-  {
-    description: "GHES",
-    gitHubVersion: { type: GitHubVariant.GHES, version: "3.0.0" },
-  },
-  { description: "GHAE", gitHubVersion: { type: GitHubVariant.GHAE } },
-];
+    {
+      description: "GHES",
+      gitHubVersion: { type: GitHubVariant.GHES, version: "3.0.0" },
+    },
+    { description: "GHAE", gitHubVersion: { type: GitHubVariant.GHAE } },
+  ];
 
 for (const variant of ALL_FEATURE_FLAGS_DISABLED_VARIANTS) {
   test(`All feature flags are disabled if running against ${variant.description}`, async (t) => {
@@ -60,13 +60,44 @@ for (const variant of ALL_FEATURE_FLAGS_DISABLED_VARIANTS) {
           (v: LoggedMessage) =>
             v.type === "debug" &&
             v.message ===
-              "Not running against github.com. Disabling all feature flags."
+            "Not running against github.com. Disabling all feature flags."
         ) !== undefined
       );
     });
   });
 }
 
+test("API response missing", async (t) => {
+  await withTmpDir(async (tmpDir) => {
+    setupActionsVars(tmpDir, tmpDir);
+
+    const loggedMessages = [];
+    const featureFlags = new GitHubFeatureFlags(
+      { type: GitHubVariant.DOTCOM },
+      testApiDetails,
+      testRepositoryNwo,
+      getRecordingLogger(loggedMessages)
+    );
+
+    mockFeatureFlagApiEndpoint(403, {});
+
+    for (const flag of Object.values(FeatureFlag)) {
+      t.assert((await featureFlags.getValue(flag)) === false);
+    }
+
+    for (const featureFlag of ["ml_powered_queries_enabled"]) {
+      t.assert(
+        loggedMessages.find(
+          (v: LoggedMessage) =>
+            v.type === "debug" &&
+            v.message ===
+              `No feature flags API response for ${featureFlag}, considering it disabled.`
+        ) !== undefined
+      );
+    }
+  });
+});
+
 test("Feature flags are disabled if they're not returned in API response", async (t) => {
   await withTmpDir(async (tmpDir) => {
     setupActionsVars(tmpDir, tmpDir);
@@ -91,7 +122,7 @@ test("Feature flags are disabled if they're not returned in API response", async
           (v: LoggedMessage) =>
             v.type === "debug" &&
             v.message ===
-              `Feature flag '${featureFlag}' undefined in API response, considering it disabled.`
+            `Feature flag '${featureFlag}' undefined in API response, considering it disabled.`
         ) !== undefined
       );
     }

src/feature-flags.ts

@@ -28,17 +28,24 @@ export class GitHubFeatureFlags implements FeatureFlags {
     private apiDetails: GitHubApiDetails,
     private repositoryNwo: RepositoryNwo,
     private logger: Logger
-  ) {}
+  ) { }
 
   async getValue(flag: FeatureFlag): Promise<boolean> {
-    const response = (await this.getApiResponse())[flag];
+    const response = await this.getApiResponse();
     if (response === undefined) {
+      this.logger.debug(
+        `No feature flags API response for ${flag}, considering it disabled.`
+      );
+      return false;
+    }
+    const flagValue = response[flag];
+    if (flagValue === undefined) {
       this.logger.debug(
         `Feature flag '${flag}' undefined in API response, considering it disabled.`
       );
       return false;
     }
-    return response;
+    return flagValue;
   }
 
   private async getApiResponse(): Promise<FeatureFlagsApiResponse> {
@@ -64,9 +71,9 @@ export class GitHubFeatureFlags implements FeatureFlags {
         if (util.isHTTPError(e) && e.status === 403) {
           this.logger.warning(
             "This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. " +
-              "As a result, it will not be opted into any experimental features. " +
-              "This could be because the Action is running on a pull request from a fork. If not, " +
-              `please ensure the Action has the 'security-events: write' permission. Details: ${e}`
+            "As a result, it will not be opted into any experimental features. " +
+            "This could be because the Action is running on a pull request from a fork. If not, " +
+            `please ensure the Action has the 'security-events: write' permission. Details: ${e}`
           );
         } else {
           // Some feature flags, such as `ml_powered_queries_enabled` affect the produced alerts.