Skip to content

Commit d00e8c0

Browse files
edoardopirovanoedoardopirovano
authored
Merge pull request #1107 from github/update-v2.1.13-31367d4e
Merge main into releases/v2
2 parents 27ea8f8 + 8bd4419 commit d00e8c0

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+1280
-138
lines changed

‎.github/check-sarif/action.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Check SARIF
2+
description: Checks a SARIF file to see if certain queries were run and others were not run.
3+
inputs:
4+
sarif-file:
5+
required: true
6+
description: The SARIF file to check
7+
8+
queries-run:
9+
required: true
10+
description: |
11+
Comma separated list of query ids that should be included in this SARIF file.
12+
13+
queries-not-run:
14+
required: true
15+
description: |
16+
Comma separated list of query ids that should NOT be included in this SARIF file.
17+
18+
runs:
19+
using: node12
20+
main: index.js

‎.github/check-sarif/index.js

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
'use strict'
2+
3+
const core = require('@actions/core')
4+
const fs = require('fs')
5+
6+
const sarif = JSON.parse(fs.readFileSync(core.getInput('sarif-file'), 'utf8'))
7+
const rules = sarif.runs[0].tool.extensions.flatMap(ext => ext.rules || [])
8+
const ruleIds = rules.map(rule => rule.id)
9+
10+
// Check that all the expected queries ran
11+
const expectedQueriesRun = getQueryIdsInput('queries-run')
12+
const queriesThatShouldHaveRunButDidNot = expectedQueriesRun.filter(queryId => !ruleIds.includes(queryId))
13+
14+
if (queriesThatShouldHaveRunButDidNot.length > 0) {
15+
core.setFailed(`The following queries were expected to run but did not: ${queriesThatShouldHaveRunButDidNot.join(', ')}`)
16+
}
17+
18+
// Check that all the unexpected queries did not run
19+
const expectedQueriesNotRun = getQueryIdsInput('queries-not-run')
20+
21+
const queriesThatShouldNotHaveRunButDid = expectedQueriesNotRun.filter(queryId => ruleIds.includes(queryId))
22+
23+
if (queriesThatShouldNotHaveRunButDid.length > 0) {
24+
core.setFailed(`The following queries were NOT expected to have run but did: ${queriesThatShouldNotHaveRunButDid.join(', ')}`)
25+
}
26+
27+
28+
core.startGroup('All queries run')
29+
rules.forEach(rule => {
30+
core.info(`${rule.id}: ${(rule.properties && rule.properties.name) || rule.name}`)
31+
})
32+
core.endGroup()
33+
34+
core.startGroup('Full SARIF')
35+
core.info(JSON.stringify(sarif, null, 2))
36+
core.endGroup()
37+
38+
function getQueryIdsInput(name) {
39+
return core.getInput(name)
40+
.split(',')
41+
.map(q => q.trim())
42+
.filter(q => q.length > 0)
43+
}

‎.github/query-filter-test/action.yml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Query Filter Test
2+
description: Runs a test of query filters using the check SARIF action
3+
inputs:
4+
sarif-file:
5+
required: true
6+
description: The SARIF file to check
7+
8+
queries-run:
9+
required: true
10+
description: |
11+
Comma separated list of query ids that should be included in this SARIF file.
12+
13+
queries-not-run:
14+
required: true
15+
description: |
16+
Comma separated list of query ids that should NOT be included in this SARIF file.
17+
18+
config-file:
19+
required: true
20+
description: |
21+
The location of the codeql configuration file to use.
22+
23+
tools:
24+
required: true
25+
description: |
26+
The url of codeql to use.
27+
28+
runs:
29+
using: composite
30+
steps:
31+
- uses: ./../action/init
32+
with:
33+
languages: javascript
34+
config-file: ${{ inputs.config-file }}
35+
tools: ${{ inputs.tools }}
36+
db-location: ${{ runner.temp }}/query-filter-test
37+
- uses: ./../action/analyze
38+
with:
39+
output: ${{ runner.temp }}/results
40+
upload-database: false
41+
upload: false
42+
env:
43+
TEST_MODE: "true"
44+
- name: Check SARIF
45+
uses: ./../action/.github/check-sarif
46+
with:
47+
sarif-file: ${{ inputs.sarif-file }}
48+
queries-run: ${{ inputs.queries-run}}
49+
queries-not-run: ${{ inputs.queries-not-run}}
50+
- name: Cleanup after test
51+
shell: bash
52+
run: rm -rf "$RUNNER_TEMP/results" "$RUNNER_TEMP//query-filter-test"

‎.github/workflows/expected-queries-runs.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Check queries that ran
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- releases/v1
8+
- releases/v2
9+
pull_request:
10+
types:
11+
- opened
12+
- synchronize
13+
- reopened
14+
- ready_for_review
15+
workflow_dispatch: {}
16+
17+
jobs:
18+
expected-queries:
19+
name: Expected Queries Tests
20+
timeout-minutes: 45
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Check out repository
24+
uses: actions/checkout@v3
25+
- name: Prepare test
26+
id: prepare-test
27+
uses: ./.github/prepare-test
28+
with:
29+
version: latest
30+
- uses: ./../action/init
31+
with:
32+
languages: javascript
33+
tools: ${{ steps.prepare-test.outputs.tools-url }}
34+
- uses: ./../action/analyze
35+
with:
36+
output: ${{ runner.temp }}/results
37+
upload-database: false
38+
upload: false
39+
env:
40+
TEST_MODE: true
41+
42+
- name: Check Sarif
43+
uses: ./../action/.github/check-sarif
44+
with:
45+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
46+
queries-run: js/incomplete-hostname-regexp,js/path-injection
47+
queries-not-run: foo,bar

‎.github/workflows/query-filters.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Query filters tests
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- releases/v1
8+
- releases/v2
9+
pull_request:
10+
types:
11+
- opened
12+
- synchronize
13+
- reopened
14+
- ready_for_review
15+
workflow_dispatch: {}
16+
17+
jobs:
18+
query-filters:
19+
name: Query Filters Tests
20+
timeout-minutes: 45
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Check out repository
24+
uses: actions/checkout@v3
25+
- name: Prepare test
26+
id: prepare-test
27+
uses: ./.github/prepare-test
28+
with:
29+
version: latest
30+
31+
- name: Check SARIF for default queries with Single include, Single exclude
32+
uses: ./../action/.github/query-filter-test
33+
with:
34+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
35+
queries-run: js/zipslip
36+
queries-not-run: js/path-injection
37+
config-file: ./.github/codeql/codeql-config-query-filters1.yml
38+
tools: ${{ steps.prepare-test.outputs.tools-url }}
39+
40+
- name: Check SARIF for query packs with Single include, Single exclude
41+
uses: ./../action/.github/query-filter-test
42+
with:
43+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
44+
queries-run: js/zipslip,javascript/example/empty-or-one-block
45+
queries-not-run: js/path-injection
46+
config-file: ./.github/codeql/codeql-config-query-filters2.yml
47+
tools: ${{ steps.prepare-test.outputs.tools-url }}
48+
49+
- name: Check SARIF for query packs and local queries with Single include, Single exclude
50+
uses: ./../action/.github/query-filter-test
51+
with:
52+
sarif-file: ${{ runner.temp }}/results/javascript.sarif
53+
queries-run: js/zipslip,javascript/example/empty-or-one-block,inrepo-javascript-querypack/show-ifs
54+
queries-not-run: js/path-injection,complex-python-querypack/show-ifs,complex-python-querypack/foo/bar/show-ifs
55+
config-file: ./.github/codeql/codeql-config-query-filters3.yml
56+
tools: ${{ steps.prepare-test.outputs.tools-url }}

‎.github/workflows/script/update-required-checks.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ fi
2121
echo "Getting checks for $GITHUB_SHA"
2222

2323
# Ignore any checks with "https://", CodeQL, LGTM, and Update checks.
24-
CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") | not)] | sort')"
24+
CHECKS="$(gh api repos/github/codeql-action/commits/${GITHUB_SHA}/check-runs --paginate | jq --slurp --compact-output --raw-output '[.[].check_runs | .[].name | select(contains("https://") or . == "CodeQL" or . == "LGTM.com" or contains("Update") | not)] | unique | sort')"
2525

2626
echo "$CHECKS" | jq
2727

‎CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# CodeQL Action Changelog
22

3+
## 2.1.13 - 21 Jun 2022
4+
5+
- Add the ability to filter queries from a code scanning run by using the `query-filters` option in the code scanning configuration file. [#1098](https://github.com/github/codeql-action/pull/1098)
6+
- Update default CodeQL bundle version to 2.9.4. [#1100](https://github.com/github/codeql-action/pull/1100)
7+
38
## 2.1.12 - 01 Jun 2022
49

510
- Update default CodeQL bundle version to 2.9.3. [#1084](https://github.com/github/codeql-action/pull/1084)

‎lib/actions-util.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/actions-util.test.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/analyze.js

Lines changed: 59 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)