Skip to content

Commit 1bb13e0

Browse files
robertbrignullrobertbrignull
authored
Merge branch 'master' into pr_template_typos
2 parents 20a0628 + f16b356 commit 1bb13e0

File tree

11 files changed

+103
-12
lines changed

11 files changed

+103
-12
lines changed

‎README.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22

33
This action runs GitHub's industry-leading static analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/semmle/ql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
44

5-
[Sign up for the Advanced Security beta](https://github.com/features/security/advanced-security/signup)
6-
75
## Usage
86

97
To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:

‎lib/finalize-db.js

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/upload-lib.js

Lines changed: 3 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/util.js

Lines changed: 18 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package-lock.json

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"dependencies": {
1313
"@actions/core": "^1.0.0",
1414
"@actions/exec": "^1.0.1",
15-
"@actions/http-client": "^1.0.4",
15+
"@actions/http-client": "^1.0.8",
1616
"@actions/io": "^1.0.1",
1717
"@actions/tool-cache": "^1.1.2",
1818
"@octokit/rest": "^17.1.0",

‎src/finalize-db.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,13 +82,13 @@ async function resolveQueryLanguages(codeqlCmd: string, config: configUtils.Conf
8282
const noDeclaredLanguage = resolveQueriesOutputObject.noDeclaredLanguage;
8383
const noDeclaredLanguageQueries = Object.keys(noDeclaredLanguage);
8484
if (noDeclaredLanguageQueries.length !== 0) {
85-
core.warning('Some queries do not declare a language:\n' + noDeclaredLanguageQueries.join('\n'));
85+
throw new Error('Some queries do not declare a language, their qlpack.yml file is missing or is invalid');
8686
}
8787

8888
const multipleDeclaredLanguages = resolveQueriesOutputObject.multipleDeclaredLanguages;
8989
const multipleDeclaredLanguagesQueries = Object.keys(multipleDeclaredLanguages);
9090
if (multipleDeclaredLanguagesQueries.length !== 0) {
91-
core.warning('Some queries declare multiple languages:\n' + multipleDeclaredLanguagesQueries.join('\n'));
91+
throw new Error('Some queries declare multiple languages, their qlpack.yml file is missing or is invalid');
9292
}
9393
}
9494

‎src/testdata/tool-names.sarif

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
3+
"version": "2.1.0",
4+
"runs": [
5+
{
6+
"tool": {
7+
"driver": {
8+
"name": "CodeQL command-line toolchain"
9+
}
10+
}
11+
},
12+
{
13+
"tool": {
14+
"driver": {
15+
"name": "CodeQL command-line toolchain"
16+
}
17+
}
18+
},
19+
{
20+
"tool": {
21+
"driver": {
22+
"name": "ESLint"
23+
}
24+
}
25+
},
26+
{
27+
"tool": {
28+
"driver": {
29+
"name": ""
30+
}
31+
}
32+
},
33+
{
34+
"tool": {
35+
"driver": {
36+
"name": null
37+
}
38+
}
39+
}
40+
]
41+
}

‎src/upload-lib.ts

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@ async function uploadFiles(sarifFiles: string[]) {
9898
matrix = undefined;
9999
}
100100

101+
const toolNames = util.getToolNames(sarifPayload);
102+
101103
const payload = JSON.stringify({
102104
"commit_oid": commitOid,
103105
"ref": ref,
@@ -106,7 +108,8 @@ async function uploadFiles(sarifFiles: string[]) {
106108
"workflow_run_id": workflowRunID,
107109
"checkout_uri": checkoutURI,
108110
"environment": matrix,
109-
"started_at": startedAt
111+
"started_at": startedAt,
112+
"tool_names": toolNames,
110113
});
111114

112115
core.info('Uploading results');

‎src/util.test.ts

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
import * as fs from 'fs';
2+
3+
import * as util from './util';
4+
5+
test('getToolNames', () => {
6+
const input = fs.readFileSync(__dirname + '/testdata/tool-names.sarif', 'utf8')
7+
const toolNames = util.getToolNames(input);
8+
expect(toolNames).toStrictEqual(["CodeQL command-line toolchain", "ESLint"])
9+
})

0 commit comments

Comments
 (0)