Skip to content

Commit 3aa3d6a

Browse files
robertbrignullrobertbrignull
authored
Merge branch 'master' into undeclared-action-input
2 parents dcd81b5 + 538cbdd commit 3aa3d6a

File tree

6 files changed

+41
-9
lines changed

6 files changed

+41
-9
lines changed

‎README.md

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22

33
This action runs GitHub's industry-leading static analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/semmle/ql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
44

5+
## License
6+
7+
This project is released under the [MIT License](LICENSE).
8+
9+
The underlying CodeQL CLI, used in this action, is licensed under the [GitHub CodeQL Terms and Conditions](https://securitylab.github.com/tools/codeql/license). As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.
10+
511
## Usage
612

713
To get code scanning results from CodeQL analysis on your repo you can use the following workflow as a template:
@@ -137,7 +143,7 @@ env:
137143

138144
to `github/codeql-action/analyze`.
139145

140-
### If you do not use a vendor directory
146+
#### If you do not use a vendor directory
141147

142148
Dependencies on public repositories should just work. If you have dependencies on private repositories, one option is to use `git config` and a [personal access token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) to authenticate when downloading dependencies. Add a section like
143149

@@ -163,6 +169,6 @@ dotnet build /p:UseSharedCompilation=false
163169

164170
Version 3 does not require the additional flag.
165171

166-
## License
172+
### Analysing Go together with other languages on `macos-latest`
167173

168-
This project is released under the [MIT License](LICENSE).
174+
When running on macos it is currently not possible to analyze Go in conjunction with any of Java, C/C++, or C#. Each language can still be analyzed separately.

‎lib/external-queries.js

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎lib/util.js

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/external-queries.test.ts

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,19 @@ import * as path from "path";
33

44
import * as configUtils from "./config-utils";
55
import * as externalQueries from "./external-queries";
6+
import * as util from "./util";
67

78
test("checkoutExternalQueries", async () => {
89
let config = new configUtils.Config();
910
config.externalQueries = [
1011
new configUtils.ExternalQuery("github/codeql-go", "df4c6869212341b601005567381944ed90906b6b"),
1112
];
12-
await externalQueries.checkoutExternalQueries(config);
1313

14-
let destination = process.env["RUNNER_WORKSPACE"] || "/tmp/codeql-action/";
15-
// COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in master
16-
expect(fs.existsSync(path.join(destination, "github", "codeql-go", "COPYRIGHT"))).toBeTruthy();
14+
await util.withTmpDir(async tmpDir => {
15+
process.env["RUNNER_WORKSPACE"] = tmpDir;
16+
await externalQueries.checkoutExternalQueries(config);
17+
18+
// COPYRIGHT file existed in df4c6869212341b601005567381944ed90906b6b but not in master
19+
expect(fs.existsSync(path.join(tmpDir, "github", "codeql-go", "COPYRIGHT"))).toBeTruthy();
20+
});
1721
});

‎src/external-queries.ts

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ import * as fs from 'fs';
44
import * as path from 'path';
55

66
import * as configUtils from './config-utils';
7+
import * as util from './util';
78

89
export async function checkoutExternalQueries(config: configUtils.Config) {
9-
const folder = process.env['RUNNER_WORKSPACE'] || '/tmp/codeql-action';
10+
const folder = util.getRequiredEnvParam('RUNNER_WORKSPACE');
1011

1112
for (const externalQuery of config.externalQueries) {
1213
core.info('Checking out ' + externalQuery.repository);

‎src/util.ts

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ import * as http from '@actions/http-client';
33
import * as auth from '@actions/http-client/auth';
44
import * as octokit from '@octokit/rest';
55
import consoleLogLevel from 'console-log-level';
6+
import * as fs from "fs";
7+
import * as os from 'os';
68
import * as path from 'path';
79

810
import * as sharedEnv from './shared-environment';
@@ -313,3 +315,11 @@ export function getToolNames(sarifContents: string): string[] {
313315

314316
return Object.keys(toolNames);
315317
}
318+
319+
// Creates a random temporary directory, runs the given body, and then deletes the directory.
320+
// Mostly intended for use within tests.
321+
export async function withTmpDir(body: (tmpDir: string) => Promise<void>) {
322+
const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'codeql-action-'));
323+
await body(tmpDir);
324+
fs.rmdirSync(tmpDir, { recursive: true });
325+
}

0 commit comments

Comments
 (0)