robojerk/codeql-action

Update first version of CLI compatible with Windows 2022

Browse source 
It is 2.8.2, not 2.7.3.
This commit is contained in:
Henry Mercer 2022-11-11 18:44:59 +00:00
parent e131232b86
commit 0c3e493df0
16 changed files with 35 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.github/workflows/__analyze-ref-input.yml generated vendored
View file

@ -31,11 +31,11 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: windows-2019 - os: windows-2019
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

4
.github/workflows/__go-custom-queries.yml generated vendored
View file

@ -31,11 +31,11 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: windows-2019 - os: windows-2019
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

2
.github/workflows/__go-custom-tracing-autobuild.yml generated vendored
View file

@ -29,7 +29,7 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: macos-latest - os: macos-latest
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120

4
.github/workflows/__go-custom-tracing.yml generated vendored
View file

@ -31,11 +31,11 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: windows-2019 - os: windows-2019
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

2
.github/workflows/__go-reconciled-tracing-autobuilder.yml generated vendored
View file

@ -29,7 +29,7 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: macos-latest - os: macos-latest
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120

4
.github/workflows/__go-reconciled-tracing-custom-build-steps.yml generated vendored
View file

@ -31,11 +31,11 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: windows-2019 - os: windows-2019
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

2
.github/workflows/__go-reconciled-tracing-legacy-workflow.yml generated vendored
View file

@ -29,7 +29,7 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: macos-latest - os: macos-latest
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120

21
.github/workflows/__ml-powered-queries.yml generated vendored
View file

@ -25,11 +25,11 @@ jobs:
strategy: strategy:
matrix: matrix:
include: include:
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: cached version: cached
@ -85,24 +85,19 @@ jobs:
- name: Check sarif - name: Check sarif
uses: ./../action/.github/check-sarif uses: ./../action/.github/check-sarif
if: matrix.os != 'windows-latest' || matrix.version == 'latest' || matrix.version # Running on Windows requires CodeQL CLI 2.9.0+.
== 'nightly-latest' if: "!(matrix.version == 'stable-20220120' && (matrix.os == 'windows-latest'\
\ || matrix.os == 'windows-2019'))"
with: with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
queries-not-run: foo,bar queries-not-run: foo,bar
- name: Check results - name: Check results
# Running ML-powered queries on Windows requires CodeQL CLI 2.9.0+. We don't run these checks
# against Windows and `cached` while CodeQL CLI 2.9.0 makes its way into `cached` to avoid the
# test starting to fail when the cached CodeQL Bundle gets updated. Once the CodeQL Bundle
# containing CodeQL CLI 2.9.0 has been fully released, we can drop this line and start running
# these checks on Windows and `cached`.
if: matrix.os != 'windows-latest' || matrix.version != 'cached'
env: env:
# Running on Windows requires CodeQL CLI 2.9.0+, which has so far only made it to 'latest'. # Running on Windows requires CodeQL CLI 2.9.0+.
SHOULD_RUN_ML_POWERED_QUERIES: ${{ matrix.os != 'windows-latest' || matrix.version SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220120' &&
== 'latest' || matrix.version == 'nightly-latest' }} (matrix.os == 'windows-latest' || matrix.os == 'windows-2019')) }}
shell: bash shell: bash
run: | run: |
echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}" echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"

2
.github/workflows/__multi-language-autodetect.yml generated vendored
View file

@ -29,7 +29,7 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: macos-latest - os: macos-latest
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120

4
.github/workflows/__remote-config.yml generated vendored
View file

@ -31,11 +31,11 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: windows-2019 - os: windows-2019
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

2
.github/workflows/__unset-environment.yml generated vendored
View file

@ -27,7 +27,7 @@ jobs:
include: include:
- os: ubuntu-20.04 - os: ubuntu-20.04
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

4
.github/workflows/__upload-ref-sha-input.yml generated vendored
View file

@ -31,11 +31,11 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: windows-2019 - os: windows-2019
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

4
.github/workflows/__with-checkout-path.yml generated vendored
View file

@ -31,11 +31,11 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: windows-2019 - os: windows-2019
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
- os: windows-latest - os: windows-2019
version: stable-20220120 version: stable-20220120
- os: ubuntu-latest - os: ubuntu-latest
version: stable-20220401 version: stable-20220401

4
.github/workflows/debug-artifacts.yml vendored
View file

@ -24,7 +24,7 @@ jobs:
version: stable-20211005 version: stable-20211005
- os: macos-latest - os: macos-latest
version: stable-20211005 version: stable-20211005
- os: ubuntu-latest - os: ubuntu-20.04
version: stable-20220120 version: stable-20220120
- os: macos-latest - os: macos-latest
version: stable-20220120 version: stable-20220120
@ -84,7 +84,7 @@ jobs:
VERSIONS="stable-20211005 stable-20220120 stable-20220401 cached latest nightly-latest" VERSIONS="stable-20211005 stable-20220120 stable-20220401 cached latest nightly-latest"
LANGUAGES="cpp csharp go java javascript python" LANGUAGES="cpp csharp go java javascript python"
for version in $VERSIONS; do for version in $VERSIONS; do
if [[ "$version" == stable-20211005 ]]; then if [[ "$version" =~ stable-(20211005|20220120|20210809) ]]; then
# Note the absence of the period in "ubuntu-2004": this is present in the image name # Note the absence of the period in "ubuntu-2004": this is present in the image name
# but not the artifact name # but not the artifact name
OPERATING_SYSTEMS="ubuntu-2004 macos-latest" OPERATING_SYSTEMS="ubuntu-2004 macos-latest"

13
pr-checks/checks/ml-powered-queries.yml
View file

@ -33,22 +33,17 @@ steps:
- name: Check sarif - name: Check sarif
uses: ./../action/.github/check-sarif uses: ./../action/.github/check-sarif
if: matrix.os != 'windows-latest' || matrix.version == 'latest' || matrix.version == 'nightly-latest' # Running on Windows requires CodeQL CLI 2.9.0+.
if: "!(matrix.version == 'stable-20220120' && (matrix.os == 'windows-latest' || matrix.os == 'windows-2019'))"
with: with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
queries-not-run: foo,bar queries-not-run: foo,bar
- name: Check results - name: Check results
# Running ML-powered queries on Windows requires CodeQL CLI 2.9.0+. We don't run these checks
# against Windows and `cached` while CodeQL CLI 2.9.0 makes its way into `cached` to avoid the
# test starting to fail when the cached CodeQL Bundle gets updated. Once the CodeQL Bundle
# containing CodeQL CLI 2.9.0 has been fully released, we can drop this line and start running
# these checks on Windows and `cached`.
if: matrix.os != 'windows-latest' || matrix.version != 'cached'
env: env:
# Running on Windows requires CodeQL CLI 2.9.0+, which has so far only made it to 'latest'. # Running on Windows requires CodeQL CLI 2.9.0+.
SHOULD_RUN_ML_POWERED_QUERIES: ${{ matrix.os != 'windows-latest' || matrix.version == 'latest' || matrix.version == 'nightly-latest' }} SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220120' && (matrix.os == 'windows-latest' || matrix.os == 'windows-2019')) }}
shell: bash shell: bash
run: | run: |
echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}" echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"

4
pr-checks/sync.py
View file

@ -23,8 +23,8 @@ def isCompatibleWithLatestImages(version):
return True return True
date = version.split("-")[1] date = version.split("-")[1]
# The first version of the CodeQL CLI compatible with `ubuntu-22.04` and `windows-2022` is # The first version of the CodeQL CLI compatible with `ubuntu-22.04` and `windows-2022` is
# 2.7.3. This appears in CodeQL Bundle version codeql-bundle-20211208. # 2.8.2. This appears in CodeQL Bundle version codeql-bundle-20220224.
return date >= "20211208" return date >= "20220224"
def operatingSystemsForVersion(version): def operatingSystemsForVersion(version):