robojerk/codeql-action

Upload per-database diagnostic SARIFs on green and red runs (#1556)

Browse source 
Co-authored-by: Henry Mercer <henry.mercer@me.com>
This commit is contained in:
Angela P Wen 2023-03-20 14:09:04 -07:00 • committed by GitHub
parent b4fba292aa
commit 3cbd063679
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
28 changed files with 450 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

3
pr-checks/checks/config-export.yml
View file

@ -1,6 +1,6 @@
name: "Config export"
description: "Tests that the code scanning configuration file is exported to SARIF correctly."
versions: ["latest"]
versions: ["latest", "nightly-latest"]
env:
CODEQL_ACTION_EXPORT_CODE_SCANNING_CONFIG: true
CODEQL_PASS_CONFIG_TO_CLI: true
@ -27,7 +27,6 @@ steps:
with:
script: |
const fs = require('fs');
const path = require('path');
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
const run = sarif.runs[0];

52
pr-checks/checks/diagnostics-export.yml Normal file
View file

@ -0,0 +1,52 @@
name: "Diagnostic export"
description: "Tests that a manually added diagnostic is exported to SARIF."
versions: ["latest", "nightly-latest"]
env:
CODEQL_ACTION_EXPORT_DIAGNOSTICS: true
steps:
- uses: ./../action/init
id: init
with:
languages: javascript
queries: security-extended
tools: ${{ steps.prepare-test.outputs.tools-url }}
- name: Manually add a diagnostic
shell: bash
env:
CODEQL_PATH: ${{ steps.init.outputs.codeql-path }}
run: |
"$CODEQL_PATH" database add-diagnostic "$RUNNER_TEMP/codeql_databases/javascript" --plaintext-message="Plaintext message" --source-id="lang/diagnostics/example" --source-name="Diagnostic name"
- uses: ./../action/analyze
with:
output: "${{ runner.temp }}/results"
upload-database: false
- name: Upload SARIF
uses: actions/upload-artifact@v3
with:
name: diagnostics-export-${{ matrix.os }}-${{ matrix.version }}.sarif.json
path: "${{ runner.temp }}/results/javascript.sarif"
retention-days: 7
- name: Check diagnostics appear in SARIF
uses: actions/github-script@v6
env:
SARIF_PATH: "${{ runner.temp }}/results/javascript.sarif"
with:
script: |
const fs = require('fs');
const sarif = JSON.parse(fs.readFileSync(process.env['SARIF_PATH'], 'utf8'));
const run = sarif.runs[0];
const toolExecutionNotifications = run.invocations[0].toolExecutionNotifications;
const diagnosticToolExecutionNotification = toolExecutionNotifications.filter(n => n.descriptor.id === 'lang/diagnostics/example' && n.message.text === 'Plaintext message');
if (diagnosticToolExecutionNotification.length !== 1) {
core.setFailed(`Expected exactly 1 entry for this diagnostic in the 'runs[].invocations[].toolExecutionNotifications[]' SARIF property, found ${diagnosticToolExecutionNotification.length}`);
}
const notifications = run.tool.driver.notifications;
const diagnosticNotification = notifications.filter(n => n.id === 'lang/diagnostics/example' && n.name === 'lang/diagnostics/example' && n.fullDescription.text && 'Diagnostic name');
if (diagnosticNotification.length !== 1) {
core.setFailed(`Expected exactly 1 entry for this diagnostic in the 'runs[].tool.driver.notifications[]' SARIF property, found ${diagnosticNotification.length}`);
}
core.info('Finished diagnostic export test');