robojerk/codeql-action

Update checks

Browse source
This commit is contained in:
Henry Mercer 2023-06-12 11:26:55 +01:00
parent a590b4afa7
commit f1c4784a3f
18 changed files with 68 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

12
.github/workflows/__analyze-ref-input.yml generated vendored
View file

@ -25,12 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: windows-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -49,6 +43,12 @@ jobs:
version: stable-20221211
- os: windows-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: windows-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

12
.github/workflows/__go-custom-queries.yml generated vendored
View file

@ -25,12 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: windows-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -49,6 +43,12 @@ jobs:
version: stable-20221211
- os: windows-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: windows-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

8
.github/workflows/__go-tracing-autobuilder.yml generated vendored
View file

@ -25,10 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -41,6 +37,10 @@ jobs:
version: stable-20221211
- os: macos-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

8
.github/workflows/__go-tracing-custom-build-steps.yml generated vendored
View file

@ -25,10 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -41,6 +37,10 @@ jobs:
version: stable-20221211
- os: macos-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

8
.github/workflows/__go-tracing-legacy-workflow.yml generated vendored
View file

@ -25,10 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -41,6 +37,10 @@ jobs:
version: stable-20221211
- os: macos-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

33
.github/workflows/__ml-powered-queries.yml generated vendored
View file

@ -25,12 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: windows-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -49,6 +43,12 @@ jobs:
version: stable-20221211
- os: windows-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: windows-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest
@ -110,23 +110,14 @@ jobs:
- name: Check sarif
uses: ./../action/.github/actions/check-sarif
# Running on Windows requires CodeQL CLI 2.9.0+.
if: "!(matrix.version == 'stable-20220401' && runner.os == 'Windows')"
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run:
js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
queries-not-run: foo,bar
- name: Check results
env:
# Running on Windows requires CodeQL CLI 2.9.0+.
SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220401' &&
runner.os == 'Windows') }}
shell: bash
run: |
echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"
cd "$RUNNER_TEMP/results"
# We should run at least the ML-powered queries in `expected_rules`.
expected_rules="js/ml-powered/nosql-injection js/ml-powered/path-injection js/ml-powered/sql-injection js/ml-powered/xss"
@ -135,12 +126,9 @@ jobs:
found_rule=$(jq --arg rule "${rule}" '[.runs[0].tool.extensions[].rules | select(. != null) |
flatten | .[].id] | any(. == $rule)' javascript.sarif)
echo "Did find rule '${rule}': ${found_rule}"
if [[ "${found_rule}" != "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
if [[ "${found_rule}" != "true" ]]; then
echo "Expected SARIF output to contain rule '${rule}', but found no such rule."
exit 1
elif [[ "${found_rule}" == "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
echo "Found rule '${rule}' in the SARIF output which shouldn't have been part of the analysis."
exit 1
fi
done
@ -149,12 +137,9 @@ jobs:
select(.properties.score != null and (.rule.id | startswith("js/ml-powered/")))] | length' \
javascript.sarif)
echo "Found ${num_alerts} alerts from ML-powered queries.";
if [[ "${num_alerts}" -eq 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
if [[ "${num_alerts}" -eq 0 ]]; then
echo "Expected to find at least one alert from an ML-powered query but found ${num_alerts}."
exit 1
elif [[ "${num_alerts}" -ne 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
echo "Expected not to find any alerts from an ML-powered query but found ${num_alerts}."
exit 1
fi
env:
CODEQL_ACTION_TEST_MODE: true

8
.github/workflows/__multi-language-autodetect.yml generated vendored
View file

@ -25,10 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -41,6 +37,10 @@ jobs:
version: stable-20221211
- os: macos-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

3
.github/workflows/__packaging-codescanning-config-inputs-js.yml generated vendored
View file

@ -83,8 +83,7 @@ jobs:
uses: ./../action/.github/actions/check-sarif
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run:
javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-not-run: foo,bar
- name: Assert Results

3
.github/workflows/__packaging-config-inputs-js.yml generated vendored
View file

@ -83,8 +83,7 @@ jobs:
uses: ./../action/.github/actions/check-sarif
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run:
javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-not-run: foo,bar
- name: Assert Results

3
.github/workflows/__packaging-config-js.yml generated vendored
View file

@ -82,8 +82,7 @@ jobs:
uses: ./../action/.github/actions/check-sarif
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run:
javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-not-run: foo,bar
- name: Assert Results

3
.github/workflows/__packaging-inputs-js.yml generated vendored
View file

@ -82,8 +82,7 @@ jobs:
uses: ./../action/.github/actions/check-sarif
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run:
javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-run: javascript/example/empty-or-one-block,javascript/example/empty-or-one-block,javascript/example/other-query-block,javascript/example/two-block
queries-not-run: foo,bar
- name: Assert Results

12
.github/workflows/__remote-config.yml generated vendored
View file

@ -25,12 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: windows-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -49,6 +43,12 @@ jobs:
version: stable-20221211
- os: windows-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: windows-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

4
.github/workflows/__unset-environment.yml generated vendored
View file

@ -25,14 +25,14 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: ubuntu-latest
version: stable-20220908
- os: ubuntu-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: ubuntu-latest

12
.github/workflows/__upload-ref-sha-input.yml generated vendored
View file

@ -25,12 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: windows-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -49,6 +43,12 @@ jobs:
version: stable-20221211
- os: windows-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: windows-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

12
.github/workflows/__with-checkout-path.yml generated vendored
View file

@ -25,12 +25,6 @@ jobs:
strategy:
matrix:
include:
- os: ubuntu-latest
version: stable-20220401
- os: macos-latest
version: stable-20220401
- os: windows-latest
version: stable-20220401
- os: ubuntu-latest
version: stable-20220615
- os: macos-latest
@ -49,6 +43,12 @@ jobs:
version: stable-20221211
- os: windows-latest
version: stable-20221211
- os: ubuntu-latest
version: stable-20230418
- os: macos-latest
version: stable-20230418
- os: windows-latest
version: stable-20230418
- os: ubuntu-latest
version: cached
- os: macos-latest

4
.github/workflows/debug-artifacts.yml vendored
View file

@ -25,10 +25,10 @@ jobs:
- ubuntu-latest
- macos-latest
version:
- stable-20220401
- stable-20220615
- stable-20220908
- stable-20221211
- stable-20230418
- cached
- latest
- nightly-latest
@ -74,7 +74,7 @@ jobs:
- name: Check expected artifacts exist
shell: bash
run: |
VERSIONS="stable-20220401 stable-20220615 stable-20220908 stable-20221211 cached latest nightly-latest"
VERSIONS="stable-20220615 stable-20220908 stable-20221211 stable-20230418 cached latest nightly-latest"
LANGUAGES="cpp csharp go java javascript python"
for version in $VERSIONS; do
for os in ubuntu-latest macos-latest; do

17
pr-checks/checks/ml-powered-queries.yml
View file

@ -22,21 +22,14 @@ steps:
- name: Check sarif
uses: ./../action/.github/actions/check-sarif
# Running on Windows requires CodeQL CLI 2.9.0+.
if: "!(matrix.version == 'stable-20220401' && runner.os == 'Windows')"
with:
sarif-file: ${{ runner.temp }}/results/javascript.sarif
queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
queries-not-run: foo,bar
- name: Check results
env:
# Running on Windows requires CodeQL CLI 2.9.0+.
SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220401' && runner.os == 'Windows') }}
shell: bash
run: |
echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"
cd "$RUNNER_TEMP/results"
# We should run at least the ML-powered queries in `expected_rules`.
expected_rules="js/ml-powered/nosql-injection js/ml-powered/path-injection js/ml-powered/sql-injection js/ml-powered/xss"
@ -45,12 +38,9 @@ steps:
found_rule=$(jq --arg rule "${rule}" '[.runs[0].tool.extensions[].rules | select(. != null) |
flatten | .[].id] | any(. == $rule)' javascript.sarif)
echo "Did find rule '${rule}': ${found_rule}"
if [[ "${found_rule}" != "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
if [[ "${found_rule}" != "true" ]]; then
echo "Expected SARIF output to contain rule '${rule}', but found no such rule."
exit 1
elif [[ "${found_rule}" == "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
echo "Found rule '${rule}' in the SARIF output which shouldn't have been part of the analysis."
exit 1
fi
done
@ -59,10 +49,7 @@ steps:
select(.properties.score != null and (.rule.id | startswith("js/ml-powered/")))] | length' \
javascript.sarif)
echo "Found ${num_alerts} alerts from ML-powered queries.";
if [[ "${num_alerts}" -eq 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
if [[ "${num_alerts}" -eq 0 ]]; then
echo "Expected to find at least one alert from an ML-powered query but found ${num_alerts}."
exit 1
elif [[ "${num_alerts}" -ne 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
echo "Expected not to find any alerts from an ML-powered query but found ${num_alerts}."
exit 1
fi

6
pr-checks/sync.py
View file

@ -5,14 +5,14 @@ import textwrap
# The default set of CodeQL Bundle versions to use for the PR checks.
defaultTestVersions = [
# The oldest supported CodeQL version: 2.8.5. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
"stable-20220401",
# The last CodeQL release in the 2.9 series: 2.9.4.
# The oldest supported CodeQL version: 2.9.4. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
"stable-20220615",
# The last CodeQL release in the 2.10 series: 2.10.5.
"stable-20220908",
# The last CodeQL release in the 2.11 series: 2.11.6.
"stable-20221211",
# The last CodeQL release in the 2.12 series: 2.12.7.
"stable-20230418",
# The version of CodeQL currently in the toolcache. Typically either the latest release or the one before.
"cached",
# The latest release of CodeQL.