robojerk/codeql-action
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
5882 commits 0 branches 1 tag 471 MiB
Find a file
Andrew Eisenberg 873c91c4f7
Update README with detailed information 
Update `README.md` to include detailed information about inputs, workflow permissions, build modes, and actions.

* **Inputs**: Add a section on inputs, including the `config` option, `languages`, `queries`, `packs`, `db-location`, `ram`, `threads`, and `source-root`.
* **Workflow Permissions**: Add a section on workflow permissions required for the actions.
* **Build Modes**: Add a section explaining the different build modes available for the actions (`none`, `autobuild`, `manual`).
* **Actions**: Add a section describing the different actions (`init`, `autobuild`, `analyze`, `upload-sarif`, `resolve-environment`, `start-proxy`) and how to use them, with links to the relevant documentation on GitHub.

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/github/codeql-action?shareId=XXXX-XXXX-XXXX-XXXX).
2024-10-03 13:42:25 -07:00
.github Exclupde eslint-plugin-import updates from dependabot 2024-10-02 14:22:25 -07:00
.vscode VSCode settings: set default formatter for TS 2023-10-27 17:21:58 +01:00
analyze Add a warning to not specify a token input in most cases. 2024-09-13 15:48:32 +01:00
autobuild Document action.inputs.token (#2110) 2024-02-08 09:45:27 +00:00
init Fix #2367, add codeql-version to outputs 2024-07-10 11:58:42 -04:00
lib Rename determineMergeBaseCommitOid() 2024-10-03 08:43:36 -07:00
node_modules Update checked-in dependencies 2024-10-03 20:02:50 +00:00
pr-checks Run PR checks using JS only 2024-09-24 17:54:33 +01:00
python-setup Restore python-setup/check_python12.ps1 2024-04-08 10:22:09 +02:00
queries Internal queries: Replace deprecated predicates 2024-01-24 12:14:58 +00:00
resolve-environment Document action.inputs.token (#2110) 2024-02-08 09:45:27 +00:00
src Rename determineMergeBaseCommitOid() 2024-10-03 08:43:36 -07:00
start-proxy fixes 2024-08-15 12:23:22 +00:00
tests Add warning and update PR checks for Swift on Linux (#2399) 2024-08-02 16:27:45 +02:00
upload-sarif Add a warning to not specify a token input in most cases. 2024-09-13 15:48:32 +01:00
.editorconfig Add a .editorconfig with our chosen formatting options. 2020-06-23 14:38:30 +01:00
.git-blame-ignore-revs Ignore prior commit in git blame 2023-07-25 17:59:56 +02:00
.gitattributes Refactor PR checks 2021-09-08 13:59:52 +01:00
.gitignore Stop tracking tsconfig.tsbuildinfo 2024-09-23 09:47:18 -07:00
.npmrc Add config file to support npm v8 and v9 simultaneously 2022-11-14 22:15:08 +00:00
.pre-commit-config.yaml Add pre-commit configuration 2023-10-26 11:03:40 +02:00
CHANGELOG.md Update changelog and version after v3.26.11 2024-10-03 20:01:45 +00:00
CODE_OF_CONDUCT.md Initial commit (from f5274cbdce4ae7c9e4b937dcdf95ac70ae436d5f) 2020-04-28 17:23:37 +02:00
CODEOWNERS Delete python-setup/ 2024-04-04 17:16:05 +02:00
CONTRIBUTING.md Add a compatibility table to the README 2024-05-07 13:58:01 -07:00
eslint.config.mjs Fix eslint configuration 2024-07-16 15:13:51 -07:00
LICENSE Initial commit (from f5274cbdce4ae7c9e4b937dcdf95ac70ae436d5f) 2020-04-28 17:23:37 +02:00
package-lock.json Update changelog and version after v3.26.11 2024-10-03 20:01:45 +00:00
package.json Update changelog and version after v3.26.11 2024-10-03 20:01:45 +00:00
README.md Update README with detailed information 2024-10-03 13:42:25 -07:00
tsconfig.json Upgrade TypeScript to 9.2.0 2023-01-18 20:59:57 +00:00

README.md

CodeQL Action

This action runs GitHub's industry-leading semantic code analysis engine, CodeQL, against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of queries, which have been developed by the community and the GitHub Security Lab to find common vulnerabilities in your code.

For a list of recent changes, see the CodeQL Action's changelog.

License

This project is released under the MIT License.

The underlying CodeQL CLI, used in this action, is licensed under the GitHub CodeQL Terms and Conditions. As such, this action may be used on open source projects hosted on GitHub, and on private repositories that are owned by an organisation with GitHub Advanced Security enabled.

Usage

We recommend using default setup to configure CodeQL analysis for your repository. For more information, see "Configuring default setup for code scanning."

You can also configure advanced setup for a repository to find security vulnerabilities in your code using a highly customizable code scanning configuration. For more information, see "Configuring advanced setup for code scanning" and "Customizing your advanced setup for code scanning."

Inputs

The CodeQL Action supports various inputs to customize the analysis. Here are some important inputs:

  • config: Path of the config file to use. This input allows you to specify a custom configuration file for the analysis.
  • languages: A comma-separated list of CodeQL languages to analyze.
  • queries: Comma-separated list of additional queries to run. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of queries.
  • packs: Comma-separated list of packs to run. Reference a pack in the format scope/name[@version]. If version is not specified, then the latest version of the pack is used. By default, this overrides the same setting in a configuration file; prefix with "+" to use both sets of packs.
  • db-location: Path where CodeQL databases should be created. If not specified, a temporary directory will be used.
  • ram: The amount of memory in MB that can be used by CodeQL extractors.
  • threads: The number of threads that can be used by CodeQL extractors.
  • source-root: Path of the root source code directory, relative to $GITHUB_WORKSPACE.

Workflow Permissions

All advanced setup code scanning workflows must have the security-events: write permission. Workflows in private repositories must additionally have the contents: read permission. For more information, see "Assigning permissions to jobs."

Build Modes

The CodeQL Action supports different build modes for analyzing the source code. The available build modes are:

  • none: The database will be created without building the source code. Available for all interpreted languages and some compiled languages.
  • autobuild: The database will be created by attempting to automatically build the source code. Available for all compiled languages.
  • manual: The database will be created by building the source code using a manually specified build command. To use this build mode, specify manual build steps in your workflow between the init and analyze steps. Available for all compiled languages.

Actions

The CodeQL Action includes several actions that can be used in your workflows. Here are the available actions and how to use them:

Supported versions of the CodeQL Action

The following versions of the CodeQL Action are currently supported:

  • v3 (latest)
  • v2 (deprecated, support will end on December 5th, 2024)

The only difference between CodeQL Action v2 and v3 is the version of Node.js on which they run. CodeQL Action v3 runs on Node 20, while CodeQL Action v2 runs on Node 16.

To provide the best experience to customers using older versions of GitHub Enterprise Server, we will continue to release CodeQL Action v2 so that these customers can continue to run the latest version of CodeQL as long as their version of GitHub Enterprise Server is supported. For example CodeQL Action v3.22.11 was the first release of CodeQL Action v3 and is functionally identical to v2.22.11. This approach provides an easy way to track exactly which features are included in different versions by looking at the minor and patch version numbers.

For more information, see "Code scanning: deprecation of CodeQL Action v2."

Supported versions of the CodeQL Bundle on GitHub Enterprise Server

We typically release new minor versions of the CodeQL Action and Bundle when a new minor version of GitHub Enterprise Server (GHES) is released. When a version of GHES is deprecated, the CodeQL Action and Bundle releases that shipped with it are deprecated as well.

Minimum CodeQL Action Minimum CodeQL Bundle Version GitHub Environment Notes
v3.25.11 2.17.6 Enterprise Server 3.14
v3.24.11 2.16.6 Enterprise Server 3.13
v3.22.12 2.15.5 Enterprise Server 3.12
v2.22.1 2.14.6 Enterprise Server 3.11 Supports CodeQL Action v3, but did not ship with CodeQL Action v3. For more information, see "Code scanning: deprecation of CodeQL Action v2."
v2.20.3 2.13.5 Enterprise Server 3.10 Does not support CodeQL Action v3.

CodeQL Action v2 will stop receiving updates when GHES 3.11 is deprecated.

See the full list of GHES release and deprecation dates at GitHub Enterprise Server releases.

Troubleshooting

Read about troubleshooting code scanning.

Contributing

This project welcomes contributions. See CONTRIBUTING.md for details on how to build, install, and contribute.