[DO NOT MERGE] GitHub AE consumables beta megabranch (#17620)
* Empty commit * updated beta note for GHAE * more GHAE update + resolve conflict * more GHAE updates + prepare for screenshots * Apply suggestions from code review Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * address remaining review comments * Revise "About GitHub AE" (#17679) * add screenshots to the Configuring article * reworked to have a separate GHAE section * list numbering * more work on screenshots and conditions * add GHAE screenshots in article * review screenshots in article * added more screenshots and updated more articles * screenshot madness * fix liquid versioning * refactor the ghae script * [GHAE CB/Feb 22]: Add article about data residency for GitHub AE (#17847) * add missing GHAE versioning to article * move screenshots to GHAE asset directory * forgot to change the path for these two images * replace CBB screenshot + add better screenshot * [GHAE CB/Feb 22]: Document upgrades for GitHub AE (#17848) * Version article for GitHub AE * Replace unused variable * Incorporate reviewer feedback * Update intro Co-authored-by: Ethan P <56270045+ethanpalm@users.noreply.github.com> * [GHAE] Enable IP allow list (#17691) * Notes for CC * Updat permission leves chart * Add updated article to further reading * Update gated feature callout with GitHub AE * Version "Managing allowed IP addresses for your organization" for AE * Update images * Update "Restricting network traffic to your enterprise" with new procedures * remove todo note * Update audited actions * Update info about Premium Runners * Use reusable for Premium Runners * Change "Premium Runners" to "AE hosted runners" * Incorporate reviewer feedback * Use correct reusable * Version reusable correctly * [Feb 22] GHAE: Code scanning beta (#17830) * Add "github-ae" to all the frontmatter * GHAE-ify the reusables * Add some more changes * Re-use some content * 🔪 Semmle links * Revert change re "--external-repository-token" in the CodeQL runner * Update CodeQL runner token scopes * Update two screenshots * Remove mention of GitHub.com from AE + other fixes * Apply suggestions from code review Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> * Use `product_name` variable instead of `product_location` * Remove confusing phrase * [Feb 22] GHAE: Code scanning API and webhook docs (#17883) * Version API and webhook docs * Actually add versioning for GHAE * Fix anchor * [TEMPORARY] Preview for API endpoints * Revert API previews * Update procedure step Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> * Update docs for AzureAD Group SCIM support in GHAE (#17892) * [GHAE CB] SMTP bootstrapping flow (#17888) * draft * update with AE conntent * update with tons of versioning * remove that lie * fill out the rest of these steps * update with correct versioning * more edits * add images * reversion most of ae article * fix versioning * format correctlly * words matter * last image * update with permmissions * update versioning * add link * apply feedback ❤️ * update with differrent spacing * update with feedback * more feedback * Temporary GHAE release notes for consumables beta launch (#17859) * Create release-notes.md * Add frontmatter * Add to index file * Update github-ae-release-notes.md * Add release notes from Google Doc * Update finalized docs links that have been reviewed * OAuth device flow link update * version for AE * few fixes * Update content/admin/overview/github-ae-release-notes.md * small edits * whoops * commit * update with different links * used wrong reusable * fix more brokenness * Update repository-references.js * Update repository-references.js Co-authored-by: Meg Bird <megbird@github.com> Co-authored-by: Kevin Heis <heiskr@users.noreply.github.com> * [GHAE] Audit public repos (#17917) * verifying what we mean by public * Apply suggestions from code review * Update content/developers/apps/installing-github-apps.md Co-authored-by: Laura Coursen <lecoursen@github.com> * fixing placememnt of liquid conditional Co-authored-by: Laura Coursen <lecoursen@github.com> * GHAE packages beta (#17786) Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> Co-authored-by: Martin Lopes <martin389@github.com> * fix broken links * [GHAE CB/March 01]: GitHub Actions on GHAE (beta) (#17725) * Added initial layout for premium runners * Restructured content * Added placeholder for removing premium runner * Added versioning and warning note for self-hosted runners * Added versioning and beta notice for actions content * Rephrased beta note * Added versioning for API docs, fixes * Added versioning fixes * Split Github-hosted and premium topics into separate articles * Added edits * Restructured some topics * Revised "Using premium runners in a workflow" * Some small fixes * Fixed typo * Added fixes to reusable * Added edits * Made section titles consistent * Added billing, group mgmt, reusable steps * Cropped certain screenshots for future-proofing * Removed superfluous reusable * Added fixes * Revert "Cropped certain screenshots for future-proofing" This reverts commit c7f24f31fa30d4fe3de2b63fc3cd5feba44ef518. * Added new section for custom images * Added versioning for enterprise-admin operations * Added edits * Added edits * Update adding-premium-runners.md * Removed SHR screenshots. Intending to update them when UI is available. * Update using-labels-with-premium-runners.md * Added custom labels section * Added preview of API docs changes * Added versioning for ip allow list section * Removed removal article * Renamed premium runners to AE hosted runners * Re-added added API preview * Fixed links, updated software specs * Revised "Software specifications" based on feedback * Fixed typos * Small fixes * Added new article "Creating custom images" * Moved "Creating custom images" link * Apply suggestions from code review Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> * Added update from review * Added updates from tech review * Apply suggestions from code review Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> * Added updates from tech review * Added updates from tech review * Added updates from tech review * Added updates from tech review * Fixed reusable * Added fixes * Added update from tech review * Removed the dereferenced OpenAPI schema files * Added fixes * Fixed links * Fixed links * Apply suggestions from code review Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> * Added updates from peer review * Removed sections that are not in beta * Update viewing-your-github-actions-usage.md * Update viewing-job-execution-time.md * Update index.md * Update about-github-hosted-runners.md * Restored versioning to match GHES approach * Fixed link * Restored self-hosted runner reference to UI steps. * Updated screenshots * Updated screenshots and procedures * Small edits to screenshots * Added AE url info for SHR * Removed superfluous versioning * Update security-hardening-for-github-actions.md * Update actions-shared.md * Small edits * Update usage-limits-billing-and-administration.md * Update managing-complex-workflows.md * Additional versioning * Additional versioning * version environments api and checkrun deployments for ghae (#17991) Co-authored-by: Martin Lopes <martin389@github.com> * Update reviewing-the-audit-log-for-your-organization.md * Added versioning for enterprise policy settings * version configuring artifact retention for AE * remove AE versioning for connecting to Marketplace * Apply suggestions from code review Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> * Update content/admin/github-actions/getting-started-with-github-actions-for-github-ae.md Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> * rewording not public to private * fixing liquid * Fixed elseif entries * Added expectations note * Revised label management article for AE hosted runners * Added enterprise-admin note for adding AE hosted runners * Update enterprise-admin.md * Update self-hosted-runner-security.md * Versioned reusable for AE * Empty commit for CI Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> Co-authored-by: skedwards88 <skedwards88@github.com> Co-authored-by: Leona B. Campbell <3880403+runleonarun@users.noreply.github.com> Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> Co-authored-by: runleonarun <runleonarun@github.com> * Update OpenAPI Descriptions for GHAE * Update content/admin/overview/github-ae-release-notes.md Co-authored-by: Ethan Palm <56270045+ethanpalm@users.noreply.github.com> Co-authored-by: mchammer01 <42146119+mchammer01@users.noreply.github.com> Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> Co-authored-by: shati-patel <shati-patel@github.com> Co-authored-by: Sarah Schneider <sarahs@github.com> Co-authored-by: skedwards88 <skedwards88@github.com> Co-authored-by: Sarah Schneider <sarahs@users.noreply.github.com> Co-authored-by: Melanie Yarbrough <11952755+myarb@users.noreply.github.com> Co-authored-by: Felicity Chapman <felicitymay@github.com> Co-authored-by: Meg Bird <megbird@github.com> Co-authored-by: Kevin Heis <heiskr@users.noreply.github.com> Co-authored-by: Leona B. Campbell <3880403+runleonarun@users.noreply.github.com> Co-authored-by: Laura Coursen <lecoursen@github.com> Co-authored-by: jmarlena <6732600+jmarlena@users.noreply.github.com> Co-authored-by: Martin Lopes <martin389@github.com> Co-authored-by: ahdbilal <55514721+ahdbilal@users.noreply.github.com> Co-authored-by: Joe Bourne <thejoebourneidentity@github.com> Co-authored-by: runleonarun <runleonarun@github.com> Co-authored-by: github-openapi-bot <69533958+github-openapi-bot@users.noreply.github.com>
This commit is contained in:
Matt Pollard
@@ -7,6 +7,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -35,7 +36,7 @@ You can use {% data variables.product.prodname_code_scanning %} with {% data var
|
||||
|
||||
{% data reusables.code-scanning.supported-languages %}
|
||||
|
||||
You can view and contribute to the queries for {% data variables.product.prodname_code_scanning %} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %} queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) in the {% data variables.product.prodname_codeql %} documentation.
|
||||
You can view and contribute to the queries for {% data variables.product.prodname_code_scanning %} in the [`github/codeql`](https://github.com/github/codeql) repository. For more information, see [{% data variables.product.prodname_codeql %} queries](https://codeql.github.com/docs/writing-codeql-queries/codeql-queries/) in the {% data variables.product.prodname_codeql %} documentation.
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
|
||||
|
||||
@@ -6,6 +6,7 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -17,7 +18,7 @@ If you use a third-party static analysis tool that can produce results as Static
|
||||
|
||||
### Integrations with webhooks
|
||||
|
||||
You can use {% data variables.product.prodname_code_scanning %} webhooks to build or set up integrations, such as [{% data variables.product.prodname_github_app %}s](/apps/building-github-apps/) or [{% data variables.product.prodname_oauth_app %}s](/apps/building-oauth-apps/), that subscribe to {% data variables.product.prodname_code_scanning %} events in your repository. For example, you could build an integration that creates an issue on {% data variables.product.product_location %} or sends you a Slack notification when a new {% data variables.product.prodname_code_scanning %} alert is added in your repository. For more information, see "[Creating webhooks](/developers/webhooks-and-events/creating-webhooks)" and "[Webhook events and payloads](/developers/webhooks-and-events/webhook-events-and-payloads#code_scanning_alert)."
|
||||
You can use {% data variables.product.prodname_code_scanning %} webhooks to build or set up integrations, such as [{% data variables.product.prodname_github_app %}s](/apps/building-github-apps/) or [{% data variables.product.prodname_oauth_app %}s](/apps/building-oauth-apps/), that subscribe to {% data variables.product.prodname_code_scanning %} events in your repository. For example, you could build an integration that creates an issue on {% data variables.product.product_name %} or sends you a Slack notification when a new {% data variables.product.prodname_code_scanning %} alert is added in your repository. For more information, see "[Creating webhooks](/developers/webhooks-and-events/creating-webhooks)" and "[Webhook events and payloads](/developers/webhooks-and-events/webhook-events-and-payloads#code_scanning_alert)."
|
||||
|
||||
### Further reading
|
||||
|
||||
|
||||
@@ -7,5 +7,6 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -14,9 +15,9 @@ versions:
|
||||
|
||||
### About {% data variables.product.prodname_code_scanning %} configuration
|
||||
|
||||
You can run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_location %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
|
||||
You can run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_name %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
|
||||
|
||||
This article is about running {% data variables.product.prodname_code_scanning %} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_ghe_server %}{% else %}{% data variables.product.prodname_dotcom %}{% endif %}.
|
||||
This article is about running {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_name %}.
|
||||
|
||||
Before you can configure {% data variables.product.prodname_code_scanning %} for a repository, you must set up {% data variables.product.prodname_code_scanning %} by adding a {% data variables.product.prodname_actions %} workflow to the repository. For more information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/setting-up-code-scanning-for-a-repository)."
|
||||
|
||||
@@ -203,13 +204,17 @@ jobs:
|
||||
|
||||
{% data reusables.code-scanning.run-additional-queries %}
|
||||
|
||||
To add one or more queries, add a `with: queries:` entry within the `uses: github/codeql-action/init@v1` section of the workflow.
|
||||
To add one or more queries, add a `with: queries:` entry within the `uses: github/codeql-action/init@v1` section of the workflow. If the queries are in a private repository, use the `external-repository-token` parameter to specify a token that has access to the private repository.
|
||||
|
||||
{% raw %}
|
||||
``` yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
with:
|
||||
queries: COMMA-SEPARATED LIST OF PATHS
|
||||
# Optional. Provide a token to access private repositories.
|
||||
external-repository-token: ${{ secrets.ACCESS_TOKEN }}
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language.
|
||||
|
||||
@@ -219,12 +224,15 @@ If you are also using a configuration file for custom settings, any additional q
|
||||
|
||||
In the following example, the `+` symbol ensures that the specified additional queries are used together with any queries specified in the referenced configuration file.
|
||||
|
||||
{% raw %}
|
||||
``` yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
with:
|
||||
config-file: ./.github/codeql/codeql-config.yml
|
||||
queries: +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main
|
||||
external-repository-token: ${{ secrets.ACCESS_TOKEN }}
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
### Using a custom configuration file
|
||||
|
||||
@@ -238,9 +246,19 @@ In the workflow file, use the `config-file` parameter of the `init` action to sp
|
||||
config-file: ./.github/codeql/codeql-config.yml
|
||||
```
|
||||
|
||||
The configuration file can be located within the local repository, or in a remote, public repository. Using a remote, public repository allows you to specify configuration options for multiple repositories in a single place. When you reference a configuration file located in a remote repository, you can use the _OWNER/REPOSITORY/FILENAME@BRANCH_ syntax. For example, _monacorp/shared/codeql-config.yml@main_.
|
||||
{% data reusables.code-scanning.custom-configuration-file %}
|
||||
|
||||
The settings in the file are written in YAML format.
|
||||
If the configuration file is located in an external private repository, use the `external-repository-token` parameter of the `init` action to specify a token that has access to the private repository.
|
||||
|
||||
{% raw %}
|
||||
```yaml
|
||||
uses: github/codeql-action/init@v1
|
||||
with:
|
||||
external-repository-token: ${{ secrets.ACCESS_TOKEN }}
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
The settings in the configuration file are written in YAML format.
|
||||
|
||||
#### Specifying additional queries
|
||||
|
||||
@@ -296,25 +314,6 @@ You can quickly analyze small portions of a monorepo when you modify code in spe
|
||||
|
||||
{% data reusables.code-scanning.autobuild-add-build-steps %} For more information about how to configure {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} for compiled languages, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages)."
|
||||
|
||||
### Accessing private repositories
|
||||
|
||||
If your workflow for {% data variables.product.prodname_code_scanning %} accesses a private repository, other than the repository that contains the workflow, you'll need to configure Git to authenticate with a personal access token. Define the secret in the runner environment by using `jobs.<job_id>.steps[*].env` in your workflow before any {% data variables.product.prodname_codeql %} actions. For more information, see "[Creating a personal access token for the command line](/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)" and "[Creating and storing encrypted secrets](/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets)."
|
||||
|
||||
For example, the following configuration has Git replace the full URLs to the `ghost/foo`, `ghost/bar`, and `ghost/baz` repositories on {% data variables.product.prodname_dotcom_the_website %} with URLs that include the personal access token that you store in the `ACCESS_TOKEN` environment variable.
|
||||
|
||||
{% raw %}
|
||||
```yaml
|
||||
steps:
|
||||
- name: Configure access to private repositories
|
||||
env:
|
||||
TOKEN: ${{ secrets.ACCESS_TOKEN }}
|
||||
run: |
|
||||
git config --global url."https://${TOKEN}@github.com/ghost/foo".insteadOf "https://github.com/ghost/foo"
|
||||
git config --global url."https://${TOKEN}@github.com/ghost/bar".insteadOf "https://github.com/ghost/bar"
|
||||
git config --global url."https://${TOKEN}@github.com/ghost/baz".insteadOf "https://github.com/ghost/baz"
|
||||
```
|
||||
{% endraw %}
|
||||
|
||||
### Uploading {% data variables.product.prodname_code_scanning %} data to {% data variables.product.prodname_dotcom %}
|
||||
|
||||
{% data variables.product.prodname_dotcom %} can display code analysis data generated externally by a third-party tool. You can upload code analysis data with the `upload-sarif` action. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)."
|
||||
|
||||
@@ -9,6 +9,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta-codeql-runner %}
|
||||
@@ -85,6 +86,8 @@ Use the `--config-file` flag of the `init` command to specify the configuration
|
||||
$ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-config.yml
|
||||
```
|
||||
|
||||
{% data reusables.code-scanning.custom-configuration-file %}
|
||||
|
||||
#### Example configuration files
|
||||
|
||||
{% data reusables.code-scanning.example-configuration-files %}
|
||||
@@ -145,7 +148,7 @@ Attempts to build the code for the compiled languages C/C++, C#, and Java. For t
|
||||
|
||||
#### `analyze`
|
||||
|
||||
Analyzes the code in the {% data variables.product.prodname_codeql %} databases and uploads results to {% data variables.product.product_location %}.
|
||||
Analyzes the code in the {% data variables.product.prodname_codeql %} databases and uploads results to {% data variables.product.product_name %}.
|
||||
|
||||
| Flag | Required | Input value |
|
||||
| ---- |:--------:| ----------- |
|
||||
@@ -155,7 +158,7 @@ Analyzes the code in the {% data variables.product.prodname_codeql %} databases
|
||||
| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |
|
||||
| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |
|
||||
| <nobr>`--checkout-path`</nobr> | | The path to the checkout of your repository. The default is the current working directory. |
|
||||
| `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_location %}. |
|
||||
| `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_name %}. |
|
||||
| `--output-dir` | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. |
|
||||
| `--ram` | | Amount of memory to use when running queries. The default is to use all available memory. |
|
||||
| <nobr>`--no-add-snippets`</nobr> | | None. Excludes code snippets from the SARIF output. |
|
||||
@@ -166,7 +169,7 @@ Analyzes the code in the {% data variables.product.prodname_codeql %} databases
|
||||
|
||||
#### `upload`
|
||||
|
||||
Uploads SARIF files to {% data variables.product.product_location %}.
|
||||
Uploads SARIF files to {% data variables.product.product_name %}.
|
||||
|
||||
{% note %}
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -32,7 +33,10 @@ If your workflow uses a `language` matrix, `autobuild` attempts to build each of
|
||||
|
||||
{% note %}
|
||||
|
||||
{% if currentVersion == "github-ae@latest" %}**Note**: For instructions on how to make sure your {% data variables.actions.hosted_runner %} has the required software installed, see "[Creating custom images](/actions/using-github-hosted-runners/creating-custom-images)."
|
||||
{% else %}
|
||||
**Note**: If you use self-hosted runners for {% data variables.product.prodname_actions %}, you may need to install additional software to use the `autobuild` process. Additionally, if your repository requires a specific version of a build tool, you may need to install it manually. For more information, see "[Specifications for {% data variables.product.prodname_dotcom %}-hosted runners](/actions/reference/specifications-for-github-hosted-runners/#supported-software)".
|
||||
{% endif %}
|
||||
|
||||
{% endnote %}
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
### Table of Contents
|
||||
|
||||
@@ -9,5 +9,6 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ permissions: 'If you have write permission to a repository you can manage {% dat
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
redirect_from:
|
||||
- /github/managing-security-vulnerabilities/managing-alerts-from-automated-code-scanning
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/managing-alerts-from-code-scanning
|
||||
|
||||
@@ -6,6 +6,7 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
<!--UI-LINK: When GitHub Enterprise Server doesn't have GitHub Actions set up, the Security > Code scanning alerts view links to this article.-->
|
||||
|
||||
@@ -23,9 +24,9 @@ If you use a continuous integration or continuous delivery/deployment (CI/CD) sy
|
||||
|
||||
{% data reusables.code-scanning.about-code-scanning %} For information, see "[About {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)."
|
||||
|
||||
You can use the {% data variables.product.prodname_codeql_runner %} to run {% data variables.product.prodname_code_scanning %} on code that you're processing in a third-party continuous integration (CI) system. Alternatively, you can use {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_location %}. For information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/setting-up-code-scanning-for-a-repository)."
|
||||
You can use the {% data variables.product.prodname_codeql_runner %} to run {% data variables.product.prodname_code_scanning %} on code that you're processing in a third-party continuous integration (CI) system. Alternatively, you can use {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_code_scanning %} on {% data variables.product.product_name %}. For information, see "[Setting up {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/setting-up-code-scanning-for-a-repository)."
|
||||
|
||||
The {% data variables.product.prodname_codeql_runner %} is a command-line tool that runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. You add the runner to your third-party system, then call the runner to analyze code and upload the results to {% data variables.product.product_location %}. These results are displayed as {% data variables.product.prodname_code_scanning %} alerts in the repository.
|
||||
The {% data variables.product.prodname_codeql_runner %} is a command-line tool that runs {% data variables.product.prodname_codeql %} analysis on a checkout of a {% data variables.product.prodname_dotcom %} repository. You add the runner to your third-party system, then call the runner to analyze code and upload the results to {% data variables.product.product_name %}. These results are displayed as {% data variables.product.prodname_code_scanning %} alerts in the repository.
|
||||
|
||||
{% note %}
|
||||
|
||||
@@ -40,7 +41,7 @@ The {% data variables.product.prodname_codeql_runner %} is a command-line tool t
|
||||
|
||||
### Downloading the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
You can download the {% data variables.product.prodname_codeql_runner %} from https://github.com/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
You can download the {% data variables.product.prodname_codeql_runner %} from https://{% if currentVersion == "enterprise-server@2.22" or currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases. On some operating systems, you may need to change permissions for the downloaded file before you can run it.
|
||||
|
||||
On Linux:
|
||||
|
||||
@@ -59,33 +60,33 @@ On Windows, the `codeql-runner-win.exe` file usually requires no change to permi
|
||||
|
||||
### Adding the {% data variables.product.prodname_codeql_runner %} to your CI system
|
||||
|
||||
Once you download the {% data variables.product.prodname_codeql_runner %} and verify that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. For example, you might configure each server to copy the runner from a central, internal location. Alternatively, you could use the REST API to get the runner directly from GitHub, for example:
|
||||
Once you download the {% data variables.product.prodname_codeql_runner %} and verify that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. For example, you might configure each server to copy the runner from a central, internal location. Alternatively, you could use the REST API to get the runner directly from {% data variables.product.prodname_dotcom %}, for example:
|
||||
|
||||
```shell
|
||||
wget https://github.com/github/codeql-action/releases/latest/download/codeql-runner-linux
|
||||
wget https://{% if currentVersion == "enterprise-server@2.22" or currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action/releases/latest/download/codeql-runner-linux
|
||||
chmod +x codeql-runner-linux
|
||||
```
|
||||
|
||||
In addition to this, each CI server also needs:
|
||||
|
||||
- A {% data variables.product.prodname_github_app %} or personal access token for the {% data variables.product.prodname_codeql_runner %} to use. You must use an access token with the `security_events` scope, or a {% data variables.product.prodname_github_app %} with the `security_events` write permission. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- A {% data variables.product.prodname_github_app %} or personal access token for the {% data variables.product.prodname_codeql_runner %} to use. You must use an access token with the `repo` scope, or a {% data variables.product.prodname_github_app %} with the `security_events` write permission, and `metadata` and `contents` read permissions. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- Access to the {% data variables.product.prodname_codeql %} bundle associated with this release of the {% data variables.product.prodname_codeql_runner %}. This package contains queries and libraries needed for {% data variables.product.prodname_codeql %} analysis, plus the {% data variables.product.prodname_codeql %} CLI, which is used internally by the runner. For information, see "[{% data variables.product.prodname_codeql %} CLI](https://codeql.github.com/docs/codeql-cli/)."
|
||||
|
||||
The options for providing access to the {% data variables.product.prodname_codeql %} bundle are:
|
||||
|
||||
1. Allow the CI servers access to {% data variables.product.prodname_dotcom_the_website %} so that the {% data variables.product.prodname_codeql_runner %} can download the bundle automatically.
|
||||
1. Manually download/extract the bundle, store it with other central resources, and use the `--codeql-path` flag to specify the location of the bundle in calls to initialize the {% data variables.product.prodname_codeql_runner %}.
|
||||
{% if enterpriseServerVersions contains currentVersion %}
|
||||
1. You can mirror the `github/codeql-action` repository on {% data variables.product.product_location %}. Unless you specify the <nobr>`--codeql-path`</nobr> flag, the runner automatically checks for the bundle in this location and on {% data variables.product.prodname_dotcom_the_website %}.{% endif %}
|
||||
1. Allow the CI servers access to https://{% if currentVersion == "enterprise-server@2.22" or currentVersion == "free-pro-team@latest" %}github.com{% else %}<em>HOSTNAME</em>{% endif %}/github/codeql-action so that the {% data variables.product.prodname_codeql_runner %} can download the bundle automatically.
|
||||
{% if currentVersion == "enterprise-server@2.22" %}
|
||||
1. Mirror the `github/codeql-action` repository on {% data variables.product.product_name %}. Unless you specify the <nobr>`--codeql-path`</nobr> flag, the runner automatically checks for the bundle in this location and on {% data variables.product.prodname_dotcom_the_website %}.{% endif %}
|
||||
1. Manually download/extract the bundle, store it with other central resources, and use the <nobr>`--codeql-path`</nobr> flag to specify the location of the bundle in calls to initialize the {% data variables.product.prodname_codeql_runner %}.
|
||||
|
||||
### Calling the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
You should call the {% data variables.product.prodname_codeql_runner %} from the checkout location of the repository you want to analyze. The two main commands are:
|
||||
|
||||
1. `init` required to initialize the runner and create a {% data variables.product.prodname_codeql %} database for each language to be analyzed. These databases are populated and analyzed by subsequent commands.
|
||||
1. `analyze` required to populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload results to {% data variables.product.product_location %}.
|
||||
1. `analyze` required to populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload results to {% data variables.product.product_name %}.
|
||||
|
||||
For both commands, you must specify the URL of {% data variables.product.product_location %}, the repository *OWNER/NAME*, and the GitHub Apps or personal access token to use for authentication. You also need to specify the location of the CodeQL bundle unless the CI server has access to download it directly from the `github/codeql-action` repository on {% data variables.product.prodname_dotcom_the_website %}{% if enterpriseServerVersions contains currentVersion %} or mirrored on {% data variables.product.product_location %}{% endif %}.
|
||||
For both commands, you must specify the URL of {% data variables.product.product_name %}, the repository *OWNER/NAME*, and the {% data variables.product.prodname_github_apps %} or personal access token to use for authentication. You also need to specify the location of the CodeQL bundle, unless the CI server has access to download it directly from the `github/codeql-action` repository.
|
||||
|
||||
You can configure where the {% data variables.product.prodname_codeql_runner %} stores the CodeQL bundle for future analysis on a server using the <nobr>`--tools-dir`</nobr> flag and where it stores temporary files during analysis using <nobr>`--temp-dir`</nobr>.
|
||||
|
||||
@@ -121,7 +122,7 @@ This example runs {% data variables.product.prodname_codeql %} analysis on a Lin
|
||||
> Successfully uploaded results
|
||||
```
|
||||
|
||||
The server has access to download the {% data variables.product.prodname_codeql %} bundle directly from the `github/codeql-action` repository on {% data variables.product.prodname_dotcom_the_website %}{% if enterpriseServerVersions contains currentVersion %} or mirrored on {% data variables.product.product_location %}{% endif %}, so there is no need to use the `--codeql-path` flag. When the analysis is complete, the {% data variables.product.prodname_codeql_runner %} uploads the results to the {% data variables.product.prodname_code_scanning %} view. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
The server has access to download the {% data variables.product.prodname_codeql %} bundle directly from the `github/codeql-action` repository, so there is no need to use the `--codeql-path` flag. When the analysis is complete, the {% data variables.product.prodname_codeql_runner %} uploads the results to the {% data variables.product.prodname_code_scanning %} view. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
#### Compiled language example
|
||||
|
||||
@@ -142,14 +143,15 @@ This example is similar to the previous example, however this time the repositor
|
||||
. /srv/checkout/example-repo-2/codeql-runner/codeql-env.sh".
|
||||
```
|
||||
|
||||
1. Run the script generated by the `init` action to set up the environment to monitor the build.
|
||||
1. Source the script generated by the `init` action to set up the environment to monitor the build. Note the leading dot and space in the following code snippet.
|
||||
|
||||
```shell
|
||||
$ . /srv/checkout/example-repo-2/codeql-runner/codeql-env.sh
|
||||
```
|
||||
|
||||
1. Build the code.
|
||||
1. Populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload the results to GitHub.
|
||||
1. Build the code. On macOS, you need to prefix the build command with the environment variable `$CODEQL_RUNNER`. For more information, see "[Troubleshooting CodeQL code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system#no-code-found-during-the-build)."
|
||||
|
||||
1. Populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload the results to {% data variables.product.prodname_dotcom %}.
|
||||
|
||||
```shell
|
||||
$ /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo-2
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -11,6 +11,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -28,7 +29,7 @@ You decide how to generate {% data variables.product.prodname_code_scanning %} a
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-security %}
|
||||
3. To the right of "{% data variables.product.prodname_code_scanning_capc %}", click **Set up {% data variables.product.prodname_code_scanning %}**. {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}If {% data variables.product.prodname_code_scanning %} is missing, you need to ask an organization owner or repository administrator to enable {% data variables.product.prodname_GH_advanced_security %}. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization)" or "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."{% endif %}
|
||||
3. To the right of "{% data variables.product.prodname_code_scanning_capc %} alerts", click **Set up {% data variables.product.prodname_code_scanning %}**. {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.0" %}If {% data variables.product.prodname_code_scanning %} is missing, you need to ask an organization owner or repository administrator to enable {% data variables.product.prodname_GH_advanced_security %}. For more information, see "[Managing security and analysis settings for your organization](/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization)" or "[Managing security and analysis settings for your repository](/github/administering-a-repository/managing-security-and-analysis-settings-for-your-repository)."{% endif %}
|
||||
|
||||
4. Under "Get started with {% data variables.product.prodname_code_scanning %}", click **Set up this workflow** on the {% data variables.product.prodname_codeql_workflow %} or on a third-party workflow.
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ permissions: 'If you have read permission for a repository, you can see annotati
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
@@ -31,7 +32,7 @@ When you look at the **Files changed** tab for a pull request, you see annotatio
|
||||
|
||||
|
||||
|
||||
If you have write permission for the repository, some annotations contain links with extra context for the alert. In the example above, from {% data variables.product.prodname_codeql %} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can also view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {% data variables.product.prodname_codeql %}, see "[About data flow analysis](https://help.semmle.com/QL/learn-ql/intro-to-data-flow.html)."
|
||||
If you have write permission for the repository, some annotations contain links with extra context for the alert. In the example above, from {% data variables.product.prodname_codeql %} analysis, you can click **user-provided value** to see where the untrusted data enters the data flow (this is referred to as the source). In this case you can also view the full path from the source to the code that uses the data (the sink) by clicking **Show paths**. This makes it easy to check whether the data is untrusted or if the analysis failed to recognize a data sanitization step between the source and the sink. For information about analyzing data flow using {% data variables.product.prodname_codeql %}, see "[About data flow analysis](https://codeql.github.com/docs/writing-codeql-queries/about-data-flow-analysis/)."
|
||||
|
||||
To see more information about an alert, users with write permission can click the **Show more details** link shown in the annotation. This allows you to see all of the context and metadata provided by the tool in an alert view. In the example below, you can see tags showing the severity, type, and relevant common weakness enumerations (CWEs) for the problem. The view also shows which commit introduced the problem.
|
||||
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta-codeql-runner %}
|
||||
@@ -51,4 +52,7 @@ If the `analyze` command for the {% data variables.product.prodname_codeql_runne
|
||||
|
||||
{% endnote %}
|
||||
|
||||
1. You're analyzing a compiled language on macOS without using the `autobuild` command and you run the build steps yourself after the `init` step. If SIP (System Integrity Protection) is enabled, which is the default on recent versions of OSX, analysis might fail. To fix this, prefix the build command with the `$CODEQL_RUNNER` environment variable.
|
||||
For example, if your build command is `cmd arg1 arg2`, you should run `$CODEQL_RUNNER cmd arg1 arg2`.
|
||||
|
||||
1. The code is built in a container or on a separate machine. If you use a containerized build or if you outsource the build to another machine, make sure to run the {% data variables.product.prodname_codeql_runner %} in the container or on the machine where your build task takes place. For more information, see "[Running CodeQL code scanning in a container](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-a-container)."
|
||||
|
||||
@@ -8,6 +8,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -9,6 +9,7 @@ redirect_from:
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
{% data reusables.code-scanning.beta %}
|
||||
|
||||
@@ -7,5 +7,6 @@ product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
github-ae: '*'
|
||||
---
|
||||
|
||||
|
||||
Reference in New Issue
Block a user