Merge branch 'main' into patch-10
This commit is contained in:
Melanie Yarbrough
@@ -35,9 +35,7 @@ You can filter email notifications you receive for pushes to a repository. For m
|
||||
|
||||
6. If you operate your own server, you can verify the integrity of emails via the **Secret** token. This token is sent with the email as the `Approved` header. If the `Approved` header matches the token you sent, you can trust that the email is from {% data variables.product.product_name %}.
|
||||
|
||||
7. Optionally, select **Send from author** to have emails delivered using the committer's email address. Otherwise, emails are sent from {% data variables.notifications.no_reply_address %}.
|
||||
|
||||
8. Click **Save settings**.
|
||||
7. Click **Save settings**.
|
||||
|
||||
|
||||
### Further reading
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
title: Configuring the retention period for GitHub Actions artifacts and logs in your repository
|
||||
intro: 'You can configure the retention period for {% data variables.product.prodname_actions %} artifacts and logs in your repository.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.23'
|
||||
---
|
||||
|
||||
{% data reusables.actions.about-artifact-log-retention %}
|
||||
|
||||
You can also define a custom retention period for a specific artifact created by a workflow. For more information, see "[Setting the retention period for an artifact](/actions/managing-workflow-runs/removing-workflow-artifacts#setting-the-retention-period-for-an-artifact)."
|
||||
|
||||
## Setting the retention period for a repository
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-settings %}
|
||||
{% data reusables.repositories.settings-sidebar-actions %}
|
||||
{% data reusables.github-actions.change-retention-period-for-artifacts-logs %}
|
||||
@@ -27,6 +27,7 @@ versions:
|
||||
<!-- endif -->
|
||||
{% link_in_list /managing-the-forking-policy-for-your-repository %}
|
||||
<!-- if currentVersion != "free-pro-team@latest" -->
|
||||
{% link_in_list /configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-repository %}
|
||||
{% link_in_list /disabling-or-limiting-github-actions-for-a-repository %}
|
||||
{% link_in_list /managing-git-lfs-objects-in-archives-of-your-repository %}
|
||||
{% link_in_list /enabling-anonymous-git-read-access-for-a-repository %}
|
||||
|
||||
@@ -16,7 +16,7 @@ versions:
|
||||
|
||||
### About release management
|
||||
|
||||
You can also publish an action from a specific release in {% data variables.product.prodname_marketplace %}. For more information, see "[Publishing an action in the {% data variables.product.prodname_marketplace %}](/actions/creating-actions/publishing-actions-in-github-marketplace)."
|
||||
You can also publish an action from a specific release in {% data variables.product.prodname_marketplace %}. For more information, see "<a href="/actions/creating-actions/publishing-actions-in-github-marketplace" class="dotcom-only">Publishing an action in the {% data variables.product.prodname_marketplace %}</a>."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.22" %}
|
||||
You can choose whether {% data variables.large_files.product_name_long %} ({% data variables.large_files.product_name_short %}) objects are included in the ZIP files and tarballs that {% data variables.product.product_name %} creates for each release. For more information, see "[Managing {% data variables.large_files.product_name_short %} objects in archives of your repository](/github/administering-a-repository/managing-git-lfs-objects-in-archives-of-your-repository)."
|
||||
@@ -49,7 +49,7 @@ You can choose whether {% data variables.large_files.product_name_long %} ({% da
|
||||
9. If you're ready to publicize your release, click **Publish release**. To work on the release later, click **Save draft**.
|
||||
|
||||
|
||||
You can also automatically create a release from the command line or in a script. For more information, see "[Releases](/v3/repos/releases/#create-a-release)."
|
||||
You can also automatically create a release from the command line or in a script. For more information, see "[Releases](/rest/reference/repos/#create-a-release)."
|
||||
|
||||
### Editing a release
|
||||
|
||||
|
||||
@@ -14,7 +14,7 @@ versions:
|
||||
|
||||
{% endnote %}
|
||||
|
||||
People with read access to a repository can see an overview of all current deployments and a log of past deployment activity, if the repository's deployment workflow is integrated with {% data variables.product.product_name %} through the Deployments API or an app from [{% data variables.product.prodname_marketplace %}](https://github.com/marketplace/category/deployment). For more information, see "[Deployments](/v3/repos/deployments/)."
|
||||
People with read access to a repository can see an overview of all current deployments and a log of past deployment activity, if the repository's deployment workflow is integrated with {% data variables.product.product_name %} through the Deployments API or an app from [{% data variables.product.prodname_marketplace %}](https://github.com/marketplace/category/deployment). For more information, see "[Deployments](/rest/reference/repos#deployments)."
|
||||
|
||||
You can also see deployment information on the "Conversation" tab of a pull request.
|
||||
|
||||
|
||||
@@ -46,7 +46,7 @@ You can navigate between the checks summaries for various commits in a pull requ
|
||||
|
||||
#### Skipping and requesting checks for individual commits
|
||||
|
||||
When a repository is set to automatically request checks for pushes, you can choose to skip checks for an individual commit you push. When a repository is _not_ set to automatically request checks for pushes, you can request checks for an individual commit you push. For more information on these settings, see "[Check Suites](/v3/checks/suites/#set-preferences-for-check-suites-on-a-repository)."
|
||||
When a repository is set to automatically request checks for pushes, you can choose to skip checks for an individual commit you push. When a repository is _not_ set to automatically request checks for pushes, you can request checks for an individual commit you push. For more information on these settings, see "[Check Suites](/rest/reference/checks#update-repository-preferences-for-check-suites)."
|
||||
|
||||
To skip or request checks for your commit, add one of the following trailer lines to the end of your commit message:
|
||||
|
||||
|
||||
@@ -13,13 +13,9 @@ versions:
|
||||
|
||||
You can change the most recent commit message using the `git commit --amend` command.
|
||||
|
||||
{% warning %}
|
||||
|
||||
In Git, the text of the commit message is part of the commit. Changing the commit message will change the commit ID--i.e., the SHA1 checksum that names the commit. Effectively, you are creating a new commit that replaces the old one.
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
#### Commit has not been pushed online
|
||||
### Commit has not been pushed online
|
||||
|
||||
If the commit only exists in your local repository and has not been pushed to {% data variables.product.product_location %}, you can amend the commit message with the `git commit --amend` command.
|
||||
|
||||
@@ -39,7 +35,7 @@ You can change the default text editor for Git by changing the `core.editor` set
|
||||
|
||||
{% endtip %}
|
||||
|
||||
#### Amending older or multiple commit messages
|
||||
### Amending older or multiple commit messages
|
||||
|
||||
If you have already pushed the commit to {% data variables.product.product_location %}, you will have to force push a commit with an amended message.
|
||||
|
||||
@@ -49,7 +45,7 @@ We strongly discourage force pushing, since this changes the history of your rep
|
||||
|
||||
{% endwarning %}
|
||||
|
||||
**Amending the message of the most recently pushed commit**
|
||||
**Changing the message of the most recently pushed commit**
|
||||
|
||||
1. Follow the [steps above](/articles/changing-a-commit-message#commit-has-not-been-pushed-online) to amend the commit message.
|
||||
2. Use the `push --force` command to force push over the old commit.
|
||||
@@ -57,7 +53,7 @@ We strongly discourage force pushing, since this changes the history of your rep
|
||||
$ git push --force <em>example-branch</em>
|
||||
```
|
||||
|
||||
**Amending the message of older or multiple commit messages**
|
||||
**Changing the message of older or multiple commit messages**
|
||||
|
||||
If you need to amend the message for multiple commits or an older commit, you can use interactive rebase, then force push to change the commit history.
|
||||
|
||||
@@ -93,7 +89,6 @@ If you need to amend the message for multiple commits or an older commit, you ca
|
||||
#
|
||||
# Note that empty commits are commented out
|
||||
```
|
||||
|
||||
3. Replace `pick` with `reword` before each commit message you want to change.
|
||||
```shell
|
||||
pick e499d89 Delete CNAME
|
||||
@@ -102,10 +97,10 @@ If you need to amend the message for multiple commits or an older commit, you ca
|
||||
```
|
||||
4. Save and close the commit list file.
|
||||
5. In each resulting commit file, type the new commit message, save the file, and close it.
|
||||
6. Force-push the amended commits.
|
||||
```shell
|
||||
$ git push --force
|
||||
```
|
||||
6. When you're ready to push your changes to GitHub, use the push --force command to force push over the old commit.
|
||||
```shell
|
||||
$ git push --force <em>example-branch</em>
|
||||
```
|
||||
|
||||
For more information on interactive rebase, see "[Interactive mode](https://git-scm.com/docs/git-rebase#_interactive_mode)" in the Git manual.
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@ versions:
|
||||
|
||||
Once a repository is archived, you cannot add or remove collaborators or teams. Contributors with access to the repository can only fork or star your project.
|
||||
|
||||
When a repository is archived, its issues, pull requests, code, labels, milestones, projects, wiki, releases, commits, tags, branches, reactions, and comments become read-only. To make changes in an archived repository, you must unarchive the repository first.
|
||||
When a repository is archived, its issues, pull requests, code, labels, milestones, projects, wiki, releases, commits, tags, branches, reactions, code scanning alerts, and comments become read-only. To make changes in an archived repository, you must unarchive the repository first.
|
||||
|
||||
You can search for archived repositories. For more information, see "[Searching for repositories](/articles/searching-for-repositories/#search-based-on-whether-a-repository-is-archived)." You can also search for issues and pull requests within archived repositories. For more information, see "[Searching issues and pull requests](/articles/searching-issues-and-pull-requests/#search-based-on-whether-a-repository-is-archived)."
|
||||
|
||||
|
||||
@@ -21,12 +21,12 @@ When you clone a repository or wiki, only Git data, such as project files and co
|
||||
|
||||
- [Issues](/v3/issues/#list-issues-for-a-repository)
|
||||
- [Pull requests](/v3/pulls/#list-pull-requests)
|
||||
- [Forks](/v3/repos/forks/#list-forks)
|
||||
- [Comments](/v3/issues/comments/#list-comments-in-a-repository)
|
||||
- [Milestones](/v3/issues/milestones/#list-milestones-for-a-repository)
|
||||
- [Labels](/v3/issues/labels/#list-all-labels-for-this-repository)
|
||||
- [Watchers](/v3/activity/watching/#list-watchers)
|
||||
- [Stargazers](/v3/activity/starring/#list-stargazers)
|
||||
- [Forks](/rest/reference/repos#list-forks)
|
||||
- [Comments](/rest/reference/issues#list-issue-comments-for-a-repository)
|
||||
- [Milestones](/rest/reference/issues#list-milestones)
|
||||
- [Labels](/rest/reference/issues#list-labels-for-a-repository)
|
||||
- [Watchers](/rest/reference/activity#list-watchers)
|
||||
- [Stargazers](/rest/reference/activity#list-stargazers)
|
||||
- [Projects](/v3/projects/#list-repository-projects)
|
||||
{% endif %}
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ versions:
|
||||
|
||||
{% data reusables.codespaces.release-stage %}
|
||||
|
||||
### Connecting the {% data variables.product.prodname_vs_codespaces %} extension to your {% data variables.product.prodname_dotcom %} account
|
||||
### Prerequisites
|
||||
|
||||
Before you can develop in a codespace directly in {% data variables.product.prodname_vscode %}, you must configure the {% data variables.product.prodname_vs_codespaces %} extension to connect to your {% data variables.product.product_name %} account.
|
||||
|
||||
@@ -29,11 +29,27 @@ Before you can develop in a codespace directly in {% data variables.product.prod
|
||||
8. To authorize {% data variables.product.prodname_vscode %} to access your account on {% data variables.product.product_name %}, click **Allow**.
|
||||
9. Sign in to {% data variables.product.product_name %} to approve the extension.
|
||||
|
||||
### Opening a codespace in {% data variables.product.prodname_vscode %}
|
||||
### Creating a codespace in {% data variables.product.prodname_vscode %}
|
||||
|
||||
After you've connected your {% data variables.product.product_name %} account to the {% data variables.product.prodname_vs_codespaces %} extension, you can develop in a codespace that you created on {% data variables.product.product_name %} directly in {% data variables.product.prodname_vscode %}.
|
||||
After you connect your {% data variables.product.product_name %} account to the {% data variables.product.prodname_vs_codespaces %} extension, you can develop in a codespace that you created on {% data variables.product.product_name %} or in {% data variables.product.prodname_vscode %}.
|
||||
|
||||
{% data reusables.codespaces.click-remote-explorer-icon-vscode %}
|
||||
2. Click the Add icon, then click **Create New Codespace**.
|
||||
|
||||
3. Type, then click the repository's name you want to develop in.
|
||||
|
||||
4. Click the branch you want to develop in.
|
||||
|
||||
|
||||
### Opening a codespace in {% data variables.product.prodname_vscode %}
|
||||
|
||||
{% data reusables.codespaces.click-remote-explorer-icon-vscode %}
|
||||
2. Under Codespaces, click the codespace you want to develop in.
|
||||
3. Click the Connect to Codespace icon.
|
||||
|
||||
|
||||
### Deleting a codespace in {% data variables.product.prodname_vscode %}
|
||||
|
||||
1. Under Codespaces, right-click the codespace you want to delete.
|
||||
2. In the drop-down menu, click **Delete Codespace**.
|
||||
|
||||
|
||||
@@ -13,8 +13,6 @@ versions:
|
||||
|
||||
As an alternative to running {% data variables.product.prodname_code_scanning %} within {% data variables.product.prodname_dotcom %}, you can perform analysis elsewhere and then upload the results. Alerts for {% data variables.product.prodname_code_scanning %} that you run externally are displayed in the same way as those for {% data variables.product.prodname_code_scanning %} that you run within {% data variables.product.prodname_dotcom %}. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
You can use your continuous integration or continuous delivery/deployment (CI/CD) system to run {% data variables.product.prodname_dotcom %}'s {% data variables.product.prodname_codeql %} analysis and upload the results to {% data variables.product.prodname_dotcom %}. This is an alternative to using {% data variables.product.prodname_actions %} to run {% data variables.product.prodname_codeql %} analysis. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
|
||||
If you use a third-party static analysis tool that can produce results as Static Analysis Results Interchange Format (SARIF) 2.1.0 data, you can upload this to {% data variables.product.prodname_dotcom %}. For more information, see "[Uploading a SARIF file to GitHub](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)."
|
||||
|
||||
### Integrations with webhooks
|
||||
@@ -23,6 +21,6 @@ You can use {% data variables.product.prodname_code_scanning %} webhooks to buil
|
||||
|
||||
### Further reading
|
||||
|
||||
* "[About code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)"
|
||||
* "[Configuring code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)"
|
||||
* "[SARIF support for code scanning](/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning)"
|
||||
* "[About {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)"
|
||||
* "[Using {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI system
|
||||
* "[SARIF support for {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/sarif-support-for-code-scanning)"
|
||||
|
||||
@@ -14,9 +14,9 @@ versions:
|
||||
|
||||
### About {% data variables.product.prodname_code_scanning %} configuration
|
||||
|
||||
You can run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_location %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
You can run {% data variables.product.prodname_code_scanning %} within {% data variables.product.product_location %}, using {% data variables.product.prodname_actions %}, or from your continuous integration (CI) system, using the {% data variables.product.prodname_codeql_runner %}. For more information about {% data variables.product.prodname_actions %}, see "[About {% data variables.product.prodname_actions %}](/actions/getting-started-with-github-actions/about-github-actions)." For more information about the {% data variables.product.prodname_codeql_runner %}, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
|
||||
|
||||
This article relates to running {% data variables.product.prodname_code_scanning %} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_ghe_server %}{% else %}{% data variables.product.prodname_dotcom %}{% endif %}.
|
||||
This article is about running {% data variables.product.prodname_code_scanning %} within {% if currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_ghe_server %}{% else %}{% data variables.product.prodname_dotcom %}{% endif %}.
|
||||
|
||||
Before you can configure {% data variables.product.prodname_code_scanning %} for a repository, you must enable {% data variables.product.prodname_code_scanning %} by adding a {% data variables.product.prodname_actions %} workflow to the repository. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %} for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository)."
|
||||
|
||||
@@ -130,6 +130,52 @@ If your workflow does not contain a matrix called `language`, then {% data varia
|
||||
with:
|
||||
languages: cpp, csharp, python
|
||||
```
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
### Analyzing Python dependencies
|
||||
|
||||
For GitHub-hosted runners that use Linux only, the {% data variables.product.prodname_codeql_workflow %} will try to auto-install Python dependencies to give more results for the CodeQL analysis. You can control this behavior by specifying the `setup-python-dependencies` parameter for the action called by the "Initialize CodeQL" step. By default, this parameter is set to `true`:
|
||||
|
||||
- If the repository contains code written in Python, the "Initialize CodeQL" step installs the necessary dependencies on the GitHub-hosted runner. If the auto-install succeeds, the action also sets the environment variable `CODEQL_PYTHON` to the Python executable file that includes the dependencies.
|
||||
|
||||
- If the repository doesn't have any Python dependencies, or the dependencies are specified in an unexpected way, you'll get a warning and the action will continue with the remaining jobs. The action can run successfully even when there are problems interpreting dependencies, but the results may be incomplete.
|
||||
|
||||
Alternatively, you can install Python dependencies manually on any operating system. You will need to add `setup-python-dependencies` and set it to `false`, as well as set `CODEQL_PYTHON` to the Python executable that includes the dependencies, as shown in this workflow extract:
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
CodeQL-Build:
|
||||
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
fetch-depth: 2
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x'
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
if [ -f requirements.txt ];
|
||||
then pip install -r requirements.txt;
|
||||
fi
|
||||
# Set the `CODEQL-PYTHON` environment variable to the Python executable
|
||||
# that includes the dependencies
|
||||
echo "::set-env name=CODEQL_PYTHON::$(which python)"
|
||||
- run: git checkout HEAD^2
|
||||
if: ${{ github.event_name == 'pull_request' }}
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v1
|
||||
with:
|
||||
languages: python
|
||||
# Override the default behavior so that the action doesn't attempt
|
||||
# to auto-install Python dependencies
|
||||
setup-python-dependencies: false
|
||||
```
|
||||
{% endif %}
|
||||
|
||||
### Running additional queries
|
||||
|
||||
@@ -140,7 +186,7 @@ To add one or more queries, add a `with: queries:` entry within the `uses: githu
|
||||
``` yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
with:
|
||||
- queries: COMMA-SEPARATED LIST OF PATHS
|
||||
queries: COMMA-SEPARATED LIST OF PATHS
|
||||
```
|
||||
|
||||
You can also specify query suites in the value of `queries`. Query suites are collections of queries, usually grouped by purpose or language.
|
||||
@@ -154,8 +200,8 @@ In the following example, the `+` symbol ensures that the specified additional q
|
||||
``` yaml
|
||||
- uses: github/codeql-action/init@v1
|
||||
with:
|
||||
- config-file: ./.github/codeql/codeql-config.yml
|
||||
- queries: +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main
|
||||
config-file: ./.github/codeql/codeql-config.yml
|
||||
queries: +security-and-quality,octo-org/python-qlpack/show_ifs.ql@main
|
||||
```
|
||||
|
||||
### Using a custom configuration file
|
||||
@@ -222,7 +268,7 @@ You can quickly analyze small portions of a monorepo when you modify code in spe
|
||||
|
||||
### Configuring {% data variables.product.prodname_code_scanning %} for compiled languages
|
||||
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %} In contrast to the other compiled languages, CodeQL can successfully analyze Go without building the code.
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %} {% data reusables.code-scanning.analyze-go %}
|
||||
|
||||
{% data reusables.code-scanning.autobuild-add-build-steps %} For more information about how to configure {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} for compiled languages, see "[Configuring the {% data variables.product.prodname_codeql %} workflow for compiled languages](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-the-codeql-workflow-for-compiled-languages)."
|
||||
|
||||
|
||||
@@ -1,9 +1,11 @@
|
||||
---
|
||||
title: Configuring code scanning in your CI system
|
||||
title: Configuring CodeQL code scanning in your CI system
|
||||
shortTitle: Configuring in your CI
|
||||
intro: 'You can configure how the {% data variables.product.prodname_codeql_runner %} scans the code in your project and uploads the results to {% data variables.product.prodname_dotcom %}.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
miniTocMaxHeadingLevel: 4
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
@@ -13,9 +15,9 @@ versions:
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### About {% data variables.product.prodname_code_scanning %} configuration in your CI system
|
||||
### About configuring {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system
|
||||
|
||||
To integrate {% data variables.product.prodname_code_scanning %} into your CI system, you can use the {% data variables.product.prodname_codeql_runner %}. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
To integrate {% data variables.product.prodname_code_scanning %} into your CI system, you can use the {% data variables.product.prodname_codeql_runner %}. For more information, see "[Running {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
|
||||
|
||||
In general, you invoke the {% data variables.product.prodname_codeql_runner %} as follows.
|
||||
|
||||
@@ -79,7 +81,7 @@ $ /path/to-runner/codeql-runner-linux init --config-file .github/codeql/codeql-c
|
||||
|
||||
### Configuring {% data variables.product.prodname_code_scanning %} for compiled languages
|
||||
|
||||
For the compiled languages C/C++, C#, and Java, {% data variables.product.prodname_codeql %} builds the code before analyzing it. In contrast to the other compiled languages, {% data variables.product.prodname_codeql %} analyzes Go without building the code.
|
||||
For the compiled languages C/C++, C#, and Java, {% data variables.product.prodname_codeql %} builds the code before analyzing it. {% data reusables.code-scanning.analyze-go %}
|
||||
|
||||
For many common build systems, the {% data variables.product.prodname_codeql_runner %} can build the code automatically. To attempt to build the code automatically, run `autobuild` between the `init` and `analyze` steps. Note that if your repository requires a specific version of a build tool, you may need to install the build tool manually first.
|
||||
|
||||
@@ -89,7 +91,7 @@ The `autobuild` process only ever attempts to build _one_ compiled language for
|
||||
$ /path/to-runner/codeql-runner-linux autobuild --language csharp
|
||||
```
|
||||
|
||||
If the `autobuild` command can't build your code, you can run the build steps yourself, between the `init` and `analyze` steps. For more information, see "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system#compiled-language-example)."
|
||||
If the `autobuild` command can't build your code, you can run the build steps yourself, between the `init` and `analyze` steps. For more information, see "[Running {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system#compiled-language-example)."
|
||||
|
||||
### Uploading {% data variables.product.prodname_code_scanning %} data to {% data variables.product.prodname_dotcom %}
|
||||
|
||||
@@ -24,7 +24,7 @@ For general information about configuring {% data variables.product.prodname_cod
|
||||
|
||||
### About autobuild for {% data variables.product.prodname_codeql %}
|
||||
|
||||
Code scanning works by running queries against one or more databases. Each database contains a representation of all of the code in a single language in your repository. For the compiled languages C/C++, C#, and Java, the process of populating this database involves building the code and extracting data. In contrast to the other compiled languages, CodeQL can generate a database for Go without building the code.
|
||||
Code scanning works by running queries against one or more databases. Each database contains a representation of all of the code in a single language in your repository. For the compiled languages C/C++, C#, and Java, the process of populating this database involves building the code and extracting data. {% data reusables.code-scanning.analyze-go %}
|
||||
|
||||
{% data reusables.code-scanning.autobuild-compiled-languages %}
|
||||
|
||||
|
||||
@@ -20,8 +20,9 @@ versions:
|
||||
{% link_in_list /troubleshooting-the-codeql-workflow %}
|
||||
{% topic_link_in_list /integrating-with-code-scanning %}
|
||||
{% link_in_list /about-integration-with-code-scanning %}
|
||||
{% link_in_list /running-code-scanning-in-your-ci-system %}
|
||||
{% link_in_list /configuring-code-scanning-in-your-ci-system %}
|
||||
{% link_in_list /troubleshooting-code-scanning-in-your-ci-system %}
|
||||
{% link_in_list /uploading-a-sarif-file-to-github %}
|
||||
{% link_in_list /sarif-support-for-code-scanning %}
|
||||
{% topic_link_in_list /using-codeql-code-scanning-with-your-existing-ci-system %}
|
||||
{% link_in_list /running-codeql-code-scanning-in-your-ci-system %}
|
||||
{% link_in_list /configuring-codeql-code-scanning-in-your-ci-system %}
|
||||
{% link_in_list /troubleshooting-codeql-code-scanning-in-your-ci-system %}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Integrating with code scanning
|
||||
shortTitle: Integration
|
||||
intro: 'You can integrate {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI systems or upload results from other tools.'
|
||||
intro: 'You can integrate third-party code analysis tools with {% data variables.product.prodname_dotcom %} {% data variables.product.prodname_code_scanning %} by uploading data as SARIF files.'
|
||||
mapTopic: true
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
title: Running code scanning in your CI system
|
||||
title: Running CodeQL code scanning in your CI system
|
||||
shortTitle: Running in your CI
|
||||
intro: 'If you use a third-party continuous integration system, you can integrate {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} into this system using the {% data variables.product.prodname_codeql_runner %}.'
|
||||
intro: 'You can use the {% data variables.product.prodname_codeql_runner %} to perform {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in a third-party continuous integration system.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
@@ -12,6 +14,10 @@ versions:
|
||||
{% data reusables.code-scanning.beta %}
|
||||
{% data reusables.code-scanning.enterprise-enable-code-scanning %}
|
||||
|
||||
### Using {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} with your existing CI system
|
||||
|
||||
If you use a continuous integration or continuous delivery/deployment (CI/CD) system other than {% data variables.product.prodname_actions %}, you can use your existing system to run {% data variables.product.prodname_dotcom %}'s {% data variables.product.prodname_codeql %} analysis and upload the results to {% data variables.product.prodname_dotcom %}. To do this, use the {% data variables.product.prodname_codeql_runner %}.
|
||||
|
||||
### About the {% data variables.product.prodname_codeql_runner %}
|
||||
|
||||
{% data reusables.code-scanning.about-code-scanning %} For information, see "[About {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning)."
|
||||
@@ -39,9 +45,18 @@ chmod +x codeql-runner-macos
|
||||
sudo xattr -d com.apple.quarantine codeql-runner-macos
|
||||
```
|
||||
|
||||
On Windows, the `codeql-runner-win.exe` file usually requires no change to permissions.
|
||||
|
||||
### Adding the {% data variables.product.prodname_codeql_runner %} to your CI system
|
||||
|
||||
Once you have downloaded the {% data variables.product.prodname_codeql_runner %} and verified that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. In addition to this, each CI server also needs:
|
||||
Once you have downloaded the {% data variables.product.prodname_codeql_runner %} and verified that it can be executed, you should make the runner available to each CI server that you intend to use for {% data variables.product.prodname_code_scanning %}. It is important to notice that each CI server that you intend to use for {% data variables.product.prodname_code_scanning %} needs to have the {% data variables.product.prodname_codeql_runner %}. You might configure each server to copy the runner from a central, internal location, or you could use the REST API to get the runner direct from GitHub, for example:
|
||||
|
||||
```shell
|
||||
wget https://github.com/github/codeql-action/releases/download/codeql-bundle-20200826/codeql-runner-linux
|
||||
chmod +x codeql-runner-linux
|
||||
```
|
||||
|
||||
In addition to this, each CI server also needs:
|
||||
|
||||
- A {% data variables.product.prodname_github_apps %} or personal access token for the {% data variables.product.prodname_codeql_runner %} to use. For private repositories the token must have the `repo` scope. For public the token needs only the `public_repo` and `repo:security_events` scopes. For information, see "[Building {% data variables.product.prodname_github_apps %}](/developers/apps/building-github-apps)" and "[Creating a personal access token](/github/authenticating-to-github/creating-a-personal-access-token)."
|
||||
- Access to the {% data variables.product.prodname_codeql %} bundle associated with this release of the {% data variables.product.prodname_codeql_runner %}. This package contains the {% data variables.product.prodname_codeql %} CLI, queries, and libraries needed for {% data variables.product.prodname_codeql %} analysis. For information, see "[{% data variables.product.prodname_codeql %} CLI](https://help.semmle.com/codeql/codeql-cli.html)."
|
||||
@@ -64,7 +79,7 @@ For both commands, you must specify the URL of {% data variables.product.product
|
||||
|
||||
You can configure where the {% data variables.product.prodname_codeql_runner %} stores the CodeQL bundle for future analysis on a server using the <nobr>`--tools-dir`</nobr> flag and where it stores temporary files during analysis using <nobr>`--temp-dir`</nobr>.
|
||||
|
||||
To view the command-line reference for the runner, use the `-h` flag. For example, to list all commands run: `codeql-runner-OS -h`, or to list all the flags available for the `init` command run: `codeql-runner-OS init -h` (where `OS` varies according to the executable that you are using). For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system#codeql-runner-command-reference)."
|
||||
To view the command-line reference for the runner, use the `-h` flag. For example, to list all commands run: `codeql-runner-OS -h`, or to list all the flags available for the `init` command run: `codeql-runner-OS init -h` (where `OS` varies according to the executable that you are using). For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system#codeql-runner-command-reference)."
|
||||
|
||||
#### Basic example
|
||||
|
||||
@@ -142,5 +157,5 @@ This example is similar to the previous example, however this time the repositor
|
||||
|
||||
### Further reading
|
||||
|
||||
- "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system)"
|
||||
- "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system)"
|
||||
- "[Troubleshooting {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-codeql-code-scanning-in-your-ci-system)"
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: SARIF support for code scanning
|
||||
shortTitle: SARIF support
|
||||
intro: 'To display results from a third-party static analysis tool in your repository on {% data variables.product.prodname_dotcom %}, you''ll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for code scanning. If you use the default {% data variables.product.prodname_codeql %} static analysis engine, then your results will display in your repository on {% data variables.product.prodname_dotcom %} automatically.'
|
||||
intro: 'To display results from a third-party static analysis tool in your repository on {% data variables.product.prodname_dotcom %}, you''ll need your results stored in a SARIF file that supports a specific subset of the SARIF 2.1.0 JSON schema for {% data variables.product.prodname_code_scanning %}. If you use the default {% data variables.product.prodname_codeql %} static analysis engine, then your results will display in your repository on {% data variables.product.prodname_dotcom %} automatically.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/about-sarif-support-for-code-scanning
|
||||
@@ -16,9 +16,9 @@ versions:
|
||||
|
||||
SARIF (Static Analysis Results Interchange Format) is an [OASIS Standard](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) that defines an output file format. The SARIF standard is used to streamline how static analysis tools share their results. {% data variables.product.prodname_code_scanning_capc %} supports a subset of the SARIF 2.1.0 JSON schema.
|
||||
|
||||
To upload a SARIF file from a third-party static code analysis engine, you'll need to ensure that uploaded files use the SARIF 2.1.0 version. {% data variables.product.prodname_dotcom %} will parse the SARIF file and show alerts using the results in your repository as a part of the code scanning experience. For more information, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)." For more information about the SARIF 2.1.0 JSON schema, see [`sarif-schema-2.1.0.json`](https://github.com/oasis-tcs/sarif-spec/blob/master/Schemata/sarif-schema-2.1.0.json).
|
||||
To upload a SARIF file from a third-party static code analysis engine, you'll need to ensure that uploaded files use the SARIF 2.1.0 version. {% data variables.product.prodname_dotcom %} will parse the SARIF file and show alerts using the results in your repository as a part of the {% data variables.product.prodname_code_scanning %} experience. For more information, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github)." For more information about the SARIF 2.1.0 JSON schema, see [`sarif-schema-2.1.0.json`](https://github.com/oasis-tcs/sarif-spec/blob/master/Schemata/sarif-schema-2.1.0.json).
|
||||
|
||||
If you're using {% data variables.product.prodname_actions %} with the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning)" or "[Running code scanning in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)."
|
||||
If you're using {% data variables.product.prodname_actions %} with the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %}, then the {% data variables.product.prodname_code_scanning %} results will automatically use the supported subset of SARIF 2.1.0. For more information, see "[Enabling {% data variables.product.prodname_code_scanning %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning)" or "[Running {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)."
|
||||
|
||||
{% data variables.product.prodname_dotcom %} uses properties in the SARIF file to display alerts. For example, the `shortDescription` and `fullDescription` appear at the top of a {% data variables.product.prodname_code_scanning %} alert. The `location` allows {% data variables.product.prodname_dotcom %} to show annotations in your code file. For more information, see "[Managing {% data variables.product.prodname_code_scanning %} alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)."
|
||||
|
||||
@@ -32,11 +32,11 @@ Each time the results of a new code scan are uploaded, the results are processed
|
||||
|
||||
SARIF files created by the {% data variables.product.prodname_codeql_workflow %} or using the {% data variables.product.prodname_codeql_runner %} include fingerprint data. If you upload a SARIF file using the `upload-sarif` action and this data is missing, {% data variables.product.prodname_dotcom %} attempts to populate the `partialFingerprints` field from the source files. For more information about uploading results, see "[Uploading a SARIF file to {% data variables.product.prodname_dotcom %}](/github/finding-security-vulnerabilities-and-errors-in-your-code/uploading-a-sarif-file-to-github#uploading-a-code-scanning-analysis-with-github-actions)."
|
||||
|
||||
If you upload a SARIF file without fingerprint data using the `/code-scanning/sarifs` API endpoint, the code scanning alerts will be processed and displayed, but users may see duplicate alerts. To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the `partialFingerprints` property before you upload the SARIF file. You may find the script that the `upload-sarif` action uses a helpful starting point: https://github.com/github/codeql-action/blob/main/src/fingerprints.ts. For more information about the API, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)."
|
||||
If you upload a SARIF file without fingerprint data using the `/code-scanning/sarifs` API endpoint, the {% data variables.product.prodname_code_scanning %} alerts will be processed and displayed, but users may see duplicate alerts. To avoid seeing duplicate alerts, you should calculate fingerprint data and populate the `partialFingerprints` property before you upload the SARIF file. You may find the script that the `upload-sarif` action uses a helpful starting point: https://github.com/github/codeql-action/blob/main/src/fingerprints.ts. For more information about the API, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)."
|
||||
|
||||
### Validating your SARIF file
|
||||
|
||||
You can check a SARIF file is compatible with code scanning by testing it against the GitHub ingestion rules. For more information, visit the [Microsoft SARIF validator](https://sarifweb.azurewebsites.net/).
|
||||
You can check a SARIF file is compatible with {% data variables.product.prodname_code_scanning %} by testing it against the {% data variables.product.prodname_dotcom %} ingestion rules. For more information, visit the [Microsoft SARIF validator](https://sarifweb.azurewebsites.net/).
|
||||
|
||||
### Supported SARIF output file properties
|
||||
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
---
|
||||
title: Troubleshooting code scanning in your CI system
|
||||
title: Troubleshooting CodeQL code scanning in your CI system
|
||||
shortTitle: Troubleshooting in your CI
|
||||
intro: 'If you''re having problems with the {% data variables.product.prodname_codeql_runner %}, you can troubleshoot by using these tips.'
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
redirect_from:
|
||||
- /github/finding-security-vulnerabilities-and-errors-in-your-code/troubleshooting-code-scanning-in-your-ci-system
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
@@ -24,7 +26,7 @@ To avoid this automatic download, you can manually download the {% data variable
|
||||
|
||||
If the `analyze` command for the {% data variables.product.prodname_codeql_runner %} fails with an error `No source code was seen during the build`, this indicates that {% data variables.product.prodname_codeql %} was unable to monitor your code. Several reasons can explain such a failure.
|
||||
|
||||
1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by using the `--languages` flag of the `init` command. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning-in-your-ci-system)."
|
||||
1. Automatic language detection identified a supported language, but there is no analyzable code of that language in the repository. A typical example is when our language detection service finds a file associated with a particular programming language like a `.h`, or `.gyp` file, but no corresponding executable code is present in the repository. To solve the problem, you can manually define the languages you want to analyze by using the `--languages` flag of the `init` command. For more information, see "[Configuring {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-codeql-code-scanning-in-your-ci-system)."
|
||||
|
||||
1. You're analyzing a compiled language without using the `autobuild` command and you run the build steps yourself after the `init` step. For the build to work, you must set up the environment such that the {% data variables.product.prodname_codeql_runner %} can monitor the code. The `init` command generates instructions for how to export the required environment variables, so you can copy and run the script after you've run the `init` command.
|
||||
- On macOS and Linux:
|
||||
@@ -114,3 +114,12 @@ If you split your analysis into multiple workflows as described above, we still
|
||||
#### Run only during a `schedule` event
|
||||
|
||||
If your analysis is still too slow to be run during `push` or `pull_request` events, then you may want to only trigger analysis on the `schedule` event. For more information, see "[Events](/actions/learn-github-actions/introduction-to-github-actions#events)."
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
### Results differ between analysis platforms
|
||||
|
||||
If you are analyzing code written in Python, you may see different results depending on whether you run the {% data variables.product.prodname_codeql_workflow %} on Linux, macOS, or Windows.
|
||||
|
||||
On GitHub-hosted runners that use Linux, the {% data variables.product.prodname_codeql_workflow %} tries to install and analyze Python dependencies, which could lead to more results. To disable the auto-install, add `setup-python-dependencies: false` to the "Initialize CodeQL" step of the workflow. For more information about configuring the analysis of Python dependencies, see "[Analyzing Python dependencies](/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#analyzing-python-dependencies)."
|
||||
|
||||
{% endif %}
|
||||
@@ -24,7 +24,7 @@ You can upload the results using {% data variables.product.prodname_actions %}{%
|
||||
|
||||
- {% data variables.product.prodname_actions %} to run the {% data variables.product.prodname_codeql %} action, there is no further action required. The {% data variables.product.prodname_codeql %} action uploads the SARIF file automatically when it completes analysis.
|
||||
- {% data variables.product.prodname_actions %} to run a SARIF-compatible analysis tool, you could update the workflow to include a final step that uploads the results (see below).
|
||||
- The {% data variables.product.prodname_codeql_runner %}, to run {% data variables.product.prodname_code_scanning %} in your CI system, by default the runner automatically uploads results to {% data variables.product.prodname_dotcom %} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)").
|
||||
- The {% data variables.product.prodname_codeql_runner %}, to run {% data variables.product.prodname_code_scanning %} in your CI system, by default the runner automatically uploads results to {% data variables.product.prodname_dotcom %} on completion. If you block the automatic upload, when you are ready to upload results you can use the `upload` command (for more information, see "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)").
|
||||
- A tool that generates results as an artifact outside of your repository, you can use the {% data variables.product.prodname_code_scanning %} API to upload the file (for more information, see "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)").
|
||||
|
||||
### Uploading a {% data variables.product.prodname_code_scanning %} analysis with {% data variables.product.prodname_actions %}
|
||||
@@ -110,5 +110,5 @@ jobs:
|
||||
|
||||
- "[Workflow syntax for {% data variables.product.prodname_actions %}](/actions/reference/workflow-syntax-for-github-actions)"
|
||||
- "[Viewing your workflow history](/actions/managing-workflow-runs/viewing-workflow-run-history)"
|
||||
- "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-code-scanning-in-your-ci-system)"
|
||||
- "[Running {% data variables.product.prodname_code_scanning %} in your CI system](/github/finding-security-vulnerabilities-and-errors-in-your-code/running-codeql-code-scanning-in-your-ci-system)"
|
||||
- "[Upload a SARIF file](/rest/reference/code-scanning#upload-a-sarif-file)"
|
||||
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
title: Using CodeQL code scanning with your existing CI system
|
||||
shortTitle: CodeQL CI system support
|
||||
intro: 'The {% data variables.product.prodname_codeql_runner %} allows you to use your existing CI system to run {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %}.'
|
||||
mapTopic: true
|
||||
product: '{% data reusables.gated-features.code-scanning %}'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.22'
|
||||
---
|
||||
|
||||
@@ -32,8 +32,8 @@ Below is a list of some of the available keyboard shortcuts.
|
||||
|-----------|------------
|
||||
|<kbd>g</kbd> <kbd>c</kbd> | Go to the **Code** tab
|
||||
|<kbd>g</kbd> <kbd>i</kbd> | Go to the **Issues** tab. For more information, see "[About issues](/articles/about-issues)."
|
||||
|<kbd>g</kbd> <kbd>p</kbd> | Go to the **Pull requests** tab. For more information, see "[About pull requests](/articles/about-pull-requests)."
|
||||
|<kbd>g</kbd> <kbd>a</kbd> | Go to the **Actions** tab. For more information, see "[About Actions](/actions/getting-started-with-github-actions/about-github-actions)."
|
||||
|<kbd>g</kbd> <kbd>p</kbd> | Go to the **Pull requests** tab. For more information, see "[About pull requests](/articles/about-pull-requests)."{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
|<kbd>g</kbd> <kbd>a</kbd> | Go to the **Actions** tab. For more information, see "[About Actions](/actions/getting-started-with-github-actions/about-github-actions)."{% endif %}
|
||||
|<kbd>g</kbd> <kbd>b</kbd> | Go to the **Projects** tab. For more information, see "[About project boards](/articles/about-project-boards)."
|
||||
|<kbd>g</kbd> <kbd>w</kbd> | Go to the **Wiki** tab. For more information, see "[About wikis](/articles/about-wikis)."
|
||||
|
||||
|
||||
@@ -86,7 +86,7 @@ versions:
|
||||
```
|
||||
9. [Push the changes](/articles/pushing-commits-to-a-remote-repository/) in your local repository to {% data variables.product.product_location %}.
|
||||
```shell
|
||||
$ git push origin master
|
||||
$ git push origin main
|
||||
# Pushes the changes in your local repository up to the remote repository you specified as the origin
|
||||
```
|
||||
|
||||
@@ -123,7 +123,7 @@ versions:
|
||||
```
|
||||
9. [Push the changes](/articles/pushing-commits-to-a-remote-repository/) in your local repository to {% data variables.product.product_location %}.
|
||||
```shell
|
||||
$ git push origin master
|
||||
$ git push origin main
|
||||
# Pushes the changes in your local repository up to the remote repository you specified as the origin
|
||||
```
|
||||
|
||||
|
||||
@@ -77,15 +77,15 @@ We send security alerts to people with admin permissions in the affected reposit
|
||||
### Configuring notifications for {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_alerts %}{% else %}security alerts{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" %}
|
||||
By default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability. You can also choose to receive {% data variables.product.prodname_dependabot_alerts %} in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-dependabot-alerts-options)."
|
||||
By default, you will receive {% data variables.product.prodname_dependabot_alerts %} by email, grouped by the specific vulnerability. You can also choose to receive {% data variables.product.prodname_dependabot_alerts %} in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-dependabot-alerts-notification-options)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion != "free-pro-team@latest" and currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
By default, if your site administrator has configured email for notifications on your instance, you will receive {% data variables.product.prodname_dependabot_alerts %} by email. You can also choose to receive {% data variables.product.prodname_dependabot_alerts %} in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-dependabot-alerts-options)."
|
||||
By default, if your site administrator has configured email for notifications on your instance, you will receive {% data variables.product.prodname_dependabot_alerts %} by email. You can also choose to receive {% data variables.product.prodname_dependabot_alerts %} in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#github-dependabot-alerts-notification-options)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion != "free-pro-team@latest" and currentVersion == "enterprise-server@2.21" %}
|
||||
By default, if your site administrator has configured email for notifications on your instance, you will receive security alerts by email. You can also choose to receive security alerts in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#security-alert-options)."
|
||||
By default, if your site administrator has configured email for notifications on your instance, you will receive security alerts by email. You can also choose to receive security alerts in a weekly email summarizing alerts for up to 10 of your repositories, in your web notifications, or in the {% data variables.product.product_name %} user interface. For more information, see "[Configuring notifications](/github/managing-subscriptions-and-notifications-on-github/configuring-notifications#security-alert-notification-options)."
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion != "free-pro-team@latest" and currentVersion ver_lt "enterprise-server@2.21" %}
|
||||
|
||||
@@ -120,8 +120,8 @@ Email notifications from {% data variables.product.product_name %} contain the f
|
||||
3. On the notifications settings page, choose how you receive notifications when:
|
||||
- There are updates in repositories or team discussions you're watching or in a conversation you're participating in. For more information, see "[About participating and watching notifications](#about-participating-and-watching-notifications)."
|
||||
- You gain access to a new repository or you've joined a new team. For more information, see "[Automatic watching](#automatic-watching)."{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
- There are new {% data variables.product.prodname_dependabot_alerts %} in your repository. For more information, see "[{% data variables.product.prodname_dependabot_alerts %} options](#github-dependabot-alerts-options)." {% endif %}{% if currentVersion == "enterprise-server@2.21" %}
|
||||
- There are new security alerts in your repository. For more information, see "[Security alert options](#security-alert-options)." {% endif %} {% if currentVersion == "free-pro-team@latest" %}
|
||||
- There are new {% data variables.product.prodname_dependabot_alerts %} in your repository. For more information, see "[{% data variables.product.prodname_dependabot_alerts %} notification options](#github-dependabot-alerts-notification-options)." {% endif %}{% if currentVersion == "enterprise-server@2.21" %}
|
||||
- There are new security alerts in your repository. For more information, see "[Security alert notification options](#security-alert-notification-options)." {% endif %} {% if currentVersion == "free-pro-team@latest" %}
|
||||
- There are workflow runs updates on repositories set up with {% data variables.product.prodname_actions %}. For more information, see "[{% data variables.product.prodname_actions %} notification options](#github-actions-notification-options)."{% endif %}
|
||||
|
||||
### Automatic watching
|
||||
@@ -158,9 +158,9 @@ If you are a member of more than one organization, you can configure each one to
|
||||
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
### {% data variables.product.prodname_dependabot_alerts %} options
|
||||
### {% data variables.product.prodname_dependabot_alerts %} notification options
|
||||
{% else %}
|
||||
### Security alert options
|
||||
### Security alert notification options
|
||||
{% endif %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}Choose how you want to receive {% data variables.product.prodname_dependabot_alerts %} for repositories that you are watching. You can receive {% data variables.product.prodname_dependabot_alerts %} in your inbox, as a banner on {% data variables.product.product_name %}, on the command line, through email, or some combination of these options.
|
||||
@@ -177,6 +177,12 @@ If you want to receive security alerts by email, choose whether you want a weekl
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% note %}
|
||||
|
||||
**Note:** You can filter your {% data variables.product.company_short %} inbox notifications by {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %} security{% endif %} alerts. For more information, see "[Managing notifications from your inbox](/github/managing-subscriptions-and-notifications-on-github/managing-notifications-from-your-inbox#supported-queries-for-custom-filters)."
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}
|
||||
|
||||
### {% data variables.product.prodname_actions %} notification options
|
||||
|
||||
@@ -112,7 +112,7 @@ To filter notifications by why you've received an update, you can use the `reaso
|
||||
|
||||
#### Supported `is:` queries
|
||||
|
||||
To filter notifications for specific activity on {% data variables.product.product_name %}, you can use the `is` query. For example, to only see repository invitation updates, use `is:repository-invitation`.
|
||||
To filter notifications for specific activity on {% data variables.product.product_name %}, you can use the `is` query. For example, to only see repository invitation updates, use `is:repository-invitation`, and to only see {% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.21" %}{% data variables.product.prodname_dependabot_short %}{% else %} security{% endif %} alerts, use `is:repository-vulnerability-alert`.
|
||||
|
||||
- `is:check-suite`
|
||||
- `is:commit`
|
||||
|
||||
@@ -3,7 +3,7 @@ title: About issues
|
||||
intro: 'Use issues to track ideas, enhancements, tasks, or bugs for work on {% data variables.product.product_name %}.'
|
||||
redirect_from:
|
||||
- /articles/creating-issues/
|
||||
- /articles/about-issues
|
||||
- /articles/about-issues/
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '*'
|
||||
|
||||
@@ -11,15 +11,16 @@ versions:
|
||||
|
||||
{% tip %}
|
||||
|
||||
**Tip:** You can also apply a label in the Labels drop-down menu within an issue or pull request.
|
||||
**Tip:** You can apply up to a maximum of 100 labels to issues and pull requests.
|
||||
|
||||
{% endtip %}
|
||||
|
||||
{% data reusables.repositories.navigate-to-repo %}
|
||||
{% data reusables.repositories.sidebar-issue-pr %}
|
||||
{% data reusables.repositories.select-items-in-issue-or-pr-list %}
|
||||
4. In the upper-right corner, click **Label**, then start typing the name of an existing label. Click the label's name to associate it with the selected items.
|
||||
4. In the upper-right corner, click **Label**, then start typing the name of an existing label. Click the label's name to associate it with the selected items. You can also apply a label in the Labels drop-down menu within an issue or pull request.
|
||||
|
||||
|
||||
|
||||
### Further reading
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: About searching on GitHub
|
||||
intro: 'Use our powerful search tools to find what you''re looking for among the many repositories, users, and lines of code on {% data variables.product.product_name %}.'
|
||||
intro: 'Our integrated search covers the many repositories, users, and lines of code on {% data variables.product.product_name %}.'
|
||||
redirect_from:
|
||||
- /articles/using-the-command-bar/
|
||||
- /articles/github-search-basics/
|
||||
@@ -24,6 +24,8 @@ You can search globally across all of {% data variables.product.product_name %},
|
||||
|
||||
- {% data reusables.search.required_login %}
|
||||
- {% data variables.product.prodname_pages %} sites are not searchable on {% data variables.product.product_name %}. However you can search the source content if it exists in the default branch of a repository, using code search. For more information, see "[Searching code](/articles/searching-code)." For more information about {% data variables.product.prodname_pages %}, see "[What is GitHub Pages?](/articles/what-is-github-pages/)"
|
||||
- Currently our search doesn't support exact matching.
|
||||
- Whenever you are searching in code files, only the first two results in each file will be returned.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
title: Configuring the retention period for GitHub Actions artifacts and logs in your organization
|
||||
intro: 'You can configure the retention period for {% data variables.product.prodname_actions %} artifacts and logs in your organization.'
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.23'
|
||||
---
|
||||
|
||||
{% data reusables.actions.about-artifact-log-retention %}
|
||||
|
||||
## Setting the retention period for an organization
|
||||
|
||||
{% data reusables.organizations.navigate-to-org %}
|
||||
{% data reusables.organizations.org_settings %}
|
||||
{% data reusables.organizations.settings-sidebar-actions %}
|
||||
{% data reusables.github-actions.change-retention-period-for-artifacts-logs %}
|
||||
@@ -100,6 +100,7 @@ versions:
|
||||
{% link_in_list /managing-the-forking-policy-for-your-organization %}
|
||||
<!-- if currentVersion == "free-pro-team@latest" -->
|
||||
{% link_in_list /disabling-or-limiting-github-actions-for-your-organization %}
|
||||
{% link_in_list /configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-organization %}
|
||||
<!-- endif -->
|
||||
<!-- if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@2.15" -->
|
||||
{% link_in_list /setting-permissions-for-adding-outside-collaborators %}
|
||||
|
||||
@@ -418,7 +418,7 @@ To ensure a secure IP and maintain compliance for your organization, you can use
|
||||
|
||||
The GraphQL response can include data for up to 90 to 120 days.
|
||||
|
||||
For example, you can make a GraphQL request to see all the new organization members added to your organization. For more information, see the "[GraphQL API Audit Log](/v4/interface/auditentry/)."
|
||||
For example, you can make a GraphQL request to see all the new organization members added to your organization. For more information, see the "[GraphQL API Audit Log](/graphql/reference/interfaces#auditentry/)."
|
||||
|
||||
### Further reading
|
||||
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
title: Configuring the retention period for GitHub Actions artifacts and logs in your enterprise account
|
||||
intro: 'Enterprise owners can configure the retention period for {% data variables.product.prodname_actions %} artifacts and logs in an enterprise account.'
|
||||
product: '{% data reusables.gated-features.enterprise-accounts %}'
|
||||
miniTocMaxHeadingLevel: 4
|
||||
versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '>=2.23'
|
||||
---
|
||||
|
||||
{% data reusables.actions.about-artifact-log-retention %}
|
||||
|
||||
## Setting the retention period for an enterprise
|
||||
|
||||
{% data reusables.enterprise_site_admin_settings.access-settings %}
|
||||
{% data reusables.enterprise_site_admin_settings.business %}
|
||||
{% data reusables.enterprise-accounts.policies-tab %}
|
||||
{% data reusables.enterprise-accounts.actions-tab %}
|
||||
{% data reusables.github-actions.change-retention-period-for-artifacts-logs %}
|
||||
@@ -33,3 +33,4 @@ versions:
|
||||
{% link_in_list /configuring-saml-single-sign-on-and-scim-for-your-enterprise-account-using-okta %}
|
||||
{% link_in_list /enforcing-a-policy-on-dependency-insights-in-your-enterprise-account %}
|
||||
{% link_in_list /enforcing-github-actions-policies-in-your-enterprise-account %}
|
||||
{% link_in_list /configuring-the-retention-period-for-github-actions-artifacts-and-logs-in-your-enterprise-account %}
|
||||
|
||||
@@ -7,6 +7,11 @@ versions:
|
||||
free-pro-team: '*'
|
||||
enterprise-server: '*'
|
||||
---
|
||||
{% note %}
|
||||
|
||||
**Note:** You cannot change your primary email address to an email that is already set to be your backup email address.
|
||||
|
||||
{% endnote %}
|
||||
|
||||
{% data reusables.user_settings.access_settings %}
|
||||
{% data reusables.user_settings.emails %}
|
||||
|
||||
@@ -82,9 +82,9 @@ Since the number and names of cookies may change,the table below may be updated
|
||||
| Google Analytics** | `_gat` | This cookie is used by Google Analytics. | one minute |
|
||||
| Google Analytics** | `_gid` | This cookie is used by Google Analytics. | one day |
|
||||
|
||||
*The **expiration** dates for the cookies listed below generally apply on a rolling basis.
|
||||
_*_ The **expiration** dates for the cookies listed below generally apply on a rolling basis.
|
||||
|
||||
**We use <b>Google Analytics</b> as a third party analytics service to collect information about how our website performs and how our users, in general, navigate through and use GitHub. This helps us evaluate our users' use of GitHub, compile statistical reports on activity, and improve our content and website performance.
|
||||
_**_ We use **Google Analytics** as a third party analytics service to collect information about how our website performs and how our users, in general, navigate through and use GitHub. This helps us evaluate our users' use of GitHub, compile statistical reports on activity, and improve our content and website performance.
|
||||
|
||||
You can control your Google Analytics cookie preferences through our cookie preference link located at the footer of our website. In addition, Google provides further information about its own privacy practices and [offers a browser add-on to opt out of Google Analytics tracking](https://tools.google.com/dlpage/gaoptout).
|
||||
|
||||
|
||||
@@ -45,7 +45,7 @@ References to a commit's SHA hash are automatically converted into shortened lin
|
||||
| Commit URL | https://github.com/jlord/sheetsee.js/commit/a5c3785ed8d6a35868bc169f07e40e889087fd2e | [a5c3785](https://github.com/jlord/sheetsee.js/commit/a5c3785ed8d6a35868bc169f07e40e889087fd2e) |
|
||||
| SHA | a5c3785ed8d6a35868bc169f07e40e889087fd2e | [a5c3785](https://github.com/jlord/sheetsee.js/commit/a5c3785ed8d6a35868bc169f07e40e889087fd2e) |
|
||||
| User@SHA | jlord@a5c3785ed8d6a35868bc169f07e40e889087fd2e | [jlord@a5c3785](https://github.com/jlord/sheetsee.js/commit/a5c3785ed8d6a35868bc169f07e40e889087fd2e)
|
||||
| Username/Repository@SHA | User/Repository@SHA: jlord/sheetsee.js@a5c3785ed8d6a35868bc169f07e40e889087fd2e | [jlord/sheetsee.js@a5c3785](https://github.com/jlord/sheetsee.js/commit/a5c3785ed8d6a35868bc169f07e40e889087fd2e) |
|
||||
| Username/Repository@SHA | jlord/sheetsee.js@a5c3785ed8d6a35868bc169f07e40e889087fd2e | [jlord/sheetsee.js@a5c3785](https://github.com/jlord/sheetsee.js/commit/a5c3785ed8d6a35868bc169f07e40e889087fd2e) |
|
||||
|
||||
### Custom autolinks to external resources
|
||||
|
||||
|
||||
Reference in New Issue
Block a user