From 5281e2179a5bcac564b426bf2dedab5a2f850aa7 Mon Sep 17 00:00:00 2001 From: Steve Guntrip Date: Fri, 21 May 2021 11:02:51 +0100 Subject: [PATCH 1/6] remove unused state param --- .../apps/building-oauth-apps/authorizing-oauth-apps.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md b/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md index fa724aafb8..985c842178 100644 --- a/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md +++ b/content/developers/apps/building-oauth-apps/authorizing-oauth-apps.md @@ -80,7 +80,6 @@ Name | Type | Description `client_secret` | `string` | **Required.** The client secret you received from {% data variables.product.product_name %} for your {% data variables.product.prodname_oauth_app %}. `code` | `string` | **Required.** The code you received as a response to Step 1. `redirect_uri` | `string` | The URL in your application where users are sent after authorization. -`state` | `string` | The unguessable random string you provided in Step 1. ##### Response From 27a5e23caca0852c96e224f79c84343598a0ce32 Mon Sep 17 00:00:00 2001 From: Lucas Costi Date: Mon, 24 May 2021 12:25:06 +1000 Subject: [PATCH 2/6] Reversion 'Renaming a branch' for GHES 3.1 --- .../managing-branches-in-your-repository/renaming-a-branch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md b/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md index 8991e75833..f9811bd0da 100644 --- a/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md +++ b/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md @@ -4,7 +4,7 @@ intro: You can change the name of a branch in a repository. permissions: People with write permissions to a repository can rename a branch in the repository. People with admin permissions can rename the default branch. versions: free-pro-team: '*' - enterprise-server: '>=3.2' + enterprise-server: '>=3.1' topics: - Repositories redirect_from: From b788f6fcf0fb581bec18f6081db75ef9fa268a16 Mon Sep 17 00:00:00 2001 From: Lucas Costi Date: Mon, 24 May 2021 12:32:07 +1000 Subject: [PATCH 3/6] Revert "Reversion 'Renaming a branch' for GHES 3.1" This reverts commit 27a5e23caca0852c96e224f79c84343598a0ce32. --- .../managing-branches-in-your-repository/renaming-a-branch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md b/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md index f9811bd0da..8991e75833 100644 --- a/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md +++ b/content/github/administering-a-repository/managing-branches-in-your-repository/renaming-a-branch.md @@ -4,7 +4,7 @@ intro: You can change the name of a branch in a repository. permissions: People with write permissions to a repository can rename a branch in the repository. People with admin permissions can rename the default branch. versions: free-pro-team: '*' - enterprise-server: '>=3.1' + enterprise-server: '>=3.2' topics: - Repositories redirect_from: From 7e002e60085624778b72512b47d551f33f43a3b9 Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Mon, 24 May 2021 09:17:08 +0100 Subject: [PATCH 4/6] Code scanning: replace deprecated `--github-auth` flag with new `--github-auth-stdin` flag (#19466) * replace deprecated flag with new flag * rework liquid versioning in article * update flag descriptions to latest * fix table formatting * more table formatting * Apply suggestions from code review Co-authored-by: Andrew Eisenberg * address latest review comments * version new flag for GHES 3.1+ only * fix list numbeting Co-authored-by: Andrew Eisenberg --- ...iguring-codeql-runner-in-your-ci-system.md | 23 ++++++++----- ...running-codeql-runner-in-your-ci-system.md | 22 ++++++++++--- .../codeql-runner-analyze-example.md | 33 ++++++++++++++++++- 3 files changed, 63 insertions(+), 15 deletions(-) diff --git a/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-runner-in-your-ci-system.md b/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-runner-in-your-ci-system.md index b825f58fe5..60026b0064 100644 --- a/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-runner-in-your-ci-system.md +++ b/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/configuring-codeql-runner-in-your-ci-system.md @@ -137,16 +137,19 @@ Initializes the {% data variables.product.prodname_codeql_runner %} and creates | Flag | Required | Input value | | ---- |:--------:| ----------- | | `--repository` | ✓ | Name of the repository to initialize. | -| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. | -| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. | +| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% if currentVersion ver_lt "enterprise-server@3.1" %} +| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |{% else %} +| `--github-auth-stdin` | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |{% endif %} | `--languages` | | Comma-separated list of languages to analyze. By default, the {% data variables.product.prodname_codeql_runner %} detects and analyzes all supported languages in the repository. | -| `--queries` | | Comma-separated list of additional queries to run, in addition to the default suite of security queries. | +| `--queries` | | Comma-separated list of additional queries to run, in addition to the default suite of security queries. This overrides the `queries` setting in the custom configuration file. | | `--config-file` | | Path to custom configuration file. | | `--codeql-path` | | Path to a copy of the {% data variables.product.prodname_codeql %} CLI executable to use. By default, the {% data variables.product.prodname_codeql_runner %} downloads a copy. | | `--temp-dir` | | Directory where temporary files are stored. The default is `./codeql-runner`. | | `--tools-dir` | | Directory where {% data variables.product.prodname_codeql %} tools and other files are stored between runs. The default is a subdirectory of the home directory. | -| `--checkout-path` | | The path to the checkout of your repository. The default is the current working directory. | +| `--checkout-path` | | The path to the checkout of your repository. The default is the current working directory. | | `--debug` | | None. Prints more verbose output. | +| `--trace-process-name` | | Advanced, Windows only. Name of the process where a Windows tracer of this process is injected. | +| `--trace-process-level` | | Advanced, Windows only. Number of levels up of the parent process where a Windows tracer of this process is injected. | | `-h`, `--help` | | None. Displays help for the command. | #### `autobuild` @@ -158,7 +161,7 @@ Attempts to build the code for the compiled languages C/C++, C#, and Java. For t | `--language` | | The language to build. By default, the {% data variables.product.prodname_codeql_runner %} builds the compiled language with the most files. | | `--temp-dir` | | Directory where temporary files are stored. The default is `./codeql-runner`. | | `--debug` | | None. Prints more verbose output. | -| `-h`, `--help` | | None. Displays help for the command. | +| `-h`, `--help` | | None. Displays help for the command. | #### `analyze` @@ -169,8 +172,9 @@ Analyzes the code in the {% data variables.product.prodname_codeql %} databases | `--repository` | ✓ | Name of the repository to analyze. | | `--commit` | ✓ | SHA of the commit to analyze. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. | | `--ref` | ✓ | Name of the reference to analyze, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. | -| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. | -| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. | +| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% if currentVersion ver_lt "enterprise-server@3.1" %} +| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |{% else %} +| `--github-auth-stdin` | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |{% endif %} | `--checkout-path` | | The path to the checkout of your repository. The default is the current working directory. | | `--no-upload` | | None. Stops the {% data variables.product.prodname_codeql_runner %} from uploading the results to {% data variables.product.product_name %}. | | `--output-dir` | | Directory where the output SARIF files are stored. The default is in the directory of temporary files. | @@ -198,8 +202,9 @@ Uploads SARIF files to {% data variables.product.product_name %}. | `--repository` | ✓ | Name of the repository that was analyzed. | | `--commit` | ✓ | SHA of the commit that was analyzed. In Git and in Azure DevOps, this corresponds to the value of `git rev-parse HEAD`. In Jenkins, this corresponds to `$GIT_COMMIT`. | | `--ref` | ✓ | Name of the reference that was analyzed, for example `refs/heads/main` or `refs/pull/42/merge`. In Git or in Jenkins, this corresponds to the value of `git symbolic-ref HEAD`. In Azure DevOps, this corresponds to `$(Build.SourceBranch)`. | -| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. | -| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. | +| `--github-url` | ✓ | URL of the {% data variables.product.prodname_dotcom %} instance where your repository is hosted. |{% if currentVersion ver_lt "enterprise-server@3.1" %} +| `--github-auth` | ✓ | A {% data variables.product.prodname_github_apps %} token or personal access token. |{% else %} +| `--github-auth-stdin` | ✓ | Read the {% data variables.product.prodname_github_apps %} token or personal access token from standard input. |{% endif %} | `--checkout-path` | | The path to the checkout of your repository. The default is the current working directory. | | `--debug` | | None. Prints more verbose output. | | `-h`, `--help` | | None. Displays help for the command. | diff --git a/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system.md b/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system.md index 854c09f0a4..d58df42cb3 100644 --- a/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system.md +++ b/content/code-security/secure-coding/using-codeql-code-scanning-with-your-existing-ci-system/running-codeql-runner-in-your-ci-system.md @@ -111,13 +111,20 @@ In this example, the server has access to download the {% data variables.product 1. Move into the directory where the repository is checked out. 1. Initialize the {% data variables.product.prodname_codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected. - ```shell +{% if currentVersion ver_lt "enterprise-server@3.1" %} + ```shell $ /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo --github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN + ``` +{% else %} + ```shell + $ echo "$TOKEN" | /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo + --github-url {% data variables.command_line.git_url_example %} --github-auth-stdin > Cleaning temp directory /srv/checkout/example-repo/codeql-runner > ... > Created CodeQL database at /srv/checkout/example-repo/codeql-runner/codeql_databases/javascript. ``` +{% endif %} {% data reusables.code-scanning.codeql-runner-analyze-example %} @@ -128,18 +135,23 @@ This example is similar to the previous example, however this time the repositor 1. Check out the repository to analyze. 1. Move into the directory where the repository is checked out. 1. Initialize the {% data variables.product.prodname_codeql_runner %} and create {% data variables.product.prodname_codeql %} databases for the languages detected. - - ```shell +{% if currentVersion ver_lt "enterprise-server@3.1" %} + ```shell $ /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo-2 --github-url {% data variables.command_line.git_url_example %} --github-auth TOKEN + ``` +{% else %} + ```shell + $ echo "$TOKEN" | /path/to-runner/codeql-runner-linux init --repository octo-org/example-repo-2 + --github-url {% data variables.command_line.git_url_example %} --github-auth-stdin > Cleaning temp directory /srv/checkout/example-repo-2/codeql-runner > ... > CodeQL environment output to "/srv/checkout/example-repo-2/codeql-runner/codeql-env.json" and "/srv/checkout/example-repo-2/codeql-runner/codeql-env.sh". Please export these variables to future processes so that CodeQL can monitor the build, for example by running ". /srv/checkout/example-repo-2/codeql-runner/codeql-env.sh". - ``` - + ``` +{% endif %} 1. Source the script generated by the `init` action to set up the environment to monitor the build. Note the leading dot and space in the following code snippet. ```shell diff --git a/data/reusables/code-scanning/codeql-runner-analyze-example.md b/data/reusables/code-scanning/codeql-runner-analyze-example.md index 01e6a97f91..82bb03d955 100644 --- a/data/reusables/code-scanning/codeql-runner-analyze-example.md +++ b/data/reusables/code-scanning/codeql-runner-analyze-example.md @@ -1,4 +1,5 @@ 1. Populate the {% data variables.product.prodname_codeql %} databases, analyze them, and upload the results to {% data variables.product.product_name %}. The results will appear in the **Security** tab for your repository. +{% if currentVersion ver_lt "enterprise-server@3.1" %} ```shell $ /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo @@ -10,7 +11,20 @@ > Successfully uploaded results ``` -1. To upload {% data variables.product.prodname_code_scanning %} results as pull request checks, specify the pull request using the `--ref` flag. We recommend setting up the {% data variables.product.prodname_codeql_runner %} so that it runs on the [`pull_request`](/developers/webhooks-and-events/webhook-events-and-payloads#pull_request) webhook event. +{% else %} + + ```shell + $ echo "$TOKEN" | /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo + --github-url {% data variables.command_line.git_url_example %} --github-auth-stdin + --commit 5b6a3078b31dc346e5ce7b86837d6abbe7a18bbd --ref refs/heads/my-branch + > Finalizing database creation + > ... + > POST /repos/octo-org/example-repo/code-scanning/sarifs - 202 in 786ms + > Successfully uploaded results + ``` +{% endif %} +2. To upload {% data variables.product.prodname_code_scanning %} results as pull request checks, specify the pull request using the `--ref` flag. We recommend setting up the {% data variables.product.prodname_codeql_runner %} so that it runs on the [`pull_request`](/developers/webhooks-and-events/webhook-events-and-payloads#pull_request) webhook event. +{% if currentVersion ver_lt "enterprise-server@3.1" %} ```shell $ /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo @@ -22,4 +36,21 @@ > Successfully uploaded results ``` +{% else %} + + ```shell + $ echo "$TOKEN" | /path/to-runner/codeql-runner-linux analyze --repository octo-org/example-repo + --github-url {% data variables.command_line.git_url_example %} --github-auth-stdin + --commit 1dc7a1346e5ce7b86835b68bbda3078b37d6abbe --ref refs/pull/123/merge + > Finalizing database creation + > ... + > POST /repos/octo-org/example-repo/code-scanning/sarifs - 202 in 786ms + > Successfully uploaded results + ``` +{% endif %} + +{% if currentVersion ver_lt "enterprise-server@3.1" %} For more information about viewing {% data variables.product.prodname_code_scanning %} alerts, see "[Triaging code scanning alerts in pull requests](/github/finding-security-vulnerabilities-and-errors-in-your-code/triaging-code-scanning-alerts-in-pull-requests)" and "[Managing code scanning alerts for your repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/managing-code-scanning-alerts-for-your-repository)." +{% else %} +For more information about viewing {% data variables.product.prodname_code_scanning %} alerts, see "[Triaging code scanning alerts in pull requests](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/triaging-code-scanning-alerts-in-pull-requests)" and "[Managing code scanning alerts for your repository](/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository)." +{% endif %} From 67a266e8b581adaf0f1df935223768845c7f6925 Mon Sep 17 00:00:00 2001 From: Edoardo Pirovano <6748066+edoardopirovano@users.noreply.github.com> Date: Mon, 24 May 2021 09:41:03 +0100 Subject: [PATCH 5/6] CodeQL Action: Add information about `db-location` option (#19418) * CodeQL Action: Add information about `db-location` option * Apply suggestions from code review * Update content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md * Update content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md * Apply suggestions from code review Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com> * Update content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com> Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com> --- .../configuring-code-scanning.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md b/content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md index 0cba7c3cb1..341d869358 100644 --- a/content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md +++ b/content/code-security/secure-coding/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning.md @@ -148,6 +148,24 @@ jobs: {% if currentVersion ver_gt "enterprise-server@2.21" %}You must ensure that Git is in the PATH variable on your self-hosted runners.{% else %}If you use a self-hosted runner, you must ensure that Git is in the PATH variable.{% endif %} +{% if currentVersion == "free-pro-team@latest" or currentVersion ver_gt "enterprise-server@3.1" or currentVersion == "github-ae@next" %} +### Specifying the location for {% data variables.product.prodname_codeql %} databases + +In general, you do not need to worry about where the {% data variables.product.prodname_codeql_workflow %} places {% data variables.product.prodname_codeql %} databases since later steps will automatically find databases created by previous steps. However, if you are writing a custom workflow step that requires the {% data variables.product.prodname_codeql %} database to be in a specific disk location, for example to upload the database as a workflow artifact, you can specify that location using the `db-location` parameter under the `init` action. + +{% raw %} +``` yaml +- uses: github/codeql-action/init@v1 + with: + db-location: '${{ github.workspace }}/codeql_dbs' +``` +{% endraw %} + +The {% data variables.product.prodname_codeql_workflow %} will expect the path provided in `db-location` to be writable, and either not exist, or be an empty directory. When using this parameter in a job running on a self-hosted runner or using a Docker container, it's the responsibility of the user to ensure that the chosen directory is cleared between runs, or that the databases are removed once they are no longer needed. This is not necessary for jobs running on {% data variables.product.prodname_dotcom %}-hosted runners, which obtain a fresh instance and a clean filesystem each time they run. For more information, see "[About {% data variables.product.prodname_dotcom %}-hosted runners](/actions/using-github-hosted-runners/about-github-hosted-runners)." + +If this parameter is not used, the {% data variables.product.prodname_codeql_workflow %} will create databases in a temporary location of its own choice. +{% endif %} + ### Changing the languages that are analyzed {% data variables.product.prodname_codeql %} {% data variables.product.prodname_code_scanning %} automatically detects code written in the supported languages. From 53a889e61cad0c298a94fe1f47b679fe30d65d39 Mon Sep 17 00:00:00 2001 From: mc <42146119+mchammer01@users.noreply.github.com> Date: Mon, 24 May 2021 09:45:32 +0100 Subject: [PATCH 6/6] version links for GHES 3.1 + (#19512) --- .../configuring-secret-scanning-for-your-appliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/admin/advanced-security/configuring-secret-scanning-for-your-appliance.md b/content/admin/advanced-security/configuring-secret-scanning-for-your-appliance.md index c6f266be2c..e2d032cbb9 100644 --- a/content/admin/advanced-security/configuring-secret-scanning-for-your-appliance.md +++ b/content/admin/advanced-security/configuring-secret-scanning-for-your-appliance.md @@ -27,7 +27,7 @@ topics: - The [SSSE3](https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-optimization-manual.pdf#G3.1106470) (Supplemental Streaming SIMD Extensions 3) CPU flag needs to be enabled on the VM/KVM that runs {% data variables.product.product_location %}. -- A license for {% data variables.product.prodname_GH_advanced_security %} (see "[About licensing for {% data variables.product.prodname_GH_advanced_security %}](/admin/advanced-security/about-licensing-for-github-advanced-security)") +- A license for {% data variables.product.prodname_GH_advanced_security %}{% if currentVersion ver_gt "enterprise-server@3.0" %} (see "[About licensing for {% data variables.product.prodname_GH_advanced_security %}](/admin/advanced-security/about-licensing-for-github-advanced-security)"){% endif %} - {% data variables.product.prodname_secret_scanning_caps %} enabled in the management console (see "[Enabling {% data variables.product.prodname_GH_advanced_security %} for your enterprise](/admin/advanced-security/enabling-github-advanced-security-for-your-enterprise)")